The Advancement of GPS Technology and its impact on Human Factors in Aviation

Nedanstående innehåll är skapat av Mimers Brunns besökare. Kommentera arbete

RUNNING HEAD: The Advancement of Global Positioning System (GPS) Technology and its Impact on
Human Factors in Aviation









The Advancement of Global Positioning System (GPS) Technology and its Impact on Human
Factors in Aviation
Oskar Nordstrand
Nova Southeastern University
2014


2


Abstract

The Global Positioning System (GPS) uses a network of orbiting and geostationary satellites
to calculate the position of a receiver over time. This technology has revolutionised a wide
range of safety-critical industries and leisure applications ranging from commercial fisheries
through to mountain running. These systems provide diverse benefits; supplementing the
users existing navigation skills and reducing the uncertainty that often characterises many
route planning tasks. GPS applications can also help to reduce workload by automating tasks
that would otherwise require finite cognitive and perceptual resources. However, the
operation of these systems has been identified as a contributory factor in a range of recent
accidents. Users often come to rely on GPS applications and, therefore, fail to notice when
they develop faults or when errors occur in the other systems that use the data from these
systems. Further accidents can stem from the „over confidence? that arises when users assume
automated warnings will be issued when they stray from an intended route. Unless greater
attention is paid to the human factors of GPS applications then there is a danger that we will
see an increasing number of these failures as positioning technologies are integrated into
increasing numbers of applications.


Introduction

Manual navigation techniques have changed very little over the centuries. For example,
commercial and leisure activities continue to rely on dead reckoning where an initial position
is established. The position is then estimated over time using an individual or vessel?s speed
and direction. The accuracy of dead reckoning calculations depend on the accuracy of the
speed input and the effects of environmental factors including wind and current. After the
Second World War, the development of radar and of differential radio signals helped to
establish automated approaches to position location. These can be thought of as precursors to
the satellite based GPS systems that have now become commonplace. GPS units are sold „as
standard? with many cars. They are widely used across the maritime industries. They can be
carried in your pocket and attached to PDAs; providing continuous updates of location
information during both work and leisure activities. This growth in the application of GPS
technologies has fuelled and been fuelled by the use of these systems in safety-critical
applications. For example, they have been integrated into the cockpits of both commercial and
general aviation. However, the adoption of GPS systems in safety-related applications has led
to a number of concerns. The FAA recognizes that GPS alone cannot satisfy the high-levels of
accuracy and redundancy that would be required across the National Airspace System. In
consequence, a number of local and wide area augmentation schemes have been proposed. In
Europe, more strategic concerns have been raised and plans continue to be revised for the
creation of an alternate system.
It is important not to underestimate the complexity of human interaction with GPS
applications. For example, the US National Oceanic & Atmospheric Administration (NOAA)
released a warning in 2002 about some of the systemic effects of GPS on navigation behavior.
In particular, they observed that some mariners were more willing to follow higher risk routes

3

closer to known hazards because they felt confident in the use of GPS technology to
accurately identify the position of those hazards. NOAA went on to point out that the
increasing accuracy of GPS fixes exposes underlying problems in the accuracy of charts and
maps. Many of these guides were developed using less accurate fixes than those provided
using GPS technology. It was argued that “prudent mariners should pass charted hazards such
as shoals or isolated dangers with utmost caution and at a safe distance, no matter what
navigational method is used” (NOAA, 2002).
Most of the concerns over the integration of GPS in safety related systems have focused on
technical and infrastructure issues. These include potential disruption to services from
unintentional interference. Studies have been conducted to exclude or minimize the impact of
very high frequency (VHF) radio, over the-horizon (OTH) military radar, and broadcast
television. There is also growing concern over the vulnerability of navigation tools to external
attack. One recent study described how a $300 jammer could cause the sudden loss of GPS
signal (John Hopkins). In the most critical scenario, this might cause an aircrew to abort a
Category III precision approach. However, many existing systems would use interpolation
and dead reckoning so that performance degradation would be extremely limited immediately
after a signal was lost. Arguably greater concern centers on longer term disruption to GPS
signals in future scenarios in which these applications become more tightly integrated with
Air Traffic Management services.
Such concerns are shaping the future application of GPS technology. In contrast, these
systems have already been implicated in a number of accidents where the underlying
technology worked as intended. In many of these mishaps, the primary cause was identified as
human „error?. Partly in consequence, investigatory agencies have issued general advice on
the use of GPS technology. For instance, the New Zealand Maritime agency has argued that:
“GPS derived positions are a useful tool in determining a vessels position but should be used
in conjunction with all other means of position fixing at the navigators disposal. The
temptation to push a button to obtain such data and not utilize more labor intensive, traditional
methods of position fixing is, to put it bluntly, bad seamanship that puts vessels and their crew
at risk. Maritime New Zealand is concerned at what appears to be a growing tendency for
mariners to place excessive reliance on GPS generated data in place of traditional methods of
navigation and issues a strong warning against such practice” (Maritime New Zealand, 2006).
Much of this important advice is focused on the recommendations that emerge from particular
incidents. There have been few attempts to gather together the lessons that can derived from a
number of different mishaps across a range of different industries. The following pages,
therefore, provide a brief overview of recent accidents in the aviation and maritime industries
in which it is argued that interaction with GPS technology either triggered or exacerbated
various forms of operator failure.




4


The Operational Benefits of Interactive GPS

The benefits of GPS and associated technology can be illustrated by the extent to which they
have become integrated into a number of safety-critical industries. For example, a recent
accident report described the standard navigational aids on board a fishing vessel equipped for
a crew of three, these included: a radar, an echo sounder, a watch keepers alarm and an
autopilot. The fishing vessel also carried two different GPS plotters and a GPS receiver
(Maritime New Zealand, 2004). The significance of this equipment can also be illustrated by
the consequences that can arise when it is used incorrectly. The subsequent investigation
found that the vessel had run aground because the skipper had not set waypoints on the GPS
equipment but had instead been using the cursor on one of the GPS plotters to keep an
informal note of course and position.
Before reviewing hazards that can arise during interaction with GPS technology in more
detail, it is first important to summarize the wide range of benefits that these applications
provide to their users. The problems that complicate interaction with these systems often stem
from the operational features that provide the greatest utility under normal operations. As
noted in the previous citation, the accuracy and availability of GPS data can lead to an over
reliance that leaves users unprepared to cope when these systems fail. The following list
summarizes further benefits of positioning technology. Subsequent sections use this list,
together with an analysis of previous accidents to identify many of the problems that arise
during the use of these systems.
1. Reduced workload. An important benefit of GPS applications is that they can reduce
workload across teams of operators in safety-critical systems. The precise nature of
this support varies from domain to domain. For example, in many commercial
maritime systems the data from GPS applications is seen as an adjunct to rather than a
replacement for conventional manual and radar based navigation techniques.
However, as we shall see, in other parts of the world crews have come to rely on GPS
technology within routine operations so that alternate techniques for location
identification are only used to supplement GPS readings. In other words, the bulk of
routine navigation tasks have passed from manual and radar based techniques to the
automated satellite based systems.

2. Reduce uncertainty. In many applications, navigation is a complex task in which
operators have to account for subtle changes in meteorological and other
environmental conditions. Under poor visibility, it can be difficult to account for the
influence of varying tides or wind speeds using dead reckoning. In other areas, for
example in desert or jungle terrains and other remote areas there may be insufficient
landmarks or radar beacons to easily employ alternate forms of navigation. In such
circumstances, GPS tools provide a critical means of reducing uncertainty in complex
navigation tasks.



5

3. Multi-criteria optimisation. GPS tools cannot be viewed in isolation. The position
information that they provide is, typically, integrated into a wide range of location
finding and route planning systems. This integration enables complex optimization
tasks to be performed where for example speed can be traded for fuel usage or routes
can be tailored to avoid congestion. These optimization tasks would otherwise occupy
considerable perceptual and cognitive resources if they had to be performed manually.
This creates significant vulnerabilities when operators must learn to cope with
degraded modes of operation (Johnson and Shea, 2007).

4. Dynamic problem solving. An important aspect of multi-criteria optimization is the
manner in which GPS applications can quickly compute alternate routes or changes in
performance characteristics in order to achieve particular objectives in the face of
changes both in an application process or operating environment. For example,
positioning equipment can automatically monitor the mean speed of its operator over
given terrain and then adjust routing information to exclude similar areas should they
fall behind the predicted schedule. As with many of the benefits identified in previous
items, it is often infeasible for operators to manually conduct the continual forms of
self-monitoring that routinely inform route revision algorithms in existing
applications.

5. Monitoring of primary systems. GPS systems provide an important means of
confirming information that can also be derived from primary sensors. For example, it
is possible to use successive location fixes to compute speed in a range of aviation,
ground and maritime applications. Similarly, the influence of tides and currents can be
inferred by comparison of performance data with location information over time.
Significant deviations between the GPS derive data and the output of other primary
systems can also be used to trigger alarms for the crew that warns them of potential
failures in either application.

6. Multiple input mappings. GPS tools can also be used to navigate using a range of
different input data. This might seem like a trivial issue. However, there are strong
benefits to be achieved if crew can choose whether or not to specify a route in terms of
individual waypoints, physical landmarks, map coordinates or even ZIP codes. The
difficulty of translating from these navigational reference systems into a single input
scheme increases burdens on operators especially if they are under time pressure. GPS
applications often provide considerable flexibility so that information can be entered
in a form that is convenient and familiar to the end user.

7. Multiple output mappings. GPS systems also offer considerable flexibility to their
users in terms of the presentation format of navigational information. They offer a host
of two and three dimensional graphical displays where map or plan views can be
extended to show fly-by simulations of potential routes from or to a known location.
In other domains, GPS data is used to generate audio alarms so that crew members are
only alerted when they have moved close to a known danger or away from a

6

recommended course. Audio warnings can also be used to provide alerts when there
are potential disagreements between primary sensors and GPS technology, indicating
possible system failures.

8. Log maintenance. The Global Positioning System and future location technologies
provide increasingly important resources for accident investigators. These tools can
automatically log location changes over time to a level of granularity that is infeasible
using manual documentation techniques. In consequence, GPS data is often the
primary resource for identifying the location of a vessel or aircraft immediately before
a mishap occurred. From the perspective of system operators, the availability of GPS
log functions may be used to justify some reduction in the frequency of manual
recording. This is a partial list. The range of benefits derived from the Global
Positioning System will increase in proportion to the variety of potential applications.
However, these strengths also create potential vulnerabilities. Increasing reliance on
navigational tools can erode traditional skills and leave operators particularly exposed
when they are deprived of these components in their underlying infrastructure.


Incidents and Accidents Involving Interaction with GPS Tools in the Aviation and
Maritime Industries

Marine Accident 1 - The Royal Majesty: Arguably one of the most notorious recent incidents
involving interaction with GPS applications occurred in 1995 with the grounding of the cruise
ship Royal Majesty (NTSB, 1997, Heidiecker et al, 2003). The GPS receiver on the Royal
Majesty provided position data that was accurate to within 100 meters. The crew also had
access to a Loran-C radio-based navigation system. This relies on time differences between
land based radio signals to provide position data along the coasts of the United States. Both
GPS and Loran-C data were fed to an integrated NACOS 25 autopilot that could be
programmed with the vessels performance characteristics using waypoints specified in terms
of latitude and longitude. The NACOS unit provided a number of operating modes. For
example, the NAV function could be used to steer the vessel along a pre-programmed track
using the GPS and other senor inputs to compensate for gyro error, wind, current and sea
conditions. Alternatively, the unit could operate in HYBRID navigation mode using position
data from Loran-C or two other positional systems not based on GPS. The unit was also
programmed to default to a DEAD RECKONING mode when satellite data were unavailable.
When the GPS unit switched to dead reckoning mode it was designed to issues a series of
warning sounds lasting around a second. The unit would also display the letters „DR?
indicating the transition into this mode. On the night of the accident, all the officers of the
watch testified that they did not see „DR? displayed on the GPS unit. They did, however,
confirm that they understood the meaning of these symbols and had seen them on previous
occasions.
Following the accident it was determined that the vessel lost all contact with satellite based
position data around thirty minutes after it left port. The failure was traced back to the antenna

7

assembly; however, there was insufficient evidence to accurately identify the cause of the
problem. Several hypotheses were generated. The GPS antenna had originally been installed
on the radar mast. Several months before the accident, it had been moved to improve signal
reception. Subsequent examinations indicated that the GPS antenna was incorrectly routed so
that members of the crew could inadvertently kick it or trip over it. This, in turn, created
stresses that might contribute to the separation of the antenna cable connection. The antenna
had also been painted on two occasions. The consequence of the antenna failure was that the
vessel continued to record alternate courses of 197° and 000° from shortly after leaving
harbor until the vessel?s arrived in Boston even though it had maintained a course close to
336° before the accident. The logs also recorded a speed of 12.7 knots. This was not
consistent with the speeds recorded manually in the bridge log. In other words, the
interruption of the satellite signal placed the GPS into dead reckoning mode. The autopilot did
not detect this change in status and no longer began to correct for the effects of wind, current,
or sea conditions. As might be expected the actual position began to drift with respect to the
location indicated through dead reckoning. The effects of an east-north-easterly wind and sea
resulted in a 17-mile error.
The previous paragraphs have briefly outlined the technical causes of the GPS failure. In
contrast, the focus of this paper is on the human factors issues that arose during interaction
with the navigation equipment. According to the master, he arrived on the bridge around
22:00. After talking with the second officer for several minutes, he checked the vessel?s
position using the plots on the chart and at a map overlay on the ARPA radar display. This
system enabled the officers to move the radar display to know locations that could be
identified from the navigation system. The corresponding plots could then be compared for
accuracy with the direct radar feeds to the bridge. The master asked the second officer
whether he had seen the BB buoy and the second officer stated that he had. Satisfied that the
positions plotted on the chart and that the map displayed on the radar continued to show the
vessel to be following its intended track, the master left the bridge around 22:10.
There were several further opportunities for the crew to identify the potential problem before
the grounding took place. Others officers on the bridge received reports that the lookouts had
sighting several high red lights as well as a flashing red light on the port bow. These were
inconsistent with the current positional information and should have caused the officers to
look again at the radar systems. They might have noticed that the radar maps did not coincide
with the ARPA display. They might also have increased the range of radar systems and then
identify their proximity to Nantucket Island. Had the officers queried the flashing red light,
they might have determined that the nearest source was the Rose and Crown Shoal buoy. This
could have warned them that they were no longer in the traffic lanes. The subsequent
investigation concluded, however, that the officers of the watch had only a limited
understanding of the functioning of their GPS systems. This was compounded by the way in
which procedures failed to ensure the use of diverse positional information. For example, the
master required that officers continue to make manual plots of their location. However, his
colleagues used GPS as the most convenient source for this information. In consequences, the

8

fixes that were plotted on the chart corresponded with the map and positions displayed on the
central console. The manual plotting was, therefore, derived from the GPS data.
The grounding of the Royal Majesty provides an important case study for the analysis in the
paper because it illustrates many of the problems that complicate interaction with GPS
applications. Firstly, like many similar systems the vessel was provided with multiple
redundant sources of location information. However, this redundancy was little more than
„skin deep?. In practice, the convenience of GPS systems meant that the crew relied on this
source of data to guide all of their monitoring and validation procedures for navigational
information. This created further vulnerabilities because different members of the crew each
assumed that their co-workers were accessing diverse information sources and so felt justified
in them continuing only to rely on GPS input. Secondly, the Royal Majesty illustrates the
dangers that arise when GPS applications are integrated into more complex systems that are,
typically, not well understood by the people who must operate them. In this case, the master
and the officers could recognize the dead reckoning mode but they were poorly prepared for
the causes and consequences of failures that could lead to this style of operation.
Marine Accident 2 – Sanga Na Langa: The consequences and notoriety of the Royal Majesty
accident justify its inclusion in this analysis. However, it is important not to overlook the
growing number of less well known incidents involving interaction with GPS technology that
have been reported across a range of industries. For instance, the New Zealand maritime
agency report on the grounding of the Sanga Na Langa, a 13.5 meter commercial passenger
and fishing vessel operating off Waiheke Island in the Hauraki Gulf, in 2006 (Maritime New
Zealand, 2006). As with many similar incidents, the skipper was familiar with the area of
coast in which the incident occurred. In particular, he knew the location of a range of offshore
rocks that posed a danger to mariners. These rocks were well indicated on the display unit of
his GPS applications and were indicated at some off the starboard side of the vessel. The
skipper?s sense of wellbeing was increased by his confidence in the GPS, which had been
installed and calibrated by a friend some six years before. It had also always given him
accurate readings before, although the unit had previously been repaired by the
manufacturer?s agent to correct a display fault. He was also using an electronic chart that is
widely used in the area where he was operating.
The skipper reported that he was just about to refer to a paper chart when a lookout identified
broken water ahead. Approximately ten seconds later, the vessel?s hull and propeller ground
over the top of a rock. The bilge pumps were able to cope with the subsequent ingress of
water and the vessel was successfully beached. The official report into the incident concluded
that the skipper had broken „one of the cardinal rules of navigation namely over reliance only
be used as a backup to official government paper charts and traditional methods of navigation.
The day after the accident, the skipper observed that the GPS placed the vessel on top of a
small island even though they were some distance away from it on their homeward journey.
This significantly undermined the skipper?s confidence in GPS technology. This sudden
erosion of trust that may take many years to establish also illustrates the central role of human
factors issues in the operation of new generations of navigation equipment.

9

The grounding of the Sanga Na Langa is also instructive because it illustrates some of the
problems that arise for investigatory agencies when they attempt to diagnose the causes of
problems with GPS applications. These systems can provide incorrect data for a variety of
reasons. GPS assisted groundings are often caused by inaccuracies in electronic charts. In this
case, the manufacturer?s representatives noted that the position of the rocks as displayed on
the screen correlated with their position in the government maps. The investigators concluded
that „it is not uncommon for display screens that have been monitoring a vessel?s position
whilst stationary, for example whilst berthed overnight, to show positions a considerable
distance from the vessel?s position? (Maritime New Zealand, 2006).
This incident again illustrates a number of key issues that complicate interaction with GPS
system in safety-related domains. The skipper of the Sanga Na Langa was familiar with the
area in which they were operating. This seems to be a common feature of many similar
accidents. Further work is required to provide more sustained evidence that familiarity with a
location increases the likelihood of being involved in a GPS related incident. It is possible to
identify a number of potential explanations for this hypothesized correlation. For instance, if
an operator understands local hazards then they may be more willing to dismiss them as soon
as they can be seen on a GPS application without necessarily checking to ensure that the GPS
has accurately located those hazards.
The grounding of the Sanga Na Langa raises further issues. For example, the skipper placed a
high degree of trust in the reliability and calibration of their GPS application. In part, this was
justified by his experience of the operational performance of the unit. However, it may also
have been influenced by the growth of consumer applications for this technology. GPS is
increasingly being integrated into mass market „of the shelf? products. Familiarity may create
an unjustified degree of confidence in the reliability of what is a complex, distributed system
of systems.
Aviation 1- Cessna Floatplane: The introduction to this paper has stressed the need to
exchange insights and lessons learned from GPS induced mishaps across several different
safety-critical industries. It is for this reason that the following examples focus on interaction
with new navigation technologies within both commercial and general aviation. Again, it is
important to stress that the use of GPS related systems has figured as a contributory cause in
both major accidents and in less well publicized incidents. For example, the US NTSB
describes how the pilot of a Cessna 208 seaplane forgot to retract the gear on takeoff from a
runway. This version of the aircraft has wheel installed on the floats. On approaching his
destination the pilot realized that the navigation system was using the position of a nearby
resort island called Filitheyo rather than the GPS position of the landing site about 2.5 miles
(4 km) to the north. The captain, therefore, began attempting to correct the GPS co-ordinates
for the landing site.
As he touched the water, the aircraft seemed to „spring back? and the captain recognized that
he had left the landing gear down. The aircraft flipped onto its back pivoting on its nose and
left wing. The subsequent investigation identified pilot error as the probable cause of the
accident. Contributory factors included a failure to use the approved checklist when ensuring

10

that the landing gear was properly raised, a failure to monitor appropriate instruments and a
failure to pay due attention to aural warnings. The manufacturer responses to the incident by
changing the aural „gear down? warning to occur at a higher speed, „thereby allowing the pilot
time to react accordingly without distraction during the final approach segment of the flight?
(NTSB, 2000). The pilot was recommended to undergo additional type training.
One of the most salient features of this incident is that the recommendations focused on the
retraining of the pilot and on minor technical changes in the on-board warning systems for the
landing gear. The findings of the investigation did not focus on the problems that the pilot
experienced in interacting with the navigation systems. Previous research has identified a
broad range of issues that complicate the reprogramming of GPS applications in safety related
domains (Johnson, 2004). These range from the confusion that often arises over the difference
between insertion and appending of a waypoint into a list of fixes through to the difficulty of
distinguishing between the different modes of operation that are provided by these navigation
systems. In this case, a relatively minor correction to the location of the destination could not
be completed by the pilot without considerable concentration. However, the subsequent
investigation did not explicitly raise this as an area for further concern.
In other areas of human computer interaction and human factors, there has been a move away
from blaming operators who experience similar problems during interaction with complex
systems. It has been argued that retraining the users will only alleviate the symptoms of an
underlying problem but will not address the causes (Johnson book). In contrast, greater
emphasis has been placed on the need to redesign interactive systems rather than rely on
retraining to address previous weaknesses in the operation of complex systems.
A final area of concern focuses on the dual nature of GPS navigation systems. One of the
primary reasons for the introduction of these applications into safety critical systems has been
that they can effectively reduce workload for crew members who might otherwise be
preoccupied with relatively routine navigation tasks. The floatplane incident illustrates that
these applications can also increase workload during key stages of flight. In particular,
complex user interfaces create particular problems for the individuals and crews that must
reprogram or reconfigure them in response to particular operational problems. In this incident,
even a relatively minor correction occupied the pilot?s finite perceptual and cognitive
resources to such an extent that safety was undermined.
Aviation 2 – Bamiyan Controlled Flight into Terrain (CFIT): The second aviation accident
forms a contrast to the relatively minor incident described in the previous paragraphs. Just as
the grounding of the fishing vessel Sanga Na Langa contrasts with the more serious damage to
the cruise liner Royal Majesty. This incident occurred in November 2004when a
Construcciones Aeronauticas Sociedad Anonima C-212-CC (CASA 212) twin-engine,
turboprop airplane collided with mountainous terrain close to the Bamiyan Valley, near
Bamiyan, Afghanistan. Several factors increased the significance of this accident. The aircraft
was operating under a US Department of Defense (DoD) contract. The captain, first officer,
and mechanic-certificated passenger, who were U.S. civilians employed by the operator, and

11

the three military passengers, who were active-duty U.S. Army soldiers, received fatal
injuries. The airplane was destroyed (NTSB, 2006).
The subsequent enquiry interviewed the program site manager who stated that he was not
aware if route planning was explicitly performed for the mission. The accepted visual flight
rules (VFR) flight plan contained destination information but did not indicate a specific route.
Instead he argued that the pilots tended to follow well known routes between specific
locations using a combination of GPS fixes and direct visual observations to ensure adequate
clearance above mountainous terrain. However, analysis of the cockpit voice recorder
revealed that the crew had never flown the selected route before. The mechanic was also
heard to observe that the valley they had chosen to follow was not the most direct route. The
captain later replied saying that they would „just have to see where this leads?. The captain,
first officer and the mechanic then discussed a topological map, the outside visual references
and the coordinates derived from their GPS applications. The captain was then heard to
remark „well normally we?d have time to on a short day like this we?d have time to play a
little bit do some explorin? but with those winds comin? up I want to [expletive] get there as
fast as we can...with this good visibility … it?s as easy as pie. you run into somethin? big you
just parallel it until you find a way thru [sic]. … this is the first good visibility day I?ve had in
the Casa. It?s not just good it?s outstanding? (NTSB, 2006). Sometime later the mechanic
stated „I don?t know what we?re gunna see, we don?t normally go this route?. The captain
replied „...all we want is to avoid seeing rock at twelve o?clock and the first officer stated
„Yeah you?re an x-wing fighter star wars man?. The captain then replied „You?re [expletive]
right. This is fun?. These informal exchanges continued when a passenger asked the flight
crew about the route of the flight and the captain discussed some of their previous mountain
flying experiences with the first officer. Shortly afterwards, the first officer stated that the
ridgeline off to their left had a minimum elevation of approximately 14,000 feet meters above
sea level. The captain stated that he was trying to find a „notch to fly through?, shortly
afterwards the mechanic asked „okay you guys are gunna make this right?? and the captain
replied, “yeah I?m hopin?. Ten seconds later, voice recorder seems to capture a stall warning
tone single beep. The captain stated they could execute a 180º turnaround and instructed the
first officer to lower the flaps. A further stall warning occurred and the mechanic stated, „call
off his airspeed for him?. The first officer responded „you got ninety five? shortly before the
recording ended.
The subsequent investigation argued that the exchanges captured on the cockpit voice
recorder provided important insights into the attitude and behavior of the crew in the
immediate run up to the crash. It was suggested that the captain and first officer acted
„unprofessionally? in deliberately flying a nonstandard route low through the valley for fun
even though the visibility was „outstanding?. The captain?s comment that he „wouldn?t have
done this if we were at gross? was interpreted to mean that the captain made a conscious
decision to fly the airplane in a way that he would not have done if the airplane had been at
maximum gross weight.
This incident illustrates further aspects of the complex interactions that take place in the
events leading to accidents that involve GPS applications. In this case, the use of navigation

12

equipment was not a direct cause of the mishap. Instead it can be argued that it played a more
circumstantial role in increasing the confidence of the crew that they could navigate their way
out of the box canyon using little more planning that visual observations and periodic updates
to their known location using satellite technology. In other words, the provision of GPS
services formed a key component in the infrastructure that supported the sense of
complacency that was criticized in the NTSB report. This complacency, in turn, was
constructed on the high degree of trust that many operators place on modern navigation
systems. As we have seen in previous accidents, this element of trust often goes far beyond
what is advised by manufacturers and designers. It may also lead the operators of safety
critical systems into situations from which navigation fixes may be insufficient to ensure the
success of complex operations.


Overview of Human Factors Dangers of GPS

Previous sections have used two maritime and two aviation accidents to provide a limited
overview of a wider range of recent mishaps that have arisen from operator interaction with
GPS technology. These incidents have been deliberately selected to include both high profile
failures, such as the grounding of the Royal Majesty, as well as lesser known but equally
significant accidents in which users have been forced to cope without the expected support
that they normally rely upon from satellite navigation systems, such as the CFIT involving the
Cessna floatplane. Based on these incidents it is possible to develop an initial list of
interaction problems that have occurred in the events leading to adverse events involving GPS
related systems:
1. Increased Workload. The opening sections made the point that many of the benefits of
GPS technology also create potential weaknesses under degraded modes of operation.
For example, an important strength of many systems is that they remove the burdens
associated with routine navigation tasks. However, many they also create additional
workload in setting the systems up. Additional time must be devoted to planning a
potential route and then programming appropriate waypoints into the system.
Similarly, the complexity of interaction with these programmable systems can create
significant dangers when operators are forced to fix even relatively trivial problems
during more critical phases of operation. The additional burdens associated with
specifying a revised destination for the floatplane is assumed to have prevented the
pilot from realizing that they were landing on water with the wheels extended.

2. Interruption of Primary Tasks. The failure of navigational systems can create a sudden
increase in workload for particular crew members during critical phases of a safety
related task. In other circumstances, problems may stem less from additional workload
than from the way in which GPS tools can interrupt other non-navigational primary
tasks. These interruptions occur during both normal and degraded modes of operation.
It can be argued that there is a danger the pilot of the float plane might have forgotten
to raise the landing gear even if he had been able to resolve the apparent problem with

13

the destination fix. Human factors research indicates that even temporary distractions
can be sufficient to cause slips and lapses in otherwise accurate plans (Reason, 1990).
Several recent accident reports have described how crew deliberately chose to turn off
the distractions created by the alarms generated by GPS applications (New Zealand
Civil Aviation Authority, 2003).

3. Hazards of Fail-silent Modes. The floatplane accident was not caused because the
GPS failed. In contrast, the system was programmed with the incorrect destination.
The pilot observed the potential problem and intervened to resolve it. In contrast, the
Royal Majesty ran aground because the autopilot and associated GPS continued to
operate in a limited form of „fail silent? mode based on dead reckoning. The crew was,
therefore, faced with the opposite problems to those described in the previous item.
Rather than being faced with the additional workload involved in solving a GPS
failure, the crew continued to operate the system as though it were functioning
normally when in fact they were receiving increasingly erroneous navigation data.

4. Over-Reliance on Navigational Data. A common theme across all of the incidents in
this paper is the high degree of trust that operators place in GPS technology and their
associated navigation systems. One element in this may be the increasing integration
GPS applications into mass market consumer products. This may suggest that there is
no additional requirement to consider the reliability and accuracy of GPS readings
within the context of safety-critical systems; familiarity may breed complacency. The
skipper of the Sanga Na Langa had operated his navigation systems for several years
without any perceived failures and hence was extremely surprised when over-reliance
on GPS data led to the grounding of his vessel.

5. Lack of Hazard Monitoring and Over-Reliance on GPS Alarms. Previous items in this
list have considered the human factors problems that can arise when operators come to
rely too much on the navigational information provided by GPS applications. One
variation of this potential hazard stems less from any failure to monitor location
information than from the high level of trust that can be placed on the alarms provided
by these systems. For example, many autopilots enable operators to specify when
visual and audio alarms are raised as they approach known hazards. This enables crew
members to devote their attention to other primary tasks than to monitor the location
of potential hazards in their environment. However, the grounding of the Sanga Na
Langa illustrates what can happen when these alarms are not raised.

6. Inaccuracies in Charts and Maps. The Sanga Na Langa incident also revealed further
hazards from interactive navigation systems. The subsequent investigation conducted
several studies to ensure not that the GPS was functioning correctly but to ensure the
accuracy of the associated electronic charts. Even when operators may be concerned to
verify the location data provided by GPS applications, they may rely too much on the
location of hazards identified in electronic charts and maps. Many of these data
sources were drawn up at a time when these technologies were not available and,

14

therefore, may not be as accurate as the fixes that are routinely available across many
industries. In other words, the widespread availability of accurate navigational aids is
exposing the inaccuracies in many of the charts and maps that guide the operators of
safety-critical applications.

7. Erosion of Traditional Navigational Skills and Practices. A continuing concern
through several of the reports that were studied in this paper is the suggestion that the
increasing use of GPS will lead to an erosion of traditional navigation skills and
practices. This does not simply refer to the users? ability to make an accurate fix on
their position. It also stems from a concern that operators are not taking the same
degree of care in planning their intended route in the belief that they can always rely
on GPS support to get them out of any eventual problem. The lack of route planning
before the loss of the CASA 212 may provide an eloquent example of this concern. It
can be argued that greater care might have been taken by the crew had they not been
able to rely on the support provided by satellite navigation systems. As we have seen,
however, the benefits provided by their technology are not always sufficient to address
the wide range of operation problems that can arise during safety-related operations in
unknown terrain.
This list is not exhaustive; it summarizes only those concerns that arose in the incidents
examined in this paper. It seems clear that further problems will arise in the interaction
between operators and the increasingly complex technologies that are being integrated with
GPS and its successors. It is ironic; however, that the rising number of these adverse events
may still not outweigh the larger number of adverse events which have occurred because
individuals and teams of co-workers chose NOT to use navigational systems (New Zealand
Maritime, 2004).


Conclusions and Further Work

The Global Positioning System (GPS) uses a network of orbiting and geostationary satellites
to calculate the position of a receiver over time. This technology has revolutionized a wide
range of safety-critical industries and leisure applications ranging from commercial fisheries
through to mountain running. These systems provide diverse benefits; supplementing the
users existing navigation skills and reducing the uncertainty that characterizes route planning
tasks. GPS applications also reduce workload by...