1 Introduction

When practitioners begin to take an interest in human-centered design it is usually an indication that things have got out of hand. More precisely, it means that the technology has become so complex that the natural human capacity for coping has been exhausted, whether it is that of the operator or the designer. This point has in the past been reached for a number of application areas (aviation, human–computer interaction, control room design) and the same fate now seems to have caught up with automotive design.

Whereas the proposal of a human-centered design alternative is a natural first reaction, it is rarely the right one. One reason is that ‘human-centered’ usually is defined by what it is not, rather than by what it is. As discussed by Winograd and Woods (1997), there is no single feature or criterion that makes a design human-centered. Common definitions of human-centeredness emphasize a number of aspects, for instance that the motivation for technology development is grounded in a statement about human needs; that people should be kept ‘in the loop’ or as parts of the system to be developed; that technology is intended to interact with people and not to replace them; or that technology development is justified by predicted improvements in human performance and/or collaboration between people. Of these four aspects the last is probably the most relevant for the automotive context. It reflects the suggestion of Winograd and Woods (1997) that design should be problem-driven, activity-centered, and context bound. Good design is problem-driven because it begins by an attempt to understand the nature of the problems that need to be solved. It is activity-centered because the focus is on the external demands that make co-operation necessary. And it is context-bound because meaning always depends on the situation and the people in them.

This approach to design puts systems and the functions of systems, rather than the user, at the center. It thereby occupies a middle ground between technology-centered and user-centered design. While the humanistic bias of human-centered design is useful as a reminder that the technological bias is wrong, it is detrimental if it is taken literally. The wholesale notion of user-centered design should be understood as a polemic or programmatic statement rather than as a solution to the problem faced in practice. Human–machine systems should not be designed to please or appeal to the user, but to accomplish or provide some function or service. (That goes even for most consumer products.)

This is particularly so in the case of the automotive environment. Vehicles are meant to transport something or someone from point A to point B, but they do not do this by themselves. This is one reason that a driver is needed. The driver’s role vis-à-vis the vehicle is, however, not to interact with it or with the traffic environment, but to ensure that the driving is safe and efficient. The goal for design must therefore be to enhance the joint system’s ability to deliver the required functionality, which means the ability of the joint driver vehicle system to remain in control throughout the travel.

1.1 Active and passive safety

Technology-driven design is usually incremental, in the sense that new functions are added when they become feasible rather than because they are needed. This often leads to situations that best can be characterized as ‘solutions looking for a problem’. Representative examples of that are expert systems in the 1980s, multi-media systems in the 1990s, and wireless mobility in the beginning of the present century. Automotive environments are no exception to this principle. Even if we leave out communication and entertainment (COMENT) systems, the abundance of active safety technologies provide plenty of examples. It is, of course, beyond dispute that modern cars have achieved a very high level of safety due to technological innovation. Until now this has mostly been in relation to passive or protective safety, and it may be argued that the level of success has been due to the existence of well-known problems and clear design goals, i.e., to reduce the human consequences of traffic accidents.

In the case of active or preventive safety the goal is less clear since there are many ways in which an accident, or the build-up to an accident, can be prevented. Whereas mitigation can be the response to a well-defined condition, similar to the top-node of a fault tree, prevention must necessarily consider all the ways in which this condition can occur, hence the fault tree itself. Despite that most of the technologies that are being offered to consumers, such as Adaptive Cruise Control, Lane Departure Warnings, Attention Monitoring and Night Vision systems, are developed on their own, thereby obfuscating the overall risk picture. Equally bad is that the need to interact with the driver is considered towards the end of design rather than at the beginning. One symptom is that any number of these systems may be in competition of the driver’s attention, leading to proposals for adaptive driver interfaces as a way to overcome the problems. That solution is, however, itself a case of technological feasibility applied to a self-created problem rather than to a real user need. The real problem lies not in the interaction with the driver, but in the failure to consider the joint driver-vehicle system from the start.

2 The primary driving task

One way of illustrating the fragmentary approach that characterizes automotive design is to look at the notion of the primary driving task. It is easily accepted that automotive design should serve to enhance the primary driving task and that it should not introduce unnecessary secondary tasks. But it is less easy to come to an agreement about what the primary driving task is, or indeed whether one should refer to a primary driving task (in the singular) or primary driving tasks (in the plural). Yet taking one position or the other is no trivial matter.

An illustration of the difficulties is conveniently provided by the European Commission’s recommendation of 21 December 1999 on safe and efficient in-vehicle information and communication systems (EC 1999). This document, which aims to clarify the principles on human machine interface to be followed by the European automobile industry, contains the following passage (notice the use of the singular form):

System controls should be designed such that they can be operated without adverse impact on the primary driving task

and further clarifies that:

In this context the principles consider that the driver’s primary driving task is safely controlling the vehicle through a complex dynamic traffic environment.

(Unfortunately it later muddies the waters by applying defining ‘system’ as follows: ‘For the purpose of this statement of principles ‘the system’ refers to the functions and parts, such as displays and controls, that constitute the interface and interaction between the system and the driver’.)

The primary driving tasks, using the plural form, are in general taken to mean what the driver should do and concentrate on, examples being lane position, speed maintenance, headway (longitudinal separation), reacting to hazards, etc. Similarly, the secondary tasks are taken to mean more or less everything else, especially if that may interfere with the primary tasks. Examples of secondary tasks are using the phone, the radio, the climate control, the navigation systems, talking to passengers, etc.

Yet neither the primary nor the secondary tasks can be defined independently of the common technology, as the above lists clearly show. The goals of joint driver-vehicle system design are therefore relative rather than absolute, in the sense that they must refer to the current level of technology and therefore also the traffic environment and driving tasks that go together with that. The design of the joint driver-vehicle system furthermore has consequences for what driving tasks and traffic environments become, hence changes its own premises (e.g., Hollnagel 2003). To illustrate this, consider three distinct ways of defining the primary driving tasks that correspond to different stages of automotive development.

2.1 Driving as safe travel

One of the first attempts to understand the nature of driving was presented by Gibson and Crooks (1938). Their analysis led to the definition of a ‘field of safe travel’, which consisted ‘... at any given moment, of the field of possible paths which the car may take unimpeded’ (Gibson and Crooks 1938, p 456). The nature of this field was clarified as follows:

The field of safe travel, it should be noted, is a spatial field but it is not fixed in physical space. The car is moving and the field moves with the car through space. Its point of reference is not the stationary objects of the environment, but the driver himself. It is not, however, merely a subjective experience of the driver. It exists objectively as the actual field within which the car can safely operate, whether or not the driver is aware of it. It shifts and changes continually, bending and twisting with the road, and also elongating or contracting, widening or narrowing, according as obstacles encroach upon it and limit its boundaries.

On the basis of this the primary driving tasks, corresponding to the operation of steering an automobile, was defined as ‘a perceptually governed series of reactions by the driver of such a sort as to keep the car headed into the middle of the field of safe travel’ (Gibson and Crooks 1938, p 457).

When we consider this definition of the primary driving tasks, it is important to keep in mind both the traffic environment and the automobiles of the day. Roads were, by and large, pretty empty compared with present day traffic densities. (From 1930 to 1990 the number of registered vehicles in the San Francisco Bay Area increased by a factor of eight; in Sweden, the increase during the same period was by a factor of 34!) There were fewer road signs and signals, and the cars themselves had only the most essential instrumentation and controls. Cars were less powerful, hence had a lower top speed and slower acceleration. Radios were unusual, and climate control was unheard of. The only feasible ‘secondary task’ would therefore be talking to passengers. On the other hand, maneuvring the car required more attention and effort, which meant that keeping the car within the field of safe travel, was a demanding task in itself.

2.2 Driving as control

In the 1970s, driving was described as a set of control tasks, combining feedforward and feedback control (e.g., McRuer et al. 1977).

Driving consist of a hierarchy of navigation, guidance, and control phases conducted simultaneously with visual search, recognition, and monitoring operations. Fundamentally, navigation is the overall selection of a route; to accomplish navigation involves a series of guidance and control operations. Guidance is concerned with more specific questions of path details and judgements based on the given situation. Typically, guidance is made up of the selection; decision and path definition aspects of one task. If, for example, overtaking and passing were the task, guidance would include the decision to overtake, and pass and the selection of the desired trajectory based on oncoming traffic and other constraints. Control is the process of effecting the guidance desired by actuating the steering wheel, accelerator, and brakes in such a way that the selected path is followed, and with acceptable accuracy (McRuer et al. 1977, p 381).

Corresponding to this, there were a number of primary driving tasks that could be described on the following three levels of control:

  • Precognitive control—open-loop commands which are so scaled by previous conditioning (complete familiarity) as to result in vehicle motions which are exactly as desired.

  • Pursuit control—an open-cycle, closed-cycle system, in which the major driver commands come from the feedforward element, while the closed-loop portion of the system acts as a vernier control (fine adjustment) to reduce any residual path errors.

  • Heading control (guidance)—consisting of (a) selection of appropriate pathways and tolerances; (b) establishing and maintaining the automobile on the specified pathway; (c) reducing path errors to threshold levels in a stable, well damped, and rapidly responding manner; and (d) maintaining the established path in the presence of disturbances such as crosswinds, roadway fluctuations, and vehicle-centred disturbances.

This change in view of the primary driving tasks is clearly related to the changes in automobiles and traffic. In the mid-1970s cars had less primary instrumentation than now but a few more controls than in the 1930s, as well as a number of additional functions such as radio and climate control. Due to developments in technology, such as power steering and power assisted braking, driving had on the one hand become physically less demanding. On the other hand cars had become more powerful in terms of speed and acceleration and the traffic environment had become more complex, so rather than simply trying to keep within the field of safe travel, drivers now had to manoeuvre in often dense traffic, as well as keep track of an increasing number of signs, signals, and indications. Relative to the situation in the 1930s, the primary driving tasks were different and more demanding at the same time as new types of secondary tasks had appeared.

2.3 Driving as situation management

Jumping ahead to the present day, driving has been described by several authors as a set of simultaneous tasks with different temporal and demand characteristics. A well-known example is Michon (1985), who proposed that driver performance could be structured at three levels that were comparatively loosely coupled. The levels were called strategical, manoeuvring, and control, respectively, and the idea was that control would switch from one level to the other at appropriate points in time.

The notion of describing driving using several levels of control can also be found in a newer model (Hollnagel et al. 2003), which distinguishes among four simultaneously active layers of control.

  • The tracking loop describes the low-level driving activities required to maintain speed, distance from the car in front/behind, relative or absolute lateral position, etc. Tracking activities are basically closed loop control, which skilled drivers can accomplish with little effort and without paying much attention to them.

  • The regulating loop provides the goals and criteria for the tracking level. Regulating is mostly closed loop, although some anticipatory control may occur. It is concerned with aspects such as target speed, specific position and movement relative to other traffic elements, etc. and may therefore involve a number of tracking sub-loops. Regulating also requires that the driver attend to what she/he is doing.

  • The monitoring loop is concerned with the state of the joint driver-car system relative to the driving environment (traffic flow, hazards) and generates the plans and objectives that are used by the regulating and tracking loops. The status of the JDVS is monitored on this level—for instance the car’s condition, location, available and used resources, etc. Monitoring further keeps track of traffic signs and signals such as indications of direction (locations and distances), warnings (e.g., road conditions or curves), and restrictions (e.g., one way traffic or speed limits).

  • The targeting loop (goal setting) is where the destination and driving criteria are generated. Targeting is distinctly an open loop activity, which is implemented by a non-trivial set of actions and often covers an extended period of time. Assessing the change relative to the goal is not based on simple feedback, but rather by a loose assessment of the situation—for instance, the estimated distance to the goal. When it is done regularly it may be considered as being a part of monitoring. When it is done irregularly, the trigger can be one of several factors such as time, a pre-defined cue or landmark (physical or symbolic), the user’s background ‘simulation’, or estimation of the general progress (like suddenly feeling uneasy about where one is), etc.

The change in modeling driving, from driving as safe travel to driving as control to driving as situation management is not just a result of the theoretical developments in psychology and the behavioral sciences, but also reflects the changes to driving as an activity. These changes are partly due to changes in vehicle technology and the migration of initially irrelevant, but now essential (?), functions into the car, and partly to changes in the nature of traffic and in the way of life as a whole. (These changes are, of course, not independent of one another.) When driving is looked at as situation management, the primary driving tasks comprise both the driving itself and keeping track of the progress of the journey such as assessing whether one is on time, on track, and with sufficient physical and mental resources to reach the destination according to internal and external constraints. The primary driving tasks are therefore only meaningful if seen from a function-centered view, as part of how drivers cope with the complexity of a dynamic traffic environment. The issue is not whether the driver can control the vehicle, but whether the joint driver-vehicle system can accomplish what it sets out to do.

3 Driver in control

As mentioned in the beginning of this paper, the overall goal of automotive design should be to enhance the ability of the joint driver-vehicle system to remain in control throughout the travel. The many technologies that are offered to make driving both easier and safer should therefore be subsumed under this goal. If that is done, the problems of reconciling diverse technologies and accommodate competing demands to the driver’s focus largely disappear. This does not happen because the technologies magically become less diverse, but because their use becomes guided by a simple top–down principle, namely to ensure that the joint driver-vehicle system has sufficient control of what it does. This in turn entails the ability to understand what happens, to know what has happened, and to anticipate what may happen either in the short or the medium term. For instance whether a conflict is imminent or whether the destination will be reached in time. The purpose of design is therefore no longer that of facilitating the interaction between human and machine, but rather to ensure the effective functioning of the joint driver-vehicle system. In consequence of that, the main concern should be one of coagency rather than one of interaction (Hollnagel and Woods 2005).

Automotive design should preferably avoid both a technological bias and a humanistic bias. The problems with technology-centered design are by now obvious, although they are not always fully acknowledged. The problems with human-centered design are as yet less obvious, but probably not much smaller. It is tempting to adopt an anthropocentric view, not least because we all are human and because we all easily can imagine ourselves as being the driver of a particular vehicle. Yet it stands to reason that any driver-vehicle system is designed to provide a specific function. It is therefore only reasonable that the design should be centered on that function and that the overriding concern is how the joint driver-vehicle system can remain in control.