Esubalew Yitayal

Jean-Marc Pierson

Dejene Ejigu

A Balanced Battery Usage Routing Protocol to Maximize Network Lifetime of MANET Based on AODV

Keywords: AODV, BBU-AODV, MANET, NS-2.34, Network Lifetime, energy consumption, residual energy

Energy efficiency is a critical issue for battery-powered mobile devices in ad hoc networks. Failure of node or link allows re-routing and establishing a new path from source to destination which creates extra energy consumption of nodes, sparse network connectivity and a more likelihood occurrences of network partition. Routing based on energy related parameters is one of the important solutions to extend the lifetime of the network. In this paper, we are designing and evaluating a novel energy aware routing protocol called a balanced battery usage routing protocol (BBU) which uses residual energy, hop count and energy threshold as a cost metric to maximize network life time and distribute energy consumption of Mobile Ad hoc Network (MANET) based on Ad hoc on-demand Distance Vector (AODV). The new protocol is simulated using Network Simulator-2.34 and comparisons are made to analyze its performance based on network lifetime, delivery ratio, normalized routing overhead, standard deviation of residual energy of all Nodes and average end to end delay for different network scenarios. The results show that the new energy aware algorithm makes the network active for longer interval of time once it is established and fairly distribute energy consumption across nodes on the network.

Introduction

Recent advances in wireless communication technologies and availability of less expensive computer processing power have led to an interest in mobile computing applications. Mobile Ad hoc Network (MANET) is a special type of wireless network in which a collection of mobile entities form a temporary network without the aid of any established infrastructure or centralized administration [START_REF] Royer | Wireless Networks[END_REF]. Therefore, dynamic topology, unstable links, limited energy capacity and absence of fixed infrastructure are special features for MANET when compared to wired networks. These characteristics put special challenges in routing protocol design.

The key challenge in the design of wireless ad hoc networks is the limited availability of the energy resources. Each of the mobile nodes is operated by a limited energy battery and usually it is impossible to recharge or replace the batteries during a mission such as in battlefields and emergency relief scenarios [START_REF] Meshram | A Protocols. International Jo 3[END_REF]3]. Since each mobile node in a MANET acts both as a router and host and most of the mobile nodes rely on other nodes to forward their packets, the failure of a few nodes, due to energy exhaustion, might cause the disruption of service in the entire network. Thus, researchers have focused on design of power-aware network protocols for the ad hoc networking environment to extend network lifetime and balance energy usage among mobile nodes.

In recent years, many researchers have focused on the optimization of energy consumption of mobile nodes, from different points of view. Some of the proposed solutions try to adjust the transmission power of wireless nodes; other proposals tend to efficiently manage a sleep state for the nodes [START_REF] Prakash | G Range Energy Aware Dy International Journal of C 5[END_REF]. Finally, there are many proposals which try to design an energy efficient routing protocol by means of an energy efficient routing metric instead of the minimum-hop count.

In this paper a new energy efficient algorithm called BBU-AODV, which maximizes the life time of a MANET by avoiding routing of packets through nodes with low residual energy and balance the total energy consumption among all nodes in the network while selecting a route to the desired destination, is proposed. BBU routing protocol is developed on top of the popular AODV routing protocol.

The remainder of the paper is organized as follows. In section 2, we describe MANET routing protocols. In Section 3, we review some of the proposed energyaware routing protocols for MANETs. We explain in detail our proposed work and its integration with AODV in Section 4. In Section 5, we compare the performance of our protocol with that of AODV via Network simulator NS-2.34 simulations for a variety of network scenarios, and finally, we conclude the paper in Section 6.

MANET Routing Protocols

In this section we describe routing protocols in MANET and the basic operation of the reactive AODV routing protocol. MANET routing protocols could be classified into three categories based on the routing information update mechanism: proactive (table-driven), reactive (on-demand) and hybrid [5].

Proactive routing protocols require nodes to exchange routing information periodically and compute routes continuously between any nodes in the network, regardless of using the routes or not. This means a lot of network resources such as energy and bandwidth may be wasted, which is not enviable in MANETs where the resources are constrained. On the other hand, reactive routing protocols do not exchange routing information periodically. Instead, they discover a route only when it is needed for the communication between two nodes. Proactive protocols inherently consume more energy than the Reactive ones; hence most of the research works involve modifications to reactive protocols. The last category which is Hybrid routing protocols combine the basic properties of the first two classes of protocols. That is, they are both reactive and proactive in nature. It uses the route discovery mechanism of reactive protocol to determine routes to far away nodes and the table maintenance mechanism of proactive protocol to maintain routes to nearby nodes.

Among reactive protocols, AODV is considered potentially the most energy efficient routing protocol. Hence many research studies have focused on making AODV routing protocol more energy efficient [START_REF] Patil | Design of an Energy Efficient Routing Protocol for MANETs based on AODV[END_REF].

Ad hoc On-demand Distance Vector (AODV): When a node wants to find a route to a destination and does not have a valid route to that destination, it will initiate a path discovery process. Path discovery process is initiated by broadcasting a route request packet (RREQ) to its neighbors. When a node receives RREQ in case it has routing information to the destination, it sends a route reply (RREP) packet back to the source. Otherwise, it rebroadcasts RREQ packet further to its neighbors till either the destination is reached or another node is found with a fresh enough route to the destination. Nodes that are part of an active route keep its connectivity by broadcasting periodically local Hello messages to its neighbors. If Hello messages stop arriving from a neighbor beyond some time threshold, the connection is assumed to be lost. When a node detects that a route to a neighbor node is not valid it removes the routing entry and sends a route error (RERR) message to neighbors that are active and use the route. This procedure is repeated at nodes that receive RERR messages till it reaches to the source node. A source that receives an RERR can reinitiate a route discovery by sending a RREQ Packet. In AODV, the routing process will not consider about the energy of the node rather it considers only minimum hop-count along the paths [START_REF] Perkins | Ad hoc on-demand distance vector (AODV) routing[END_REF]. Hence AODV algorithm may result in a quick depletion of nodes battery along the most heavily used routes in the network.

Related Works

Routing is one of the important solutions to the problem of energy efficiency in Mobile ad hoc network. In the recent past years energy efficient routing in Ad hoc network has been addressed by many research works which has produced so much innovation and novel ideas in this field. The majority of energy efficient routing protocols for MANET try to reduce energy consumption by means of an energy efficient routing metric instead of the minimum-hop metric. Each and every protocol has some advantages and shortcomings. None of them can perform better in every condition. It depends upon the network parameters which decide the protocol to be used. This section reviews some of the many energy efficient schemes based on AODV developed by researchers in the field. In Zhaoxiao et al. [START_REF] Zhaoxiao | Modified Energy-Aware AODV Routing for Ad hoc Networks[END_REF], to mitigate the energy saving problem, an energy-aware routing named EAODV for Ad Hoc networks is proposed. The algorithm selects routing according to the dynamic priority-weight ( ) and takes the hop count as an optimization condition. The dynamic priority weight is determined using the square of the ratio of residual battery energy(R) and consumed energy(C) of a node at time t as shown below.

The destination node selects two maximum summation of priority-weight which spends less energy and owns larger capacity based on synthetic analysis among possible routes and propagates the route reply (RREP) messages to the source node. The second path will be used when the primary path fails. Since the work considered the summation of priority-weight, the selected path for data transmission might contain a node which has less remaining energy.

Jie et al [START_REF] Jie | Researching on AODV and PS-AODV Routing Protocols of Ad Hoc Network for Streaming Media[END_REF] propose a PS-AODV routing protocol based on load conditions of a node to balance uneven nodes energy consumption of the traditional AODV. They made an improvement in route discovery process. Node checks its load value when received a RREQ packet before forwarding RREQ packets. If the node load is too high, it refuses to forward the RREQ packet until the load is reduced. However queue

2 (t) C (t) R = (t) i i i
load condition could not give guarantee to protect nodes with little battery capacity which decreases network life time.

Lei and Xiaoqing [START_REF] Lei | Improved energy-aware AODV routing protocol[END_REF] propose an improved energy aware AODV strategy to extend network life time. The improvements made by the authors are on route request packets and hello mechanisms of AODV. However the algorithm did not consider fair distribution of energy usage across nodes on the network.

Patil et al. [START_REF] Patil | Design of an Energy Efficient Routing Protocol for MANETs based on AODV[END_REF] introduce an algorithm which combines Transmission Power and Remaining Energy Capacity and integrates these metrics into AODV so that the Ad hoc network has a greater life time and the energy consumption across the nodes is reduced. During route discovery from source to destination the transmission and remaining energy values along the route are accumulated in the RREQ packets. At the destination or intermediate node (which has a fresh enough route to the destination) these values are copied into the RREP packet which is transmitted back to the source. The source alternates between the maximum remaining energy capacity route and minimum transmission route every time it performs route discovery. Since hop count did not consider as a cost metric and transmission power is used for route selection, the selected link for data transmission might be frequently broken which creates more energy consumption and shorten life time of network.

Kim and Jang [START_REF] Kim | AODV based Energy Efficient Routing Protocol for Maximum Lifetime in MANET[END_REF] propose an enhanced AODV routing protocol to maximize networks lifetime in MANET using an Energy Mean Value algorithms. Here, energy remaining of each node in the path between source and destination is accumulated and delivered to the destination by adding a field on a RREQ message. The destination node does not give a RREP reply immediately to the first RREQ, rather it waits for 3 * NODE_TRAVERSAL_TIME to receive additional RREQ packets destined for the node. Then the destination node adds the accumulated residual energy of each path and divides by the number of hops along the paths to obtain the mean energy of network. Finally the destination node unicasts RREP messages along the reverse path of the RREQ message received first and nodes hearing the RREP message store the mean energy. When a new path is discovered, the mean energy stored in each node is compared with the residual energy in the node. If the residual energy is less than the mean energy, the delay time of RREQ message is set to be 0.5ms otherwise the delay time of RREQ message is set to 0.05ms.Since the nodes are mobile, cumulative delay of each node affect the relay node out its position during data transmission which minimizes network lifetime and consumes battery.

Liu et al. and Sara et al. [START_REF] Liu | Energy Efficient on demand Multipath Routing Protocol for Multi-hop Ad Hoc Networks[END_REF][START_REF] Sara | Energy Efficient Ad Hoc on Demand Multipath Distance Vector Routing Protocol[END_REF], propose a multipath mobile ad hoc routing protocol which extends the Ad Hoc On-demand Multipath Distance Vector routing protocol . The protocol finds the minimum remaining energy of each route and sort multi-route by descending nodal residual energy. Once a new route with higher nodal residual energy is emerging, it is reselected to forward rest of the data packets.

The work done in Tie et al. [START_REF] Tie | Alternate Link Maximum Energy Level Ad Hoc Distance Vector Scheme for Energy Efficient AdHoc Networks Routing[END_REF] proposes ALMEL-AODV which considers node remaining energy as a routing metric to balance and extend the survival time of the nodes in the network. The proposed algorithm chooses two highest summations of residual energy routes for data transmission. The second route will be used as a backup. Although the metric used is important, a node which has very low residual energy might be included during message transmission as they centered on maximum summation of remaining energy irrespective of nodal residual energy. Hence the remaining capacity of each host should be consider as a metric to prolong the life time of the network. Kim et al. [START_REF] Kim | Power-aware routing based on the energy drain rate for mobile ad hoc networks[END_REF] introduce an energy drain rate metric, which represents the rate of battery consumption. It estimates the lifetime of a node; therefore, if the estimated value is below a threshold, the traffic passing through it can be diverted in order to avoid node failure due to battery exhaustion. The cost of a node i is calculated as the ratio between the Remaining Battery Power (RBC) and the Drain Rate (DR): C= RBC / DR C-K Toh [START_REF] Toh | Maximum battery life routing to support ubiquitous mobile computing in wireless adhoc networks[END_REF] proposes a routing algorithm called Minimum Total Transmission Power Routing (MTPR) based on minimizing the amount of energy required to get a packet from source to destination. The problem is mathematically stated as:

Where Tij denotes the energy consumed in transmitting between two consecutive nodes i and j in route . Although the MTPR can reduce the total energy consumption of the overall network, it does not reflect the lifetime of each mobile entity.

Singh et al. [START_REF] Singh | Power-aware with Routing in Mobile Ad Hoc Networks[END_REF] propose the Minimum Battery Cost Routing (MBCR) which used the remaining energy capacity as a cost metric, and the cost function is defined as: MBCR selects routes with a minimum cost value to choose the route with the maximum remaining energy capacity. However, MBCR only considers the summation of the inverse of residual battery capacities for all nodes along the path. Thus, routes containing small energy capacity nodes can still be chosen.

Local Energy-Aware Routing Protocol is proposed by works in [START_REF] Wang | Power-aware on-demand routing protocol for manet[END_REF][20][21] [22] [START_REF] Malek | Improved the Energy of Ad Hoc On-Demand Distance Vector Routing Protocol[END_REF]. When a node receives a RREQ message at time t, it compares its current remaining energy capacity with the predefined threshold value or computed value. If the residual energy is less than the threshold or computed value, the RREQ message is dropped. Otherwise, the message is processed and forwarded. However, the destination will receive a route request message only when all intermediate nodes along the route have enough battery levels. If all the paths to destination have small residual energy, the RREQ message will not be reached at the destination.

Kumar and Banu [START_REF] Kumar | E2AODV Protocol for Load Balancing in Ad-Hoc Networks[END_REF] present an E2AODV scheme to balance load distribution of nodes. A threshold value is used to judge if intermediate node was overloaded or not.

Here, an intermediate node receiving the RREQ will compare its current queue length with its threshold before rebroadcasting it. If queue length is greater than the threshold, the RREQ will be dropped. Otherwise, the node will broadcast it. In their scheme, the threshold value plays the key role in selecting nodes whether or not to forward RREQ. Every time an intermediate node receives a RREQ, it will recalculate the threshold according to the average queue length of all the nodes along the path to the node itself. Therefore, the threshold is variable and changing adaptively with the current load status of network.

∏ ∈ ∏ ) , ( j i ij T Min

The Proposed Work

The main aim of this work is to propose a routing protocol that increase the life time of network and fairly distribute an energy consumption of hosts in MANET. The algorithm which we propose combines threshold, summation of residual energy, min residual energy and hop count as a cost metric and integrates these metrics into AODV in an efficient way. This metrics ensure that all the nodes in the network remain up and running together for as long as possible.

Modification on RREQ Packet

The proposed energy aware AODV modifies route request (RREQ) packet for route discovery process as shown in Figure 1. We modified the fields in the RREQ packet by adding minimum residual energy (MRE) and sum of residual energy (SRE) which keeps the minimum remaining energy and sum of remaining energy along the path respectively. An EnergyDifference (D) field, which stores the difference between either average minimum residual energy (AME) and threshold (Th) or average sum of residual energy (ASE) and threshold (Th), is also added on the routing table at a destination node.

In BBU-AODV, when all nodes in some possible routes between a sourcedestination pair have large remaining energy than the threshold then a route with maximum of the difference of average sum of residual energy and threshold among the routes is selected. Otherwise the maximum difference of the average minimum residual energy and threshold among the routes is selected.

Mathematical Model of BBU-AODV

If we consider a generic route r j = n 0 , n 1 , n 2 , … , n d , where n 0 is the source node and n d is the destination node , h is the number of hop between n 0 and n d and a function r(n i ) denotes the residual energy of node n i then the average minimum residual energy(AME) and average summation of residual energy(ASE) for the route r j is calculated as:

The BBU-AODV algorithm selects an optimal route k O k (D) which verifies the following condition:

If (minimum residual energy along a path is greater than or equal to the threshold i.e.

Choose a route which has the maximum of the difference of average residual summation and threshold i.e.

Else Choose a route with maximum difference of average minimum residual energy and threshold i.e.

Where A is the set of all routes under consideration and Th is a predefined energy threshold.

Algorithm for RREQ Handling

The pseudo code in Figure 2 shows the algorithm used to search for the desired path and the flow chart of RREQ handling at the intermediate and destination node for BBU-AODV is as shown in Figure 3.

The intermediate nodes process RREQ as follows:

Step

SRE= (residual energy of current node + SRE of RREQ received)

Step 3: If RREQ is not the first or Destination Sequence Number is not greater than the sequence number in the routing table, then the coming RREQs is discarded.

The destination node processes RREQ as follows:

Step 1: The node checks whether RREQ is first arrived by looking up the source node id and broadcast ID in a routing table.

Step Step 3: If RREQ is not the first, then the node checks its waiting time .

Step

4: If RREQ is not expired, then the algorithm calculates an energyDifference (routing cost) for the new RREQ and compares it with an EnergyDifference value on the the routing table. If the route cost (D) of the incoming RREQ is greater than an EnergyDifference (D) in the routing table, then the destination node replaces the routing table entry of an existing RREQ by the incoming copies of RREQ otherwise the incoming RREQ is discarded.

Step 5: If the node receives another copy of RREQ, it executes step 4 till its waiting time expires.

Step 6: If waiting time expires a destination node sends an RREP on the reverse path which has large value of EnergyDifference to a source node.

Comparison of Routing Protocols

To understand the operations of the proposed protocol, we consider three different routing protocols namely AODV, ALMEL-AODV and BBU-AODV. In Fig. 4, the number written above a node corresponds to the value of residual node energy during RREQ received and inside a node indentifies a particular node. We have also used 10 joule as an energy threshold for the network. Case 1: Choose a route with minimum hop count between source and destination (AODV routing protocol). AODV selects route < S-6-7-8-D > which has the smallest hop count of 4.

Case 2: Choose a route with largest Summation of residual energy. (Max_Sum Energy (ALMEL-AODV) routing protocol. The ALMEL-AODV algorithm selects route <S-1-2-3-4-5-D> which is the largest summation of residual energy.

Case 3: Choose a route with large summation of residual energy and less hop count if possible; otherwise choose a route with largest minimum residual energy and less hop count (proposed routing protocol i.e. BBU-AODV). Our proposed model selects a route with largest value of EnergyDifference (D). Thus route <S-9-10-11-12-D> which has largest D value of 6.6 is selected.

Case 1 selects the shortest path without considering remaining energy of nodes. Thus, case 1 does not give guarantee for long network lifetime. Case 2 selects a route with largest summation of residual energy but it has serious problem in terms of life time and hop count as it may still choose a route with nodes containing small remaining battery capacity as shown in

Simulation Environment

In this paper the simulations are carried out using Network Simulators-2 version 2.34 [START_REF]Network Simulator[END_REF] to evaluate the performance of the proposed energy efficient routing protocol against AODV and ALMEL_AODV. Expire-Time(T) of D(sec) 0.1

Performance Metrics

The following performance metrics are used to evaluate our algorithm against AODV routing protocol.

Network lifetime: the time

Delivery ratio: the ratio of packets generated at the sou

Standard deviation of resi variation or "dispersion" exi

Normalized routing overh data packets delivered at the Average End-to-End Del and receiving by the des queuing time.

Simulation Results

The following results show MANET.

Network lifetime

Our modified energy aware by achieving long duratio network during the simulat life time is due to the fact residual energy nodes as a shorter path between source

Delivery Ratio

Fig. 7 shows that the propos ALMEL-AODV. This is du which is active for longer d

Conclusion

Maximum network life time MANET as a new route disc is selected which creates ext the network. To overcome simulation results show that reasonable distribution of en and classical AODV. But A end to end delay than the mo various mobility and traffic forward to minimize routing he average end to end delay of AODV is smaller than b L-AODV. The reason is that AODV only finds sho very irrespective of other parameters. Furthermore, of ALMEL-AODV is higher than BBU-AODV. Thi doesn't consider hop count as a cost metric. Hence s will be selected increases.

e end to end delay with different number of nodes e and fair utilization of energy usage is very important i covery process has to be reinitiated if less energy capable p tra energy consumption of nodes and affects delivery ratio these problems, a BBU-AODV algorithm is proposed. T t BBU-AODV has better network lifetime, delivery ratio nergy consumption across nodes than both ALMEL_AO AODV has relatively low normalized overhead and aver odified one. Now we are working on to examine the effec c models on BBU-AODV algorithm. We are also look g overhead of both AODV and BBU-AODV.

Fig. 1 .

 1 Fig. 1. Modified RREQ Packet format

Fig. 2 .Fig. 3 .

 23 Fig. 2. Pseudo code on how node process RREQ

Figure 4 .

 4 Case-3 improves the drawbacks of Case 1 and Case-2 by considering both residual energy and hop count as a cost metric. Based on our algorithm the cost function (D) for path S-1-2-3-4-5-D, S-6-7-8-D, S-9-10-11-12-D and S-13-14-15-16-17-18-D is -9.5, -9.25, 6.6 and 5.4 respectively as shown in Figure 4. Hence BBU-AODV selects path S-9-10-11-12-D which is the largest value of D i.e. 6.6 for data transmissions. So the proposed algorithm always chooses a route which extends network lifetime by taking energy capable nodes and distributes load among mobile nodes as well by taking either large summation of residual energy or maximum residual energy.

Fig. 4 .

 4 Fig. 4. BBU-AODV route setup from node S to node D

Fig. 5 .

 5 Fig. 5. Net

Fig. 6 .

 6 Fig. 6. Stan

Fig. 7 .Fig. 8 .

 78 Fig. 7. D

Fig. 9 .

 9 Fig. 9. Averag

  2: If RREQ is first arrived, it calculates an EnergyDifference(D) value as shown below and waiting time ( ) for additional RREQ's packet and keeps it on a routing table for additional RREQ.

	Let threshold (Th) = some constant energy E
	If (MRE >= Th)
	D= ((SRE/hopcount) -Th)
	Else
	D= ((MRE/hopcount) -Th)

Table 1 .

 1 We used Wireless Channel/Wireless Physical, Propagation model is Free Space Propagation Model, Queuing model is Drop Tail/Priority Queue, Mobility model is Random Waypoint model and MAC protocol is 802.11. The simulation setup consists of an area of 500m X 500m with different number of nodes ranging from 100 to 200 for each simulation. Each packet starts travelling from a random location to a random destination with a randomly chosen speed. When a node reaches a destination, it moves to another randomly chosen destination after a pause. To emulate the dynamic environment, all nodes move around in the entire region with maximum speed of 20m/sec. Constant Bit Rate (CBR) traffic source with packet size of 512 bytes is used. Traffic scenarios with 15 source-destination pairs were used to establish the routes. All the simulations were run for a period of 500 sec. The initial energy of each node was set as 100 Joule with transmission and reception power of 1 W and 0.5W respectively. The Energy threshold value for the simulation is set to 30 Joule and the expiration time of D at the destination routing table is set to 0.1sec. Identical movement and traffic scenarios are used across all protocols.Once the trace file is generated, a Perl and AWK scripts are used to analyze the information from the trace file. Based on the output of these scripts, graphs are plotted for network lifetime v/s number of nodes, delivery rate v/s number of nodes, normalized routing overhead v/s number of nodes, standard deviation of residual energy of all nodes v/s number of nodes and average end to end delay v/s number of nodes. The parameters used in the simulation are listed in Table1. Simulation Parameters

	Simulation Parameters	Values
	Number of Nodes	100 to 200
	Geographical areas(m 2 )	500mX500m
	Packet Sizes(Bytes)	512
	Traffic Type	CBR
	Pause time(sec)	40
	Mobility Model	Random way Point
	Simulation Time(sec)	500
	Initial Energy(Joule)	100
	Transmission Energy(Watt)	1
	Reception Energy(Watt)	0.5
	Traffic Sources	15
	Maximum Speed(m/s)	20
	Threshold(Joule)	30

  Review of Current Routing Protocols for Ad Hoc Mo E Personal Communications 6(2), 46-55 (1999) A.: Issues and Challenges of Energy Consumption in MAN ournal of Networking and Parallel Computing, 56-60 (2013) , N., Golla, V., Jayanthi, G.: Designing Energy Routing Proto on Optimization in MANET. IEEE Transactions on Emerg 13) Gupta, S.C., Vijay, S.: Design and Implementation of Vari ynamic Source Routing Protocol for Mobile Ad Hoc Netwo Computer Engineering and Technology (IJCET), 105-123 (201 kia, T., Dutkiewicz, E.: A review of routing protocols for mo r Ad Hoc Networks 2 (2004)

	both
	orter
	the
	s is
	the
	in a
	path
	o of
	The
	and
	ODV
	rage
	ct of
	king
	obile
	NET
	ocol
	ging
	able
	orks.
	13)
	obile

: A


Racim Fahssi
email: fahssi@irit.fr

Célia Martinie
email: martinie@irit.fr

Philippe Palanque
email: palanque@irit.fr

Enhanced Task Modelling for Systematic Identification and Explicit Representation of Human Errors

Task models produced from task analysis, are a very important element of UCD approaches as they provide support for describing users goals and users activities, allowing human factors specialists to ensure and assess the effectiveness of interactive applications. As user errors are not part of a user goal they are usually omitted from tasks descriptions. However, in the field of Human Reliability Assessment, task descriptions (including task models) are central artefacts for the analysis of human errors. Several methods (such as HET, CREAM and HERT) require task models in order to systematically analyze all the potential errors and deviations that may occur. However, during this systematic analysis, potential human errors are gathered and recorded separately and not connected to the task models. Such non integration brings issues such as completeness (i.e. ensuring that all the potential human errors have been identified) or combined errors identification (i.e. identifying deviations resulting from a combination of errors). We argue that representing human errors explicitly and systematically within task models contributes to the design and evaluation of error-tolerant interactive system. However, as demonstrated in the paper, existing task modeling notations, even those used in the methods mentioned above, do not have a sufficient expressive power to allow systematic and precise description of potential human errors. Based on the analysis of existing human error classifications, we propose several extensions to existing task modelling techniques to represent explicitly all the types of human error and to support their systematic task-based identification. These extensions are integrated within the tool-supported notation called HAMSTERS and are illustrated on a case study from the avionics domain.

Introduction

Task analysis and modelling approaches have always focused on the explicit representation of standard behavior of users, leaving user error analysis for later phases in the design processes [START_REF] Baber | Task analysis for error identification: a methodology for designing error-tolerant consumer products[END_REF]. This is part of the rationale underlying task analysis which is to provide an exhaustive analysis of user behavior describing goals and activities to reach these goals. Clearly, errors, mistakes and deviations are not part of the users' goals and thus left aside of tasks descriptions. This exhaustive aspect of task analysis is fundamental as it is meant to provide the basics for a global understanding of users behaviors which will serve as a basis for driving evolutions of the interactive system. However, practice (for real-life applications) shows that reaching this comprehensiveness is very hard, especially as it require a vast amount of resources. If cuts have to be made when analyzing standard activities, it is clear that infrequent or abnormal behaviors are often not considered. However, this is precisely where the emphasis should be placed in order to deal efficiently with error tolerance as error prone systems deeply impact efficiency and satisfaction. Beyond these usability-related aspects, in critical systems the cost of an operator error might put people life at stake, and this is the reason why Human Reliability Assessment (HRA) methods (such as HET, CREAM or HERT) provide means for identifying human errors. Such approaches go beyond early work of Norman on typologies of human errors [START_REF] Norman | Categorization of action slips[END_REF] which have then been integrated in the action theory [START_REF] Norman | The Psychology of Everyday Things[END_REF]. Indeed, they are usually associated with tasks descriptions in order to relate work and goals with erroneous behaviors of operators. However, they all exploits basic task description techniques making impossible to go beyond qualitative and quantitative temporal descriptions.

In this paper we propose the use of a detailed task description technique called HAMSTERS [START_REF] Martinie | Extending procedural task models by systematic explicit integration of objects, knowledge and information[END_REF] within a HRA method to support identification of errors related to information, knowledge and devices. Beyond that, we present extensions to HAMSTERS notation in order to describe identified error within the task models. Integrating errors within a task model brings multiple advantages, the most prominent being the seamless representation of activities to reach goals and possible deviations. Such integrated representation can be exploited for building effective and error avoidant interactive systems.

The paper is structured as follows. Section 2 presents the human error domain, human reliability assessment methods and task modeling. This state of the art is used to identify limitations of current HRA methods and to identify requirements for extending task models to encompass information dedicated to user errors. Section 3 presents an extended version of the HAMSTERS notation in which genotypes and phenotypes of errors enrich "standard" task models. This section also proposes a stepwise process based on Human Error Template (HET) [START_REF] Stanton | Predicting design induced pilot error using HET (human error template)-A new formal human error identification method for flight decks[END_REF] HRA method to systematically identify user errors and to represent them in task models. Section 4 shows, on a case study, how this framework can be used and what it brings to the design and verification of errortolerant safety critical interactive systems. Section 5 highlights benefits and limitations of the approach while section 6 concludes the paper and presents future work.

Related Work on Human Error and Task Modelling

Human error has received a lot of attention over the years and this section aims at presenting the main concepts related to human errors as well as the existing approaches for analyzing them. This related work section starts with the analysis of taxonomies of human errors followed by processes and methods for identifying human errors in socio-technical systems. Last sub-section summarizes work on representing human errors with a specific focus on representations based on task description.

Definition and taxonomies of human errors

Several contributions in the human factors domain deal with studying internal human processes that may lead to actions that can be perceived as erroneous from an external view point. In the 1970s, Norman, Rasmussen and Reason have proposed theoretical frameworks to analyze human error. Norman, proposed a predictive model for errors [START_REF] Norman | Categorization of action slips[END_REF], where the concept of "slip" is highlighted and causes of error are rooted in improper activation of patterns of action. Rasmussen proposes a model of human performance which distinguishes three levels: skills, rules and knowledge (SRK model) [START_REF] Rasmussen | Skills, rules, knowledge: signals, signs and symbols and other distinctions in human performance models[END_REF]. This model provides support for reasoning about possible human errors and has been used to classify error types. Reason [START_REF] Reason | Generic error modelling system: a cognitive framework for locating common human error forms[END_REF] takes advantages of the contributions of Norman and Rasmussen, and distinguishes three main categories of errors:

1. Skill-based errors are related to the skill level of performance in SRK. These errors can be of one of the 2 following types: a) Slip, or routine error, which is defined as a mismatch between an intention and an action [START_REF] Norman | Categorization of action slips[END_REF]; b) Lapse which is defined as a memory failure that prevents from executing an intended action. 2. Rule-based mistakes are related to the rule level of performance in SRK and are defined as the application of an inappropriate rule or procedure. 3. Knowledge-based errors are related to the knowledge level in SRK and are defined as an inappropriate usage of knowledge, or a lack of knowledge or corrupted knowledge preventing from correctly executing a task. At the same time, Reason proposed a model of human performance called GEMS [START_REF] Reason | Generic error modelling system: a cognitive framework for locating common human error forms[END_REF] (Generic Error Modelling System), which is also based on the SRK model and dedicated to the representation of human error mechanisms. GEMS is a conceptual framework that embeds a detailed description of the potential causes for each error types above. These causes are related to various models of human performance. For example, a perceptual confusion error in GEMS is related to the perceptual processor of the Human Processor model [START_REF] Card | The model human processor: An engineering model of human performance[END_REF]. GEMS is very detailed in terms of description and vocabulary (e.g. strong habit intrusion, capture errors, overshooting a stop rule …) and structuring approaches have been proposed as the Human Error Reference Table (HERT) in [START_REF] Palanque | Task Patterns for Taking Into Account in an Efficient and Systematic Way Both Standard and Erroneous User Behaviours[END_REF].

Causes of errors and their observation are different concepts that should be separated when analyzing user errors. To do so, Hollnagel [START_REF] Hollnagel | The phenotype of erroneous actions Implications for HCI design[END_REF] proposed a terminology based on 2 main concepts: phenotype and genotype. The phenotype of an error is defined as the erroneous action that can be observed. The genotype of the error is defined as the characteristics of the operator that may contribute to the occurrence of an erroneous action.

These concepts and the classifications above provide support for reasoning about human errors and have been widely used to develop approaches to design and evaluate interactive systems [START_REF] Rizzo | Handling human error[END_REF]. As pointed out in [START_REF] Papatzanis | Identifying Phenotypes and Genotypes: A Case Study Evaluating an In-Car Navigation System[END_REF] investigating the association between a phenotype and its potential genotypes is very difficult but is an important step in order to assess the error-proneness of an interactive system. This is why most of the approaches for Human Reliability Assessment focus on this double objective, as presented in next section.

Techniques and methods for identifying Human Errors

Many techniques have been proposed for identifying which human errors may occur in a particular context and what could be their consequences in this given context. Several human reliability assessment techniques such as CREAM [START_REF] Hollnagel | Cognitive reliability and error analysis method (CREAM)[END_REF], HEART [START_REF] Williams | A data-based method for assessing and reducing human error to improve operational performance[END_REF], and THERP [START_REF] Swain | Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications[END_REF] are based on task analysis. They provide support to assess the possibility of occurrence of human errors by structuring the analysis around task descriptions. Beyond these commonalities, THERP technique provides support for assessing the probability of occurrence of human errors. • Tool support for task analysis and modelling: to indicate whether or not a particular Computer Aided Software Environment (CASE) tool is available to provide support for the application of the technique; • Associated error classification: to indicate which human error classification is used to identify possible errors. 'G' and 'S' indicates whether the classification comes from a generic system failures analysis or whether it is specific to human errors; • Capacity to deal with combination of errors: to indicate whether or not the techniques provides explicit support for identifying possible combinations of errors.

Here only 2 values are possible: 'No' and 'NE' (Not Explicitly meaning that the method was not claiming explicitly that combinations of errors are handled).

For all the techniques presented above the process of identifying possible human errors highly relies on the user tasks descriptions. The task descriptions have to be precise, complete and representative of the user activities, in order to be able to identify all the possible errors. Indeed, the task description language as well as the mean to produce the description affect the quality of the analysis. However, most of them exploit Hierarchical Task Analysis (HTA) which only provides support for decomposing user goals into tasks and subtasks and for describing the sequential relationships between these tasks (in a separate textual representation called "plan"). As HTA does not provide support for describing precisely the types of user actions, the temporal ordering types that are different from a sequence of actions (such as concurrent actions, order independent actions…), as well as information and knowledge required to perform an action, errors related to these elements cannot be identified. Furthermore, as most of these techniques do not have tool support it is cumbersome to check coverage of and to store identified errors in a systematic way. For example, as HTA does not provide support for describing knowledge required to perform a task, none of these methods provide explicit support for the identification of all possible knowledge-based mistakes.

Support for representation of human errors in task model

As explained above the expressive power of the task modelling notation has a direct impact on how task models produced with these notation are likely to support the identification of errors. Many task modelling notations have been proposed over the years focusing on the representation of standard user behaviors most of the time leaving aside erroneous behaviors. Table 2 presents a comparison of task modelling notations to assess (depending on their expressive power) their capability in identifying and representing human errors. For each notation, the following information is highlighted:

• Identification of human error: to indicate whether or not the notation provides support to systematically establish a relationship between a task model element and a component of a model of human information processing or model of human performance. • Explicit representation of human error: to indicate whether or not the notation provides support to systematically represent human error related information in a task model. • Explicit representation of error recovery: to indicate whether or not the notation provides support to explicitly represent recovery tasks i.e. when an error has occurred, to describe the set of actions to be performed in order to still reach the goal. While this is possible in most task modelling notations (e.g. set of action to perform after entering a wrong PIN when using a cash machine) we identify here the fact that the notation makes explicit (or not) that this set of task is related to a user error. COMM [START_REF] Jourde | COMM notation for specifying collaborative and multimodal interactive systems[END_REF] GOMS [START_REF] Card | The psychology of human-computer interaction[END_REF] GTA [START_REF] Van Der | GTA: Groupware task analysis-Modeling complexity[END_REF] HAMSTERS [START_REF] Annett | Hierarchical task analysis[END_REF] Even though the table above demonstrates the very limited account of error handling in task modeling notation, task models have already been used to take into account possible human errors while interacting with an interactive system. Paterno and Santoro proposed a model-based technique that uses insertion of deviated human actions into task models in order to evaluate the usability of the system and to inform design [START_REF] Paterno | Preventing user errors by systematic analysis of deviations from the system task model[END_REF], however, such information is presented in tables outside of the task models. This approach is relevant for human error identification but only in generic terms (as it exploits HAZOP which is a standard hazard analysis method). Palanque and Basnyat proposed a technique based on task patterns (represented in CTT) that supports human routine errors [START_REF] Palanque | Task Patterns for Taking Into Account in an Efficient and Systematic Way Both Standard and Erroneous User Behaviours[END_REF] description. Here a specific task model is produced in which recovery actions following errors are explicitly represented, thus ending up with two un-connected task model. Modification in one of the task model has then to be reflected in the other one increasing complexity of task modelling activities. In both contributions, no specific element of the notation are introduced thus leaving the contributions to basic task elements provided in CTT notation (and thus not covering errors related to information, knowledge … as presented above).

In order to overcome the limitations of the current task modelling notations, next section presents extensions to the HAMSTERS notation to specifically represent errors. While the extensions are made explicit on that particular task modelling technique, the underlying concepts are generic making them applicable to others.

Extending a Task Modelling Notation to support the identification and representation of human errors

This section presents the extensions that have been added to the HAMSTERS notation in order to provide support for systematic identification and representation of human errors in task models. We also present how this extended notation has been integrated within a human error identification technique. This process starts with an extant task model and extends it with explicit genotypes and phenotypes of errors.

HAMSTERS notation

HAMSTERS (Human -centered Assessment and Modeling to Support Task Engineering for Resilient Systems) is a tool-supported graphical task modeling notation for representing human activities in a hierarchical and structured way. At the higher abstraction level, goals can be decomposed into sub-goals, which can in turn be decomposed into activities. Output of this decomposition is a graphical tree of nodes that can be tasks or temporal operators. Tasks can be of several types (depicted in Table 3) and contain information such as a name, information details, and criticality level. Only the single user high-level task types are presented here but they can be further refined. For instance the cognitive tasks can be refined in Analysis and Decision tasks [START_REF] Martinie | Task-model based assessment of automation levels: application to space ground segments[END_REF] and collaborative activities can be refined in several task types [START_REF] Martinie | Multi-models-based engineering of collaborative systems: application to collision avoidance operations for spacecraft[END_REF]. Temporal operators (depicted in Table 4 and similar to the ones in CTT) are used to represent temporal relationships between sub-goals and between activities. Tasks can also be tagged by properties to indicate whether or not they are iterative, optional or both. The HAMSTERS notation is supported by a CASE tool for edition and simulation of models. This tool has been introduced in order to provide support for task system integration at the tool level [START_REF] Martinie | Multi-models-based engineering of collaborative systems: application to collision avoidance operations for spacecraft[END_REF]. This tool supported notation also provides support for structuring a large number and complex set of tasks introducing the mechanism of subroutines [START_REF] Martinie | Structuring and Composition Mechanism to Address Scalability Issues in Task Models[END_REF], sub-models and components [START_REF] Martinie | Structuring and composition mechanisms to address scalability issues in task models[END_REF]. Such structuring mechanisms allow describing large and complex activities by means of task models. These structuring mechanisms enables the breakdown of a task model in several ones that can be reused in the same or different task models. HAMSTERS expressive power goes beyond most other task modeling notations particularly by providing detailed means for describing data that is required and manipulated [START_REF] Martinie | Multi-models-based engineering of collaborative systems: application to collision avoidance operations for spacecraft[END_REF] in order to accomplish tasks. Fig. 1 summarizes the notation elements to represent data. Information ("Inf:" followed by a text box) may be required for execution of a system task, but it also may be required by the user to accomplish a task. Physical objects required for performing a task can also be represented ("Phy O") as well as the device (input and/or output) with which the task is performed ("i/o D"). Declarative and situational knowledge can also be made explicit by the "SiK" and "StK" elements.

HAMSTERS notation elements and relationship with genotypes

All of the above notation elements are required to be able to systematically identify and represent human errors within task models. Indeed, some genotypes (i.e. causes of human errors) can only occur with a specific type of task or with a specific element in a task model described using HAMSTERS. This relationship between classification of genotypes in human error models and task modelling elements is not trivial. For this reason, Table 5 presents the correspondences between HAMSTERS notation elements and error genotypes from the GEMS classification [START_REF] Reason | Human Error[END_REF]. Such a correspondence is very useful for identifying potential genotypes on an extant task model. It is important to note that strategic and situational knowledge elements are not present in this table. Indeed, such constructs are similar to the M (Methods) in GOMS and thus correspond to different ways of reaching a goal. As all the methods allow users to reach the goal an error cannot be made at that level and is thus not connected to a genotype.

Extensions to HAMSTERS to describe user errors

Several notation elements have been added to HAMSTERS in order to allow explicit representation of both genotypes and phenotypes of errors. Table 6 summarizes these notation elements that can be used to describe an observable consequence of an error (phenotype) and its potential associated causes (genotypes).

In that table the first column lists the types of errors following GEMS classification.

The second column makes the connection with the SRK classification as previously performed in [START_REF] Reason | Human Error[END_REF]. Third column present the new notation elements in HAMSTERS for describing genotypes of errors as well as how they relate to the classifications on human error. Four new elements are added: Slips, Lapses, Rule-Based Mistakes and Knowledge-Based Mistakes. As for phenotypes only one notation element is proposed. Indeed, the phenotype (i.e. how the errors is made visible) only need to be explicitly represented, the label beneath it providing a textual description while its relationship to

Inf : Information

DK :

Declarative the causes is made by connecting genotypes to it. Such connections will be presented in details in the case study section.

Modelling process

In this section, we show how we have integrated HAMSTERS extended notation with the HET [START_REF] Stanton | Predicting design induced pilot error using HET (human error template)-A new formal human error identification method for flight decks[END_REF] technique. HAMSTERS could be used to replace HTA in any other human error identification method based on task description, but we have chosen HET because it provides a detailed process and because it has been demonstrated in [START_REF] Stanton | Predicting design induced pilot error using HET (human error template)-A new formal human error identification method for flight decks[END_REF] to be more accurate than other techniques such as SHERPA and HAZOP [START_REF] Stanton | Predicting pilot error on the flight deck: Validation of a new methodology and a multiple methods and analysis approach to enhancing error prediction sensitivity[END_REF].

Fig. 2 presents a modified version of the HET process and provides support for identifying genotypes and phenotypes of possible human errors by embedding error descriptions in the task models that have been produced to describe user activities. The extended process starts with a task analysis and description phase (as for the original HET one), but in our case the produced task models are refined to represent perceptive, cognitive and motor user tasks as well as information and knowledge required to perform the tasks. These models take full advantage of the expressive power of HAMSTERS that has been presented in section 3. All the modifications made with respect to the original process have been made explicit by using various shades of grey.

Next step in the process exploits the task type-genotypes correspondence table (Table 5), to provide support for systematic identification of genotypes associated to perceptive, cognitive, motor and interactive input tasks, but also to the related phenotypes. The likelihood and criticality of a genotype are inserted as properties of the instance of represented genotype. This is performed in HAMSTERS tool by specific properties associated to the genotypes icons. Similarly, likelihood and criticality of a phenotype can also be described using properties of the instance of a represented phenotype. Likelihood of a phenotype may be a combination of likelihood of related genotypes. Once all of the possible genotypes and phenotypes have been identified and described in the task model, the human error identification and representation technique is applied to the next task model. Once all of the models have been analyzed, a last step is performed (see bottom left activity in Fig. 2) in order to determine, for each task model that embeds human error descriptions, which phenotypes may be propagated to

S lip

Lapse KBM other task models. Several phenotypes may be associated to an observable task, but not all of them may happen in a particular scenario.

Illustrative example from an avionics case study

This section presents an excerpt of task models produced by the application of the process presented above for identification and representation to a case study. The case study belongs to the aeronautics domain and more precisely deals with pilot tasks exploiting a weather radar cockpit application. This section aims at illustrating how the HAMSTERS extensions can be applied to human operations on a real-life application. Due to space constraints, the application of all new elements of notation are not shown in this article but most of them are.

Presentation of the weather radar case study

Weather radar (WXR) is an application currently deployed in many cockpits of commercial aircrafts. It provides support to pilots' activities by increasing their awareness of meteorological phenomena during the flight journey, allowing them to determine if they may have to request a trajectory change, in order to avoid adverse weather conditions such as storms or precipitations. In this case study, we particularly focus on the tasks that have to be performed by a pilot to check the weather conditions on the current flight path. Fig. 3 presents a screenshot of the weather radar control panels, used to operate the weather radar application. These panels provides two functionalities to the crew. The first one is dedicated to the mode selection of weather radar and provides information about status of the radar, in order to ensure that the weather radar can be set up correctly. The operation of changing from one mode to another can be performed in the upper part of the panel (mode selection section). The second functionality, available in the lower part of the window, is dedicated to the adjustment of the weather radar orientation (Tilt angle). This can be done in an automatic way or manually (Auto/manual buttons). Additionally, a stabilization function aims to keep the radar beam stable even in case of turbulences. The right-hand part of Fig. 3 4), pilots can determine whether or not the content of the clouds is dangerous for the aircraft. For example, the red color highlights the fact that the clouds contain heavy precipitations. Such information is needed in order to ensure that the current or targeted flight plan are safe.

4.2

Task model of the task "Check weather conditions on the flight path" Fig. 5 presents the description, with HAMSTERS elements of notation, of the activities that have to be performed to check the weather conditions on the flight path.

The tasks presented in this model describe how the pilot builds a mental model of the current weather from information gathered on the navigation display (Fig. 4). For a pilot, checking weather conditions is very important as it provides support for deciding to maintain or change the current trajectory of the aircraft. This task is decomposed into 3 sub tasks:

• "Examine Map": the pilot perceives and examines the radar image of the weather, which is displayed on the navigation display (see Fig. 4). To perform this analysis, the pilot has to know the meaning of the weather representations (described with declarative knowledge notation elements in Fig. 5 such as "Green light clouds mean precipitation").

• "Manage WXR control panel": This sub task is represented by a subroutine, and linked to another task model, which describes the tasks that have to be performed to control the WXR modes. • "Manage Display Range": This sub task describes the actions that have to be performed by the pilot in order to change the range of the WXR display with using the physical knob "range" (illustrated in Fig. 3 b)). The pilot has to turn the knob to modify the range, and then to wait for the radar image to be refreshed on the navigation display (Fig. 4).

Task model with human errors

Fig. 6 presents a modified version of the "Check weather conditions on the flight path" task model. This new version embeds the descriptions of possible human errors (genotype and phenotypes) which have been identified while applying the human error identification process. Each human task and interactive input task is connected to one (or several) genotype(s), indicating possible cause(s) of errors. Genotypes are then connected to phenotypes, which are the observable consequences of the errors. For example, the "Perceive image" perception task is connected to the genotype "Perceptual confusion: image badly or not perceived" (zoomed in view in Fig 7). This genotype is also connected to the phenotype "Weather target wrongly or not detected". In the same way, the "Interpret and analyze" cognitive analysis task, which requires particular knowledge to be performed (the "DK" labeled rectangles containing declarative knowledge about relationships between the color of visual artefacts in the navigation display and the composition of the clouds) is connected to the knowledge based mistake "Illusory correlation: No weather problem detected". This means that a wrong user knowledge association could cause a non-detection of a weather issue on the flight path. And this genotype is also connected to the phenotype "Weather target wrongly or not detected".

Benefits and limitations of the approach

The stepwise refinement process of task models presented in section 3.4 and its application to the case study in section 4 have demonstrated the possibility to exploit the extended version of HAMSTERS to support identification and description of operator errors on an existing task model. While this is critical in order to identify parts in a system that might be error prone or parts in the system that are not tolerant to operators errors it is also true that the task models enriched with error artefacts are gathering a lot of information that might decrease their understandability and modifiability. We currently favor the expressiveness of the notation and of the resulting task models than legibility and understandability. These two aspects are currently being addressed at tool level providing multiple filtering mechanisms for hiding (in a temporary way) information that the analyst is not focusing on. For instance, all the information elements can be hidden, as the genotypes and the phenotypes if the current activity is to focus on sequencing of tasks.

The main objective of the approach is to support redesign activities when error prone designs have been identified. Such redesign would take place through an iterative design process involving co-evolution of tasks and systems as presented in [START_REF] Barboni | Beyond modelling: an integrated environment supporting co-execution of tasks and systems models[END_REF] but development costs are clearly increased. This is the reason why such an approach would be also useful for supporting certification activities in critical systems. For instance, as stated in [START_REF] Easa Cs | Certification for large Aeroplanes[END_REF] CS25-1302 annex E 1-F-1, "Flight deck controls must be installed to allow accomplishment of these tasks and information necessary to accomplish these tasks must be provided " and in CS 25-1309 "stems and controls, including indications and annunciations must be designed to minimize crew errors, which could create additional hazards". This CS 25 document consists in a list of requirement that have to be fulfilled in order for aircraft manufacturers to go successfully through certification processes (which are managed by regulatory authorities and/or third parties). The two highlighted requirements demonstrate that certification can only be successful using a complete and unambiguous description of operator's tasks and by ensuring that equipment (called system in this paper) are not error prone. Finally, it is important to note that the process proposed and its associated tool-supported notation remain a manual expert-based activity. This is made clearly visible by the "is the error credible?" step in the process where identification of errors can only come from deep understanding of operators activities and possible deviations.

Conclusion

In this paper we have presented a way of taking into account in a systematic way abnormal user behavior by extending previous work in the area of task modelling and human error analysis and identification. We proposed the use of several classifications in human error and integrated them into an analysis and modelling process exploiting new extensions in the task modelling notation HAMSTERS. These extensions make it possible to explicitly represent genotypes and phenotypes of operator errors and to describe their relationships. These contributions have been applied to a real-life case study in the field of aeronautics demonstrating most of the aspects of the contributions. However, errors related to strategic knowledge and errors related to temporal ordering (e.g. the task model describes a sequence of tasks but the operator performs them in parallel) were not presented even though covered by the approach.

As identified in "Benefits and Limitations" section, this work targets at supporting certification activities for critical systems and more precisely cockpits of large aircrafts. However, thanks to the tool support provided by HAMSTERS (which make human error identification and description less resource consuming) the approach is also applicable to other domains where errors are damaging, in terms of human life, economics, prestige, trust …

Fig. 1 .

 1 Fig. 1. Representation of Objects, Information and Knowledge with HAMSTERS Notation

StartFig. 2 .

 2 Fig.2. Human error identification and description process extended from HET[START_REF] Stanton | Predicting design induced pilot error using HET (human error template)-A new formal human error identification method for flight decks[END_REF]

Fig. 3 .

 3 Fig. 3. Image of a) the numeric part of weather radar control panel b) physical manipulation of the range of the weather radar

Fig. 4 .

 4 Fig. 4. Screenshots of weather radar displays

  (labelled "b)") presents an image of the controls used to configure radar display, particularly to set up the range scale (right-hand side knob with ranges 20, 40, … nautical miles).

Fig. 5 .

 5 Fig. 5. Task model of the "Check weather conditions on the flight path" task

Fig. 4

 4 Fig.4shows screenshots of weather radar displays according to two different range scales (40 NM for the left display and 80 NM for the right display). Spots in the middle of the images show the current position, importance and size of the clouds. Depending on the color of the clouds in the navigation display (Fig.4), pilots can determine whether or not the content of the clouds is dangerous for the aircraft. For example, the red color highlights the fact that the clouds contain heavy precipitations. Such information is needed in order to ensure that the current or targeted flight plan are safe.

Fig. 6 .

 6 Fig. 6. Task model of the "check weather conditions on the flight path" task embedding the description of potential errors

Fig 7 .

 7 Fig 7. "Examine map" sub-task of the "check weather conditions on the flight path" task embedding the description of potential errors

  weather on the trajectory of the aircraft DK : Yellow clouds contain mean precipitations DK : Red clouds mean heavy precipitations DK : Green clouds mean light precipitation Weather target wrongly or not detected Perceptual confusion :Image badly or not perceived Inf : weather image Illusory correlation : No weather problem detected

Table 1

 1

	presents an overview on the existing

Table 1 .

 1 Summary of techniques and methods used for identifying human errors

Name of the technique Type of tech- nique Task model- ling Tool sup- port Associated error classification (Ge- neric/Specific)

						Combi-
						nation of
						errors
	Hazard and operability study	Safety	HTA	None Not done, Less, More, As well as, Other	G NE
	(HAZOP) [15]	analysis			than, Repeated, Sooner, Later, Misor-
					dered, Part of
	Systematic human error re-	HEI,	HTA	None Action errors, Checking errors, Commu-	S No
	duction and prediction ap-	HRA			nication errors, Info retrieval errors, Se-
	proach (SHERPA) [7]				lection errors
	Potential human error cause	HEI,	HTA	None HAZOP classification	G NE
	analysis (PHECA) [43]	HRA
	Cognitive reliability and er-	HEI,	HTA	None Timing, Duration, Sequence, Object,	S NE
	ror analysis method	HRA			Force, Direction, Distance, Speed
	(CREAM) [10]
	Human error assessment and	HEI,	HTA	None None (concrete description of the human	S NE
	reduction technique	HRA			error)
	(HEART) [44]
	Human Error Identification	HEI,	HTA	None Skill Rule Knowledge model	S NE
	In Systems Tool (HEIST)	HRA
	[13]
	Human Error Template	HEI, Hu-	HTA	None Fail to execute: Task execution incom-	S No
	(HET) [36]	man Fac-			plete, Task executed in the wrong direc-
		tors			tion, Wrong task executed, Task re-
					peated, Task executed on the wrong in-
					terface element,
					Task executed : too early/too late/too
					much/too little, Misread information,
					other
	System for Predictive Error	HEI,	HTA	None Action, Retrieval, Check, Selection,	G No
	Analysis and Reduction	HRA, SA			Transmission
	(SPEAR) [40]
	Task Analysis For Error	HEI, HF	HTA	None Generic categories	S NE
	Identification (TAFEI) [2]
	Technique for Human Error	HEI, HCI HTA	None Goals, Plans, Performing actions, Per-	S NE
	Assessment (THEA) [30]				ception, Interpretation and evaluation
	Human Error Recovery and	HEI	HTA	None Omission, Timing, Sequence, Quality,	S No
	Assessment (HERA) [14]	HRA			Selection error, Information Transmis-
					sion error, Rule Violation, Other
	Tech. for Human Error Pre-	HRA	Not	None Omission, Commission, Selection error,	S No
	cision Rate (THERP) [39]		speci-		Error of sequence, Time error, Qualita-
			fied.		tive error.
	Tech. for the Retrospective	HEI	HTA	None Selection and Quality	S No
	and Predictive Analysis of	HRA			Timing and Sequence
	Cognitive Errors in Air Traf-				Communication
	fic Control (TRACer) [35]
	Task Model-Based System-	HCI, DC	HAMST	HAM	HAZOP and Reason classifications	G NE
	atic Analysis of System Fail-		ERS	STER
	ures and Human Errors [20]			S

Table 2 .

 2 Support for describing errors and errors-related elements

	Task Modelling Notations
	CTT [27]
	Element of representation

Table 3 .

 3 Task types in HAMSTERS

		Abstract	Input	Output	I/O	Processing
	Abstract	Abstract	Not Applicable	Not Applicable	Not Applicable	Not Applicable
	User
		User abstract	Perceptive	Motor	User	Cognitive
	Interactive	Abstract inter-active	Input	Output	Input/Output	Not Applicable
	System	Abstract sys-tem	Output	Input	Input/Output	System

Table 4 .

 4 Illustration of the operator type within hamsters

Table 5 .

 5 Correspondence between HAMSTERS elements and genotypes from GEMS[START_REF] Reason | Human Error[END_REF]

	Element of notation in	Related genotype from GEMS [32]
	HAMSTERS
	Perceptive task	Perceptual confusion (Skill Based Error)
			Interference error (Skill Based Error)
	Input task	Motor task	Interference error (Skill Based Error) Double capture slip (Skill Based Error)
			Omissions following interruptions (Skill Based Error)
			Skill based errors	─ Double capture slip ─ Omissions following interruptions
				─ Reduced intentionality
				─ Interference error
				─ Over-attention errors
			Rule based mistakes	Misapplication of good rules
				─ First exceptions
				─ Countersigns and non-signs
				─ Informational overload
				─ Rule strength
				─ General rules
	Cognitive task		─ Redundancy ─ Rigidity
				Application of bad rules
				─ Encoding deficiencies
				─ Action deficiencies
				─ Selectivity
			Knowledge based mis-	─ Workspace limitations
			takes	─ Out of sight out of mind ─ Confirmation bias
				─ Overconfidence
				─ Biased reviewing
				─ Illusory correlation
				─ Halo effects
				─ Problems with causality
				─ Problems with complexity
	Information	Double capture slip, Omissions following interruptions, Interference error, all of the Rule Based Mistakes and Knowledge Based Mis-
			takes
	Declarative knowledge	All of the Knowledge Based Mistakes

Table 6 .

 6 Representation of genotypes and phenotypes in HAMSTERS

	Type of error (GEMS [32])	Level of Performance from [31]	Representation of genotype in HAMSTERS	Representation of phenotype in HAMSTERS
	Slip
		Skill-based
	Lapse
		Rule-based
	Mistake
		Knowledge-based