Ying Huo

Daniel Delahaye

Yanjun Wang

ICRAT

Keywords: Closest point of approach, sensitivity analysis, local approach, variance-based method

The increase of air traffic demand leads to a higher risk of collision. In the process of ensuring the safety of air traffic, Closest Point of Approach (CPA) plays an important role in estimating potential dangers. Sensitivity analysis of CPA provides related information about the influences from different aircraft parameters to CPA. The parameters such as speed of aircraft, flight direction and relative position of aircraft are used as inputs, the closest distance between two aircraft and the time from the first observation to CPA are considered to be the outputs. The main idea presented in this paper includes the establishment of the model and the selection of sensitivity analysis method. The proposed model contains all possible encounter scenarios of two aircraft and can establish the relations between dependent and independent variables simply. The objective of sensitivity analysis is to detect the influential effects from the inputs to the outputs based on the model. Thus two methods are considered in this paper: Local approach uses the partial derivative corresponding to a specific point with respect to a certain input to determine the sensitivity. This method is limited by explaining one situation each time. Variance-based method which is under a probabilistic framework bases on random numerical sampling generates numerical results to determine the global influential effects with certain assumptions. The sensitivity analysis will benefit air traffic management controllers by offering auxiliary strategies while a dangerous situation occurs.

I. INTRODUCTION

The increase of air traffic has potential impact on the collision risk between aircraft. Recently, not only commercial air transportation but general aviation transportation grow dramatically which result in heavy workload for air traffic controllers and higher risk of accidents. The widely used Traffic Collision Avoiding System (TCAS) and Airborne Collision Avoiding System (ACAS) play important roles in avoiding the potential collisions between aircraft and obstacles, as well as providing solutions to air crew for emergency situations. Since in en-route segment, the separation between two aircraft is the primary consideration of the collision avoidance system, it is necessary to investigate Closest Point of Approach (CPA) to determine the closest distance under the potential collision scenarios in the free airspace [START_REF] Alam | Evolving air traffic scenarios for the evaluation of conflict detection models[END_REF].

During the process of developing collision detection and avoidance system, lots of research works based on CPA are studied. A typical one is given by Kuchar and Yang on the conflict detection model [START_REF] Kuchar | Survey of Conflict Detection and Resolution Modeling Methods[C[END_REF]. Usually the mathematical part of resolution advisory detection ends up with computational formula of CPA [START_REF] Munoz | A TCAS-II resolution advisory detection algorithm[END_REF].

Sensitivity analysis has been widely employed for various kinds of problems to determine the influential effects between the inputs and the outputs [START_REF]Sensitivity analysis[END_REF]. Houck and Powell have studied the sensitivity of collision risk on parallel approach by using a runway reference frame. A baseline case was used as a criterion to analyze the relationship between variables such as roll rate, heading change, air speed etc. and the output which is collision rates by applying the least square method [START_REF] Houck | A parametric sensitivity study of ultra closely spaced parallel approaches[END_REF]. Jackson and Zhao defined the modeling error between predicted trajectories and real trajectories which are fed back by pilots. Except the modeling errors and human mistakes, the linearly related equation between predicted trajectories and real trajectories can be used to determine the expressions for closed-loop sensitivity [START_REF] Jackson | Sensitivity of trajectory prediction in air traffic management[J][END_REF]. These previous work use different kinds of methods to achieve the final goal of sensitivity analysis on the specific aspects.

Although there are plenty of studies related to CPA, the contributions from the parameters which determine the time and distance to CPA has been less addressed. In this paper we present the sensitivity analysis of CPA considering only two converging aircraft. The study is based on flight cruise phase when aircraft speed, heading, and altitude do not change. A preliminary analysis on CPA is conducted to detect the time and the distance between initial observation at time t 0 and the closest point at time t cpa . Then, a model is developed which takes all the possible scenarios into account. Therefore, the information we extract from radar data can be adapted to one of the scenarios in the model.

The structure of this paper is organized as follows. Section II provides the background information on CPA and introduces the parameters that will be used as inputs and outputs. Modeling process is also presented in this section. Section III using local approach for sensitivity analysis, results are represented with figures. Section IV presents the process of using global sensitivity analysis method including the calculation of sensitivity indices. Simulation and results of this method are explained. In section V, we conclude the work and sketches the further direction of research.

II. CLOSEST POINT OF APPROACH A. Definition

Closet Point of Approach represents to the positions of two dynamically moving objects where they reach their closest distance [START_REF] Arumugam | Closest-point-of-approach join for moving object histories[END_REF].

ICRAT 2018

Figure 1. The CPA obtained by two objects moving with different speeds Fig. 1 shows an example of CPA with two moving objects. V i , P o i are the speed vector and the initial position of aircraft i, while V j , P o j are linked to aircraft j. As they are flying with different speeds and directions, the distance between these two aircraft first decreases and then increases. For all the situations we can locate the time t cpa when the distance between them is minimum.

Two parameters T CP A and D CP A are introduced to represent the outputs. For two aircraft, T CP A is the time from the initial position to the closest point, i.e. T CP A = t cpa -t 0 , while D CP A indicates the obtainable minimum distance between two aircraft.

B. T CP A and D CP A

Let V ij and P ij be the relative velocity vector and the relative position vector of the two aircraft respectively. Then T CP A and D CP A can be expressed based on the following notations.

We consider that L 1 and L 2 represent the trajectories of two aircraft, P i (t) and P j (t) are the associated positions of the two aircraft at time t,

L1 : P i (t) = P o i + V i * (t -t 0 ) (1)
L2 : P j (t) = P o j + V j * (t -t 0 ) (2)
Since we only consider the process starting from the initial position, thus t 0 is assumed to be 0. Then, the distance between aircraft i and j at time t is given by:

d ij (t) = |P i (t) -P j (t)| = P o i -P o j + V i * t -V j * t = P o i -P o j + (V i -V j ) * t = |P ij + V ij * t| (3)
When the derivative of d ij (t) with respect to t is equal to 0, the minimum value of d ij (t) is reached. To eliminate the negative values,

D ij (t) = d ij (t) 2 is used instead of d ij (t). D ij (t) = d ij (t) 2 = P 2 ij + 2 * P ij * V ij * t + (V ij * t) 2 (4)
The CPA is achieved when the derivative of D ij (t) is 0. Therefore, we calculate the partial derivative of D ij (t) with respect to t.

∂D ij (t) ∂t = 2 * t * |V ij | 2 + 2 * P ij * V ij (5)
,

∂D ij (t) ∂t = 0 (6) 2 * t * |V ij | 2 + 2 * P ij * V ij = 0 (7)
T CP A = - P ij * V ij |V i -V j | 2 (8)
.

We can then determine D CP A :

D CP A = d ij (T CP A ) = |T CP A * V ij + P ij | (9)
D CP A = - P ij * V ij |V ij | 2 * V ij + P ij (10)
These equations of T CP A and D CP A give potential relations among aircraft speeds and positions. In order to detect the effects of inputs on outputs, we present the following model considering all possible encounter situations. In the following work, we will only consider the norm of D CP A .

C. Modeling Formula

Motivated by the goal of developing a model which is beneficial to the sensitivity analysis, the cross point reference coordinate is introduced for this model. This model uses the crossing point of two aircraft trajectories as the center of the coordinate. Two aircraft are located inside an airspace which is shown as a circle, referred to Fig. 2. In this coordinate system, we have the flight direction of aircraft i towards the positive Y axis. We consider that aircraft j only locates in the third and fourth quadrant of our model to avoid the overlap of scenarios and reduce the calculation cost.

P o i = (0, -R) P o j = (r * sinλ, r * cosλ) P ij = P o j -P o i = (r * sinλ, r * cosλ + R) (11)
V i = (0, V i ) V j = (V j * sinδ, V j * cosδ) V ij = V j -V i = (V j * sinδ, V j * cosδ -V i ) (12)
Using the relation: λ = δ + π, this model has four variables instead of five. In order to reduce the computational cost, the range of δ is set from 0 to π. As for the speed of aircraft, V i and V j vary from 600 km/h to 1000 km/h. Using this model, the scenarios obtained under previous conditions have a large percentage of positive values in terms of T CP A .

Fig. 3 and Fig. 4 show the 3D graph of T CP A and D CP A respectively. The values of T CP A and D CP A are represented by colors. In our equations, the units for the outputs are hour and kilometer for T CP A and D CP A respectively, but when using hour, the scale for T CP A is too small, thus in Fig. 3 we convert it into minute to make the data much easier to show. Since they are 3D figures, only three situations are presented to avoid the overlap of information. Aircraft i has a speed of |V i | = 800 km/h and aircraft j has three different speeds:

|V j | = 700 km/h, |V j | = 800 km/h and |V j | = 900 km/h.
The aim of this paper is to analyze the sensitivity of the T CP A , D CP A when inputs (δ, V i , V j , and r) are consisted with uncertainties. In our work, we will make proper choice of sensitivity analysis method considering the parameters and the structure of our model. There are many approaches for sensitivity analysis. For the sake of adapting to our main function, two methods are proposed. One is known as local approach, using partial derivatives to estimate the sensitivity of one specific point. Another one is a variance-based method which is referred as global sensitivity analysis [START_REF] Iooss | A review on global sensitivity analysis methods[END_REF].

III. LOCAL APPROACH

A. Mathematical Description

This method is widely used to analyze effects of small perturbations of model inputs on model outputs. Local approach is based on partial derivatives [START_REF] Kucherenko | Derivative-Based Global Sensitivity Measures[END_REF]. We define the main function as Y = f (x 1 , x 2 , ..., x k ) which is a square-integral function. The variables are defined as X = (x 1 , x 2 , ..., x k ). The fundamental expression of this method is shown as below:

E i (x * ) = Y (x * 1 , ..., x * i-1 , x * i + ∆, x * i+1 , ..., x * k ) -Y (x * ) ∆ (13) Where x * = (x * 1 , x * 2 , ..., x * i , ..., x * k )
is the specific point where sensitivity analysis is considered. E i is the variation of Y with respect to one of its input x i . We can easily notice that ( 13) is an equation that shows the partial derivative of the objective function in terms of x i , so it can be defined as:

E i (x * ) = ∂Y (x * ) ∂x i ( 14
)
Since our model have considered numerous scenarios, it is difficult to analyze all of them at the same time. However, with the help of Matlab the calculation is achievable and the results can be displayed.

B. Results

With the pre-mentioned formula ( 8) and ( 10) in section II and the terms [START_REF] Campolongo | Enhancing the Morris method[C]. Sensitivity Analysis of Model Output[END_REF] and ( 12) which derived from the cross point coordinate system, the T CP A and D CP A can be represented by four parameters. We can define T CP A and D CP A as Y , i.e. the outputs of our main function, the variables X will be represented by the current parameters: r, δ, V i , V j .

We present four figures to show the evolutions of the two outputs under certain assumptions.

-The speed of aircraft i is fixed at 900 km/h. (Common speed during cruise phase) -The speeds chosen for aircraft j are 750 km/h and 850 km/h in order to limit the number of figures displayed simultaneously. -X axis shows the range of δ (heading of aircraft j), Y axis is r (distance between aircraft j and the cross point at the initial point), Z axis shows the exact value of the partial derivative on a given parameter. Each figure contains two graphs. The graph on the left side represents the situation that the speed of aircraft j is set to be 750 km/h, the other one represents the situation when the speed of aircraft j is 850 km/h. Fig. 5 and Fig. 6 show the partial derivatives between T CP A and its corresponding variables. Fig. 7 and Fig. 8 provide the same information of D CP A and its variables.

The figures provide us information to analyze the variation trend of T CP A and D CP A according to the partial derivative values derived from each graph. These four figures gather together many situations, among them, the absolute value of partial derivative determines the influence caused by the corresponding variable on the output. When derivative value is near 0, the influence caused by the corresponding variable is relative small. In Fig. 5, since it emphasizes r, so we consider the situation of a given δ, as r changes, the derivatives of T CP A with respect to r is nearly constant. The change of parameter r leads to different influence on T CP A according to δ, when δ is small, r has a relative big influence on T CP A . The same results can be concluded from the other graph in Fig. 5.

Fig. 6 presents the partial derivatives of T CP A with respect to δ. Considering the situation with a small r, such derivatives have a sudden decrease when δ is small, along with the increase of δ, the derivative values approach 0. The variation in graph indicates that δ has a big influential effects on T CP A when it is small, as δ increase, the influence decreases, however, the results are also related to the value of r, when r is large, the influence from δ to T CP A is not obvious, but as r decreases, the influences become more and more strong.

Partial derivatives of D CP A with respect to r and δ are given on Fig. 7 and Fig. 8. The way to analyze the variation trend of D CP A is similar, since those graphs are more complicate, a general conclusion can not be given, the derivative value for a certain scenario can measure the variation of output accurately.

We also notice that the range of derivative values of Fig. 6 is [-2, 0.5] and [-6, 0]. In Fig. 5, the ranges correspond to a ratio of 10 -3 , the scale difference also happens in Fig. 7 and Fig. 8. However, the units of δ and r are different, and we can not tell which inputs gives the most contribution to the output in this case. Through all the graph, the trend for T CP A and D CP A can be analyzed, but without the exact values, this approach can not integrate several inputs for comparison.

The partial derivatives with respect to the corresponding variables exhibits the situation at a given point but it cannot provide a complete and accurate conclusion while it can be done in global sensitivity analysis.

IV. GLOBAL SENSITIVITY ANALYSIS

Global sensitivity analysis is a general method to detect the influential effects from the whole situations [START_REF] Kucherenko | Derivative based global sensitivity measures and their link with global sensitivity indices[END_REF], so it is possible to get accurate relations between inputs and outputs. There are quite a lot of methods for global sensitivity analysis. These methods can be classified into two main categories: screen technique and variance decomposition. Here are the advantages and drawbacks of these methods.

-Screen technique is usually used in models which have large number of inputs. Due to the relations between inputs and outputs, this method categorizes inputs into several types according to the influence mode and it is usually used with other sensitivity analysis methods in order to deal with huge volume of data. The most typical method is Morris method. However, this kind of methods can not compare the influential values of each input [9][11]. -Variance-based method do not need to know a prior relations between inputs and outputs and it can provide values to compare the effects from inputs to the outputs. Besides, this method is used for non-monotonic and non linear function. Thus, this method can be chosen for this study.

A. Sensitivity Indices Description

Our main function, Y = f (x 1 , x 2 , ..., x k ), is a nonmonotonic and non-linear equation, where x denotes the variables and k is the number of variables we have. In our case, the variables are independent. Thus the decomposition of the output variance is validated for variance-based method. The functional decomposition scheme is given as [START_REF] Homma | Importance measures in global sensitivity analysis of nonlinear models[END_REF]:

f = f 0 + k i=1 f i + k i=1 k j>i f ij + ... + f 12...k (15)
The terms inside this equation are related to different variables,

f i = f i (x i ), f ij = f ij (x i , x j
) and so on. The unicity of ( 15) has already been verified [START_REF] Sobol | Sensitivity analysis for non linear mathematical model[END_REF]. The interpretations of the function are represented as below:

f 0 = E(Y ) f i = E x∼i (Y | x i ) -E(Y ) f ij = E x∼ij (Y | x i , x j ) -f i -f j -E(Y ) (16)
Where E(Y ) denotes the mean expectation of the whole function Y . E x∼i (Y | x i ) denotes the mean expectation of function Y over all the possible values while keeping x i fixed and similar meaning for the higher terms.

The decomposition of the variance can be written as follows:

V i =V xi (E x∼i (Y | x i )) V ij =V xixj (E x∼ij (Y | x i , x j )) -V xi (E x∼i (Y | x i )) -V xj (E x∼j (Y | x j ) (17)
Assuming we have k variables. The formula containing all the variance terms can be represented as:

V (Y ) = k i=1 V i + k i=1 k j>i V ij + ... + V 12...k (18)
If both side are divided by V (Y ), we obtain the so called "Sobol's indices":

k i=1 S i + k i=1 k j>i S ij + ... + S 12...k = 1 (19)
The first order indices represents the influence which is caused only by a certain variable, denoted by S i . The total indices of one variable represent the interaction effects of all the inputs, it is noted as S Ti . The way to compute S Ti is S i plus all the interaction terms which include variable x i . In this study, the results we extract are the first order indices and the total indices. For other terms, the computational complexity make it hard to decide the second or higher order indices of each input, therefore the results interpretation for these terms are also difficult. The associated sensitivity measurement are written as:

S i = (V xi (E x∼i (Y | X i ))) V (Y ) (20)
S Ti = (E x∼i (V xi (Y | X ∼i ))) V (Y ) (21)

B. Monte-Carlo Sampling

The variance-based method consists of two parts. The first part is the data sampling and the second part is the estimator detection.

Monte-Carlo data sampling is a method that provides a series of random data which are compatible with inputs to improve the estimation precision through numerous repetition of calculation.

Two independent sampling matrices A and B with N rows and K columns are generated. N depends on the estimation accuracy that we are targeting for the experiments. Each column corresponding to one input. Two indices i and j refer to the i-th column and j-th row respectively. The index i runs from 1 to N (the number of simulations) and j equals to the number of inputs that we have. Matrix A (i) B is defined through the way that all columns are from A excepts the i-th column which is from B. An example of matrices recombination is shown in Fig. 9. Through the combination of matrices A and B, in each experiment we can change one input for certain times while making other inputs fixed and this explain the principle of variance-based analysis in a way. These matrices will be used in the following calculation in which matrix A and B and matrix

A (i)
B are all used to calculate the corresponding variation or expectation of a certain input to the outputs.

1) Extraction of probability of failure: The variables we generate through Monte-Carlo method is uniformly distributed between 0 and 1. Such variable are then transformed to the ranges of the input data of our model. During the process of evaluating T CP A , negative values exist due to some inappropriate situations that have their CPA already passed. We consider it as a kind of probability of failure (P f ) which is caused by the model and Monte-Carlo method:

P f = Ī(X) = 1 N k=1 N I(x i ) = N f N (22)
Where Ī(X) is the expected value of all I(X), I(X) refers to an indicator function,which is defined as:

I(X) = 1 if Y (x) ≤ 0 0 otherwise (23)
In our case, the number of experiments is 10 5 . According to the reference, the probability of failure experiments extracted from the Monte-Carlo simulation is around 4% to 5%. Such percentage of failure is small, we can consider that our computation process is still effective.

2) Estimator: The estimators of "Sobol's indices" are based on the sensitivity indices. The expression of estimators have already been validated by lots of experts.

With the matrix established, V xi (E x∼i (Y | x i ) contributes to calculate the first order effect for S i and E x∼i (V xi (Y | x ∼i )) contributes to S T i [START_REF] Saltelli | Variance based sensitivity analysis of model output. Design and estimator for the total sensitivity index[END_REF] e.g.:

V xi (E x∼i (Y | x i )) = 1 N N j=1 f (B) j (f (A (i) B ) j -f (A) j ) (24) E x∼i (V xi (Y | x i )) = 1 2N N j=1 (f (A) j -f (A (i) B ) j ) 2 (25)
Based on the data sampling, the generated data can be applied in the estimators to generate the matrices that are used in (24) and (25), thus the first order indices (S i ) and total indices (S T i ) can be computed.

C. Results

Here, we note that (19) indicates that the sum of indices equals to 1. Since we have four variables, thus we consider that for an input whose first order indices is bigger than 0.3 has a big influential effect on the output. The main functions of sensitivity analysis are T CP A = f (δ, r, V j , V i ) and

D CP A = f (δ, r, V j , V i ).
The property of Monte-Carlo method makes the generated data change every time, hence the results for each experiment have slightly differences. Through a probabilistic way, the results that we get can reflect the contribution from each input to the output. Tab. I displays the first order effects of each input to T CP A , while in Tab. II, total effects are represented. Regarding to the relative connections between variables and the indices, we can get the conclusion as follows:

For first order effects of T CP A , we have S 1 > S 3 > S 2 ≈ S 4 while the total effects have the order of S T 1 > S T 2 > S T 3 > S T 4 . Regarding the corresponding variables, the rank of inputs due to influential effects is δ > V j > r ≈ V i . Taking the first order indices and total effects into consideration, the relative contribution from inputs to outputs should be approximately determined.

In this case, δ obtains the highest influence in affecting the output itself and other inputs have absolutely small effect compare to δ. Referring to the method provided in [START_REF] Jacques | Sensitivity analysis in presence of model uncertainty and correlated inputs[END_REF], when the order of the total effects are different from the first-order indices, the inputs which have relative high difference on the indices will be compared. In our case, r (the distance between aircraft j to crossing point, more intuitively can be thought as the relative position of two aircraft) does not obtain a high value on the first order indices, however it has a strong effect on the output together with other inputs. So r is also a parameter which should be considered seriously. Thus, in reality and in the aspect of time, relative flight direction of two aircraft (δ) should be first considered in case of conflict and the relative position of the aircraft (r) can be taken as a reference to avoid the emergency situation.

Tab. III and Tab. IV indicate the potential sensitivity of variables and the closest distance between two aircraft. Both the first order indices and the total effects have the same order of r > δ > V i ≈ V j . r is the key parameter while relative flight direction of two aircraft (δ) is also important in affecting the closest distance of two aircraft.

The sensitivity analysis of T CP A and D CP A demonstrates that during the convergence of two aircraft, the key parameters are relative flight direction of two aircraft and the distance between aircraft j to cross point. The speeds of two aircraft have a relative small effect. The proposed methodology will help the investigation of aircraft movement and encounter status and it is beneficial to facilitate the emergency strategies and ensure the safety for air traffic management and also can be used in the route design process.

V. CONCLUSION

The main objective of this paper is to use appropriate method to support sensitivity analysis of CPA. All the work that have been done in this paper relies on the mathematical computation formula of T CP A and D CP A . The proposed model is compatible to the sensitivity analysis and satisfy the condition of including all possible scenarios.

The sensitivity analysis method presented in this paper can either detect the sensitivity of one specific point or from a general perspective. The key point of using local approach is the existence of partial derivative from the main function with respect to the corresponding variables. Variance-base method is using Monte-Carlo method to generate uniformly distributed data for the matrices, the calculated results for each experiment turn out to be really close to each other.

In this paper the speeds of aircraft, the distance from cross point to the position of aircraft j and the heading of aircraft have been introduced to describe the scenarios. With all these hypotheses, a scenario with two converging aircraft can be found in the model. Local approach enable to analyze the variation of outputs for a specific situation, while variancebased method explains the influential effects from inputs to the outputs as a whole.

The sensitivity analysis is useful for quantifying the performance of resolution methodologies. The future step is to ICRAT 2018 establish the same relations for a 3 dimension model as well as considering the uncertainty of wind or other weather conditions.

Figure 2 .

 2 Figure 2. Crossing Point Reference Frame

Figure 3 .

 3 Figure 3. 3D graph of T CP A (min) with different speeds, using color to represent the values of T CP A .

Figure 4 .

 4 Figure 4. 3D graph of D CP A (km) with different speeds, using color to represent the values of closest distance of two aircraft.

Figure 5 .

 5 Figure 5. Partial derivative of T CP A with respect to r with different speeds (speeds of aircraft j are 750 km/h for left graph and 850 km/h for the right graph). In the situation with fixed δ, but changing r, the derivative values have minor change. Along with the increase of δ, the influence due to r on T CP A become smaller.

Figure 6 .

 6 Figure 6. Partial derivative of T CP A with respect to δ with different speeds (speeds of aircraft j are 750 km/h for left graph and 850 km/h for the right graph). When r is small, along with the increase of δ, derivative values have a fluctuation and then become flat. The amplitude of fluctuation decreases with larger r.

Figure 7 .

 7 Figure 7. Partial derivative of D CP A with respect to r with different speeds (speeds of aircraft j are 750 km/h for left graph and 850 km/h for the right graph). When δ near 0 and π, the variation of derivative values are small, when δ is around some certain range, along with the decrease of r, the derivative values decrease from positive to negative then become almost flat.

Figure 8 .

 8 Figure 8. Partial derivative of D CP A with respect to δ with different speeds (speeds of aircraft j are 750 km/h for left graph and 850 km/h for the right graph). Given a fix r, along with the increase of δ, the derivative values have an obvious perturbation at beginning then it tend to be flat.

Figure 9 .

 9 Figure 9. Matrix Recombination with Monte-Carlo Method

ACKNOWLEDGEMENT

The author is gratefully acknowledge the support of Mr. Serge Roux for his assistance with technical improvements.


Béatrice Linot
email: beatrice.linot@loria.frbeatrice.linot@univ-lorraine.fr

Jérôme Dinet
email: jerome.dinet@univ-lorraine.fr

François Charoy
email: francois.charoy@loria.fr

Valerie L Shalin
email: valerie@knoesis.org

Kees Boersma

eds. Brian Tomaszewski

Information gain in sociotechnical systems

Keywords: Communication, information sharing, virtual information display. Information gain in sociotechnical systems

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

Communication is an important factor in socio-technical systems, particularly during emergencies related to natural disasters, terrorist attacks, or combat. Recognizing this, the crisis management literature focuses on improving the integrity of communication equipment, vulnerable for example to the loss of electricity or communication satellites. Though the integrity of communication equipment is surely necessary, this is but one factor in effective communication. Communication issues arise even in the presence of functioning communication equipment, generally attributed to the absence of information sharing. [START_REF] Quarantelli | Disaster Crisis Management[END_REF] is a prominent voice in this realization, pointing to the need for rapid and accurate communications in crisis management. Lagadec (2007), [START_REF] Dautun | Contribution à l'étude des crises de grande ampleur : connaissance et aide à la décision pour la Sécurité Civile[END_REF], [START_REF] Karsenty | Comment maintenir des relations de confiance et construire du sens face à une crise ?[END_REF] and [START_REF] Weick | Sensemaking in organizations[END_REF] enrich our understanding, pointing out problems specific to crisis management such as the unexpected nature of events with extensive consequence and the need for a several teams of response experts representing many different but interacting domains with their own concerns, organizations and cultures (e.g., health and utilities). The complaints regarding communication challenges are numerous, but the theory of effective communication is thin and vague, lacking in constructs to guide analysis and remedy. For example, [START_REF] Lee | Human factors and ergonomics in automation design[END_REF] consider the interaction with automation as a communication problem, but still rely on constructs founded on the properties of an individual, human information processing architecture. More recently, Projet GénéPi (Granularité des Niveaux de Pilotage en Gestion de Crise, 2015) identifies the importance of context in the interpretation of crisis data; data do not have persisting relevance, affected by the passage of time and human intervention. For example, a road may not stay flooded indefinitely, and debris eventually gets removed. Context is not an issue that emerges from a human information processing perspective; this is an issue that emerges from domain analysis including the influence of, and interaction between, multiple agents with different responsibilities. Our goal here is to reveal exactly what "context" means, to assure that context is preserved in any attempts to remediate communication issues with computational tools.

While the literature is full of conclusions, the actual data regarding information distribution issues during a crisis is quite sparse and therefore lacking in implementation implications. This paper provides specific examples to illustrate general claims regarding the nature of context. Our examples are drawn from the explosion that occurred on the Deepwater Horizon oil rig on April 20, 2010, in the Gulf of Mexico, well documented in widely available US government reports. Our concern here, however, is not the resulting crisis, however tragic. Rather, as a result of the crisis, extensive documentation of the preceding events provides an unusually detailed, publically accessible account of the communication work practice in complex distributed socio-technical systems. Daily work practice on Deepwater Horizon has most of the critical properties of crisis management noted above, including unexpected events, extensive consequence, the involvement of numerous disciplines with diverse responsibilities, and a key role for context in the interpretation of data.

Although we note limited scholarly analysis regarding either computational capability or human behavior in the available documentation of Deepwater Horizon, we do not attempt to re-assess responsibility nor take a position on sensitive policy matters. We do however take issue with the superficial claim that "there is no apparent reason why more sophisticated, automated alarms and algorithms cannot be built into the display system to alert [...] anomalies." Figure 1 betrays a profound mis-appreciation for the human role in such complex socio-technical systems and the challenge of data interpretation in a noisy, stochastic and generally successful work practice in which the base rate of nominal conditions vastly outnumbers the base rate of consequential, off-nominal conditions (see [START_REF] Moray | Monitoring, Complacency, Scepticism and Eutactic Behaviour[END_REF] regarding the cost-effective human response to automation). Revealing the true human role in the interpretation of data and the exchange of information, particularly concerning context sensitivity, provides a proper foundation for computational tools for information exchange.

Consistent with [START_REF] Hong | Some microfoundations of collective wisdom[END_REF], we claim that a primary responsibility of humans is to interpret data with knowledge, and distribute these interpretations to other participants whose subsequent or simultaneous activities depend on these interpretations. Humans do not function like sensors [START_REF] Sheth | Semantics empowered web 3.0: Managing enterprise, social, sensor, and cloud-based data and services for advanced applications[END_REF][START_REF] Hampton | Sentinels of breach: Lexical choice as a metric of urgency. Human Factors. Special Issue on Big Data/Winner of the 2016 Human Factors Prize[END_REF] but rather use knowledge and experience to place their observations in the context of work goals and responsibilities. Participants in a complex domain differ not only in work goals and responsibilities, but also knowledge and experience, and are therefore differentially sensitive to particular features of the world. Observers share information (rather than data) and so must our communication tools. However, in distributed and/or mediated work, participants do not share responsibilities, access to the same data or knowledge to interpret the data. As a result, we claim that shared information is tailored in detail [START_REF] Wilson | Relevance theory[END_REF] according to the anticipated needs of a trusting recipient. This paper aims to illustrate the process of transforming data into information by situating them in context, resulting in the suppression of reasoning details in the transmission of conclusions; the necessarily evolving work plan provides a key component of context; and previously suppressed domain-specific details take on importance in the interpretation of new data. We employ data from the President's commission, a separate report of recommendations, and C-Span video testimony to provide a qualitative analysis. In so doing, we expose the key challenge in the development of computational support for the distribution of information: to maintain and complement the fundamentally context-sensitive features of communication.

"In the future, the instrumentation and displays used for well monitoring must be improved. There is no apparent reason why more sophisticated, automated alarms and algorithms cannot be built into the display system to alert the driller and mudloggers when anomalies arise. These individuals sit for 12 hours at a time in front of these displays. In light of the potential consequences, it is no longer acceptable to rely on a system that requires the right person to be looking at the right data at the right time, and then to understand its significance in spite of simultaneous activities and other monitoring responsibilities."

THE DEEPWATER HORIZON ACCIDENT

On April 20, 2010, the Deepwater Horizon (a mobile drilling platform such as show in Figure 2) dug the deepest well ever offshore in the Gulf of Mexico. A resulting explosion caused a fire that killed 11 and injured 17. The event was subject to extensive investigation, including an independent U.S. White House commission of inquiry and the U.S. House Energy and Commerce Committee. Investigation identified some clear areas of concern regarding risk management and construction oversights. We employ the report from the President's commission (National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (2011a) While problem solving often proceeds by decomposing potentially separable elements into sub-problems, the approach is merely heuristic [START_REF] Simon | Proceedings from: The American Philosophical Society[END_REF]. Complex systems are only "nearly" decomposable, and potential dependencies eventually require evaluation. Snook & Connor (2005, p.196), notes NASA's failure to recognize the cross-disciplinary foam strike problem that doomed STS-107. "Whatever you divide, you have to put back together again." (Snook & Connor,p.199). In particular, we are concerned with the distribution of responsibilities across multiple contractors with different organizational cultures. This is characteristic of sociotechnical systems, including crisis management. We will see below that re-assembly depends on the communication of information between tasks rather than data.

Our analysis of communication problems in socio-technical systems [START_REF] Linot | Proceedings from: International Psychological Applications Conference and Trends. Trust in Computer-Supported crisis management communication: Toward a new model[END_REF] takes inspiration from several sources. [START_REF] Pickering | Toward a Mechanistic Psychology of Dialogue[END_REF] model of verbal exchange between two participants emphasizes a generic goal of communication, to establish aligned situation models. However, Pickering and Garrod omit several constructs that we believe are important in a model that serves the development of information technology. First, and emphasized here, we add a distinction between observable features in the world (data) and the resulting information. Information results from interpretive, knowledge based processes. Drawing from [START_REF] Mayer | An integrative model of organizational trust[END_REF], we consider propensity to trust, risk perception and evaluation, which we believe influences interpretive processes and information exchange. The recipients of information may lack the knowledge required for interpretation. Because detail is intentionally omitted in this exchange, trust is fundamental to the process. Recipients must trust in the source to provide comprehensible, relevant content, enhancing what [START_REF] Endsley | Toward a theory of situation awareness in dynamic systems[END_REF] calls "situation awareness". Complimenting Pickering & Garrod, we include a role for communication tools, which must preserve communication goals for alignment founded on trust.

IMPLICATIONS OF DEEPWATER HORIZON FOR THE DESIGN OF COMPUTATIONAL SUPPORT FOR COMMUNICATION

Recipients in the exchange of information trust their sources to tell them everything they need to know, and nothing more [START_REF] Grice | Logic and conversion: From the William James Lectures[END_REF][START_REF] Wilson | Relevance theory[END_REF]). Below we sample the Deepwater Horizon data to make three related points to guide an implementation of tools that respect this over-arching property of information exchange. First, information is contextualized data. We require computational support to distribute distilled information, not low-level data. An interpretive process necessarily suppresses otherwise overwhelming detail 1 Hereafter referred to as the National Commission (2011a) report.

2 Hereafter referred to as the Committee on the Analysis of causes report. hidden within the responsibilities of separable disciplines. Second, a key part of context is the work plan, which almost certainly changes in response to emergent circumstances. We require a computationally accessible, current plan to provide context to guide the routing of information to interested parties. Finally, suppressed detail can become newly important with respect to an evolving plan. We require a means to detect and elevate newly relevant, but formerly suppressed detail in the design of computational support for communication.

To select the examples we report here, we reviewed the cited investigation reports, and viewed the publicly available testimony. Our method does not follow anthropologically rigorous grounded theory, in the sense of elevating subtle issues that emerge from systematic analysis of an extensive corpus. Instead, our examples and analysis specifically respond to the quote in Figure 1, to challenge a misguided "alarm" model of information exchange in socio-technical systems. Our sampling method does not establish the base rate for the phenomena we identify in the domain we are studying or for domains in general. We assert, but cannot demonstrate, that the phenomena we note are representative of nominal operations. Skeptics should consider the coding exercise that a compelling quantitative demonstration entails, and its dependence on the scope and detail of the source account outside our control. However, more consistent with the anthropologist's challenge, we frame our interpretation of specific events with a potentially generalizable account to infer their implications for the design of computational support for communication.

Information is contextualized data

A key point of our analysis is that exchanged information, whether during a crisis or nominal operations, is not data, but an interpretation of the data that turns it into information. Figure 3 presents an excerpt from the testimony of Andrea Fleytas, a 23-year-old female responsible for navigating the mobile drilling rig. She was stationed on the vessel bridge, remote from drilling operations. Ms. Fleytas was responsible for monitoring and acknowledging alarms for the engines, ballast control and combustible fire, and was to inform senior officers of any issues.

Figure 3 illustrates the distinction between data and information. In this case, the data are the combustible gas alarms. But the information is what this means, that is "a well control situation". While Ms. Fleytas received the data from her control panel on the bridge, the information came from elsewhere. When she received a subsequent inquiry from the engine control room what she reported was not the data, but the information she had received, "we are in a well control situation". Unfortunately, a key piece of context was not exchangedthe location of the alarms, potentially due to alarm cacophony.

Although Ms. Fleytas recounts an exchange during the unfolding crisis, we propose that turning data into information is characteristic of all exchange. This is particularly challenging when artifacts are the source of data. Figure 4 illustrates this interpretive problem, for the ordinarily routine problem of determining well-flow. Figure 4 indicates some of the logic required to turn flow data into information: the assumptions, the dependence upon the specific well, and a preference for a particular data source.

E: […] their only words to you were "we are in a well control event" W: Yes, they said "we have a well control situation" and they hung up. E: And shortly thereafter you had a call from the engine control room asking you what was going on? W: That's right. I responded "we have a well control situation" […]. W: before the phone call I got a, we were getting the combustible gas alarms.

[…]. W: There were so many alarms, there were hundreds of them on that page. Figure 5 shows that different cultures may disagree on the merits of different data sources. This extended testimony further illustrates the complex logic of sensor interpretation, in particular, the purpose of the sensor. In addition to confirming the calibration issue raised in Figure 4, Figure 5 raises additional concern for the role of context in sensor interpretation. Calibration is an activity specific to all sensors; recipients of sensor data could reasonably be expected to ask about the recency of calibration. The concern here is that numerous external, common sense events can affect sensor readouts, including crane operations and fluid movements between pits.

Operators are responsible for manually logging common sense context, such as which pit is active. Without this information, sensor data are just that, and not information. Figure 5 also disposes of the idea that more alarms will solve the situation awareness problem; they merely add noise because their interpretation is context sensitive.

Although adjudicating between the Sperry/Transocean preferences may be relevant to the accident investigation, it is not relevant here. Different organizations may have different experiences and ownership in different, legitimate data sources. This is one basis of cultural differences between organizations. Most obviously, the observer must understand how the sensor works. Confidence in the resulting interpreted information comes from knowing how it was determined. Second, sensor values reflect a closed world assumption independent of other mitigating factors. However, sensors function in an open world, under the influence of many other factors that affect interpretation. Crucially, the world is not necessarily instrumented to take all of these influences into account in the automated processing of such data. Human observers are aware of these however, and adjust the sensor processing and interpretation accordingly. Therein lies the critical challenge of computationally supported information distribution. Trust is a function of the data source and the logic used to interpret it, but at least some interested parties likely lack the knowledge to conduct interpretation themselves. Moreover, recording the context such as pit activity in machine readable fashion is burdensome.

W: The flow out meter that Sperry Sun has, I believe it is an acoustic meter. […] E: You think even calibrated that the system that Sperry Sun was not as good as the system that Transocean had? W: That was the feedback I got from the guys on the rig. W: Uh, the flow out sensor that Sperry used was as I mentioned was the sonic sensor. It determines fluid levels, fluid height, the flow return line.

[…] I don't know the sonic, sorry, I don't know the Transocean model name that they used for their flow out sensor. I just know that it's type was of a paddle. E: And of the two, which one would you think is the most accurate method or sensor? W: I would say the sonic or radar sensor that detects the fluid levels has a greater ability for detecting minute flows, small flows whereas the paddle does not. Sperry moved to the sonic sensor, they used to employ the paddle sensor, some years ago. transferring fluid to the active system and you are at the same time taking a gain from the well, it's difficult to determine that gain because you don't know the exact rate of the transfer. The pump system that moves fluid from one pit to another is not monitored for flow.

[…] And it is up to the mudloggers to designate in the system which pits are active at the time. For the majority of time pits 9 and 10 were deemed active. But if the rig were to switch to say pit 6 then the mudloggers would go into his system and say 9 and 10 are no longer the active and go into the auxiliary book and designate pit 6 as the active. And that would be reflected in the actual pit volume change.

[…] E: And are there alarms on each one of those sensors in case there is a noticeable difference in volumes between the two? Well, the Sperry system has the capability of setting up an alarm for any data that is stored in its database. So, the mudloggers will typically set up an alarm for what is deemed to be critical information, to see if it would cross certain thresholds or to see if they are not receiving data within a certain time period. So, for instance, gas. If gas were to exceed a certain threshold, the computer would give a visual and an audio alarm. So, the mudloggers, if he hears this, say he is examining a sample, he hears an alarm go off, he can look at his computer and see what crossed what threshold. Typically, there is not an alarm on the flow in or the flow out, because they vary so often and they stop and start so often. You would have alarms going off every five minutes, every hour. Kees Boersma and Brian Tomaszewski, eds.

An (evolving) plan provides essential context

We have already made the claim that information is data placed in context. Here we make the point that the plan-the purpose of the coordinated work along with how it will be achieved, provides this context. Figure 6 presents the plan as represented and distributed in text.

First, we note that plan steps provide the language of communication. Figure 7 summarizes the exchanges surrounding step 1, the positive pressure test for casing integrity.

The information to be exchanged is not decontextualized flow-back volume and its change over time, but the status of completing a procedural step, and its implications for the success of the prior cement job. We see the same type of high-level language in communication regarding the success of step 4, in figure 8. At 10:43 a.m., Morel e-mail an "Ops Note" to the rest of the Macondo team listing the temporary abandonment procedures for the well. It was the first time the BP Well Site Leaders on the rig had seen the procedures they would use that day. BP first shared the procedures with the rig crew at the 11 a.m. pretour meeting that morning. The basic sequence was as follows: 1. Perform a positive-pressure test to test the integrity of the production casing; 2. Run the drill pipe into the well to 8,367 feet (3,300 feet below the mud line); 3. Displace 3,300 feet of mud in the well with seawater, lifting the mud above the BOP and into the riser; 4. Perform a negative-pressure test to assess the integrity of the well and bottom-hole cement job to ensure outside fluids (such as hydrocarbons) are not leaking into the well; 5. Displace the mud in the riser with seawater; 6. Set the surface cement plug at 8,367 feet; and 7. Set the lock down sleeve.

At 8:02 p.m., the crew opened the annular preventer and began displacing mud and spacer from the riser.

Halliburton cementer Chris Haire went to the drill shack to check on the status of the upcoming surface cement plug job. Revette and Anderson told him the negative-pressure test had been successful and that Haire should prepare to set the surface cement plug, (p. 109).

Senior Toolpusher Randy Ezell left the evening meeting with BP feeling pleased at their praise "on how good a job we had done…How proud they were of the rig. "He stopped in at the galley to get a beverage before continuing to his office. At 9:20, he called Anderson up on the rig floor and asked", "How did your negative test go?"65 Anderson: "it went good". We bled it off. We watched it for 30 minutes and we had no flow. We suggest that these are nominal exchanges between professionals with different specialties. Some detail behind the conclusion might be articulated, but certainly not all. In the nominal case, the abbreviated account is a necessity in distributed work, without which participants would be mired in endless speculation. The recipient needs to know whether the prerequisite step has been completed, and that is the focus of communication. Consistent with Gricean communication principles (1967) and [START_REF] Cooke | An ecological perspective on team cognition[END_REF] who show that more information is not necessarily better, participants trust other participants to provide important information. If observers omit detail, recipients are justified in assuming that the omitted detail is not relevant; the absence of report implies the absence of import.

A further challenge lies in plan changes (see Figures 9,10 and 11).

While accident analysis focuses on the absence of change management protocols, our point is that the plan always changes in response to prevailing circumstances. Because the plan provides important context for the interpretation of information, communicating plan changes becomes relevant, as does re-situating data previously conceptualized in terms of a now stale plan.

While initial well design decisions undergo a serious peer review process and changes to well design are subsequently subject to a management of change (MOC) process, changes to drilling procedures in the weeks and days before implementation are typically not subject to any such peer-review or MOC process. At Macondo, such decisions appear to have been made by the BP Macondo team in ad hoc fashion without any formal risk analysis or internal expert review. This appears to have been a key causal factor of the blowout. A few obvious examples, such as the last-minute confusion regarding whether to run six or 21 centralizers, have already been highlighted. The evidence to date does not unequivocally establish whether the failure to use 15 additional centralizers was a direct cause of the blowout. But the process by which BP arrived at the decision to use only six centralizers at Macondo illuminates the flaws in BP's management and design procedures, as well as poor communication between BP and Halliburton. For example, it does not appear that BP's team tried to determine before April 15 whether additional centralizers would be needed. Had BP examined the issue earlier, it might have been able to secure additional centralizers of the design it favored. Nor does it appear that BP based its decision on a full examination of all potential risks involved. Instead, the decision appears to have been driven by an aversion to one particular risk: that slip-on centralizers would hang up on other equipment. BP did not inform Halliburton of the number of centralizers it eventually used, let alone request new modeling to predict the impact of using only six centralizers.

Halliburton happened to find out that BP had run only six centralizers when one of its cement engineers overheard a discussion on the rig. Another clear example is provided by the temporary abandonment procedure used at Macondo. As discussed earlier, that procedure changed dramatically and repeatedly during the week leading up to the blowout. As of April 12, the plan was to set the cement plug in seawater less than 1,000 feet below the mud line after setting the lockdown sleeve. Two days later, Morel sent an e-mail in which the procedure was to set the cement plug in mud before displacing the riser with seawater. By April 20, the plan had morphed into the one set forth in the Ops Note": the crew would remove 3,300 feet of mud from below the mud line and set the cement plug after the riser had been displaced. The integrity of the cement job is crucial, indicated in Figure 12, and echoed in the report "Given the risk factors surrounding the primary cement job" (p. 119), including a change in cement materials (National Commission, 2011a).

Suppressed Details can Matter

The fatal error concerns the determination of a successful negative-pressure test, resulting from two different types of problems: 1) proximal errors concerning the logic surrounding the declaration and 2) distal errors concerning the absence of relevant context to guide the interpretation of negative test data.

Logic surrounding the negative pressure test

Figure 13 explains the general idea behind the test.

Figure 14 describes what actually happened. We see here what is by now the crucial communication feature. The information is in terms of the plan for abandonment, a successful negative pressure test. Spectacularly problematic logical details are suppressed. The above documentation in Figure 8 reveals that the conclusion and not the details get distributed through the work system.

According to outcome, the crew was clearly wrong in their conclusion. Additional documentation (see Figure 15) distributes the flawed proximal reasoning across both BP and Transocean personnel, (National Commission 2011b, p. 240). Figure 16 further documents a failure to seek additional input from on-site expertise.

BP's overall approach to the centralizer decision is perhaps best summed up in an e-mail from BP engineer Brett Cocales sent to Brian Morel on April 16. Cocales expressed disagreement with Morel's opinion that more centralizers were unnecessary because the hole was straight, but then concluded the e-mail by saying. But, who cares, it's done, end of story, [we] will probably be fine and we'll get a good cement job. I would rather have to squeeze [remediate the cement job] than get stuck above the WH [wellhead]. So Guide is right on the risk/reward equation. Instead of pumping pressure into the wellbore to see if fluids leak out, the crew removes pressure from inside the well to see if fluids, such as hydrocarbons, leak in, past or through the bottom hole cement job. In so doing, the crew simulates the effect of removing the mud in the wellbore and the riser (and the pressure exerted by that mud) during temporary abandonment. If the casing and primary cement have been designed and installed properly, they will prevent hydrocarbons from intruding even when that "overbalancing" pressure is removed. First, the crew sets up the well to simulate the expected hydrostatic pressure exerted by the column of fluids on the bottom of the well in its abandoned state. Second, the crew bleeds off any pent-up pressure that remains in the well, taking it down to 0 psi. Third, the crew and Well Site Leaders watch to make sure that nothing flows up from and out of the well and that no pressure builds back up inside of the well. If there is no flow or pressure buildup, that means that the casing and primary cement have sealed the well off from external fluid pressure and flow. A negative-pressure test is successful if there is no flow out of the well for a sustained period and if there is no pressure build-up inside the well when it is closed at the surface. Trust in personnel judgment is key to the proliferation of a flawed conclusion. A final concern is the availability of information to raise suspicion regarding the anomaly.

The crew opened the drill pipe at the rig to bleed off any pressure that had built up in the well during the muddisplacement process. The crew tried to bleed the pressure down to zero, but could not get it below 266 psi.

When the drill pipe was closed, the pressure jumped back up to 1,262 psi.

[…] BP Well Site Leader Vidrine then insisted on running a second negative-pressure test, this time monitoring pressure and flow on the kill line rather than the drill pipe. (The kill line is one of three pipes, each approximately 3 inches in diameter, that run from the rig to the BOP to allow the crew to circulate fluids into and out of the well at the sea floor.) The pressure on the kill line during the negative pressure test should have been identical to the pressure on the drill pipe, as both flow paths went to the same place (and both should have been filled with seawater). Vidrine apparently insisted the negative test be repeated on the kill line because BP had specified that the test would be performed on the kill line in a permit application it submitted earlier to MMS. For the second test, the crew opened the kill line and bled the pressure down to 0 psi. A small amount of fluid flowed, and then stopped. Rig personnel left the kill line open for 30 minutes but did not observe any flow from it. The test on the kill line thus satisfied the criteria for a successful negative pressure test-no flow or pressure buildup for a sustained period of time. But the pressure on the drill pipe remained at 1,400 psi throughout.

The Well Site Leaders and crew never appear to have reconciled the two different pressure readings.

[A] "bladder effect" may have been proposed as an explanation for the anomaly-but based on available information, the 1,400-psi reading on the drill pipe could [..] only have been caused by a leak into the well. Nevertheless, at 8 p.m., BP Well Site Leaders, in consultation with the crew, made a key error and mistakenly concluded the second negative test procedure had confirmed the well's integrity. They declared the test a success and moved on to the next step in temporary abandonment. ..] Transocean agrees that its crew is expert in monitoring for and identifying kicks, even in underbalanced situations. Hence the rig crew did not call the BP well site leaders for advice when they noticed anomalous pressure readings during the displacement of the riser but instead relied on their own expertise to determine whether there was a kick. Information about drilling at Macondo was compartmentalized both within and between companies. It does not appear that the well site leaders ever contacted BP onshore personnel to discuss their inability to bleed off drill pipe pressure during the negative pressure test. They did not seek a second opinion from Sims or O'Bryan, both of whom are engineers and were on the rig during the negative pressure test as part of the VIP visit. Instead, according to their own accounts, the well site leaders accepted an explanation from a Transocean tool pusher who had no more training on test procedures than they had (p. 228).

Absence of Contextual Information

We have already argued about the challenge of interpreting anomaly, for example in well flow rates due to the role of context. This is why alarms do not solve the information distribution problem. Figure 17 summarizes the distal context that should have influenced the interpretation of the anomalous negative pressure test data.

In this case, trust in the system to distribute relevant contextual information was badly misplaced, a likely reflection of organizational cultures at BP, and contributing to misalignment between subcontractors. Several procedural changes, many of which were either unknown or not salient, and some of which occurred well prior to drilling activity, constituted context that should have raised suspicion regarding the results of the negative flow test. These include: changes in the well equipment, reducing the number of centralizers employed (National Commission, 2011a, p. 116), changes in the composition of well cement (National Commission, 2011a, p. 117), the absence of a final cement test (National Commission, 2011a, p. 117), changes to the cements procedure (National Commission, 2011a, p. 120;National Commission, 2011b, p. 233), ambiguity regarding the adequacy of the float valves (National Commission, 2011a, p. 98) and changes to the procedure for conducting the negative flow test (National Commission, 2011a, p. 108).

CONCLUSION

The outcome of Deepwater Horizon is too easily dismissed by blaming less than admirable profit motives. Moreover, such a conclusion has little bearing on crisis response. While "poor communication" accurately labels the phenomena contributing to the Deepwater Horizon accident, the label does little to reveal the general principles one might employ to design computational tools that effectively support communication.

To this end we have made three related points in this paper: Data become information by situating them in context resulting in the suppression of reasoning details in the transmission of conclusions; the necessarily evolving work plan provides a key component of context; and previously suppressed domain-specific details take on importance in the interpretation of new data. Organizational culture likely influences both the interpretation processes and the scope of information detail to be exchanged between organizations. Any tool purported to support communication must consider these points as requirements in selecting formatting and organizing information. This is the focus of our future work (Linot, Charoy, Dinet & Shalin, in review).

The solution is surely not simply to provide more information [START_REF] Cooke | An ecological perspective on team cognition[END_REF]. Misses occur in noisy, complex sociotechnical systems that although stochastic, rarely fail. Misses occur in the presence of potentially millions of The pressure data were not ambiguous. Rather, they showed repeatedly that formation fluids, in this case hydrocarbons, were flowing into the well. The failure to properly conduct and interpret the negativepressure test was a major contributing factor to the blowout. Given the risk factors surrounding the primary cement job and other prior unusual events (such as difficulty converting the float valves), the BP Well Site Leaders and, to the extent they were aware of the issues, the Transocean crew should have been particularly sensitive to anomalous pressure readings and ready to accept that the primary cement job could have failed. It appears instead they started from the assumption that the well could not be flowing, and kept running tests and coming up with various explanations until they had convinced themselves their assumption was correct. Finally, due to poor communication, it does not appear that the men performing and interpreting the test had a full appreciation of the context in which they were performing it. Such an appreciation might have increased their willingness to believe the well was flowing (p. 119).

Information appears to have been excessively compartmentalized at Macondo as a result of poor communication.

BP did not share important information with its contractors, or sometimes internally even with members of its own team. Contractors did not share important information with BP or each other. As a result, individuals often found themselves making critical decisions without a full appreciation for the context in which they were being made (or even without recognition that the decisions were critical). For example, many BP and Halliburton employees were aware of the difficulty of the primary cement job. But those issues were for the most part not communicated to the rig crew that conducted the negative-pressure test and monitored the well. It appears that BP did not even communicate many of those issues to its own personnel on the rig-in particular to Bob Kaluza, who was on his first hitch as a Well Site Leader on the Deepwater Horizon (p. 123). mundane, correct decisions and responses. Changing decision criteria for the communication of information for possible future relevance must consider the resulting information overload in a system largely composed of correct behavior. Information overload is particularly critical when resources, especially response time, are limited. This is as relevant to crisis management as Deepwater Horizon, perhaps moreso.

Building shared awareness across the participants in distributed work, founded on information rather than data appears key. Lack of awareness concerning task dependencies and differences in organizational culture surely contribute to inconsistency in information sharing. However, in this case, pressure on subcontractor performance hardly encouraged the cross-sharing of doubt regarding the satisfactory completion of responsibilities. We can hope this property of Deepwater is not characteristic of crisis response.

The Deepwater data and our analysis are far from ideal in at least three respects. First, although they result from a real incident, they are post hoc accounts. Except for written records such as e-mail we cannot be certain that the language of recollection is the language actually used. Moreover, they result from investigative inquiry and though generally under oath, the data are not spontaneous. Finally, Deepwater is just a placeholder for a true crisis management event. The problem is not the absence of procedure and method in crisis response (FEMA, 2009). The problem is that the purpose of the system is different, to save lives and provide assistance to those in need. We cannot be sure that this context does not influence the nature of exchange, for example, by creating increased urgency by assembling teams even less familiar with each other than the teams in Deepwater or by magnifying the need for distributing an ever-evolving plan. The spatial modeling and reasoning in crisis management is more complex, as both the event and response likely involve the displacement of goods and services. Pre-existing instrumentation (fixed sensors) are less likely, as crisis generally occurs in unexpected, otherwise ordinary environments. In this view, relative to the complexity, diversity and necessarily ad-hoc response to crisis management, the communication lesson of Deepwater and the implications for the design of computational support is likely a best-case scenario.

Figure 1 .

 1 Figure 1. Commission impression of human fallibility in sociotechnical systems (National Commission, 2011a, p.121).

Figure 2 .

 2 Figure 2. Mobile oil drilling rig positioned on a drilling site.

Figure 3 .

 3 Figure 3. Andrea Fleytas Testimony (22:24) US Coast Guard & Bureau of Ocean Energy Management. October 5, 2010.

Figure 4 .

 4 Figure 4. John Guide Testimony (1:01:42) US Coast Guard & Bureau of Ocean Energy Management, October 7, 2010.

  E: […] Mr. Guide he indicated that […] he felt that the crew relied more on the Transocean paddle type sensor. W:[…] It was their sensor. I expect they would trust their sensor. […] W: But the flow out was never intended to be an actual measure of volume. If you want to see the volume, the actual amount of a gain or loss, you would always use the pit volumes. You would never use the flow out over a given time. […] If you have a good calibration then you can expect over a period of time for it to be relatively accurate. But that calibration is in need of constant tweaking. That's because the flow-out sensor is influenced by so many activities. Just rig movement will affect your flow out reading, whether it is rig movement due to crane operations or ballasting, or sea movement. […] they would calibrate them according to whatever rig activities were going on at the time. So, if they were drilling say during crane operations and the crane operations were throwing their flow out sensor off, they might try to recalibrate then. E: […] Earlier when I asked you about flow in and flow out you said you would actually have to look at the pit volumes. How do you do that when you simultaneously have multiple activities going on in the rig? When you are moving fluid from multiple pits to another pit? W: It's difficult. Um if they are transferring fluid to what is determined to be the active pits at the time, or removing fluid from the active pits, then it becomes difficult to determine what influences on that active pit are due to that fluid transfer and what influences are due to drilling conditions. So, if you are say

Figure 5 .

 5 Figure 5. John Gisclair Testimony (5:08) US Coast Guard & Bureau of Ocean Energy Management, October 7, 2010.

Figure 6 .Figure 7 .

 67 Figure 6. The final plan for temporary well abandonment. Step four was not properly conducted (National Commission, 2011a, p. 104).

Figure 9 .

 9 Figure 9. Documentation of frequent changes in the plan (National Commission, 2011a, p. 122).

Figure 10 .

 10 Figure 10. Plan changes associated with the number of centralizers (National Commission, 2011a, p. 115-116).

Figure 11 .

 11 Figure 11. Additional plan changes in temporary abandonment procedure (National Commission, 2011a, p. 123).

Figure 12 .

 12 Figure 12. Additional plan changes to cement job (National Commission, 2011a, p. 116).

Figure 13 .

 13 Figure 13. Logic of the negative pressure test (National Commission, 2011a, p. 105).

Figure 14 .

 14 Figure 14. The negative pressure test was declared successful for the kill line instead of the drill line, (National Commission 2011a, p. 107/108).

Figure 15 .

 15 Figure 15. Distributed responsibility for flawed reasoning proximal to event (National Commission, 2011b, p. 240).

Figure 16 .

 16 Figure 16. Additional experts were not consulted (National commission 2011b).

Figure 17 .

 17 Figure 17. Distal contributions to the accident (National Commission 2011a).

The flow out meter that Transocean has is a paddle.

  They are both relative readings that are calibrated by, you know, seeing how much pump and how much goes into the pit. It has to be calibrated. The top line number on there, your flow in, is a calculated number. It is not measured. It is calculated from pump strokes assuming a pump stroke efficiency.

	[…]
	W: In Deepwater wells the

main thing you look for is flow back signature. It's called fingerprinting.

  So, you see, when you make a connection, since you are using compressible fluid, you see how long it takes the flow to dissipate and does it flow down and level off. And then you time this. And depending upon the well you are on you know it could be 2 ½ minutes, it could be ten minutes. Every trip I went out there, and there were many, and I was talking to any of the folks on the rig, they

were always watching the Transocean flow out meter.

Two accounts of the status of negative pressure test (step 4) in preparation for surface plug setting (step 6). As described later in the report a spacer is a liquid that separates drilling mud used during the drilling operations from the seawater that is pumped in to displace the mud once drilling is complete, that is a reference to step 5 (National Commission, 2011a).

	"
	Ezell: "What about your displacement? How's it going?" Anderson: "It's going fine […] It won't be much
	longer and we ought to have our spacer back." [...], (p. 7).

Figure 8. CoRe Paper -Universal Design of ICT in Emergency Management Proceedings of the 15th ISCRAM Conference -Rochester, NY, USA May 2018 Kees Boersma and Brian Tomaszewski, eds.

ACKNOWLEDGMENTS

Valerie Shalin's participation in this project is supported by NSF Grant 1520870, Srinivasan Parthasarathy Principal Investigator.