Erik Hollnagel

Ph.D., Professor, Professor Emeritus






























































Extended Control Model (ECOM)

The Extended Control Model (ECOM) acknowledges that the performance of the joint system can be described as involving different but simultaneous layers of control (or concurrent control loops). Some of these are of a closed-loop type or reactive, some are of an open-loop type or proactive, and some are mixed. Additionally, it is acknowledged that the overall level of control can vary, and this variability is an essential factor with regard to the efficiency and reliability of performance.

As far as the control layers go, there is no absolute reference to be found. Since the purpose is to provide a way to describe, analyse and model actual performance, the number of layers should be sufficient to serve the purpose, but not so large that the descriptions become unmanageable. At the present stage of development of ECOM, the following four layers suffice. The descriptions are illustrated with examples from car driving, but can be applied to control of any kind.

The reality of the control layers

Several models provide a description of human performance expressed in terms of layers or levels. This usually refers to the notion of different types o information processing, most famously in the skill-based, rule-based. knowledge-based framework. When layers or levels are defined from a model of internal mental functions, whether they are called information processes or cognitive processes, or base their semantics (meaning) on assumptions about the hidden functions of a system, philosophical disputes invariably arise.

As stated above, there is no absolute reference to be found form which the number of layers can be derived. But more importantly, the existence of the control layers is not based on any assumptions about process, mental or otherwise, inside a system. Quite to the contrary, the philosophical basis for the layers is that fact that performance always takes place in different time-frames, and therefore need to consider these.


The tracking control type describes the activities required to keep the vehicle inside a region of the time-space continuum. (More formally, tracking can be defined as “the response of an operator or control system intended to nullify the effects of some external disturbance.”) In the case of driving a car, these refer to the intended speed, the intended distance from the car in front (or more unusually, from the car behind), the lateral position on the road, etc. Tracking activities are very much a question of closed-loop control, and for the skilled user such activities are performed automatically, without paying much attention to them, and therefore with little effort. (Note that this closed-loop control only goes for the experienced user. For the novice these tasks are not a question of tracking but rather of regulating, cf. below.) While activities of the tracking type usually are performed in an automatic and unattended manner, they may become attended, hence more like regulating, if conditions change.

In the ECOM, the goals and criteria for the tracking control type are derived from the level of regulating. Most of the tracking activities are furthermore amenable to technology take-over and automation. In the case of driving a car the speed can be maintained by cruise control and in some cases separation distance may be maintained by adaptive cruise control. In the case of vessels and aeroplanes, both direction and speed are usually automated. The automation of tracking activities often gives rise to automation surprises. This is because the almost complete take-over of closed-loop control makes it very difficult for the user to follow what is going on, hence to maintain the situation comprehension that is needed at the other levels of activity.


Activities at the level of tracking require that actions and/or targets (as well as criteria) have been defined. The ECOM describes this is a result of activities at the level of regulating. The regulating control type thus directs tracking control type by providing input to it (new goals and criteria). Regulating is itself basically a closed-loop activity, although anticipatory control may also take place. Activities at the level of regulating are not always performed smoothly and automatically, but require that the person attend to what s/he is doing. The activities refer to specific plans and objectives that come from the level of monitoring. In driving, regulating involves manipulation of the vehicle, hence a number of tracking sub-loops.

In driving, regulating activities are concerned with the position of the car relative to other traffic elements, such as avoiding obstacles and changing position relative to other cars (e.g., overtaking), etc. In relating to other traffic, the regulating loop may supersede the tracking loop. It may, for instance, be more important to keep the position in the traffic flow than to maintain a given speed, hence braking (or acceleration) may overrule keeping a steady speed. This can also be expressed as a temporary suspension of one goal (keeping a constant speed) to the advantage of another (maintaining a safety distance to other cars). The incompatibility between goals can be resolved by changing plans, e.g., first to overtake the car in front and then to go back to maintaining a steady speed.


Whereas activities at the level of regulating may lead to either direct actions or goals for the tracking loop, activities at the level of monitoring are mainly concerned with setting objectives and activating plans for actions. This can involve monitoring the condition of the vehicle, although this has in most cases been taken over by instrumentation and automation. Modern cars usually have self-diagnosing systems that only inform the driver in case of serious limit transgressions or malfunctions, and measurements have therefore effectively been replaced by alarms. Other monitoring activities have to do with the location of the vehicle. Whereas position refers to the vehicle relative to other traffic elements, location refers to the vehicle relative to the features of the environment, specifically the intended destination. Except for empty roads, the user must always maintain the position of the vehicle relative to other traffic elements; yet if s/he does not also monitor the location of the vehicle, s/he may not get closer to the destination. (In both aviation and sailing, several accidents have resulted from failing to monitor the location of the aircraft or vessel.) Finally, monitoring also includes keeping track of traffic signs and signals, such as indications of direction (locations and distances), warnings (e.g. road conditions or curves), restrictions (e.g., one way traffic or speed limits), and status (traffic signals).

In other domains and processes a similar distinction between regulating (position) and monitoring (location) can be made, although the space may not be a physical (Euclidean) one. Other activities at the level of monitoring may have to do with infotainment and information sources. Although this is not monitoring of driving per se, it may affect the ability to drive, particularly if it is non-trivial. Monitoring does not directly influence positioning of the vehicle in the sense of closed-loop control and regulation, but is rather concerned with the state of the joint driver-car system relative to the driving environment.


The last control type is at the level of targeting or goal setting. An obvious kind of goal-setting is with regard to destination. That goal gives may rise to many subgoals and activities, some of which can be automated or supported by information systems. Other goals have to do with driving performance criteria. For instance, if a user apprehends that s/he will arrive late to the destination, it may lead to a revision of the criteria for the other loops, notably regulating and tracking. If time is short, the style of driving may be changed by increasing the speed, reducing the separation distance, and in general take greater risks. Another example is if the car includes a sensitive consignment, such as a frail person or a delicate piece of equipment. In this case both the driving style and the route may be changed, as avoiding shaking and bumping becomes more important than, e.g., speed or fuel consumption.

Goal-setting is distinctly an open-loop activity, in the sense that it is implemented by a non-trivial set of actions and often covers an extended period of time. Assessing the change relative to the goal is not based on simple feedback, but rather by a loose assessment of the situation – for instance, the estimated distance to the goal. When the assessment is done regularly it may be considered as being a part of monitoring and tracking (such as in the Test-Operate-Test-Exit loop introduced by Miller et al., 1960). When the assessment is done irregularly, the trigger is usually some unknown factor, perhaps time, perhaps a pre-defined cue or landmark (physical or symbolic), perhaps the user’s background “simulation” or estimation of the general progress (like suddenly feeling uneasy about where one is).

A Comprehensive Model of Extended Control

A joint cognitive system is characterised by its ability to maintain control under varying conditions and to counter the effects of disturbances. The ECOM describes the performance of the joint system by means of four interacting and simultaneous control loops. In terms of the model, the four loops ensure that key performance parameters are kept within desired ranges, and that the progress of the location of the vehicle relative to the overall goal is tracked.

Effective vehicle control means that the joint system must be involved in all the control types the same time. Ineffective vehicle control, with risks to and effects on the user’s conditions, happens when one or more control type is degraded. A proposal for describing the coupling or dependencies between the four control types or loops is shown in Figure 1. This emphasises how the loops are connected by the way in which the results (output) from a “higher” loop becomes the objectives (input) to a “lower” loop. The layout in Figure 1 is somewhat misleading, since the loops appear to be sequential rather than in parallel. This is a shortcoming of the representation on a two-dimensional static drawing surface, and not of the model.

Figure 1: The extended control model.

The functional characteristics of the different control types are summarised in the table below.






Type of control involved

Compensatory (feedback)

Anticipatory (feedforward + feedback)

Condition monitoring (feedback)

Goal setting (feedforward)

Demands to attention

None (pre-attentive)

High (unfamiliar actions; Low (familiar actions)

Low (intermittent)

High (concentrated)

Frequency of occurrence


Medium to high (context dependent)

Intermittent, but regular

Low (preparations, re-targeting)

Information needs


Present + future

Past + present

Past + (present) + future

The characteristics apply to any joint system that is in control of a process from a driver in a vehicle or a pilot in a cockpit, over a control room crew in a power plant or a fire-fighting team, to a management group in an organisation.

Interaction Between Control Types

The above description shows how the ECOM can be used to describe some of the interactions between the different control types. The assumption throughout is that the control types are simultaneous, or rather that goals and objectives corresponding to different levels of activity are being pursued simultaneously. One use of the ECOM is therefore to account for the non-trivial dependence between goals and activities at difference levels. A driver may, for instance, be interrupted at the level of tracking due to a disturbance, such as a pedestrian that suddenly crosses the street, without being interrupted at the levels of targeting or monitoring. A local evasion manoeuvre to avoid a collision need not lead to a loss of sense of position or localisation. Yet a loss of localisation, such as when one is driving in an unknown city, may have effects on the driving of the car at the level of regulating and tracking. In either case the loss may be abrupt or gradual. The reasons for the loss may be explained in different ways, depending on the theoretical stance taken. From a CSE perspective, the importance is the predictable effect of the between-loop interaction on the performance of the joint system, rather than the specific model of micro-cognition or information processing that is used to explain it.

Furthermore, the goals of each control loop can temporarily be suspended. The driver can thus suspend a higher-level goal to focus on a lower level one. The driver may, for instance, temporarily give up any attempt to get to a location and instead concentrate on driving and identifying where s/he is (meaning absolute rather than relative position, such as when driving in an unknown city). The driver may also suspend the regulating and tracking loops or goals e.g. by pulling up to the curb, or stopping the car.

The bottom line is that driving performance and the effect of support systems can only be understood in the context of the joint system. The importance of the environment can be seen in the relative importance of different goals. In urban traffic, for instance, the driver who is familiar with the streets will navigate from waypoint to waypoint in a closed-loop manner, paying attention mostly to the flow of traffic, although often in a highly automated manner without full awareness. His/her attention may instead be focused on listening to the radio, planning the activities of the day, or simply flicker around without any recognisable purpose. (In the COCOM, this corresponds to the tactical unattended control mode.) Driving can be smooth and efficient because little effort is required to monitor the position relative to the destination. For the inexperienced driver the situation is quite different. Monitoring the location becomes very important and more effort is assigned to it. The actual driving, though still a closed-loop activity, may therefore take place at a slower speed and with lower efficiency. For both types of drivers, open road driving is more consistent, since less effort is needed to control the position amongst other traffic elements, and more effort can be used to monitor the progress towards the destination.

The Effects Of Automation

Modern cars contain a significant amount of automation, and more is to come in the near future. The automation of concern here is that which affects the ability to control the car. According to the ECOM, the control types cover everything from monitoring the position of the car (and the performance and resources of the car), to keeping the car on the road, e.g. when surface friction is reduced. The automation of the car should be seen as it pertains to the various control types and the various kinds of goals.

  • Driving performance on the level of tracking is closed-loop, but there is a strong dependence between the regulating and the tracking control. The efficiency of regulating requires input (feedback) from the tracking activities. If these therefore are heavily automated, regulating is likely to suffer, even though tracking itself may be efficiently carried out by the automation. This is most conspicuous in the case of automation that may be activated without prior warning, such as a Dynamic Stability and Traction Control system. A DSTC system may be effective at keeping the car on the road if it is seen as an isolated function. But the sudden on-off nature of its functioning may also make the regulating of the car difficult because important information is filtered away and because the automation makes it hard for the driver to predict what the car will do next.
  • On the level of regulating, performance is a mixture of closed-loop and open-loop control, although mostly the former. The effective regulating of a car, such as avoiding collisions with other traffic elements, requires that the driver is able to predict what will happen – meaning the driver’s own car plus the other traffic elements. To the extent that such functions as night vision, collision warning and collision avoidance functions are introduced, the regulating tasks may become more difficult to accomplish.
  • On the level of monitoring, performance is mostly of the open-loop type. It therefore involves estimating the location and status of the car in the short-term and long-term future. Several systems already exist that can support these activities, such as Road and Traffic Information Systems. The proper use of such systems may lead to new task requirements, and may demand activities, e.g., on the level of regulating in addition to driving the car.
  • Finally, on the level of targeting, performance is of the open-loop type. There is at present little impact of automation on this level, in the sense of taking over – or even supporting – the human functions. There may, however, be many ways in which new technology can affect the targeting, ranging from information about changes to traffic or weather, to messages received from family or work relationships – or possible even road traffic controllers! Even if direct automation is still a remote possibility for activities on the level of targeting, the changes to the traffic environment brought on by information technology may be substantial even in the short term.

The above comments illustrate how it is possible to think about automation in the terms of the ECOM. The main point is that this model offers a framework by means of which an understanding of the effects of automation can be developed for the joint system as a whole. In the model this will be expressed as the changes (read: disturbances) to the balance between activities represented various control types.


Finally, a few comments on the relation between the ECOM and the COCOM are in place. At present, the COCOM can be seen as an elaboration of the basic cyclical model with emphasis on the different control modes, i.e., how control can be lost and regained, and how the control modes affect the quality of performance. The ECOM does not change this significantly. The degree of control can still be considered relative to the levels of the ECOM.

On the level of tracking the activities are performed in an automated and unattended manner. Even if a person runs away from a fire in a state of panic, the running itself is unaffected – or may even be improved! It therefore makes little sense to talk about a degrading of control, although the tracking loop clearly may be disrupted by external events. On the other three levels (regulating, monitoring, targeting) control can clearly be lost, leading to a degradation of performance. The loss of control is very much a question of losing goals, or of selecting inappropriate goals and criteria. Relative to the COCOM, the ECOM should not introduce any significant changes in the description of levels of control, and the performance cycle (selection-evaluation) remains as a unit of description. The ECOM does not imply that there are simultaneous cycles as such, but rather that the formulation of goals is described on several levels, i.e., a simultaneity or concurrence of goals and intentions. In terms of human performance it is only possible to do two things at the same time if one of them is on the level of tracking, i.e., if it is automated and unattended. The apparent ability to do several things at the same time is therefore due to the ability to switch or share between goals in an efficient manner. The ECOM thus describes the relation between multiple levels of goals, rather than between multiple levels of action as such.


Miller, G. A., Galanter, E. & Pribram, K. H. (1960). Plans and the structure of behavior. New York: Holt, Rinehart & Winston.