Keywords

1 Introduction

The Trajectory Recovery Systems (TRS) is a joint cognitive system [17] proposed as a mitigation tool to reduce In-Flight Loss of Control (ILOC) accidents by facilitating appropriate human-computer interaction. As there is no single intervention strategy to prevent ILOC, TRS may fit into NASA’s framework for a Future Integrated Systems Concept to prevent ILOC accidents [5]—specifically providing flight safety assurance and resilience as a part of Flight Safety Management & Resilient Control and Crew Interface Management. This paper addresses ILOC due to stall conditions, how the notion of JCS relates to the TRS concept, state of art technologies, TRS system features, and efforts that resulted in a functional prototype of the TRS system.

2 In-Flight Loss of Control Involving a Stall (ILOC- S)

ILOC has been defined qualitatively by a characterization of observed flight behaviors [11, 28] such as: (a) flight outside of normal operating envelope; (b) ineffective or unpredictable response to pilot control inputs; (c) nonlinearities, to include kinematic/inertial coupling; divergent or oscillatory flight behavior; and (d) high sensitivity to small variable changes. The leading causal factors of ILOC accidents are human induced. Over 80 % of ILOC accidents happened close to the ground—thus demanding accurate and timely recovery. However, ILOC accidents frequently involve inappropriate crew response, and a stalled condition [10]. An examination of 126 ILOC accidents elicited seven generalized sequences of events [10]; crew response, inappropriate control inputs, and aerodynamic stalls were major contributors.

A stall occurs when an airfoil exceeds its critical angle of attack, resulting in a loss of lift. A stall will result in a rapid increase in drag, and rapid decrease in lift, which can propagate to a dangerous loss of control situation [1]. However, ILOC is not synonymous with a stall. There are various situations in which ILOC can occur; for instance, mechanical failure of an aircraft system. Yet an analysis of 126 ILOC accidents occurring over a 30 year period found that 42.8 % involved inappropriate crew response to an off-nominal event; moreover 77.8 % of accidents involved a vehicle upset (i.e. abnormal attitude, airspeed, stall), and specifically 38.9 % of the accident set analyzed involved a stall [4]. This work is concerned specifically with mitigation as it relates to ILOC that involves a stall.

3 ILOC-S Cognitive Functions and Aircraft Control Displays

3.1 Cognitive Cues for ILOC-S

The crash of Air France 447 was an ILOC accident. All three pilot static systems became inoperative and unreliable due to an accumulation of ice crystals. This off-nominal event disrupted the collaborative information processing between pilot and technological agents of the aircraft—the aircraft automated system entered a state of reversion; excess angle of attack protection was lost. The pilot flying inexplicably introduced inappropriate nose back on the side stick controller, causing the aircraft to enter a stalled condition. The accident report [3] explicates the failure of the pilots to understand the situation leading to “the de- structuring of crew cooperation [that] fed on each other until the total loss of cognitive control of the situation” (p. 199).

A system such as the one discussed here is composed of a tightly coupled complex relationship between task, operator, and artifact [7–9]. Seeking to parse the impact one element has on the system is nearly impossible due to the impact each element has on the other. With the loss of all airspeed indications, the pilots (operator) had to develop new task to control the aircraft (artifact). Clearly the requisite information processing in this is context is what Rasmussen envisioned as knowledge level [24]. However, pilots most often work at a skill level— and generally aircraft displays are built around nominal processes [5]. The report finds the crew response lacking because of a failure to respond with the right action arising from the complexity of the situation. In keeping with Rasmussen’s constructs, the crew was suddenly thrust into a context that required the highest information processing level, yet the report suggests a failure to transition to this level. Instead inappropriate controls meant for nominal events were applied.

The final report of AF 447 suggests that if cognitive control were maintained or regained, appropriate crew response would follow, and thereby a return of the aircraft to controlled flight would subsequently follow [3]. This is not a matter of simply appropriate task fulfillment by an individual pilot, but appropriate cognitive functions being fulfilled to produce context appropriate activity. Boy [8] contends that Cognitive Functions (CF) transform a generic task into an appropriate activity; as a function resources brought to bear, roles of multiple agents (human and artificial) in a system, and that which is environmentally persistent (context). Inherent in transformation are mental models, which give rise to an abstract construction of the state, structures, processes of the system and its environment. Accordingly, cognitive processes that occur at Rasmussen’s skill level are based upon training and mental models [23]. Yet situations such as that which faced the AF 447 pilots required an adaptive response due to erroneous aerodynamic performance information that had arisen from the blocked pitot tubes. In other words, the situation demanded an adaptive response— first and foremost, an update to the mental model. This knowledge response presupposes cognition that is resilient and goal orientated.

Given a task, certain information requirements exist [19, 27] based upon the hierarchical level of human involvement in the task. A framework has been proposed as a convention of cueing representations for appropriate information processing levels (Table 1) [24]. Therefore, the information requirements are not only related to the task at hand, but the required level of cognition for a given context. For AF 447, in order for the requisite identification and subsequent action to occur, appropriate symbols must have been made available. Thus, for knowledge-based behavior to occur, signs or signals were less than adequate, as those correspond to rules and skill respectively; a symbol is required for adaptive behavior. Remarkably, the final accident document reports that no symbols for adaptive action were available [3]; a less than adequate cognitive function existed to transform the recovering task into an effective activity.

Table 1. Examples for appropriate information processing. adapted from Rasmussen [24]
Full size table

The Bureau d’Enquêtes et d’Analyses made the following recommendation in the wake of the AF 447 accident [3]:

The crew never formally identified the stall situation. Information on angle of attack is not directly accessible to pilots [emphasis mine]…It is essential in order to ensure flight safety to reduce the angle of attack when a stall is imminent. Only a direct readout of the angle of attack could enable crews to…take the actions that may be required. Consequently, the BEA recommends: that EASA and the FAA evaluate the relevance of requiring the presence of an angle of attack indicator directly accessible to pilots on aeroplanes (p. 205).

Appropriate action, as stated in the accident report, was a reduction of the angle of attack, yet the final report suggests that outside of signals indicating a stall, no provision for such adaptation was available. Such adaptation required technological as well as temporal resources time that the crew did not have.

3.2 Aerodynamic Control for ILOC Recovery

Early in initial training, pilots experience and learn how to recover from stalls. Stalls may feel different from aircraft to aircraft, yet the aerodynamics and recovery procedures and similar. Recovery from a stall involves, at the highest level of abstraction, a reduction of the angle of attack. This is instantiated by advancing the throttles, and applying the appropriate amount of forward control yoke input to effect a downward elevator control deflection—the result is a reduction of angle of attack [16].

Control responsiveness is a function of dynamic pressure and flow adhesion on the suction surface of the wing (or elevator). During a stall, both elements are in jeopardy— dynamic pressure as airspeed decreases, and airflow over the wing as it becomes prone to flow separation at high angles of attack. A loss in an aircraft’s responsiveness to control stick movement occurs—the controls become “sluggish.” Dynamic pressure and flow separation change in strength during a stall; it is important to begin the recovering maneuver expeditiously and accurately to avoid losing too much altitude. Additionally, during high angles of attack greater thrust is required [2].

3.3 Synthesis of Control Paradigms: Cognitive Functions for ILOC Recovery

Given that there exists an objective aerodynamic reality and constraints that imposes environmental constraints on the aircraft, automation, and crew; and there also exist requisite cognitive control—the use of CFs provide offer a means to balance the two demands [8]. The state of the world as it is must be available to the pilot; yet it must be provided in a form to facilitate its use [19, 20]. Vicente offers a similar sentiment in proposing that the appropriate display paradigm required for control of a system that has external constraints for goal directed behavior is a correspondence rather coherence model [26]. Norman describes HCI design display challenges by identifying the gap between an operator’s intention and required action, and the effect of that input and the operator’s perception as the gulf of execution and the gulf of evaluation respectively [22]. Thus ILOC recovery requires a display that closes the gap between execution and control, and the state of the word and evaluation.

Practically, a pilot’s desire and intent may not be directly related to an appropriate action to attain the desired aircraft state—for example, a pilot’s intent to stop the approach of the ground by pulling the control yoke of a stalled aircraft. The intention is to immediately make the aircraft go up; yet in a stalled condition, this intention is aerodynamically impossible! Angle of attack (AOA) must first be reduced for generation of lift to fly away from the ground. Thus, there exist two requisite CFs for ILOC recovery, control inputs that: a) return the aircraft to the intended flight path; and b) restore the aerodynamic functioning of the wings.

Remarkably, little is offered in most cockpits to explicitly support these CFs [3]. This may be because traditional models of situation awareness (SA) that inform display design may be insufficient to support appropriate analysis of CFs. Implicit here, is that design must include cognition of CFs (macro-cognition) and their potential conflicts to overall system behavior. System State Awareness has been proposed to transcend the archetype linear SA construct [14]; this concept may better supports pilot-aircraft coupling.

Important here is that effective pilot-aircraft coupling is accomplished between efferent and afferent channels mediated by aircraft control systems and displays organized around a pilot’s accurate mental model. Nominal aircraft control task are built upon the supposition that this coupling exists. Therefore, restoring an aircraft to control entails restoring or modifying the relationship between pilot and aircraft.

To manipulate AOA, complex relationships composed of aircraft configuration, thrust, speed, flight path, altitude, and load factors must be mentally modeled by the pilot. Here, AOA is not an abstract topic, but a parameter that is directly influenced by, and influences these other parameters. Therefore, recovery from a novel stall may catapult a pilot into a problem-solving task—Rasmussen’s knowledge level. Yet in time critical situations, inciting a stimulus-response pilot behavior may be most appropriate. It is in this sense that adaption of pilot-aircraft coupling must occur, as restoring the pilot to attain an appropriate mental model may not be practical as they be constrained by time available for recovery.

4 State of the Art for ILOC-S

Industry has developed, and installed, various instrumentation and systems that aim to mitigate the risk of an aircraft entering a stall; Fig. 1 depicts one such display. Experimental displays have been designed and developed to incorporate physical flight parameter representations as well as higher order flight function representations; one such display offers the pilot directly perceivable insight into their aircraft’s aerodynamic performance [25].

Fig. 1.
figure 1

The display on the B737-800’s primary flight display

Full size image

4.1 Pitch Limit Indicator, PLI

The pitch limit indicator, labeled “A” in 1, shows the limit in terms of pitch angle, that the aircraft can increase before stalling. The PLI is automatically engaged by the system when the aircraft is at higher than normal angles of attack [21]. This PLI provides a higher level of situational awareness, and aids the observer up to an angle of 30 degrees.

4.2 Boeing Angle of Attack Indicator

The angle of attack indicator, labeled “C”, is a pure indicator, giving a dial reading and a numerical value of angle of attack. The dial on the round gauge rescales depending on the change in angle of attack [21]. It becomes clear that both instruments have a preventive nature, and if the airplane exceeds a critical angle of attack, there technically is no optimized tool to safely guide a pilot away from LOC-S back into controlled flight.

4.3 Airbus Flight Laws

The Airbus Flight Laws [10] are designed on three levels to monitor the situation, and activate when necessary. The three levels are normal, alternate, and direct. These are a group of flight laws that are designed to automatically adjust for unusual situations. For example, in the event of a stall, the first law is designed to automatically pitch the nose down and increase airspeed.

4.4 LOC-S and Need for New Innovation

Although the various state of the art systems described above are indeed operational and useful to pilots, LOC-S is still a threat to aviation safety [4, 6]. Often aviation safety enhancement is not a direct need, but a need that should be taken into consideration in order to predict future accidents. In order to do this, there is a need to redefine a new set of requirements for a “system” that will be able to exist during LOC-S, where conventional flight laws are definitely different.

5 TRS Design Process and Features

5.1 TRS Functions

The Trajectory Recovery System (TRS) guides a pilot to reduce AOA and avoid terrain by following a salient bull’s-eye; it also informs necessary thrust settings for recovery (Fig. 2). TRS is context dependent; an aerodynamic algorithm drives the appearance, movements, and removal of TRS representations.

Fig. 2.
figure 2

TRS not displayed (A); TRS displayed directing pitch and power (B); TRS pitch and power targets attained (C)

Full size image

5.2 Human Centered Design

TRS has been proposed as a Human Design Centered (HCD) solution as part of an overall integrated effort towards ILOC mitigation [5]. HCD attempts to analyze, design, and evaluate life critical systems for optimum safety, efficiency, and comfort [9].

Insights into ILOC-S suggest that is not simply a human operator failure, but instead a joint cognitive system (JCS) [17] behavioral outcome that arises from complex interactions between technological artifacts, organizations elements, and human action. A JCS perspective embraces the totality of cognitive interactions that precede an ILOC accident—(CF) are no longer isolated to the human. CFs are emergent system properties that are shared amongst elements of the entire socio-technical system [7, 8]. In addition to roles and resources of the JCS, cognition for ILOC recovery is embodied in context. Thus, the concomitant interplay of all elements affords the pilot information of “what is possible” and “what can be done” [22]. It follows that mitigation efforts to ILOC be supported by formative design efforts that account for these; namely HCD development process is discussed elsewhere.

5.3 Direct Perception for ILOC-S Recovery

TRS leverages environmental cues in order to provide a pilot with affordances for action [15, 18, 22]. It incorporates an ecological display that reduces the distance between interpretation of aircraft AOA and the required AOA for recovery. Additionally, the danger of cognitive tunneling is addressed through cognitive countermeasures [12, 13]; removal of non-recovery pertinent representations.

5.4 Context Awareness and Mediated Interaction

TRS is ubiquitous—always active, monitoring and facilitating appropriate cognitive control based on aerodynamic and environmental constraints and context. TRS captures live aerodynamic data, analyzes it and mediates appropriate human computer interactions. Interaction with automation can occur at various levels: supervision, mediation, and collaboration [9]. For example, the Traffic Collision Avoidance System (TCAS) in aircraft functions at all three levels. That is, at a non-alerting state, it simply identifies targets; at a partially alerted state it collaborates with the user to issue warnings; while at the fully alerted state, it commands the human agent to take actions; thus, this final state is one of supervision. These requirements presume logic— robust algorithms to facilitate assimilation of new data and appropriate action.

5.5 Target Design

TRS is depicted in Fig. 2. Information is eliminated and a target is displayed on the screen [12, 13]; “TRS MODE” is annunciated on the display. Magenta Bull’s-eyes Target appears and directs an optimized pitch for expeditious and accurate recovery when the aircraft’s critical angle of attack is exceeded. Upon reaching the target pitch, the magenta center will turn to green. An outer unfilled ring indicates the necessary to increase thrust; upon advancement of throttles the outer ring will progressively fill yellow, and then green when the appropriate power setting for recovery is set. Upon a safe trajectory TRS will then disengage and return the PFD to the nominal display.

5.6 Target Engagement and Disengagement

TRS is animated by an aerodynamic algorithm. It engages only when required for a recovering maneuver, then disengages when the event is resolved. TRS continuously calculates the stall speed and AOA of the aircraft. Therefore, exceeding critical angle of attack and slowing down to below stall speed are considered as the triggering elements for the trajectory recovery system, as shown in Eq. 1.

$$ \alpha_{indicated} > \alpha_{critical} = 15^\circ $$
(1)

Another criterion that engages the TRS is the airspeed dropping below the stall speed. The second criterion is shown in Eq. 2.

$$ V < V_{stall} $$
(2)

Providing two independent triggering points for TRS increases safety by assuring more aspects of the incipient stall are acknowledged by the system. Disengagement criteria are defined by the triggering airspeed, a safe angle of attack (8º), and a safe vertical speed (100 feet per minute) demonstrating a gain in altitude. Initial testing demonstrated that these values were excellent and provided a successful recovery.

6 Target Dynamics

The TRS target will present itself at the point where the aircraft would experience zero angle of attack. This angle will constantly move, as the pitch attitude will decrease with the angle of attack shown in Eq. 3.

$$ \theta_{TRS} = \theta - \alpha $$
(3)

The pitch attitude that the target displays on TRS, as shown in Eq. 3, calculates the flight path angle of the aircraft. In order for the target to start increasing in pitch, a triggering airspeed has been decided to act as a criterion. The value for V2, (1.2Vs) was determined to be appropriate, as shown in Eq. 4. If the triggering velocity as well as the flight path angle criteria are achieved, TRS target begins its ascent.

$$ V_{{trigger,re\text{cov} ery}} = 1.2V_{stall} $$
(4)

TRS also provides bank-leveling guidance. The algorithm for this situation instructs the pilot to level the wings, not to bank in the opposite direction. A simple mirror equation was used to obtain the shifting of the target horizontally as shown in Eq. 5.

$$ \phi_{TRS} = - \phi $$
(5)

6.1 Usability

To validate the design of TRS, an online survey was given to 35 professional pilots with an average of 9474 total flight hours. It was found that offering access to information does not necessarily mean that it will be used. For example, 8 out of the 32 (25 %) professional pilots indicated weakness or neutrality in their ability to use an AOA indicator. This finding suggests that attention must be paid to the use of information to be effective [19]. Specifically, does the information provided afford and signify the use [22]? When queried, 87.5 % survey participants supported the desirability of a display for command guidance from ILOC recovery. Such a device would provide access to and use of information necessary for recovery from an ILOC event.

6.2 Iterative Usability Validation

Although our algorithmic approach allows the aircraft to recover, the angle of attack is much slower to decrease compared to the pitch attitude of the aircraft, causing the aircraft to accelerate to very high values. A constant, or buffer, was therefore applied to the equation governing the location of the TRS target as demonstrated in Eq. 6.

$$ \theta_{TRS} = \gamma + 5^{{\underline{ \circ } }} $$
(6)

Different constants were used on different computers, due to the CPU available from each. An optimal value of 5 degrees was deemed appropriate by the expert pilot during testing of the TRS on the simulator. The second equation in need of manipulation was the trigger airspeed for recovery. Just like the TRS target pitch position, a buffer was put in place Eq. 7 to allow for a more rapid recovery, given the fact that the target will begin to increase in pitch as the airplane reaches its position.

$$ V_{{trigger,re\text{cov} ery}} = 1.2V_{stall} - 15knots $$
(7)

This buffer value of 15 knots was chosen after various other values were tested. The last thoroughly tested value is the rate of ascent, which was decided to be 7 degrees per second. This was determined to be an aggressive enough pull up to allow a small loss in altitude.

7 Conclusion

Analysis of ILOC cognitive and aerodynamic control suggests that one strategy for accident mitigation is to mediate human computer interaction for optimal aircraft performance. Conceptual development TRS has been developed with the intention to mitigate LOC-S. Specifically, TRS provides recovery guidance is provided for a return to controlled flight. Other use applications include training prompts and guidance for scaffolded learning.

The development of TRS is presently at an evaluation phase, as it has already functional as a prototyped and has been integrated into a 737 FTD. Evaluation and iterative design will be conducted as a part of the HCD design process. Future TRS functionality could support commanded optimal terrain avoidance while respecting aerodynamic constraints, and an enhanced commanded recovery maneuvers—for a banking and “slicing” to the horizon maneuver in order decrease load factor and expeditiously return to the horizon.