Mode control panel

Abstract: Mode management is the processes of understanding the character and consequences of autoflight modes, planning and selecting the engagement, disengagement and transitions between modes, and anticipating automatic mode transitions made by the autoflight system itself. The state of the art is represented by the latest designs produced by each of the major airframe manufacturers, the Boeing 747-400, the Boeing 777, the McDonnell Douglas MD-11, and the Airbus A320/A340 family of airplanes. In these airplanes autoflight modes are selected by manipulating switches on the control panel. The state of the autoflight system is displayed on the flight mode annunciators. The integrated mode management interface (IMMI) is a graphical interface to autoflight mode management systems for aircraft equipped with flight management computer systems (FMCS). The interface consists of a vertical mode manager and a lateral mode manager. Autoflight modes are depicted by icons on a graphical display. Mode selection is accomplished by touching (or mousing) the appropriate icon. The IMMI provides flight crews with an integrated interface to autoflight systems for aircraft equipped with flight management computer systems (FMCS). The current version is modeled on the Boeing glass-cockpit airplanes (747-400, 757/767). It runs on the SGI Indigo workstation. A working prototype of this graphics-based crew interface to the autoflight mode management tasks of glass cockpit airplanes has been installed in the Advanced Concepts Flight Simulator of the CSSRF of NASA Ames Research Center. This IMMI replaces the devices in FMCS equipped airplanes currently known as mode control panel (Boeing), flight guidance control panel (McDonnell Douglas), and flight control unit (Airbus). It also augments the functions of the flight mode annunciators. All glass cockpit airplanes are sufficiently similar that the IMMI could be tailored to the mode management system of any modern cockpit. The IMMI does not replace the functions of the FMCS control and display unit. The purpose of the INMI is to provide flight crews with a shared medium in which they can assess the state of the autoflight system, take control actions on it, reason about its behavior, and communicate with each other about its behavior. The design is intended to increase mode awareness and provide a better interface to autoflight mode management. This report describes the IMMI, the methods that were used in designing and developing it, and the theory underlying the design and development processes.

Abstract: In this paper, a new framework based on intent inference is proposed to detect the flight-deck human-automation mode confusion. Due to the rapid advancement of flight-deck technology, human-automation issues have become a core area of focus in today’s aviation safety. The complexity of the advanced flight deck leads to new safety concerns such as dysfunctional interaction between the human and the automation. To reduce the occurrence of incidents caused by the human-automation issues, it is necessary to detect the undesirable interaction between them in a timely manner. To this end, however, it is required to model the behavior of the human and the automation, as well as the interaction between them, which is a challenging task. In this paper, a hybrid system and a discrete event system are proposed to model the complex behaviors of the automation and the pilot, respectively. An intent inference algorithm is then proposed to infer the intents of the human and the automation using the behavior models and s...

Abstract: : Although formal methods for developing computer systems have been available for more than a decade, few have had significant impact in practice. A major barrier to their use is that developers find formal methods difficult to understand and apply. One exception is a formal method called SCR for specifying computer system requirements which, due to its easy-to-use tabular notation and demonstrated scalability, has achieved some success in industry. To demonstrate and evaluate the SCR method and tools, we recently used SCR to specify the requirements of a simplified mode control panel for the Boeing 737 autopilot. This paper presents the SCR requirements specification of the autopilot, outlines the process we used to create the SCR specification from a prose description, and discusses the problems and questions that arose in developing the specification. Formalizing and analyzing the requirements specification in SCR uncovered a number of problems with the original prose description, such as incorrect assumptions about the environment, incompleteness, and inconsistency. The paper also introduces a new tabular format we found useful in understanding and analyzing the required behavior of the autopilot. Finally, the paper compares the SCR approach to requirements with that of Butler [5], who uses the PVS language and prover [14] to represent and analyze the autopilot requirements.

Abstract: The experiments described had three main objectives: First, to validate the recommendations for an improved Man Machine Interface (MMI) design based on a Phase I experiment on the human factors of data link in glass cockpits. Second, to investigate the effect of directly loading data linked Air Traffic Control (ATC) instructions into the various avionic systems (gating) on crew performance and finally, to study the effectiveness of different alerting schemes to ATC uplinks.The experiment was performed by the National Aerospace Laboratory (NLR) using their moving base Research Flight Simulator (RFS) which was configured to represent realistic , gate to gate, flight operations. A total of 9 crews participated for 6 flights lasting appr. 50 minutes each. Flight scenarios were routed from Amsterdam airport to London airport and back. Each pair of flights was performed with a different level of gating and associated procedures. Alerting schemes were studied, varying the use of distinctive aural alerts and the use of different alerting schemes depending on "message criticality". Results showed a dramatic increase in the crew acceptance levels of data link, as compared to the Phase I experiments, validating the recommendations based on these studies. Succesful factors were: putting more emphasis on operational relevant page layout and the use of more practical procedures. Further results showed a preference for auto loading the Flight Management System (FMS) type of information as compared to an auto loading capability including Mode Control Panel (MCP) entries. Finally the results suggested that an alerting scheme using a distinct but 'non-annoying' aural alert should be prefered.