Wiener summarizes the information required by the flightcrew to fully comprehend the behavior of the avionics as the answers to the questions: "What is it doing now?, "Why is it doing that?", and "What is it going to do next?" The research described in this paper proposes to specify the behavior of the avionics in a manner that directly answers these questions.

The communication between flightcrew and avionics is based on a framework of cooperation between the cockpit agents, where the agents behavior is defined by intentions associated with situation/action pairs. This method is demonstrated by the specification of the automation proposed for the Vertical Guidance function of the High Speed Civil Transport (HSCT). Design of Flight Mode Annunciation (FMA) to communicate the intentions of the avionics, and interactive computer-based training that exploits the intentional formal model of the avionics are discussed.

INTRODUCTION

Advances in technology have enabled increasingly sophisticated automation to be introduced into the cockpit of modern commercial air transports. This automation serves to support the flightcrew in performing the mission by automating repetitive functions (ex. pitch and thrust control), providing a large data-base of information (ex. airways, and closest airports), and performing more accurate computations (ex. fuel economy). These systems have effectively achieved some goals of reducing flightcrew workload, improving mission safety, and improving the economy of operation. In a study performed by the FAA Human Factors Team on the Interfaces Between Flightcrews and Modern Flightdeck Systems (FAA; 1996), a set of suggestions to improve the overall "aviation system" were made. These suggestions include: improved communication and coordination that could eliminate procedures that are incompatible with highly automated airplanes, the modernization of NOTAMs, charts, approach plates, etc., and the standardization of some cockpit features that can reduce training and potential problems when flying different aircraft, especially aircraft from different manufacturers. The report also identified issues associated with the situational awareness (pages 43 to 66) and management of automation (pages 33 to 41).

Research on Automation Surprises

In a study of 99 ASRS reports Eldredge, Mangold, and Dodd (1992) concluded that 60 out of 99 incidents were caused by discrepancies between pilot expectations and operation of the avionics. In a recent review, Mangold and Eldredge (1995) found that different levels of automation are not effectively used by revenue service flightcrews, that flightcrews may be unfamiliar with some of the functionality of the avionics, and that the limitation in the annunciation of the state of the avionics and the state of the flightplan results in some uncertainty on the part of the flightcrews.

Sarter and Wood's (1995) study showed that pilot expectations for the behavior of the avionics do not always reflect the actual operation of the avionics, especially in rare but potentially critical emergency situations such as low speed abort of takeoff.

Woods et. al (1994) and Hutchins (1994) have suggested that the avionics systems may be too complex for human cognitive abilities due to the large number of different options for performing maneuvers and the large number of different modes especially those involving speed and altitude.

Vakil et. al. (1995) conclude "that there does not appear to be a simple consistent global model of the Autoflight Systems." They point out that no such model is presented in flight manuals which tend to describe only the basic procedures for operating the avionics, the flightcrew-avionics interface, and the physical (hardware box) composition of the avionics. Numerous other researchers have made similar observations.

In an in-depth survey of pilots use of automation in the modern "glass cockpit", McCrobie et. al. [1997] report that pilots believe that the limited use of the automation in the descent and approach phases is a "system-wide" problem that includes the experience and training of the flightcrews, the design and testing and the avionics, and the integration of Air Traffic Control.

The intentional avionics research described in this paper is explicitly designed to develop a single model of the intention and behavior of the avionics that can be shared by operators and designers, and can be implemented in the avionics software [Sherry et. al., 1996], and [Sherry and Polson, 1996].

Enhancing Annunciation and Situational Awareness

Vakil, Hansman, and Midkiff [1995a] have developed an Electronic Vertical Situation Display (EVSD) that annunciates the current and next control-modes with targets, control allocations, and a graphical representation of the predicted sequences of the current modes and targets.

Hutchins [1994] Integrated Mode Management Interface (IMMI) replaces the Mode Control Panel (MCP) and incorporates both a Horizontal Situation Display (HSD) (also known as a Navigation Display (ND) ) and a Vertical Situation Display (VSD). Both displays contain representations of the currently engaged, armed and available lateral and vertical control-modes and targets. The pilot selects modes by pressing an icon representing an available mode. A major goal of Hutchins' IMMI design is to make available to the pilots information about the consequences of engaging a mode at or near the focus of the pilots attention - the tip of their finger used to engage the mode. This display uses touch sensitive screens.

THE COCKPIT AND IT'S AGENTS

The cockpit of a commercial air transport is composed of three agents: a captain, a first officer, and the avionics. The flightcrew are responsible for executing the mission of the vehicle: to transport passengers and cargo from origin to destination (Billings, 1996). This mission is performed within the constraints of weather, air traffic, airspace regulations, airline policies, performance of the aircraft, and expectations for profitable operation of the airline. To execute this mission, the flightcrew must have full knowledge of the mission and the constraints of the environment. Avionics systems that automate tasks associated with the execution of the mission are also encoded with knowledge of the mission and rules for sorting the constraints in which the mission is executed. The cooperation between the flightcrew and the avionics is one of the fundamental elements in the effective operation of the cockpit.

Patterns of Delegation

The tasks performed by the agents in the cockpit include: Flightplanning, Guidance, and Control. The Flightplanning task constructs a 4 dimensional trajectory that takes into account ATC instructions, airspace regulations, the performance of the aircraft and weather. The Guidance task determines the targets and control-mode required to maintain the current leg of the Flightplan. The Control task instantaneously manipulates the aircraft control surfaces and propulsion to acquire and maintain the current Guidance targets. These tasks perform the strategic, tactical, and instantaneous views discussed by Mangold and Eldredge (1995).

In the Managed configuration the flight-crew have delegated authority for Flightplanning, Guidance, and Control tasks to the avionics. The flight-crew provide ATC instructions to the avionics via the MCDU and MCP, and monitor the progress of the mission and the behavior of the avionics.

A FRAMEWORK FOR COOPERATION BETWEEN AGENTS THROUGH THE USE OF INTENTION

When the cockpit is in the Managed configuration (fully automated), the Flighplanning, Guidance, and Control tasks are performed by the automation. The behavior of the automation is determined by the rules for operation encoded into the software of the avionics. The flightcrew monitor the progress of the mission and serve as the interface between the avionics and Air Traffic Control. The flightcrew also monitor the behavior of the avionics.

Wiener (1989) summarizes the information required by the flightcrew to fully comprehend the behavior of the avionics as the answers to the questions: "What is it doing now?"; "Why is it doing that?"; and "What's it going to do next?".

A framework for communication between flightcrew and avionics is derived from a framework of cooperation introduced by Jennings (1995) for distributed (artificial) intelligent agents.

Each agent in the cockpit is assumed to perform a set of actions to achieve the objectives of the air transport mission . The agents are considered to be in cooperation when: (1) the agents understand the goals of the air transport mission and, in principle, agree to cooperate to achieve these goals, (2) the agents agree on a common recipe (set of actions) to achieve the goals, and (3) the agents perform actions, in the context of the goals, in an interdependent manner.

It is the goal of the intentional avionics research described in this paper to start to define the type of constructs and grammars required by a language for communication between agents in the cockpit, and to develop formal models and tools for capturing and encoding intentional behaviors such that they can be encoded in the software of avionics and used to train flightcrews.

A MODEL OF INTENTIONAL BEHAVIOR

The Operational Procedure Model (OPM) (Sherry, et. al., 1996) is a knowledge representation scheme for designing and training the behavior of hybrid discrete-event/continuous control laws. This model takes the operator's viewpoint and is based on the operator's language. The model also adopts a rule-based notation that makes the description easy to read and easy to learn. The model is designed to capture the declarative and procedural knowledge of the mission constructs used by pilots in executing the mission. The model uses a hierarchical structure to manage the complexity and is based on a mathematical formalism of first-order logic and finite state machines. This formalism helps to manage complexity and yields a description that can be directly converted into software.

The OPM includes Missions, Operational Procedures, Scenarios, and Behaviors. A mission represents the overall objective or intention of the control law under development. A mission is achieved by executing a sequence of operational procedures. The operational procedures represent the set of tasks that are required to achieve the mission. This set includes normal operation, special cases, and abnormal operation. The operational procedures are characterized by their intentions and are named by a verb-noun pair that reflects the objective of the task. For example, an operational procedure labeled "Descent to Recapture the Path from Late" describes the intention of the avionics to maneuver in order to capture the optimal path for a descent.

Each operational procedure is defined by a set of scenarios and a behavior that represent the situations-action of a rule. A scenario identifies the situation in the mission when the operational procedure shall be invoked. For example, the Climb Operational Procedure for Managed operation (VNAV engaged) is invoked when the aircraft is in the climb phase of the mission (not sequenced the T/C), is level at a Climb Altitude Constraint defined at a waypoint that has just been sequenced, and the Clearance Altitude has been raised to a higher altitude.

The behavior identifies the actions that are performed. These actions manipulate control surfaces and display information to the flightcrew. For the example of the Climb Operational Procedure described above, the following actions are performed; (1) select the next highest altitude target from the Clearance Altitude, Climb Altitude Constraint, and Cruise Flightlevel, (2) select the climb speed profile from the Econ Climb CAS, Econ Climb Mach, max Angle Climb CAS ...etc., (3) control speed via the elevators, and (4) set the throttles to climb thrust.

The scenarios in the OPM are determined based on a set of inputs that are used strictly for decision-making. It is estimated that up to 80% of the avionics software performs decision-making. The behaviors are computed by algebraic transform functions or data manipulation algorithms that convert inputs into outputs. The remaining avionics software (> 20%) implements these behaviors. The outputs of the OPM represent the actions taken by the system.

EXAMPLE DESIGN OF INTENTIONAL AVIONICS

The application of intention in the design of avionics software and in the design of the user-interface is illustrated in the development of the Vertical Guidance function for the High Speed Civil Transport (HSCT) (Sherry et. al., 1996).

When VNAV (or PROF/FMS SPDS) is engaged, the automation for the Vertical Guidance function performs the decision-making and computations that determine the altitude target, speed target, vertical speed target, and the parameters controlled on the pitch and thrust axes to achieve the current leg of the Flightplan (see Figure 1). This task is equivalent to the actions performed by the flightcrew when speed, altitude, and vertical speed targets are dialed into the Mode Control Panel (MCP) and when autothrottle and pitch modes (such as Flightlevel Change, Altitude Hold) are selected.

The intentional design of the operation of the Vertical Guidance function is summarized in Table 1. The function used 55 inputs in the decision-making for selecting the active scenario. The function had 4 outputs defined in Figure 1.

The Altitude Target output is set to one of 16 different altitudes. These altitudes include; the Clearance Altitude entered via the MCP, Climb and Descent Altitude Constraints from the flightplan on the CDU, and the Cruise Flightlevel for normal operation. There are also altitudes for precision approaches (Minimum Descent Altitude) and altitudes for engine-out and other special and abnormal operations.

Table 1: Statistics for HSCT Vertical Guidance

The Speed Targets output is set to one of 26 different speeds. These speeds include; takeoff speed schedule, Econ Climb CAS, Econ Cruise Mach, Econ Descent CAS, and the approach and land speed schedule for normal operation. Speeds for holding patterns, max endurance, max angle climb, max descent and engine-out operation cover special and abnormal operations.

The Vertical Speed Target output is set to a default value of -750 fpm, or the value entered in the MCP vertical speed window.

Eleven Pitch/Thrust modes are possible. The pitch/thrust combinations are derived from the legal combinations of pitch and thrust modes. See Hutchins (1994) for an analysis of the possible combinations of pitch and thrust modes.

The specification of the of the Vertical Guidance function defines 118 behaviors in the OPM. These behaviors define the legal combinations of altitude target/speed target/vertical speed target/control-mode that that are required to perform the mission. The specification defines 289 scenarios that cover all the situations that could occur in the air transport mission.

Each scenarios-behavior pair is labeled by an operational procedure to capture the intent of the behavior and the conditions under which the scenario is invoked. The 118 operational procedures were to cumbersome too work with so the scenarios and behaviors were organized into a hierarchy of scenario and behavior pairs. The hierarchy of scenario and behavior pairs include three levels. At the top level 13 operational procedures are defined: 7 operational procedures for normal operations (see Table 2) and 6 for abnormal operations. Fanning out from this top-level are the scenario/behavior pairs that determine the altitude targets, speed targets, vertical speed targets, and pitch/thrust control-modes for the each scenario/behavior pair at the top of the hierarchy. Altitude targets and speed targets have their own hierarchy of scenario/behavior pairs. The complete hierarchy of operational procedures for the Vertical Guidance function can be found in Sherry et. al. (1996).

INTENTIONAL FLIGHT MODE ANNUNCIATION

The cockpit of modern commercial air transports do not annunciate the Vertical Guidance operational procedures names or scenario names. Analysis of FMA's in modern "glass" cockpits found 34 of the 55 scenario inputs (mission constructs) used by the automation are annunciated in a distributed manner across the displays. Most of the outputs are displayed, but 28 of 54 values held by the outputs are computed by the avionics and not annunciated in any way. With training and dexterity in scanning the displays a trained flightcrew can generally infer the intention and subsequent behaviors of the automation.

An Intentional FMA for Vertical Guidance includes: the operational procedures to communicate the intent, and the scenarios, outputs, and values held by the outputs to communicate the actions. Example FMA's are defined in Sherry and Polson (1996) and Feary (1997).

The amount of information and the ability of the pilot operator to understand the intention and behavior of the system based on the display of limited sets of data is under investigation. The solution may lie in the display of sub-sets of the information as a function of context. Alternative proposals lie in rigorous training on the use and interpretation of the displays. An experiment to evaluate the effect of this annunciation and training is planned (McCrobie, 1997).

MODEL-BASED TUTORS

Computer-based instructional technology, known as cognitive tutors, possess a computational model capable of performing the behaviors that the students are required to learn in the ways students will perform these behaviors (Anderson, et.al., 1995).. The premise of these instructional systems is that instruction should be based on a cognitive model of the competence that the student is learning.

Evaluations of these tutors showed that students achieved the same level of proficiency as conventional instruction in one third of the time. This performance is attributed to the fact that students learn the skills in production-rule units, that the instruction is structured, and that the students receive immediate feedback and error correction as they practice the skill.

Feary (1997) demonstrated a web-based interactive tutor that trained pilots how to read and understand traditional and intentional FMAs. This tutor provided the declarative knowledge in the OPM for Vertical Guidance. Work is underway to add the procedural knowledge to the tutor. The procedural knowledge tutor will use the same software as is used in the airborne avionic system.

CONCLUSIONS

The premise of the cooperative cockpit is that the cockpit agents share a joint understanding of each others intentions and subsequent behaviors. To achieve this goal the design process used to develop avionics must capture the intentions and behavior of the avionics. An example of how avionics software can be designed using this approach is described in this paper.

To take advantage of this approach and avoid automation surprises, the flightcrew must be cognizant of the intentions and behavior of the avionics. Research using the Vertical Guidance function is underway to train flightcrews on the behavior of an intentional avionics system defined in scenario/behavior pairs and to display the intention and behavior of avionics in the cockpit.

Anderson, J. R., Corbett, A. T., Koedinger, K., & Pelletier, R. (1995). Cognitive tutors: Lessons learned. The Journal of Learning Sciences, 4,167-207.

Eldredge, D., S. Mangold, and R.S. Dodd (1992) A Review and Discussion of Flight Management Incident Reported to the Aviation Safety Reporting System (Final Report No. DOT/FAA/RD-92/2). Battelle/U.S. Department of Transportation.

FAA (1996) Federal Aviation Administration Human Factors Report on : The Interfaces Between Flightcrews and Modern Flight Deck Systems.

Feary, M., Alkins, M., Palmer, E., Sherry, L., McCrobie, D., Polson, P. (1997) Behavior-based vs. System-based Training and Displays for Automated Vertical Guidance. Proceedings of the Ninth International Aviation Psychology Symposium Conference. Columbus Ohio. The Ohio State U.

Hutchins, E. (1994) An Integrated Mode Management Interface for Training. A paper given at the Training for Automation Workshop, NASA Ames Research Center, Moffet Field, Ca. August 24, 1995.

Jennings, N.R. (1995) Controlling Cooperative Problem Solving in Industrial Multi-agent Systems Using Joint Intentions. Artificial Intelligence 75 pgs 195-240.

Mangold, S.J. and D. Eldredge (1995) Flight Management Systems Information Requirements. In R.S. Jensen (Ed), Proceedings of the Eight International Aviation Psychology Symposium Conference. Columbus, Ohio: The Ohio State University.

McCrobie, D., M., Alkins, Feary, M., Palmer, E., Sherry, L., Polson, P(1997) Enhancing Vertical Navigation Performance in Glass Cockpit Aircraft. Proceedings of the Ninth International Aviation Psychology Symposium Conference. Columbus Ohio. The Ohio State U.

Sarter, N.B., and D.D. Woods (1995) Strong, Silent, and Out-of-the-Loop: Properties of Advanced (Cockpit) Automationand Thier Impact on Human Automation Interaction. CSEL Report 95-TR-01. Cognitive Systems Laboratory, The Ohio State University, Columbus, Ohio.

Sherry, L. et. al (1996) Design of an Intentional Flightpath Management Function for the HSCT Cooperative Cockpit. Honeywell Technical Publication C69-5370-002.

Sherry, L., and Polson, P. (1996) Annunciation and Training of Knowledge-based Avionics . Honeywell Technical Publication C69-5370-003.

Vakil, S., R.J. Hansman, and A.H. Midkiff (1995) Impact of Vertical Situation Information on Vertical Mode Awareness in Advanced Autoflight Systems. AIAA/IEEE Digital Avionics Systems Conference. Nov 6-9, Cambridge, MA.

Vakil, S., R.J Hansman, A.H. Midkiff, & T. Vaneck (1995a). Feedback Mechanisms to Improve Mode Awareness in Advanced Autoflight Systems. Proceedings of the Eight International Aviation Psychology Symposium Conference. Columbus Ohio. The Ohio State University.

Wiener, E. (1989). Human Factors of Advanced Technology ("Glass Cockpit") Transport Aircraft (NASA Contractor Report No. 177528). NASA Ames Research Center.

Woods, D.D., L.J. Johannsen, R.I. Cook, N.B. Sarter (1994) Behind Human Error: Cognitive Systems, Computers, and Hindsight. Dayton, Ohio: Crew Systems Ergonomic Information and Analysis Center.