NASA/TP-2007-213474

Synthesis from Design Requirements of a Hybrid System

for Transport Aircraft Longitudinal Control

Volume I

Charles S. Hynes and Gordon H. Hardy

Ames Research Center, Moffett Field, California

Lance Sherry

Honeywell International Inc., Phoenix, Arizona

December 2007
The NASA STI Program Office. . . in Profile

Since its founding, NASA has been dedicated to the CONFERENCE PUBLICATION. Collected

advancement of aeronautics and space science. The papers from scientific and technical conferNASA Scientific and Technical Information (STI) ences, symposia, seminars, or other meetings

Program Office plays a key part in helping NASA sponsored or cosponsored by NASA.

maintain this important role.

The NASA STI Program Office is operated by

Langley Research Center, the Lead Center for

NASA's scientific and technical information. The

NASA STI Program Office provides access to the

NASA STI Database, the largest collection of

aeronautical and space science STI in the world.

The Program Office is also NASA's institutional

mechanism for disseminating the results of its

research and development activities. These results

are published by NASA in the NASA STI Report

Series, which includes the following report types:

• TECHNICAL PUBLICATION. Reports of

completed research or a major significant phase

of research that present the results of NASA

• SPECIAL PUBLICATION. Scientific, technical,

or historical information from NASA programs,

projects, and missions, often concerned with

subjects having substantial public interest.

• TECHNICAL TRANSLATION. Englishlanguage translations of foreign scientific and

technical material pertinent to NASA's mission.

Specialized services that complement the STI

Program Office's diverse offerings include creating

custom thesauri, building customized databases,

organizing and publishing research results ... even

providing videos.

For more information about the NASA STI

programs and include extensive data or theoreti- Program Office, see the following:

cal analysis. Includes compilations of significant

scientific and technical data and information

deemed to be of continuing reference value.

NASA's counterpart of peer-reviewed formal

professional papers but has less stringent

limitations on manuscript length and extent

of graphic presentations.

• TECHNICAL MEMORANDUM. Scientific and

technical findings that are preliminary or of

• Access the NASA STI Program Home Page at

Iiitp://www.sti.iiasa.gov

• E-mail your question via the Internet to

help@sti.nasa.gov

• Fax your question to the NASA Access Help

Desk at (301) 621-0134

specialized interest, e.g., quick release reports, Telephone the NASA Access Help Desk at

working papers, and bibliographies that contain (301) 621-0390

minimal annotation. Does not contain extensive

analysis.

• CONTRACTOR REPORT. Scientific and

technical findings by NASA-sponsored

contractors and grantees.

• Write to:

NASAAccess Help Desk

NASA Center for AeroSpace Information

71 15 Standard Drive

Hanover, MD 21076 -1320
NASA/TP-2007-213474

Synthesis from Design Requirements of a Hybrid System

for Transport Aircraft Longitudinal Control

Volume I

Charles S. Hynes and Gordon H. Hardv

Ames Research Center, Moffett Field, California

Lance Sherry

Honeywell International Inc., Phoenix, Arizona

National Aeronautics and

Space Administration

Ames Research Center

Moffett Field, California 94035-1000

December 2007
Acknowledgments

We thank Michael Heymann for suggesting the investigation of validity regions in state space, and for many

discussions. Charles E. Billings, William Bjorkman, James Franklin, Charles W. (Bill) Harper, Feng Lin, George

Meyer, and Everett Palmcr reviewed the report and provided useful comments on both content and presentation.

We are grateful to them all.

Available from:

NASA Center for AeroSpace Information

7115 Standard Drive

Hanover, MD 21076-1320

(301)621-0390

National Technical Information Service

5285 Port Royal Road

Springfield, VA 22161

(703) 487-4650
TABLE OF CONTENTS

LISTOF ACRONYMS ....................................................................................... ............................... vii

LISTOF SYMBOLS ........................................................................................... ............................... vii

EXECUTIVESUMMARY ................................................................................................................. xi

SUMMARY ........................................................................................................... ............................... 1

PARTI—BACKGROUND .....................................................................................................3

INTRODUCTION................................................................................................. ............................... 3

VehicleManagement System ............................................................................ ............................... 3

Verification and Validation ............................................................................... ............................... 6

AutomationTheory ............................................. ___ ...................................................................... 7

Design Goals and Technical Approach ........................................................... ............................... I 1

SpecificObjectives .......................................................................................... ............................... 12

Scope ................................................................................................................ ............................... 13

Planof Report .................................................................................................. ............................... 13

OVERVIEW OF DESIGN METHOD ............................................................................................... 17

Formulation of Synthesis Problem .................................................................. ............................... 17

Solution of Synthesis Problem ......................................................................... ............................... 19

An Example Illustrating Invalid Mode Selection ........................................................................... 21

AIRCRAFTMODEL .......................................................................................... ............................... 23

Definitionsand Assumptions ........................................................................... ............................... 23

ReferenceFrames ............................................................................................ ............................... 24

Equationsof Motion ........................................................................................ ............................... 26

Flight Envelope ......................................... ....................................................... ...............................

AircraftDynamical Behavior .......................................................................... ............................... 33

PART 11—DESIGN SYNTHESIS ..................................................................... ............................... 43

FLIGHT CONTROL SYSTEM ........................................................................... ............................... 43

Concept ............................................................................................................ ............................... 43

ModeDefinition ............................................................................................... ............................... 44

ModeHierarchy ............................................................................................... ............................... 44

y-V Command Mode ....................................................................................... ............................... 47

VCommand Mode .......................................................................................... ............................... 50

yCommand Mode ............................................................................................ ............................... 53

DynamicThrust Saturation .............................................................................. ............................... 54

SAFETY REQUIREMENTS .............................................................................. ............................... 60

FlightHazards .................................................................................................. ............................... 60

SafetyMargins ................................................................................................. ............................... 61

EnvelopeProtection ......................................................................................... ............................... 62

iii
TABLE OF CONTENTS (continued)

EFFECTIVENESS REQUIREMENTS .............................................................................................. 63

Effectiveness Concept .................................................................................................................... 63

AltitudeCapture Example .............................................................................................................. 64

Path/Speed Command Supermode Specifications .......................................................................... 67

Effectiveness of y-V Command Mode ............................................................................................ 68

Effectiveness of V Command Mode ............................................................................................... 69

Effectiveness of y Command Mode ................................................................................................ 70

Annunciation Requirements ........................................................................................................... 74

MODEVALIDITY ............................................................................................................................. 75

ValidityConcept ............................................................................................................................. 75

Validity ofy-V Command Mode .................................................................................................... 75

Validity of V Command Mode ....................................................................................................... 76

Validityof y Command Mode ........................................................................................................ 77

Summary of Validity Conditions .......................................................................................

SYNTHESIS OF PATH/SPEED COMMAND SUPERMODE ........................................................ 80

TheSynthesis Problem ................................................................................................................... 80

Expression of Validity Conditions by Symbolic Logic .................................................................. 81

HeuristicDesign Strategies ............................................................................................................. 84

Partitioning and Inversion of Validity Table .................................................................................. 86

Construction of Statechart .............................................................................................................. 88

System Properties for Path/Speed Command Supermode .............................................................. 91

ConcludingRemarks ...................................................................................................................... 92

SYNTHESIS OF ALTITUDE COMMAND SUPERMODE ............................................................ 93

AltitudeRegulation ......................................................................................................................... 93

ModeStructure ............................................................................................................................... 94

FunctionalSpecification ................................................................................................................. 96

ModeControl Panel ........................................................................................................................ 97

SafetyRequirements ..................................................................................................................... 100

EffectivenessRequirements .......................................................................................................... 102

Safety Versus Effectiveness ......................................................................................................... 104

Mode Validity for Altitude Command Supermode ...................................................................... 105

HeuristicStrategy ......................................................................................................................... 108

Construction of Statechart ............................................................................................................ 118

System Properties for Altitude Command Supermode ................................................................. 120

Failuresand Abuses ...................................................................................................................... 125

ConcludingRemarks .................................................................................................................... 127

OTHER SECOND-LEVEL AND THIRD-LEVEL SUPERMODES .............................................. 127

ApproachSupermodes .................................................................................................................. 127

Go-Around Supermodes ............................................................................................................... 128

DepartureSupermodes .................................................................................................................. 128

Third-Level Supermodes .............................................................................................................. 128

Operational Use of Automated System ........................................................................................ 129

IV
TABLE OF CONTENTS (continued)

PART III—CONSEQUENCES .............................................................. ............................131

AIRWORTHINESS, CERTIFICATION, AND COCKPIT INTERFACE DESIGN ISSUES........ 131

Airworthiness and Certification Issues ......................................................................................... 131

Cockpit Interface Design Issues ................................................................................................... 132

HardwareFailures ......................................................................................................................... 132

Avionic System Certification ....................................................................................................... 133

CockpitInterface Design .............................................................................................................. 136

Design Recommendations ............................................................................................................ 138

FUTUREWORK .............................................................................................................................. 142

Human-Automation Integration .................................................................................................... 142

Generalization to Other Safety-Critical Systems .......................................................................... 145

CONCLUSIONS.............................................................................................................................. 147

REFERENCES................................................................................................................................. 149

LIST OF FIGURES

Figure 1. Vehicle management system ........................................................................................... 4

Fi o ure 2. Continuous and discrete systems ..................................................................................... 7

Figure3. Hybrid system .................................................................................................................. 9

Figure4. Regions of validity ......................................................................................................... 10

Figure5. Design Method ............................................................................................................... 17

Figure 6. Engine failure during initial climb ................................................................................. 22

Figure 7. Reference frames ........................................................................................................... 25

Figure 8. Aircraft performance envelope ...................................................................................... 31

Figure9. Speed stability ................................................................................................................ 34

Figure 10. Aircraft dynamical behavior .......................................................................................... 40

Figure 1 l . Flight control system ..................................................................................................... 45

Figure 12. Geometric stability regions for primitive modes ........................................................... 56

Figure 13. Safety envelope for Path/Speed Command supermode ................................................. 62

Figure 14. Altitude capture example ............................................................................................... 66

Figure 15. Statechart for Path/Speed Command super-node ........................................................... 89

Figure 16. Geometric regions for mode selection within Path/Speed Command supermode......... 91

Figure 17. Approximation of Ili<,htpath target ................................................................................ 95

v
LIST OF FIGURES (continued)

Figure 18. Distributed decision-making: control flow and information flow within

supermodehierarchy ...................................................................................................... 96

Figure 19. Mode control panel ........................................................................................................ 98

Figure 20. Safety envelope for Altitude Command supermode .................................................... 101

Figure 21. Engine-out performance .............................................................................................. 104

Figure 22. Geometric regions for mode selection within Altitude Command supermode........... 112

Figure 23. Statechart for Altitude Command supermode ............................................................. 119

Figure 24. Supermode selection within Altitude Command supermode ...................................... 121

Figure 25. Head-up display symbology ........................................................................................ 140

LIST OF TABLES

Table 1. Selection of envelope protection modes ........................................................................ 63

Table 2. Validity conditions for primitive modes ........................................................................ 79

Table 3. Symbolic validity conditions ......................................................................................... 83

Table 4. Target screening strategy for Path/Speed Command supermode .................................. 84

Table 5. Strategy for setting target thrust ..................................................................................... 85

Table 6. Inverted validity table for Path/Speed Command supermode ....................................... 87

Table 7. Mode selection within Path/Speed Command supermode ............................................ 88

Table 8. Validity conditions for Altitude Command supermode ............................................... 108

Table 9. Target screening strategy for Altitude Command supermode ..................................... 109

Table 10. Mode selection within Altitude Capture/Hold supermode and Climb/Descend

supermode.................................................................................................................... 110

Table 1 1. Inversion of reduced validity table for Altitude Command supermode ...................... 110

Table 12. Supermode selection within Altitude Command supermode ....................................... 115

vi
LIST OF ACRONYMS

AFS Autoflight system

ATC Air traffic control

CDU Control display unit

EAS Equivalent airspeed

EGT Exhaust gas temperature

EPR Exhaust pressure ratio

FAA Federal Aviation Administration

FMS Flight mana g cmem system

ILS Instrument landing system

MCP Mode control panel

QSRA Quiet short-haul research aircraft

TAS True airspeed

VNAV vertical navivatlon

LIST OF SYMBOLS

English Symbols

a = a (H) Sonic velocity, ft/sec

aNLIM Normal acceleration limit, 3 ft/sect

AR = b2/S in,, aspect ratio, dimensionless

b in_g, span. ft

CL lift coefficient, dimensionless

CDP = CDP (M) Parasite drag coefficient, dimensionless

dH/dt Rate ol' chanyoe of height H, ft/sec

(dH/dt)o Threshold rate of change of height H, 250 ft/min

dV/dt Rate of change of airspeed V, ft/sec`

d-y/dt Rate of chan o e of flightpath angle y, rad/sec

D Draw. Ih

e = e (M) Span efficiency, dimensionless

g Acceleration of gravity, ft/sect

H I lciLht in Standard Atmosphere, ft

H„ Altitude deviation threshold, ft

AH Altitude error, ft

Iy Pitch moment of inertia, slug/ft2

vii
LIST OF SYMBOLS (continued)

English Symbols (continued)

Kv Longitudinal acceleration limiter parameter, dimensionless

L Lift, lb

M = V/a Mach number, dimensionless

MYPitching moment, ft-lb

N Engine rpm (revolutions per minute), percent

POStandard sea-level barometric pressure, 2116.22 lb/ft2

q Rate of change of pitch angle 0, rad/sec

S Aircraft wing area, ft2

T Thrust, lb

T/S = f (N, M) Corrected thrust, lb

V Airspeed, ft/sec

VE

= V^I6 Equivalent airspeed, ft/sec

W Aircraft weight, lb

W/S Aircraft wing loading, Ib/ft2

Greek Symbols

a Angle of attack, rad

7 Flightpath angle, rad

Ay Flightpath angle increment, 3 deg

ycoT Trim (equilibrium) flightpath angle, rad

YsrEEO Flightpath angle for airspeed control, rad

b = p/po - 6 (H) Ambient pressure ratio, dimensionless

8ELEV Elevator- deflection, rad

ST Throttle position, rad

0 Pitch angle, rad

Po Standard sea-level density, 0.00237691 sl/ft'

6 = p/p„ = a (H) Ambient density ratio, dimensionless

0 Bank angle, rad

viii
LIST OF SYMBOLS (continued)

Subscripts

CMD Commanded

ExP Exponential law

LIM Limited

MAX Maximum

MIN M1111111LI111

Mc Minimum control airspeed

PAR Parabolic law

POT Potential (equilibrium or trim) conditions

REF Reference

SAFE Safety envelope limit

TGT Target

Logical Symbols

Equivalence = Negation

Logical OR v Logical AND omitted

Implication =>

Ix
LIST OF SYMBOLS (continued)

Logical Conditions

VT = (VTGT < VMIN) VT2 - (VTGT > VMAX)

VT 3 - (VTGT < V MIN DRAG)

V I = (V< VMIN DRA(i) V2 = (V < VTGT)

V3 = (V = VTGT) V4 = (V > VTGT)

GI -(Y=0)

GTi = ('ITGT < 'YSAr1 )

GT3 = (YTGT = 'YPOT T( W)

GT5 = (YTGT < YPOT MI ♦ )

Q = (YTGT < 7SPEI:D MIS )

DC I - (YPOT MIN < 0)

TC1 = (YPOT MAX < 0)

TS I = (Y < YSPEIiD NI I0)

TT I - CYPOT TGT = YI'( ) 1 V I

TT3 = (YPOT TGT < YP() 1 M1 0

APP = (PRIORITY = Sl'I.I•.I))

PE(V)- --,[PTTI]^1Q "1.1-21

H I = ( HTGT < H SAPI )

GT2 = (YTGT < YPOT TGT)

GT4 = (YTGT > YPOT TGT)

GT6 - (YTGT > YPOT MAX)

P = (TGT ^! YSPEED MAX)

PF I = (YPOT MAX = YPOT MIN)

TC2 = (YPOT MAX = 0)

TS2 = (Y ^! YSPEED MAX)

TT2 = (^/POT TGT = YPOT MAX)

TT4 = (YPOT TGT > YPOT MAX)

PP = (PRIORITY - PATH)

PE (Y) - --, (GT6 V 1 TS2)

H2 - (HTGT > HMAX)

NE I = -, [(GT2 u GT3) V4] [GT2 V3]

NE2 = [(GT32 u GT4) V2] [GT4 V3]

x
EXECUTIVE SUMMARY

The avionic systems for flight management and flight control on board current transport aircraft

have become quite complex, resulting in heavy penalties on development time and cost. These

systems have evolved during more than 20 years of ad hoc development, and now comprise very

large codes characterized by functional duplication, so that a single flight task can often be accomplished in several different ways. Weak functional coordination at the design level can result, under

unusual circumstances, in unsafe or inappropriate system actions. Furthermore, simulation is an

inadequate method for finding and eliminating such system behavior, because it is impractical to

simulate all possible cases. Excessively complex mode structure can result in pilot mode confusion,

preventing the flight crew from identifying unsafe or inappropriate system actions in time to avoid

potentially catastrophic consequences.

Recent advances in automation theory now enable an improved approach that ensures proper

coordination of system elements. New design principles are derived from long-established criteria

for aircraft design and certification. These criteria are based on more than 40 years of operating

experience with jet transport aircraft, and specify functional requirements for aerodynamic, structural, and propulsion design. However, no such broad functional criteria have previously been

applied to the design of avionic systems.

This report presents a detailed application to longitudinal control. Qualitative analysis based on the

governing differential equations shows that longitudinally the aircraft is capable of only three kinds

of dynamical behavior during manually controlled flight. Basic automated control modes are developed that correspond to each of the three kinds of behavior, and mode selection logic is then synthesized in such a way as to guarantee that the complete system satisfies behavioral design principles

specified beforehand.

Formal system validation is based on rigorous proof of system behavioral properties. This formal

validation supplements informal validation achieved by means of piloted simulation, but, unlike

simulation, guarantees that unsafe or inappropriate system actions are ruled out by the system

design.

Principled design results in a drastically simplified mode structure. This simplified mode structure is

matched to an optimized division of cockpit duties between human crewmembers and the automated

system, and can be expected to eliminate pilot mode confusion.

To summarize, major design goals are (1) system design integrity based on proof of correctness at

the design level. (2) significant simplification and cost reduction in system development and certification, and (3) improved operational efficiency, with significant alleviation of human-factors

problems encountered by pilots in current transport aircraft.

This report provides for the first time a firm technical basis for criteria governing design and certification of avionic systems for transport aircraft. It should be of primary interest to designers of nextgeneration avionic systems.

xi
X11
SYNTHESIS FROM DESIGN REQUIREMENTS OF A HYBRID SYSTEM

FOR TRANSPORT AIRCRAFT LONGITUDINAL CONTROL

Charles S. Hynes,' Gordon H. Hardy,' and Lance Sherry'

Ames Research Center

SUMMARY

Hybrid systems are dynamical systems that consist of both continuous and discrete elements. This

report presents a new method for synthesizing such systems from design requirements, and applies

the method to the design of a system for longitudinal control of transport aircraft. The resulting

system satisfies general requirements for safety and effectiveness specified a priori, enabling formal

validation of the complete system to be achieved.

The design process begins by describing three primitive (basic) modes for continuous control of

flightpath and airspeed that correspond to the three fundamental kinds of dynamical behavior

characterizing transport aircraft. For each mode, the dynamical behavior specified by the governing

differential equations is discretized by relating it geometrically to the aircraft performance envelope.

Validity conditions for each mode are derived from safety and effectiveness requirements imposed

a priori, and the three primitive modes are then combined to form a supermode that constitutes the

lowest-level hybrid system. Within this lowest-level supermode, discrete mode control logic is synthesized directly from the validity conditions. Although synthesis is rigorous, heuristic arguments

based on general notions of maximum effectiveness and logical dominance simplify the process,

with the help of extensive use of elcmentary symbolic logic. In cases where aircraft performance

limitations preclude capture ol'path or speed targets, the exact nature of the limitation is annunciated

for resolution at higher levels within the mode hierarchy (or, ultimately, by the human crew), with

assurance of logical completeness. Extension to higher-level supermodes is described, with a

detailed altitude-control example.

The potential contributions of formal validation to system design integrity are discussed, and

analysis of several transport aircraft accidents and incidents selected to serve as examples leads to

the suggestion that new airworthiness criteria based on general safety and effectiveness properties

might improve operational safety. The design of the human/machine cockpit interface is discussed

briefly, and several heuristic guidelines for system and interface design are proposed. Regarding the

pilot's mode selection as a command given to the system enables analysis from the human-factors

viewpoint of the same accidents and incidents studied previously from the system design perspective, and leads to recommendations that cockpit interface design be integrated into the system design

process, and that formal validation be extended to include the cockpit interface.

1 Retired, NASA Ames Research Center, Moffett Field. CA 94035.

Fonnerly at Honeywell International Inc., Flight Control Systems Design, Phoenix, AZ; currently at George Mason

University, 4400 University Drive, MS 4A6, Fairfax, VA 22030.
The present results may contribute by example to the development of more general theoretical

methods for synthesis of hybrid systems. They should also be of practical interest to designers of

next-generation transport aircraft avionic systems.

2
PART I

BACKGROUND

INTRODUCTION

Hybrid systems are dynamical systems that consist of both continuous and discrete elements. For

example, autopilots with multiple control laws, each specified by a different mode, are hybrid

systems in which the modes constitute the discrete elements. This report presents a new method for

synthesizing the discrete elements of such systems (that is, the mode selection logic) directly from

design requirements, and applies this method to the design of a system for longitudinal control of

transport aircraft. The resulting system satisfies general requirements for safety and effectiveness

specified a priori, enabling formal validation of the complete system to be achieved. Compared with

the systems installed in current transport aircraft, this new method for mode synthesis leads to drastic simplification of mode structure, and has potential for streamlining system development and

certification, reducing costs, and eliminating pilot mode confusion.

In order to provide necessary background, this section discusses the flight management systems on

board current transport aircraft. It shows that the complexity of these large, reactive hybrid systems

imposes heavy penalties on development time and cost. It then reviews methods for verification and

validation of these systems. The simulation-based methods currently in use are limited by the impossibility of testing all cases, but formal mathematical methods have potential for avoiding that limitation. Recent advances in automation theory now enable an improved design approach, which is the

subject of this report.

The problem of predicting theoretically the dynamical behavior of hybrid systems is discussed in

detail, and it is shown how lack of predictability in safety-critical systems can lead to "automation

surprises" with potentially catastrophic consequences. Although theoretical prediction of dynamical

behavior is mathematically intractable for arbitrarily specified hybrid systems, the problem can in

principle be solved by inversion: starting from certain safety and effectiveness properties specified a

priori, the mode selection logic can be synthesized so as to force the completed system to satisfy the

specified behavioral properties.

After this brief review of automation theory, the design goals of the synthesis method and the technical approach are described, the specific objectives and scope of this work are presented, and the

section concludes with a detailed presentation of the plan of the report.

Vehicle Management System

The block diagram of figure 1 illustrates operation of a transport aircraft by its human crew within

the air traffic control (ATC) system. The illustrated system is termed a Vehicle Management System

to distinguish it from the flight management systems (FMS) on board current transport aircraft,

although the two systems share their major elements in common. In figure 1, solid lines represent

continuous signals, broken lines represent discrete signals, and blocks represent transformations of
signals from input to output. The diagram as a whole can be regarded as a simplified representation

of the process by which the flight plan on the left side is transformed into the aircraft motions on the

right side.

Pilot Roles

The human pilot is represented in two roles, the strategic (planning) role on the left of the dashed

vertical line, and the tactical (executive) role on its right. On the left (strategic) side, the pilot makes

up the flight plan, accounting for weather, route, fuel reserves, airline policies, and the like, and

proposes the flight plan to ATC. The pilot's strategic activities are knowledge-based (Rasmussen,

1976) because they require cause-and-effect understanding of whole disciplines such as meteorology

and airline flight operations. After accounting for other air traffic so as to provide separation, ATC

issues a clearance to the aircraft. On board the aircraft, the clearance must be checked for legality

and feasibility before acceptance, and an executable trajectory must be synthesized that specifies the

reference flightpath in space and time.

When the ATC clearance is accepted and the reference flightpath determined, the pilot's tactical role

(right side of diagram) comes into play. The pilot's tactical activities involved in executing the flight

plan and monitoring progress of the flight are rule-based, and could in principle be automated. In

practice, much of this lower-level supervisory activity consists of selecting appropriate modes for

the navigation, guidance, and flight control functions of the automated system, and monitoring

-

COCKPIT INTERFACES

- - - - - - - - - - - - - - - - - - - - - -

Collision Ground

Route STRATEGIC TACTICAL avoidance proximity (planning) (execution)

Weather Primary i

flight displays i

Fuel i

I Targets -► DISPLAY i Map

reserves State Reference estimates -' Warning & i Airline •, Tactical flightpath annunciation i

policies Reject Accept I V supervision ^-- -- - - - - - - Modes

FLIGHT

PLANNING

LEGAL

FEASIBLE PILOT - -► MODE CONTROL

Guidance Leve13 Control Leve12 Control Levell

Flight plan Reference mode mode mode

Clearance flightpath i Waypoint, T Velocity

AIR TRAFFIC TRAJECTORY altitude. OUTER vector INNER

CONTROL SYNTHESIS G UIDANCE airspeed I CONT a2LJ target CONTROL

targets

Other 1

traffic Aircraft Aircraft state estimates Servo

performance commands

data

(

NAVIGATION ----- Nav mode Engine failure —^ Aircraft

Other failure - ►

AIRCRAFT motions

Radios &

satellites Turbulence

- Discrete Inertial data Continuous Wind shear

Air data

Pilot is shown in strategic and tactical supervisory roles. Shaded blocks

indicate system elements treated in detail by this report. Cross-hatching

indicates proposed application guidelines.

Figure 1. Vehicle management system.
displays and annunciations. (Direct manipulation of the flight controls during manual flight, which is

a skill-based activity that is discussed later, is not illustrated.)

Functional Description

The navigation system combines onboard sensor data with radio and satellite receiver data to form

aircraft state estimates, which provide feedback of aircraft motions. The guidance system compares

the actual trajectory of the aircraft based on state estimates with the reference trajectory, and generates local targets for waypoint position, altitude, and airspeed that are intended to null trajectory

errors. The outer-loop control system accepts these local targets and generates a target velocity

vector intended to ensure capture of waypoint, altitude, and airspeed targets. The target velocity

vector is displayed to the flight crew and also injected into the inner-loop control system. The innerloop control system accepts the target velocity vector and generates commands to the control surface

and throttle servos of the aircraft that are intended to ensure capture of the target velocity vector. The

resulting aerodynamic and propulsive forces and moments then act on the aircraft to generate its

motions. These motions are displayed to the crew and fed back to the guidance and control systems

by means of the state estimate ,­ aircraft position and altitude are also fed back to ATC by means of

ground-based radar (not illustrated).

The actions of the navigation. ,g uidance, and control systems are subject to the laws (that is, transformational algorithms) specified b\ the navigation, guidance, and control modes, which are selected

partially by the pilot (tactical role) and partially by the automated system. The three hierarchical

levels of mode control illustrated b\ the diagram are explained lit later, and should be ignored

for the present.

Environmental Influences

Figure 1 illustrates environmental influences of several kinds that act on the aircraft system. The

tactical (right) side of the dia L rann sJio\\ s that atmospheric turbulence and wind shear act on the

aircraft itself, disturbing its motion directly. Engine failure is considered an environmental influence,

because the failed engine is external to the remaining elements of the system. Likewise, failures

within other aircraft systems ( h\ draulic s y stem, electrical system, and the like) are external failures

to which the Vehicle Mana_uenicnt S y stem is required to react (fig. 1). Similarly, warnings from the

collision avoidance system anal the around proximity warning system are considered environmental

influences, because these warning s also represent external conditions to which the aircraft system is

required to react.

On the strategic (left) side of the dia g ram, factors that could force revision of the flight plan are

exemplified by deterioration of' \\ either conditions at the destination airport, depletion of fuel

reserves owing to unexpected hcad\\ Inds, or a change of route to avoid storms. Such factors also are

considered environmental intluences to which the aircraft system must react. To summarize, the

aircraft system must be reg arded as reacting dynamically to more or less continuous external

disturbances.

Implementation Software

The code that implements the tli g ht management systems on board current transport aircraft consists

of about 2 to 2.5 million source-code instructions, and doubles in size about every 4 years (Sherry

and McCrobie, 1998). About 20%, of this code consists of computer modeling of continuous system

5
elements for state estimation, trajectory synthesis, guidance, flight control, and cockpit display. The

other 80% of the code consists of discrete decision logic. The complexity of this large, reactive

hybrid system imposes heavy penalties on development time and cost.

In general, the continuous elements of the system implement mathematically based algorithms. For

these continuous elements, existing knowledge of numerical analysis provides an adequate basis for

design provided that it is correctly applied, and the computational behavior of the resulting continuous routines can be checked independently by well-understood input-output test methods. Furthermore, many of these routines can be reused.

On the other hand, design of the discrete decision logic relies largely on heuristics that lack a firm

mathematical basis. Furthermore, software architecture has evolved during more than 20 years of

ad-hoc development, current mode structures are vehicle-dependent, and are characterized by

multiply-overlapping functions. Under these circumstances, it is not surprising that most industry

effort required for development and for verification and validation of implementation code is

expended on the discrete elements of the system. The next section discusses current industry trends

for verification and validation.

Verification and Validation

Flight qualification of safety-critical systems requires both verification and validation. Verification

seeks to determine that the system implementation satisfies its specification, while validation examines whether the specification itself is correct. The industry approach to verification and validation

has been based on massive testing of the completed system, and Federal Aviation Administration

(FAA) certification has required inspection of the results of these tests. Development and certification have become increasingly expensive and time-consuming as system complexity has grown, and

the industry is now seeking more efficient alternatives to labor-intensive manual coding and testing.

Formal Verification

One alternative method uses decision tables as the fundamental specification document for the

discrete decision logic, which as already noted comprises about 80% of the implementation code in

current flight management systems. When the specification is complete, the implementation code

can be generated directly from the decision table by an algorithm that has itself been formally verified. By this means, the verification process can, in principle, be automated, with very significant

reductions in development time and cost. However, it seems likely that new certification criteria

will be needed to enable regulatory approval.

Formal Validation

If the trend toward formal verification develops as anticipated, it may be expected that the potential

for formal validation will be explored next. Validation of safety-critical aircraft systems depends

ultimately on the judgment of human pilots. The industry approach to validation has been based on

the designer's interpretation of expert pilot judgments in formulating design specifications, and has

required extensive piloted simulation for evaluation of the complete system M all expected operational contexts. Such informal validation is subject to the same limitations as informal verification.

In practice, simulation cannot test all possible paths through codes as complex as those on board

current transport aircraft, and cannot explore all possible operational situations.

6
STATE SPACE

Initialization

Supervisory control

ID ) Undesired state

State A

Condition 1 Y \ C

Discrete

states

a) Continuous system. b) Discrete system.

Formal validation has potential for augmenting expert pilot judgment by eliminating any system

behavior that is in conflict with general requirements for safety and for effective operation. These

general requirements must be based on flight hazards identified a priori (Leveson, 1995), and on

control tasks necessary for flight operations within the ATC system. Just as for formal verification, it

seems likely that new certification criteria will be needed in order to take full advantage of this new

approach to validation. Formal validation could be based on theoretical prediction of the dynamical

behavior of the system, but no method is presently available for predicting the dynamical behavior

of an arbitrarily specified reactive hybrid system; the discussion turns next to this mathematical

problem.

Automation Theory

Continuous Dynamical Systems

The dynamical behavior of an aircraft can be represented mathematically by a system of continuous

differential equations that involve functions of state variables (that is, motion quantities such as

position and velocity) and their time derivatives. The variations of these state variables with time

(termed dynamical trajectories of the system) are illustrated by figure 2(a), which shows two possible trajectories determined by different applications of control or different environmental influences

such as atmospheric turbulence. It can be seen that, starting from the same initial condition, one of

these trajectories remains within the safe flight envelope, while the other, potentially catastrophic

trajectory exceeds the boundaries of the safe envelope.

Discrete Dynamical Systems

The various task-related modes of the automated control system of an airplane (for example, climb

mode, altitude and headinu hold modes, autoland mode, etc.) can be represented mathematically by a

discrete dynamical system, as illustrated by figure 2(b). In figure 2(b), the state variables of the

Figure 2. Continuous and discrete systems.
discrete system ( that is, the system modes) are represented by circles, and transitions between modes

are represented by arrows. Each possible transition is governed by an associated logical condition: a

transition occurs if and only if its associated logical condition is true. Starting from a known initial

state (fig. 2(b)), the path taken through the state space defines the dynamical trajectory of the discrete system. It can be seen that different dynamical trajectories are possible, depending on the truth

or falsity of the conditions involved.

For example, let State A (tile initial state) correspond to the OFF condition, let State B correspond to

engagement of the altitude hold mode, and let Condition 1 be set to TRUE if the pilot presses the

button for selection of the altitude hold mode. Then the state transition diagram of figure 2(b) has the

interpretation that the system tra nsitions from OFF (State A) to ALTITUDE HOLD ENGAGED (State B)

when the pilot presses the selection button (Condition 1 TRUE). Other conditions could be set TRUE

or FALSE automatically, instead of being determined directly by pilot selection. Dependence of conditions oil states constitutes discrete feedback (fig. 2(b)).

Entry into certain states could result in undesirable or potentially catastrophic consequences, as

illustrated by the shaded State 1) in tilure 2(b). For example, State D could correspond to retraction

of the landing gear with the aircraft oil ground, or to total electrical failure during an instrument

approach, or (in a military context) to accidental launch of a missile. Fortunately, a well-developed

theory of supervisory control cnahles the transition paths leading to such undesired states to be

identified systematically and blocked off(fig. 2(b)). However, all such states must be identified and

enumerated.

Hybrid Dynamical Systems

A dynamical system that contains coupled continuous and discrete elements, as illustrated by

figure 3, is termed a hybrid system. It can he seen that selection of control modes A, B, C, or D, each

of which is characterized b y a di l'Icrent control law, determines different trajectories for the continuous system (left side of figure 3). Therefore, the continuous system is coupled to the discrete system

by means of the control laws characterizing the various modes.

Furthermore, because the truth or falsity of the conditions governing transitions within the discrete

system depends in general oil conditions (that is, oil state variables of the continuous

system), perturbations in the continuous trajectories determine different trajectories for the discrete

system (right side of figure 3) as the aircraft reacts to environmental influences. Therefore, the discrete system is coupled to the continuous system by means of the logic governing mode transitions.

It follows that each of the two systems is coupled to the other.

Dynamical Behavior

The dynamical behavior of continuous systems governed by differential equations is well-known.

The theory of linear differential equations is mathematically complete, and the nonlinear differential

equations describing aircraft motions can be linearized for small perturbations in the neighborhood

of any desired operating point. Therefore, prediction of the dynamical behavior of the aircraft can be

based on broad theoretical kno\^ led`^e of the properties of the solutions of the governing differential

equations, such as stability or instability, without reliance on numerical solution of the differential

equations via simulation. Agreement between theoretical prediction, simulation, and experimental

flight test results is generally satisfactory for transport aircraft.

8
STATE SPACE

Initialization

Continuous t

states

S

Supervisory control

O

p Undesired state

Condition 1 Y \ C

B

Discrete

states

Coupling of discrete system and continuous system precludes

theoretical prediction of dynamical behavior.

Figure 3. Hybrid system.

Prediction of dynamical behavior is more difficLilt for discrete systems than for continuous systems.

When one trajectory is known for a continuous system such as an aircraft, physical continuity of the

forces acting on the aircraft ensures that all neighboring trajectories must be similar in form. For

discrete systems physical continuity plays no role, and even the notion of neighboring trajectories

loses all significance. Knowledge of system behavior along one trajectory implies nothing for behavior along other trajectories, so that all combinatorial possibilities must be considered. Nevertheless,

computational methods are available for discrete systems that enable all possible trajectories to be

traced and enumerated, even for quite complex systems.

When a continuous system such as an aircraft is coupled to a discrete system consisting of several

automated control modes to form a hybrid system like the flight management systems installed in

current transport aircraft, the infinite-dimensional nature of the states characterizing the continuous

system precludes enumeration. Furthermore, the continuous system introduces variable dynamical

time delays that complicate the logical conditions governing state transitions within the discrete

system. Therefore, the dynamical behavior of an arbitrarily specified hybrid system cannot be predicted theoretically by any known method.

Automation Surprises

Further insight into the potentially catastrophic consequences of this lack of predictability can be

gained by analyzing the behavior of the simplified hybrid system illustrated by figure 4, which

shows the regions of validity in state space for two modes denoted as Mode A and Mode B. A

formal definition of validity is presented later. Briefly, any continuous-system trajectory that lies

within the illustrated boundaries is considered safe, and any excursion outside those limits is considered potentially catastrophic. These regions of mode validity must be regarded as bubbles floating in

multidimensional state space. Furthermore, these bubbles move about in the state space and change

shape as the system reacts to environmental influences.

9
STATE SPACE

Design transition surface Design transition surface

A

i Adjusted transition

B surface

r i

r

r ^

r • r •

Operating r r Operating

A

r point A

point r

r r

r

r r r B r B

To avoid invalid operation, transition surface must lie within

intersection of regions of validity.

a) Normal conditions. b) Abnormal conditions.

Figure 4. Regions of validity.

The diagram on the left (fig. 4(a)) illustrates a normal condition. At the operating point shown,

which could lie anywhere on one of the trajectories illustrated on the left side of figure 3, both Mode

A and Mode B are valid, and either could be selected safely. The selection logic is indicated by the

transition surface, which shows that Mode A is selected for points to the left of the transition surface, and Mode B is selected for points to its right. For the operating point shown, Mode B would be

selected. It is clear that, for a safe transition, the transition surface must lie within the intersection of

the two regions of validity.

The diagram on the right (fig. 4(b)) illustrates an abnormal condition. It can be seen that the region

of validity for Mode A remains the same as in figure 4(a), but that the region of validity for Mode B

has moved to the right and diminished in size owing to system reaction to changes in environmental

conditions, such as engine failure or wind shear. As a result, the operating point no longer lies within

the region of validity for Mode B. If the transition surface in figure 4(b) remains specified as in

figure 4(a), then Mode B will be selected even though it is invalid under the changed environmental

conditions.

Such an invalid mode selection could result in automated system actions that are unsafe, or totally

inappropriate for the intended operation, actions that take the human operators completely by surprise. A concrete example of an invalid mode selection that caused an aircraft accident is presented

later in the section "An Example Illustrating Invalid Mode Selection." In order to avoid such potentially catastrophic mode selections, the transition surface must be adjusted as the system reacts to

environmental influences so that it always lies within the intersection of the two regions of validity,

as shown at the right of figure 4(b).

However, such adjustment of the transition surfaces in a complex reactive system is a very difficult

problem, because it would require that many independent entities be maintained in strict correspondence under dynamically varying conditions. A simpler approach, which is taken in this report, is to

10
eliminate separate transition surfaces entirely by making the regions of validity themselves the

agency of mode selection.

Design Methods

In the absence of any method for theoretical prediction of the dynamical behavior of reactive hybrid

systems, system designers have been forced to take a computational approach via simulation, as

already explained. The example illustrated by figure 4 shows that, because simulation of all environmental conditions is impossible, it cannot be determined by means of a purely computational

approach whether an existing system satisfies requirements that ensure valid transitions in general.

The resulting lack of behavioral predictability under exceptional conditions has been recognized as

a serious human-factors deficiency (Wiener, 1989; Billings, 1996).

There remains the possibility of a theoretical attack on the inverse design problem. This inverse

approach seeks to synthesize (that is, to deduce by a mathematical process) the specification of a

hybrid system in such a way as to ensure that the system satisfies a set of dynamical behavior

properties imposed a priori that rule out unsafe or inappropriate behaviors. This approach seems

especially attractive for the design of transport aircraft flight management systems, for which the a

priori specification of behavioral properties can take advantage of criteria for design and certification of jet transports that are based on more than 40 years of experience with both civil and military

operation. This report presents a method for synthesizing mode selection logic for transport aircraft

flight management systems so as to satisfy general safety and effectiveness properties specified a

priori, enabling formal validation to be achieved.

Design Goals and Technical Approach

Design Goals

Major design goals are (1) system design integrity based on proof of logical correctness at the design

level, (2) significant simplification and cost reduction in system development and certification, and

(3) improved operational efficiency, with significant alleviation of certain human-factors problems

encountered by pilots in current transport aircraft.

Technical Approach

The technical approach to be taken leads toward these goals through development of a system architecture capable of formal verification and validation, which would replace much of the software

testing currently required for certification with logical proof of algorithmic properties for all safetycritical system elements, and would enable comprehensive validation. Because such an architecture

must of necessity make use of a drastically simplified mode structure, it may be expected to alleviate

11 Liman- problems relating to mode confusion (Hughes and Dornheim, 1995).

Synthesis Method

Following a suggestion of Michael Heymann (Heymann, personal communication, 1994), the present approach concentrates on investigating the region of state space for each mode that corresponds

to valid operation of the system (fig. 4). Based on these well-defined regions, the state space is discretized geometrically, and the conditions for validity of each mode are tabulated. This table must be

inverted (interchanging tabulated quantities with their arguments) to provide the basis for a mode

selection strategy. However, it is found that naive inversion leads to a combinatorial explosion of
cases. To avoid this explosion, heuristic strategies are used to partition the validity table, and the

partitioned table is then inverted to obtain a logically complete enumerated list of relevant cases.

Each case is related geometrically to a well-defined region of the state space, and selection criteria

determine mode selection uniquely for each such region. The complete system satisfies general

safety and effectiveness properties specified a priori. Behavioral properties are summarized by

general theorems that enable formal validation of the complete system to be achieved. The potential

for generalization of the method to other hybrid systems will be discussed later.

Logical Consistency

A fully axiomatic treatment (Rushby, 1995) would seek to examine formally the logical consistency

of the specified safety and effectiveness properties, which is not attempted here. It might seem that,

in case of conflict between safety and mission effectiveness, in airline service the latter should

always be sacrificed in favor of safety. But this formulation is too simple to deal with situations in

which violation of effectiveness could in itself give rise to a safety hazard. For example, if a wind

shear that overwhelmed aircraft performance should be encountered during final approach, avoiding

the a priori hazard of stalling might seem to require maintaining the conventional generous airspeed

margins above stalling speed, even if this caused the aircraft to settle below the approach path. But it

is now well-accepted that the safest policy for traversing wind shear requires holding the approach

path to avoid striking the ground short of the runway, and sacrificing airspeed margin, if necessary,

right down to stalling speed. More subtle examples of cases in which violation of effectiveness could

create a hazard can be foUnd in the accidents and incidents selected for discussion in appendix G.

In several of these cases, the hazard was compounded by poor annunciations to the human crew,

compromising their- potential capability for resolving problems not known to the designers a priori.

Recognizing the limitations of our knowledge in this human-factors area, the present work does

not attempt a complete axiomatic treatment. Instead, it deals on a case-by-case basis with logical

conflicts between safety and effectiveness, such as performance limitations that preclude capture

of altitude or airspeed targets. In each case, the exact nature of the limitation is annunciated for

resolution at higher levels within the system hierarchy, or, ultimately, by the human crew. Assurance

that all such cases of conflict are certain to be identified is provided by a guarantee of logical

completeness.

Specific Objectives

The primary objective of the present work is to enable formal validation by developing a practical

design procedure, one useful to industry designers in the near term, for synthesis of hybrid systems

that satisfy general safety and effectiveness properties specified a priori.

A secondary objective is to realize the potential of formal validation for improved operational safety,

with particular concern for the design integrity of the complete system, including the human/

machine cockpit interface, and to provide a firm technical basis for certification criteria.

A tertiary objective is to contribute to the development of more general theoretical methods for

synthesizing hybrid systems directly from design requirements.

12
Scope

This report treats only the problem of transport aircraft longitudinal control, which is more interesting than lateral-directional control because two longitudinal response parameters (flightpath angle

and airspeed) are controlled by two control parameters (pitch and thrust). Furthermore, the longitudinal problem is complicated by abrupt saturation of the thrust control. In contrast, lateral-directional

control in coordinated flight with small sideslip angles involves only one response parameter (heading) and one control parameter (bank angle) not subject to abrupt saturation. For simplicity, no

failures are treated in detail in this report, with the exception of abrupt failure of one engine, as previously explained. However, methods that enable detailed treatment of other failures are discussed

briefly.

The elements of the Vehicle Management System that are treated in this report are indicated by the

shaded blocks in figure 1. The continuous elements treated are the outer-loop control, the inner-loop

control, and the aircraft itself together with its control surface and throttle servos. The design of

these continuous elements uses the nonlinear inverse control concept developed theoretically by

Meyer (Meyer and Cicolani, 1981) and applied by Franklin (Franklin, Hynes, Hardy, Martin, and

Innis, 1986) to the flight control system of a NASA research aircraft.

As indicated by the shading in figure 1, the discrete elements of the Vehicle Management System

treated in detail in this report consist of the mode control logic for the first two levels of the mode

hierarchy, which correspond functionally to the autoflight systems installed in current transport

aircraft. As indicated by the cross-hatching in figure 1, guidelines are presented in this report for

simplified development of guidance functions and associated third-level supermodes, which correspond functionally to current vertical navigation (VNAV) systems.

The navigation function and the corresponding elements for lateral-directional control can be treated

by applying the synthesis methodology developed in this report. It can be seen that, on the right

(tactical) side of the vertical dashed line in figure 1. the two remaining elements are, first, the cockpit interfaces grouped within the display function, and second, the human crew's role in tactical

supervision. Comments on human-factors research needed to model these elements, which could

enable complete integration of the human-automation system. can be found in the section "Future

Work."

Plan of Report

Contents of Report

The report is divided into two volumes and three major parts. Part I ("Background") begins with the

"Introduction," and presents a brief overview of the formulation and solution of the synthesis problem in the section "Overview of Design Method."

Next, in the section "Aircraft Model," the aircraft model is described in detail. The dynamical

response of the aircraft to longitudinal control is developed from the governing differential equations, and related geometrically to the forms of trajectories in the flightpath-airspeed plane.

13
Part II ("Design Synthesis") begins with the section "Flight Control System," in which the mode

hierarchy is described, and the continuous elements of the flight control system are treated in detail.

The lowest-level elements in the mode hierarchy, which are termed primitive modes (that is, not

composite), relate directly to the dynamical behavior of the aircraft. The higher-level elements relate

to the control tasks required for operation within the ATC system, such as capturing and holding an

altitude, tracking the approach path, and the like. Three primitive modes for automated longitudinal

control are defined, and their stability properties are analyzed and related geometrically to certain

regions of the flightpath-airspeed plane.

In the section "Safety Requirements," flight safety hazards are identified a priori, and are associated

with certain boundary contours in the flightpath-airspeed plane. Safety margins are then applied to

these boundaries to define the safe flight envelope. Flight envelope protection is discussed, and

envelope protection modes are defined.

In the section "Effectiveness Requirements," the concept of effectiveness of the automated control

system for its intended purpose is developed, and related to the performance capability of the aircraft. (The concept of effectiveness plays a role in the synthesis problem similar to that of liveness in

computer science.) Complete effectiveness is defined to require capture of altitude, airspeed, and

flightpath targets. Partial effectiveness is defined, and requirements for annunciation of violations of

effectiveness are specified.

In the section "Mode Validity," validity is defined to require both safety and effectiveness. Validity

is analyzed for each mode based on the differential equations specified by the control law, and is

related geometrically to the stability regions of the flightpath-airspeed plane studied previously. The

conditions for validity of each mode are summarized by a validity table, which completes the formulation of the synthesis problem.

Solution of this problem for the lo ,.N, est-level hybrid system is discussed in detail in the section

"Synthesis of Path/Speed Command Supermode." Synthesis based on naive inversion of the validity

table is shown to be intractably complex. Heuristic strategies based on general notions of maximum

effectiveness, best approximation, and logical dominance are adopted, and are used to partition the

validity table, accounting for logical dependencies. The partitioned table is then inverted to obtain a

logically complete enumerated list of relevant cases. Each case is related geometrically to a welldefined region of the flightpath-airspeed plane, and mode selection criteria determine mode selection

uniquely for each such region, statecharts specifying mode selection logic are constructed directly

from the mode selection tables. The complete system satisfies the safety and effectiveness properties

specified a priori.

In the section "Synthesis of Altitude Command Supermode," extension of the synthesis method to

the second level of the mode hierarchy is described, with detailed application to altitude control.

System properties are summarized by general theorems that enable formal validation of the complete

system to be achieved.

The section "Other Second-Level and Third-Level Supermodes" presents guidelines for simplified

development of other second-level and third-level supermodes based on modifications to the secondlevel Altitude Command supermode, and shows how the complete Vehicle Management System

14
could be used in airline service. This section completes the second major part of the report, "Design

Synthesis."

The last major part of the report, Part i1I, "Consequences," deals with assessment of its consequences for airworthiness and certification, and for human-factors design of cockpit interfaces. The

section "Airworthiness, Certitication, and Cockpit Interface Design Issues" discusses those issues in

the context of several transport aircraft accidents and incidents. These accidents and incidents are

selected to show the broad applicability of airworthiness principles based on the safety and effectiveness properties developed in this report. Simple but plausible analysis shows that, although the

causes of these accidents and incidents differ greatly in detail, each of them resulted from some

violation of safety and effectiveness properties. On anthropomorphic terms, each of the automated

systems involved exhibited a lack of trustworthiness in carrying out its assigned task that would

have been recognized as unacceptahlc had the same task been assigned to a human crewmember.)

Furthermore, these problems hax e not been alleviated by experience, because the most recently

designed systems are charactcriied by violations of safety and effectiveness properties similar to

those encountered in previous desi,U'n generations. The discussion leads to the suggestion that formal

validation might signtficantl,^ inipro\ c operational safety. Cockpit interface design is discussed

briefly, and several heuristic Lurdelines are proposed.

The next section, "Future Work." discusses the possibility of modeling the lower levels of the

human pilot's activities invol\ ed in tactical supervision, enabling formal validation to be extended

to include the complete human marhinc cockpit interface. The potential for generalization of the

synthesis method developed w thu report to other hybrid systems such as highly automated industrial plants for petrochemicals and nuclear power is discussed in some detail.

Finally, the "Conclusions" arc prc,cnted, and the "References" and "Figures" complete the report.

The main report is presented M 'A olume One."

Volume Two presents seven appendices, which are intended to make the main report accessible to

readers with various backu,round,.

Appendix A presents a tutorial rc\ ic\\ of the U. S. Standard Atmosphere, with atmospheric parameters tabulated at six selected ahitudes tier- reference.

Appendix B presents a tutorial rc\ ic\\ of transport aircraft design and operation. Dynamic models

with three different levels of tidcl,ty are developed to support the present work; however, these

models may also be useful for Iuturr studies. Dynamic simulation is implemented by means of a

widely available spreadsheet. and several flying qualities criteria are illustrated by time histories of

aircraft motions in response to cic%ator steps and pulses.

Appendix C presents a rigorous development of the aircraft equations of motion derived by elementary methods in appendix B. and generalizes those equations for symmetric (coordinated) turning

flight.

15
Appendix D presents a brief tutorial review of elementary propositional logic, and provides a list of

theorems in symbolic logic for reference.

Appendix E discusses the application of elementary propositional logic to real-time embedded systems; statechart semantics are summarized, and modifications are proposed that facilitate implementation within a clock-based sequential machine.

Appendix F develops methodology for generating formal proofs, and applies it to provide rigorous

proof of several theorems that summarize the dynamical behavior of the transport aircraft and

control system described by the main report, enabling formal validation of the complete system to

be achieved. Independently verified regulator properties that ensure eventual capture of altitude and

airspeed targets are taken as axioms of the formal system, ignoring time-dependent detail. This

methodology enables application of ordinary (static) propositional logic to the dynamical system.

Currently available codes for automated hypothesis testing can provide the basis for a theoremproving tool, and it is suggested that such tools could play a crucial role in future system

development.

Appendix G presents brief statements summarizing the aspects of several selected transport aircraft

accidents and incidents that are considered relevant to issues of system design.

Recommendations for Readers

Readers desiring only an overview of the design procedure should read the section, "Overview of

Design Method," and then skip to the "Conclusions." Readers interested in the design and operation

of the complete system, but not in the details of the method of logical synthesis, should skip the

section "Synthesis of Path/Speed Command Supermode" and the synthesis discussion in the section

"Synthesis of Altitude Command Supermode." Readers interested primarily in the human-factors

aspects of formal validation should read the sections "Overview of Design Method," "Airworthiness,

Certification, and Cockpit Interface Design Issues," "Future Work," and "Conclusions."

Readers desiring additional background in transport aircraft design and operation can consult the

tutorial treatments in appendices A, B, and C, and the summary of selected accidents and incidents

in appendix G. Readers desiring additional background in formal logic and its application to realtime computation within embedded systems can consult appendices D and E. Specialists in formal

logic and automated hypothesis testing who are interested ill contribution that their expert knowledge can make to avionic system design should read the sections "Overview of Design Method,"

"Synthesis of Path/Speed Command Supermode," "Synthesis of Altitude Command Supermode,"

and appendix F. The formal proofs contained in appendix F are essential for formal validation of the

complete system, but it is expected that only readers familiar with formal logic and others with a

vital interest in formal validation will need to follow these proofs in detail; the introductory

discussion of proof methodology should be of more general interest.

16
OVERVIEW OF DESIGN METHOD

This section provides a brief, qualitative overview of the design method that is treated in detail in

this report. Because this section provides an overview of selected sections of the report, references to

tables 2, 3, 4, 6, and 7, and to figures 6 and 7 do not appear here in numerical sequence. The design

procedure, which is illustrated by the block diagram of figure 5, can be summarized by the following

steps (terms in italics refer to the elements of figure 5):

Formulation of Synthesis Problem

The aircra/i model for longitudinal motions in the plane of symmetry is developed, and the

governing differential equations are derived. The aircraft motion is described, like that of any

rigid body, by six ordinary differential equations. As a consequence of the assumed bilateral

symmetry of both the aircraft itself and the surrounding aerodynamic flow field, those six

equations separate into two uncoupled sets of three equations each, one set describing the

longitudinal motions, which are the subject of this report, and the other set describing the

lateral-directional motions, which are not treated.

Safety

hazards

FLIGHT ENVELOPE

- ---------- --- Safety Safety

margins properties

AIRCRAFT Static i ENVELOPE Envelope MODEL LIMITS Aircraft + protection

Control

inputs

DIFFERENTIAL

EQUATIONS

Aircraft i

response

dynamical

behavior modes

MODE VALIDITY Validity

(qualitative) DEFINITION ANALYSIS table

Dynamic STABILITY Primitive

} control t

i REGIONS modes

Flying qualities Effectiveness

- - - - - - - - - - - - - - criteria properties

(functionality)

a) Formulation of design synthesis problem.

Heuristic

design Information Maximum

strategies availability effectiveness Initialization

1 + + Mode 1

Partitioned selection

Validity ^ARTITIONING validity table ISEMODEON table STATE CHART

cti n

Moection table PROCESS CRITERIA CONSTRUCTION sel

1 t System

Validity Engineering properties

case analysis

b) Solution of design synthesis problem.

Figure 5. Design Method.

17
The aircraft model is finr ther simplified by the assumption that elevator control is sufficiently

powerful and pitch response sufficiently rapid to generate any desired lift variation. This

assumption eliminates the pitching moment equation from the three-degree-of-freedom model,

reducing the aircraft model to two degrees of freedom. Because rotational pitch dynamics are

eliminated from the model together with the pitching moment equation, the two-degree-offreedom model treats the aircraft as a point mass concentrated at its center of gravity. A detailed

justification for use of this simplified model is presented, based on response calculations that

demonstrate the excellence of the approximation for representative transport aircraft

(appendix B).

The response parameters of the two-degree-of-freedom model (eqs. (1) and (2)) are flightpath

angle (climb angle) and airspeed. and the control parameters are pitch and thrust. The state space

for the continuous differential equations consists, therefore, of the two-dimensional flightpathairspeed plane. Furthermore, fli_g htpath angle and airspeed are also the selected output variables.

2. The differential equations are solved for the steady state, and theflight envelope diagram is

constructed (fig. 8) by cross-plottin_u flightpath angle versus airspeed with contours of pitch and

thrust as parameters. The physical limits of the flight envelope (envelope li»rits), which are

quasi-static, correspond to nllnlllium thrust, maximum thrust, minimum airspeed, and maximum

airspeed. Minimum airspeed is determined in normal symmetric flight by the stalling speed, and

in abnormal engine-out fli__ht b y the minimum control speed. Maximum airspeed is determined

by structural limits at low altitude and by compressibility (Mach) limits at high altitude.

During manual flight, the pilot controls pitch with elevator and engine revolutions per minute

(rpm) with throttle. It can he seen from the flight envelope chart of figure 8 that the steady-state

solution of the differential equations for any combination of control inputs is determined by the

intersection of the conrespondin_-, pitch and thrust contours. The desired solution is termed the

target operating point.

3. The dynamic response of the aircraft to control is related to its flight envelope as follows. The

accelerations acting on the aircraft can be determined graphically from the flight envelope

diagram by noting the position of the point corresponding to the current path and speed of the

aircraft relative to the pitch and thrust control contours (fig. 9), which is equivalent to constructing the direction field ofsolutions to the differential equations. By stepwise numerical integration of the accelerations. each solution of the differential equations can be mapped into a unique

path in the path-speed plane. ( Representative paths connecting initial and final points are illustrated in the flight envelope dia g rams of figure 10.) Thus, in principle, complete information about

the dynamical behavior of the aircraft is contained geometrically in the flight envelope diagram.

4. Analysis of the differential equations shows that, qualitatively, only three kinds of aircraft

behavior need to be considered. Ifboth pitch and thrust are available for control (termed Type (i)

control), then both flightpath angle (climb angle) and airspeed can be controlled independently.

If thrust is fixed (saturated) so that only pitch is available for control, then either airspeed can be

controlled at the expense of ili g htpath angle (termed Type (ii) control), or else flightpath angle

can be controlled at the expense of airspeed (termed Type (iii) control). By analyzing the

18
stability properties of the solutions corresponding to each of the three kinds of dynamical

behavior, the flight envelope is partitioned geometrically into seven discrete regions (fig. 10),

within each of which the dynamical behavior of the aircraft is qualitatively similar. Physically,

the boundaries separating these stability regions correspond to thrust control saturation and to

speed for minimum drag.

These boundaries are treated as mathematically sharp. (Uncertainties contributed by noisy

measurements or external disturbances remain to be dealt with during implementation.) With

sharp boundaries, logical completeness of the classification scheme is established by inspection

of the flight envelope diagram to ensure that all points in the plane lie in one discrete region or

another, so that no point exists in the state space that is not identified by its region.

5. Primitive control modes are defined for the automated system (fig. 11) that correspond qualitatively to the three kinds of dynamical behavior, and control laws are specified quantitatively to

satisfy applicable flying qualities criteria for manual control.

6. Flight safety hazards are identified a priori, and safety margins providing protection against

these hazards are applied to the physical Iiinits of the flight envelope to define safe envelope

limits (fig. 13). Envelope protection is discussed, and envelope protection modes are defined.

General effectiveness properties that the complete system is required to satisfy to assure capture

of flightpath and airspeed targets are specified, and are related to the performance capability of

the aircraft. Steady-state values of flightpath angle and airspeed must lie within the aircraft flight

envelope. Complete effectiveness, partial effectiveness, and normal effectiveness are defined,

and requirements for annunciation of effectiveness violations are specified.

Mode validity is defined to require that both safety and effectiveness properties hold. For each

primitive mode, a validity analvsis based on the differential equations specified by the control

law is performed, and the region in state space (the flightpath-airspeed plane) is determined that

corresponds to valid operation of the aircraft in that mode. In figure 10(a), only Region I is valid

for Type (i) control. In figure 10(b), all regions except Regions VI and VII are valid for Type (ii)

control. In figure 10(c), only Regions 1, I1, 111, and IV are valid for Type (iii) control.

Discrete validity conditions are enumerated, and these conditions are related geometrically to the

discrete stability regions determined previously (fig. 10). The validity conditions are summarized

by a table (table 2) that gives the validity of each mode as a function of the instantaneous measured values of path and speed, and of the desired (target) values of these parameters. This

validity, table completes the formulation of the synthesis problem.

Solution of Synthesis Problem

9. In principle, the mode selection logic for the primitive modes can be synthesized by inversion of

the validity table (table 2), interchanging arguments with tabulated quantities. Before inversion,

validity conditions are tabulated. with modes and parameters as arguments. After inversion, truth

values would be tabulated with modes and validity conditions as arguments (that is, the inverted

19
table would be a truth table for table 2). However, brute-force inversion based on enumeration of

all cases is shown to be intractably complex.

In table 2, there are 10 binary conditions. (These binary conditions can be seen more clearly by

expressing them in terms of symbolic logic, as in table 3.) It may be seen that there are 5 binary

conditions that determine the validity of the y-V Command mode (first column of table 3), 7 conditions that determine the validity of the V Command mode (second column), and 7 conditions

that determine the validity of they Command mode (third column). If these conditions were all

independent, there would be 25 = 32 combinations requiring evaluation for assessment of the

validity of the y-V Command mode, 2' = 128 combinations for the V Command mode, and

2' = 128 combinations for the y Command mode. After accounting for duplication of conditions

between columns, it is found that there are actually 10 independent conditions in table 3. It

follows that, for assessment of the validity of all three primitive modes by inversion of the whole

table, there would be 2 10 = 1024 combinations requiring enumeration. Furthermore, a mode

selection policy would have to be formulated specifying a unique mode selection for each of

these 1024 combinations. Therefore, it must be expected that a naive, brute-force approach based

on enumeration of all cases would be found intractably complex.

10.Heuristic design strategies for mode selection and for input screening of target values (table 4)

are developed, based on general notions of maximum effectiveness, best approximation, and

logical dominance. When adopted, these strategies can be regarded as part of the functional

specification if desired.

11. The validity table (table 2) is partitioned with the help of the heuristic strategies and extensive

use of elementary symbolic logic, accounting for logical dependencies.

12. The partitioned validity table is inverted to generate a logically complete list of enumerated

cases (table 6). Each case corresponds to a single combination of conditions that determine the

validity of each mode, and is related geometrically to a well-defined region of the tlightpathairspeed plane.

13. Mode selection criteria are applied to each enumerated case to generate the mode selection table

(table 7). In some cases validity considerations alone are sufficient to determine mode selection.

In some cases for which no modes are valid, the information available is nevertheless sufficient

to determine mode selection, otherwise, engineering analysis is applied on a case-by-case basis

to determine the least adverse choice. in cases for which multiple modes are valid, mode selection is based on maximifing gffectiveness. The resulting mode selection table (table 7) determines

mode selection uniquely for each enumerated case and for the geometric region (fig. 10) to

which that case corresponds.

14. The mode selection statechart (fig. 15) is constructed directly from the mode selection table,

specifying mode initialization according to a simplified initialization strategy developed

separately.

20
15. After completing steps 1-14, system properties are summarized by concise statements of system

behavioral properties that enable formal validation of the complete system to be achieved. (For

the Altitude Command supermode, which is functionally similar to the Flight Level Change

mode in current transport aircraft, the dynamical behavior of the synthesized system is summarized by five theorems (appendix F) that demonstrate satisfaction of the general safety and effectiveness properties imposed a priori.)

An Example Illustrating Invalid Mode Selection

Partitioning of the two-dimensional state space into well-defined regions of mode validity, as just

discussed, has laid the groundwork for a concrete example illustrating the potentially catastrophic

consequences of invalid mode selection, which is presented next. This example supplements the

abstract discussion of automation surprises presented in the "Introduction."

Performance Envelope

Figure 6 illustrates the performance envelope for a representative transport aircraft. It can be seen

that the upper broken contour represents the variation of maximum flightpath angle (climb angle)

with airspeed with all engines operating at maximum thrust, and the solid contour (center of diagram) represents its variation with one engine inoperative. The operating point shown (open circle)

is typical for the initial climb after takeoff. Comparison with figure 10(a), shows that the initial

operating point lies in Region I.

Engine Failure After Takeoff

Now assume that an engine fails abruptly, and that maximum available thrust is applied to the

remaining engines. The maximum possible climb angle is therefore reduced to the level corresponding to the solid contour, and the thrust control becomes saturated. Since by definition Type (1) control requires unsaturated thrust, Type (i) control is not available, and either Type (ii) control (that is,

speed control) or Type (iii) control (that is, path control) must be selected.

System Behavior

Comparison with figure 10(c) shows that just after engine failure the operating point lies in

Region V, even though the operating point itself remains unchanged during the brief time interval

during which the failure is assumed to take place—it is the maximum thrust contour that changes,

not the operating point.

In Region V, Type (iii) control is invalid. If Type (iii) control is selected, the aircraft trajectory will

follow the horizontal path marked P in the diagram (fig. 6): path is controlled at the expense of

speed, which decreases steadily until penetration of the minimum-control-speed boundary (left side

of diagram) causes potentially catastrophic loss of control.

On the other hand, if Type (ii) control is selected, the aircraft trajectory will follow the vertical path

marked S in the diagram (fig. 6): speed is controlled at the expense of path, which decreases steadily

until equilibrium is reached as shown (tilled circle) oil maximum-thrust contour. Certification

criteria require that the resulting climb gradient must provide adequate obstacle clearance, ensuring a

safe outcome when speed control is maintained.

21
Discussion

It is clear that Type (ii) control should be selected after engine failure. The resulting operating point

has two desirable properties: first, it represents the best approximation to the initially selected

operating point that is physically realizable following engine failure; and second, it results in the

steepest climb gradient achievable at the selected airspeed. Nevertheless, selection of Type (iii)

control has caused at least one aircraft accident under similar conditions. Avoiding such catastrophic

mode selections presents a challenge to designers of automated systems.

The method of synthesizing mode selection logic that is developed in this report avoids selection of

invalid modes whenever possible. If none of the available modes is valid, case analysis based on

enumeration enables selection of the least adverse choice. If several modes are valid, the selection is

made so as to maximize effectiveness. This strategy results in best physically realizable approximations when the aircraft is subject to performance limitations of various kinds.

In the engine failure case discussed in this example, it should be noted that correct mode selection

need depend only on mode validity (which is based on general identification of geometrical stability

regions within the state space), and does not require specific identification of engine failure. With

this validity-based mode selection strategy, it is recognition that the target climb angle exceeds the

S = Speed Control

P = Path control Maximum thrust. all engines

O Initial

I

r

r p climb i

a S i

y r Maximum thrust. engine out

-0 0.

m E

m U

a

r

r_° Steady-state performance envelope

E

iz

m

3

E U

h

C

N

Minimum (idle) thrust

E

m

3

U

in

Airspeed

Velocity vector

Engine failure during initial climb at scheduled thrust. Following

Flightpath angle engine failure. selection of automated speed control is valid. but

selection of automated path control results in potentially

Horizontal plane catastrophic penetration of minimum-control-speed boundary.

Figure 6. Engine failure during initial climb.

22
performance capability of the aircraft that triggers reversion to Type (ii) control, not recognition of

engine failure. Therefore, any other failure that caused a similar loss of performance (perhaps a

hydraulic fault that prevented landing-gear retraction) would result in a similarly safe outcome—all

that is required is onboard determination of validity regions within the state space (that is, detennination of performance-envelope limits) with sufficient accuracy. This strategy stands in sharp contrast

to other design methods that attempt specific identification of each possible abnormal condition in

order to enable appropriate mode selection.

AIRCRAFT MODEL

The aim of the following discussion is to enable a qualitative understanding of "what the automated

control system is trying to do, and how it does it" that is accessible to readers without a detailed

mathematical grasp of the properties of nonlinear differential equations. The necessary background

follows: (1) elementary differential calculus for definition of derivative; (2) elementary integral

calculus for definition of integral, and for approximate evaluation of definite integrals by trapezoidal

rule; and (3) elementary physics for formulation of differential equations according to Newton's

second law.

Because the differential equations governing the aircraft motion are solved numerically by the

control system, and because this motion is driven by pilot control inputs and by atmospheric disturbances whose forms are unknown until they are encountered in real time, classical methods of

solving differential equations for known forcing functions are of little help in understanding control

system actions and aircraft dynamic responses. (Dynamical responses to representative simplified

pilot control inputs are calculated numerically and discussed in detail in appendix B.) Fortunately,

the qualitative understanding of aircraft dynamical behavior that is essential for this report is not

difficult, and indeed is already familiar to pilots.

Definitions and Assumptions

Readers unfamiliar with aeronautical terminology would no doubt find unintelligible the summary

statement that the mathematical aircraft model to be developed will be based on path-frame description of the motion of a rigid aircraft with negligible thrust inclination during straight, symmetric,

wings-levelflighi in sti// air over a hat, rtonrotating Earth. The discussion must therefore begin by

explaining the technical definitions of the italicized terms and the simplifying assumptions they

imply. A more expanded treatment can be found in appendix B.

Symmetric

Not only is the aircraft structure bilaterally symmetric, but the aerodynamic flow fields on each side

of the aircraft plane of symmetry are mirror images of each other. The small asymmetric rotational

effects owing to like-rotation engines are neglected. The aircraft velocity vector lies in the plane of

symmetry.

Transport aircraft operate in symmetric flig ht except during crosswind landing and in case of engine

failure. The effects of thrust asymmetry owing to engine failure are discussed later.

23
Straight

The projection of the aircraft trajectory in the ground plane (its track) is a straight line. For straight,

symmetric flight, the wings of a symmetric aircraft must be level. Results are generalized later to

include symmetric (coordinated) turning flight (appendix Q.

Rigid Aircraft

By definition, the distances between each pair of points in a rigid body must remain fixed, but transport aircraft cannot be considered structurally rigid (indeed, they are quite flexible). Nevertheless,

the frequencies characterizing elastic structural deformations (vibration) usually lie so far above

those for rigid-body motions of the whole aircraft that the airflow can be considered to act upon the

deformed aircraft. In that case (the quasi-static assumption), the aircraft can be treated as a rigid

body provided that aerodynamic force and moment parameters are suitably modified to incorporate

the effects of structural deformation. With the quasi-static assumption, aircraft motions (like those of

any other rigid body) can be described by six ordinary differential equations involving six degrees of

freedom.

Movable control surfaces are assumed to be balanced and irreversibly actuated, so that no additional

differential equations are required for description of their motions. Gyroscopic effects of rotating

engine machinery are neglected.

Still Air

The static atmospheric environment is specified by the Standard Atmosphere (appendix A), which

describes the variations of ambient temperature, pressure, air density, and sonic velocity with height

above the surface of the Earth. The effects of atmospheric disturbances such as steady (horizontal)

wind, steady (vertical) draft, wind shear, and atmospheric turbulence are discussed later.

Flat, Nonrotating Earth

The gravitational force at the surface of the Earth is assumed to remain fixed independent of height,

and small Coriolis and centrifugal ("weightlessness") accelerations are neglected. The spherical

Earth is approximated by a tangent horizontal plane, with the point of tangency directly below the

aircraft (local tangent plane approximation). These approximations are valid for control of subsonic

transport aircraft.

Reference Frames

Body Frame

The origin of the body ./rame is located at the aircraft center of gravity. Its longitudinal X axis is

aligned with the aircraft reference fuselage axis (often parallel to the cabin floor). The lateral Y axis

is orthogonal to the plane of symmetry and positive toward the right wing. The vertical Z axis is

positive downward in the plane of symmetry, forming a right-hand orthogonal triad with the X and

Y axes. The pitch angle 6 measures the angular elevation of the X axis relative to the local horizontal plane (fig. 7(a)). It is essential to describe the rotational motions of the aircraft in the body frame

to avoid appearance of the moments and products of inertia as time-varying parameters in the equations of motion.

24
Path Frame

The origin of the path fi°ame is located at the aircraft center of gravity. Its tangential T axis is aligned

with the aircraft velocity vector. In symmetric flight, the lateral L axis is orthogonal to the plane of

symmetry, and coincides with the Y axis of the body frame. The normal N axis is positive downward

in the plane of symmetry, forming a right-hand orthogonal triad with the T and L axes. The flightpath angle y measures the angular elevation of the T axis relative to the local horizontal plane. In

straight, symmetric flight the angle of attack a is equal to the angular difference (6 — ,y) (fig. 7(b));

symmetric (coordinated) turning flight is discussed later.

Pilots perceive these angular relationships from inside the aircraft, of course, and express them by

saying that the pitch angle describes where the aircraft is pointing, the flightpath angle describes

where it is going, and the angle of attack is the difference between where the aircraft is pointing and

where it is going. Except during takeoff and landing, the pilot's primary control task can be regarded

as control of the velocity vector in such a way as to realize the mission objectives summarized by the

flight plan; pitch control is then considered a means by which control of the velocity vector can be

achieved.

It will be shown next that the aerodynamic lift and drag forces and also the engine thrust force are

aligned with the axes of the path frame, so that only the gravity force requires trigonometric transformation. Therefore, choice of the path frame for the translational motions is convenient from two

viewpoints: first, the pilot's task is closely related to the path-frame motion parameters (flightpath

angle and airspeed); and second, the force description and the resulting equations are simplified.

Lift, Drag, and Thrust

The propulsive force (gross thrust) acts in the plane of symmetry; its component along the T axis is

termed the net thi,ust. Thrust inclination relative to the T axis is negligible for conventional transport

aircraft, together with interference effects between engine efflux and external aerodynamic flow.

Therefore, the total engine thrust is assumed to act along the Taxis. By definition, the aerodynamic

drag force acts in the negative T (streamwise) direction, and the lift force L acts upward in the negative N direction (fig. 7(c)). Under the quasi-steady flow assumption (appendix B), the aerodynamic

forces are assumed to depend only on the (vectorial) velocity of the aerodynamic flow relative to the

aircraft.

Airstream

X Body Airstream

X Body Y ^......... W L

H

^^ Tangential Yp

X Earth X Earth

T

Z Body Normal

Z Earth Z Earth

a) Earth frame and body b) Path frame aligned with c) Force equilibrium.

frame. velocity vector.

Figure 7. Reference frames.

25
Equations of Motion

Under the assumptions just discussed, the aircraft motion is described. like that of any rigid body, by

six ordinary differential equations. As a consequence of the assumed bilateral symmetry of both the

aircraft itself and the surrounding aerodynamic flow field, those six equations separate into two

uncoupled sets of three equations each, one set describing the longitudinal motions, which are the

subject of this report, and the other set describing the lateral-directional motions, which are not

treated. The set of three longitudinal equations comprises (1) the longitudinal, force equation (sometimes termed the streamwise force equation), which describes translation along the T axis of the path

frame, (2) the normal_force equation (sometimes termed the lifi equation), which describes translation along the N axis of the path frame, and (3) the pitching-moment equation, which describes

rotation about the Y axis of the body frame.

Three-Degree-of-Freedom Model

These three equations of motion are obtained by application of Newton's second law to the rigid

aircraft. An elementary derivation can be found in appendix B, and a rigorous but nonelementary

derivation of the two force equations making use of vector-matrix methods is presented in

appendix C. The three longitudinal equations of motion are as follows (fig. 7(c)):

1 dV T — D — — sin y (1)

g dt W

Vdy_L

— — —cosy (2)

dt W

I d = M Y (q. da/dt, (x, V, 8ELEV) (3)

where the notation is given ill "List of Symbols."

The quantity (1/g)(dV/dt) oil left side of equation (1) is the (normalized) longitudinal acceleration, and the quantity (V/g)(dy/dt) on the left side of equation (2) is the (normalized) normal acceleration, which is proportional to curvature of the flightpath in the plane of symmetry. The lift and

drag forces are related to an-le of attack and airspeed by functions (appendix B) of the form

L = L (a, V) and D = D (L, V) (4)

The angle of attack is related to pitch angle and fli g htpath angle by the kinematic equation

a=6—y (5)

which is valid for straight, symmetric, wings-level flight, as already noted.

26
It can be seen that equation ( I ) is coupled to equation (2) by the 7 term, and to equation (3) by the

lift and drag variations of equation (4). Equation (2) is coupled to equation (3) by the lift variation

(4) and the kinematic relation (5), and to equation (1) by the airspeed factor V on the left side of

equation (2). Equation (3) is coupled to the other equations by the functional dependence of pitching

moment on pitch rate, angle-of-attack rate, angle of attack, and airspeed, as indicated on the right

side of equation (3). Therefore, the three differential equations form a coupled nonlinear dynamical

system. Detailed numerical calculations of the response of this coupled system to elevator impulses

and steps are presented in appendix B.

Two-Degree-of-Freedom Model

The pitching moment My on the right side of equation (3) is proportional to the elevator deflection

SELEV, which the pilot controls directly during manual flight by means of the cockpit control column.

The pilot shapes the column control input as necessary to obtain the desired pitch response, despite

the unwanted coupling that results from the dependence of the pitching moment My upon the angle

of attack ct and its rate of change da/dt and upon the airspeed V (eq. (3)). This desired pitch

response then results in the desired angle-of-attack response (eq. (5)) and the desired lift (eq. (4)).

The lift determines the normal acceleration according to equation (2). Indeed, one of the oldest and

most important flying qualities criteria is the specification of column force required to generate an

incremental normal acceleration of 1 g.

The time integral of normal acceleration then determines the flightpath response according to

equation (2), which is coupled with equation (1), as already noted. Dynamic response calculations

for a representative transport (appendix B) show that fli ghtpath follows pitch with a time lag in the

order of 2 sec that characterizes the aircraft. Flightpath response to an elevator (column) impulse

stabilizes within 3 sec (the short term); airspeed responds much more slowly.

Therefore, provided that the elevator control is sufficiently powerful and the pitch response sufficiently rapid (that is, pitch response bandwidth is sufficiently wide) relative to the flightpath

response, the pitch angle itself can be regarded as the controlled quantity instead of the elevator (or

column) deflection. It then follows from equations (4) and (5) that any desired variation of lift can be

generated by means of pitch control. This assumption is justified for transport aircraft designed to

meet applicable flying-qualities criteria for manual control, because pitch bandwidth and control

power are much higher than necessary for low-bandwidth automated control of flightpath and

airspeed, especially when modest acceleration limits are imposed for passenger comfort. (Highbandwidth tasks such as automatic landing are not considered in this report.)

This assumption that pitch control can generate any desired lift variation eliminates the pitching

moment equation, reducing the aircraft model to two degrees of freedom. Because rotational dynamics are eliminated from the model together with equation (3), the two-degree-of-freedom model

treats the aircraft as a point mass concentrated at its center of gravity. Appendix B presents a

detailed justification for choice of this two-degree-of-freedom model based on response calculations

that demonstrate the excellence of the approximation for representative transport aircraft.

27
To summarize, the two-degree-of freedom model consists of the longitudinal force equation (1), the

normal force equation (2), and the functional relations (4) that describe the lift force L and the drag

force D. As a first step toward understanding the dynamical behavior of the aircraft, the steady-state

solution of these equations is studied in the next section.

Flight Envelope

For steady (trimmed) flight conditions, the acceleration terms on the left sides of equations (1) and

(2) must vanish, so that the equations become (as illustrated by figure 7(c))

Sill y = T WD (1 a)

and

cos y = L (2a)

W

Denoting the trimmed (potential) 1ightpath angle by yroT, equations (la) and (2a) become

TD

sinyPOT

W

(1b)

and

L

cosy t,ot- W (2b)

For flight in still air, yro,z is also an aerod y namic flightpath angle that is referred to the air mass, as

are of course the aerodynamic forces L and D. The parameter yroT can also be regarded as a control

parameter that plays the sank role as thrust. (The parameter yroT is the same as that denoted by yTRiM

in appendix B.)

Lift and Drag Characteristics

Appendix B shows how the I i h and dritu forces are reduced to nondimensional coefficients whose

characteristic variations can he studied in canonical form. Briefly summarizing the results, the lift

coefficient CL and the drab coclfi( Iciit CI) are defined by the equations

z

L= PV_ S C' t (a,M) D= p

2

S C o (a,M) (B-6d)

In the equations (B-6d), the Alach number M is defined by M = V/a where a denotes the sonic

velocity, and the quantity pV','2 is termed the dynamic pressure, where p denotes atmospheric

density.

At low Mach numbers below M = 0.3, the effects of Mach number are unimportant, so that M can be

dropped from the functional relations (B-6d). Appendix B shows that the lift coefficient C L increases

28
W/S sin y

g T — CDP V '"/2 — I W/Ssin 7NOT — n

POT AR e P„VE-/2 W W/S P„ E

(B- l Od)

n AR e (p0VE^/2)

linearly with angle of attack, reaching its maxima» value at the stalling angle. At higher Mach

numbers, the lift-curve slope dCL/da increases slightly, and the maximum value of the lift coefficient decreases as shock waves form on the aircraft wings.

Appendix B shows that the drag coefficient CD varies parabolically with angle of attack, and therefore with lift coefficient (that is, the drag polar curve is parabolic). At Mach numbers above M = 0.6

the drag coefficient increases with Mach number, slowly at first and then more abruptly as shock

waves form on the aircraft.

in steady flight, the lift L must equilibrate the normal component of aircraft weight W according to

equation (2a). Appendix B shows that the variation of the drag D with airspeed V determined by

equations (2a) and (B-6d) is quadratic, taking on its minimum value at an intermediate airspeed

termed the speed.for mininntin drag, and increasing at both lower and higher airspeeds.

Engine Thrust Characteristics

Appendix B shows that, at altitudes below 15,000 ft, maximum available engine thrust decreases

slowly with increasing airspeed and Mach number. As altitude increases, the slope dT/dM of this

thrust variation decreases; at cruising altitudes, the available thrust becomes nearly independent of

Mach number.

Performance Envelope

The aircraft performance envelope for steady flight (that is, for flight conditions in which both the

longitudinal acceleration dV/dt and the normal acceleration V (dy/dt) vanish) is determined by the

variation of the trimmed flightpath angle yi>oT with airspeed or Mach number, which is found by

substituting into equations (1 b) and (2b) the lift, drag, and thrust functions just discussed.

Appendix B shows that the resulting quadratic variation of yroT with airspeed is given by the

equation

where the notation is given in the "List of Symbols.”

Sample calculation— Equation (B-10d) gives the variation of the equilibrium (steady-state) flightpath angle 71)o^t with equivalent airspeed Vt;, with the thrust T (or, alternatively, the engine rpm N) as

parameter. It can be seen that, at a known height H in the Standard Atmosphere (appendix A) and at

a selected equivalent airspeed Vi, and with known aircraft parameters T/W, W/S, Cpp, AR, and e,

equation (B- I Od) is quadratic in sin yroT and can be solved for yPoT in closed form. The following

parameter values are representative for a transport aircraft climbing with maximum thrust at sea

level at the minimum-drag airspeed (table 1, appendix B):

W/S = 150 lb/ft' Cpp = 0.0150 AR = 7.19 e = 0.83

V = 487.9 ft/sec VE = 289.1 kt M = 0.437 T/W = 0.1765

29
With these parameter values, equation (13-10d) becomes

sin YPOT — 

0.028 286 sine 

YPOT = 0.1200 (B-1 Oe)

The numerical solution for sin YPOT is 17.6766 ±17.5562, or, because the property sin (.):5 1 rules

out the positive sign,

sin YPOT = 0.1204 YPOT = 6.92 deg

Because YPOT is small, the exact result differs trivially from the approximation obtained by neglecting the small sine 'YPOT term. At this climb angle and airspeed, the lift coefficient, the drag coefficient, the lift/drag ratio, and the rate of climb are found for reference to be

CL = 0.53 Co = 0.0298 L/D = 17.7 dH/dt = 3524 ft/min

Thrust contours— Repeating the calculation over the airspeed range of interest and plotting YPOT

against VE or M (eq. (B-7m), appendix B) defines the contour for maximum thrust, which forms

the upper boundary of the flight envelope. The contour for minimum (idle) thrust forms the lower

boundary. Contours for intermediate values of thrust can be added as desired to complete the diagram for the aircraft performance envelope (Innis, Holzhauser, and Quigley, 1970).

Pitch contours— A second set of contours corresponding to constant pitch angle can be constructed

in the following way. Solve equation (2b) and equation (B-6d) for the lift coefficient

CL = C W cosYPOT =[(W/S) /(pV2/2)] COS YPOT (B- l Of)

which determines the lift coefficient for any point (V E, YPOT) within the flight envelope, because YPOT

is given by the ordinate and the dynamic pressure (pV 2/2) is determined by the abscissa V E (or M).

Now, the lift coefficient is related to angle of attack by a linear equation, which can be solved to find

the angle of attack corresponding to the selected point. With both the flightpath angle YPOT and the

angle of attack a known, the pitch attitude 0 can be found from the following equation:

0=a+y (5)

which is valid for wings-level flight as already noted.

Flight envelope chart— A representative flight envelope is illustrated by figure 8. The left-hand

boundary corresponds to the stalling speed. The right-hand boundary is determined by structural

limits at low altitude, and by compressibility (Mach) effects at high altitude. The upper and lower

boundaries are determined by the maximum and minimum thrust limits, respectively, as noted

previously. Because at any fixed throttle setting (constant engine rpm), thrust decreases with speed

(eqs. (B-8f) and (B-8g), appendix B), the thrust contours take on their maximum values of YPOT at

airspeeds slightly below the speed for minimum drag.

30
Maximum

thrust

Minimum

thrust

Oa

rncm

r

ma

t

rn

LL

Maximum takeoff weight Sea level

STALL MIN DRAG uMAX

Airspeed

Figure 8. Aircraft performance envelope.

The flight envelope illustrated by figure 8 applies to an aircraft at maximum takeoff weight (wing

loading W/S of 150 Ib/ft) operating at sea level, as indicated on the diagram. Other parametric

values of wing loading and altitude would result in flight envelope charts similar in form but

differing in details. Various schemes are available for nondimensionalizing the parameters to enable

a single chart to serve for all flight conditions (Taylor, 1974). Appendix B shows that the equivalent

airspeed at which wing stall occurs depends only on aircraft weight (specifically, on wing loading),

and is independent of altitude. Therefore, at low speed the equivalent airspeed, which is approximately the speed that is indicated by the standard cockpit airspeed indicator, is an especially convenient choice for the abscissa of the flight envelope chart. At high speed, the Mach number may be a

more convenient choice for the abscissa.

Onboard calculation— However, it is not necessary to calculate the entire flight envelope on board

the aircraft. The following discussion shows that knowledge of the upper flight envelope limit

yPoT MAx and the lower limit yroT MIN at the instantaneously prevailing (measured) airspeed is sufficient to determine mode selection for the flight control system to be developed. For that purpose,

only the aircraft weight W, the drag D (estimated from the aircraft polar drag curve), and the maximum and minimum thrust limits are necessary (eq. (lb)). These parameters must be updated continuously by the onboard system. Correction of the flight envelope for the effects of nonstandard

ambient conditions, of turning flight, of wind, draft, and wind shear, and of engine failure are discussed next.

31
Nonstandard Atmospheric Conditions

The effects of nonstandard atmospheric conditions can be accounted for by using onboard measurements of ambient temperature and pressure in performance envelope calculations instead of Standard

Atmosphere values.

Symmetric (Coordinated) Turning Flight

In symmetric (coordinated) turning flight with near-zero sideslip, the increased lift required can be

approximated by replacing the aircraft weight W with W/cos 0 in the lift equation, where 0 is the

angle of bank (appendix Q. Therefore, the effect of turning flight is the displacement of the

constant-thrust contours downward and to the right, the same as for increased weight. To verify this

effect, note that reducing the T/W term in equation (B-1 Od) reduces yro T displacing the contours

downward, while increasing V so as to hold the other terms constant at increased weight displaces

the contours to the right.

The increased angle of attack required to generate the increased lift can be approximated by dividing

the right-hand side of equation (5) by cos 0. Both these approximations are valid over the range of

bank angles encountered during controlled flight of transport aircraft (appendix Q.

Steady Horizontal Wind

Appendix B shows that the equations of motion remain unchanged during flight in steady horizontal

wind, provided that flightpath angle and speed are measured with respect to the airmass. Therefore,

the flight envelope also remains unchanged.

Wind Shear and Vertical Draft

If the airmass accelerates instead of moving uniformly, or if the wind field varies with altitude so

that the aircraft encounters changing winds during climb or descent, appendix B shows that an

additional term involving the wind shear (time rate of change of tailwind velocity) appears in the

longitudinal (streamwise) force equation. In an increasing tailwind. this wind-shear term acts to

reduce airspeed in the same way as a drag increase. Because lift is proportional to the square of

airspeed, the loss of lift owing to reduced airspeed results in downward acceleration, causing the

aircraft to settle below its still-air path. Aircraft performance can be severely degraded. Steady

downdrafts have a similar performance-degrading effect on the aircraft even though the airmass

moves uniformly, because level flight relative to the Earth requires climbing flight relative to the

airmass.

It follows that tailwind shear and downdraft displace the constant-thrust contours of the flight

envelope downward toward smaller y, and, conversely, headwind shear and updraft displace them

upward. Contour displacement can be estimated from onboard measurements (Funabiki, Bando,

Tanaka, Hynes, and Hardy, 1993). (Shear disturbances exceeding the FAA-specified threshold of

2 kt/sec must be detected, and must cause the control system to transition to a special wind-shear

recovery mode, which is not treated in this report).

Engine Failure

Engine failure causes a loss of thrust that displaces the maximum-thrust contour downward toward

smaller y, leaving the zero-thrust contour (lower envelope boundary) unchanged. Thrust asymmetry

combines with limited rudder control power to define a sloping minimum-control boundary (VMc

32
contour in figure 8) such that, at airspeeds below Vmc aircraft controllability cannot be retained if

maximum thrust is applied to the operating engines. Since an engine could fail at any time, flight

below the minimum-control airspeed must be avoided in airline service. Actual thrust remaining

after engine failure can be estimated on board from measurements of engine rpm and ambient

conditions (appendix B).

Aircraft Dynamical Behavior

Pitch and Thrust Control

Specializing equations (1) and (2) for control of flightpath angle 'y and airspeed V by means of pitch

angle and thrust and placing the control quantities on the right, equations (1) and (2) become

1 dV

g dt

— + sin 7 = snl Y^,oT

(1 c)

and

V d ^ + cos Y= 

W

c)(2

where YPOT is defined by equation ( I b). The complete solution of equations (lc) and (2c) determines

the dynamic response of the aircraft to pitch and thrust control, which is discussed next.

Response Trajectories

The dynamic response of the aircraft to pitch and thrust control is closely related to the geometrical

form of the flight envelope diagram. The discussion begins with an overview of design issues before

taking up the dynamical behavior of the aircraft in detail.

Overview– The dynamic response of the aircraft to pitch and thrust control depends on the initial

operating point within its performance envelope. Operating points are selected to realize the flight

profile summarized by the flig ht plan (appendix B). Each operating point corresponds to a steadystate solution of the equations of' motion for specified pitch and throttle control inputs, and the

transitions from one operatin g point to the next correspond to transient solutions of the equations

of motion. Flying-qualities criteria based on pilot evaluation define what is meant by well-shaped

responses, which enable smooth. rapid capture of the desired (target) operating point during manual

control. Automated systems should be designed to achieve response shapes similar to those desired

for manual control, because from the flying-qualities viewpoint it can be taken as axiomatic that

behavior that is difficult to anticipate is difficult to monitor.

Steady-state solution– During manual flight, the pilot controls pitch with elevator and engine rpm

with throttle. It can be seen from the flight envelope chart of figure 8 that the steady-state solution of

the force equations (lc) and (2c) for any combination of control inputs is determined by the intersection of the pitch and rpm (thrust) contours corresponding to those control inputs. The desired steadystate solution is termed the target operating point. By definition, the longitudinal and normal accelerations must vanish at each steady-state solution point. It will be shown next that the accelerations

prevailing at any other point (that is, any point not corresponding to a steady-state solution) can be

determined directly from the flight envelope diagram.

33
rncm

L

ffl

Q

L

Q7

LL

Airspeed V

No equilibrium

t dV B g dt YTGT

ai

rn Unstable Stable c

Fixed f0L

thrust ma

L

LL

Of < 0 d` > 0

Airspeed V

A

11

Fixed

thrust

dV

dt z:

a) Longitudinal and normal acceleration variation b) Longitudinal acceleration variation with

with pitch and thrust control. airspeed at constant flightpath angle.

Figure 9. Speed stability.

Determination of normal acceleration— Equation (2c) shows that, at any airspeed V, the (normalized) normal acceleration (V/g) dy/dt is equal to the difference between the normalized lift L/W and

cosy In figure 9(a), L/W is related to the pitch angle contour corresponding to the instantaneous

pitch angle in the following way. At any fixed speed V, the lift force L is proportional to angle of

attack, and according to equation (5) the angle of attack is equal to the difference between pitch

angle and flightpath angle. Thus at any speed V and flightpath angle y, the normal acceleration is

proportional to the vertical distance from the instantaneous flightpath angle y upward to the pitch

angle contour corresponding to the instantaneous pitch angle 6. Therefore, if the pitch angle contour

is displaced upward from an equilibrium angle by an abrupt increase of pitch, the resulting normal

acceleration is proportional to the incremental displacement A6 (fig. 9(a)).

Mathematically, the variation of the lift coefficient C L with angle of attack a given by equation

(B-6d) can be linearized (appendix B). Then, by combining equations (2c), (5), and (B-6d), it can be

shown that the variation of normal acceleration (V/g) (dy/dt) with pitch angle 6 (while the airspeed

V and the fli ghtpath angle y remain fixed at their initial values Vo and yo) is determined approximately by the partial derivative

(a/a9) (V/g) (dy/dt) v.y = ( I /C W ) OCc/aa).

34
Determination of longitudinal acceleration— Since equilibration of normal forces takes place

rapidly following any disturbance (appendix B), it is reasonable to assume that normal forces remain

in equilibrium during the change of airspeed that follows an abrupt change of thrust, especially since

thrust inclination to the longitudinal axis has already been assumed to be negligible. It then follows

from equation (4) that the variation of drag with airspeed remains the same during such a speed

change as in steady flight.

Under these conditions, equation (1c) shows that, for small y, the normalized longitudinal acceleration (1/g)(dV/dt) is approximately equal to the increment y— YPOT. At any point, the normalized

longitudinal acceleration is therefore equal to the vertical distance from the instantaneous flightpath

angle y upward to the 7POT contour corresponding to the instantaneous thrust (fig. 9(a)). It follows

that, if the thrust contour is displaced upward from an equilibrium setting by an abrupt increase of

thrust, the resulting normalized longitudinal acceleration is equal to the incremental displacement

DyPOT• Extensive use will be made of this geometric relationship.

Direction field— The determination of the longitudinal and normal accelerations at a point (V, y) is

equivalent to construction of the direction field for the differential equations (I c) and (2c) at that

point. Starting from any initial point, each solution of the differential equations for specified pitch

and thrust control inputs can be mapped into a unique trajectory in the (V, y) plane by stepwise

numerical integration of the longitudinal and normal accelerations over the direction field. Thus,

in principle, complete information about the dynamic response of the aircraft is contained geometrically in the flight envelope diagram.

Flying qualities criteria— The final point of each trajectory (the steady-state solution) is determined

by the intersection of the pitch and thrust contours corresponding to the specified control inputs, as

already noted. In order to capture a specified target point, these control inputs should cause the aircraft to traverse a suitable trajectory from the initial point to the target point. Desirable trajectories

result in rapid but smooth capture maneuvers, subject to constraints on normal and longitudinal

acceleration and on control power. During manual control, the form of each capture trajectory is

generated by the human pilot. Flying qualities criteria applicable to transport aircraft specify aircraft

design characteristics that assure satisfactory dynamic response. These criteria are based on more

than 40 years of operating experience with both civil and military jet transport aircraft (Anonymous,

1985).

Dynamic Response

With the assumption that pitch control can generate any desired lift variation, as previously discussed, equation (2c) shows that the normal acceleration (V/g)(dy/dt) can be controlled as desired,

whatever the value of y. By adjusting the lift L to compensate for variations in airspeed V, the flightpath rate dy/dt can be controlled as desired, whatever the prevailing values of V and y. For example,

by making dy/dt proportional to the path error relative to the target y, smooth, rapid control of y

without overshoot can be obtained independent of V

Similarly, equation ( l ) shows that the longitudinal acceleration dV/dt can be controlled as desired by

varying the thrust T. By making adjustments in T to compensate for variations in flightpath y and

drag D, dV/dt can be controlled as desired, whatever the prevailing values of 'Y and D. For example,

35
by making dV/dt proportional to speed error relative to the target V, smooth, rapid control of V

without overshoot can be obtained independent of y.

Pitch and thrust control— By combining control of the flightpath angle yby varying the lift L (that

is, by varying pitch angle 6) and control of the airspeed V by varying thrust T, both the flightpath

angle y and the airspeed V can be controlled independently by simultaneous pitch and thrust control

inputs. Geometrically, the final solution point in the flight envelope diagram (fig. 8) is then determined by the intersection of the specified pitch and thrust contours, which can be made to coincide

with any target (V, y) point within the steady-state flight envelope.

Pitch control of airspeed with thrust saturated— If the thrust T is saturated at maximum or

minimum thrust, or fixed at any intermediate value so that only pitch is available for control, then

equation (2c) shows that the flightpath angle y can be controlled by pitch just as before. Equation (1)

shows that, if the flightpath angle y is regarded as the control variable replacing the thrust T (which

is now fixed), then dV/dt can be controlled as desired by making adjustments in yto compensate for

variations in drag D. For example, if dV/dt is maintained constant over a range of airspeed, then the

locus of operating points lies on a contour parallel to the fixed-thrust contour, but displaced from it

vertically by a distance equal to the normalized longitudinal acceleration (1/g)(dV/dt), as illustrated

by figure 9(a) (with the arrow reversed in sign). In order to control airspeed by varying pitch, the

flightpath angle 'y must be controlled so as to obtain the desired value of dV/dt in equation (1). The

flightpath angle y therefore cannot be controlled independently.

Geometrically, the final solution point in figure 8 is then located at the intersection of the fixedthrust contour with the vertical line corresponding to the target airspeed. By selecting the fixed

(target) thrust appropriately, any target point within the steady-state flight envelope can be captured.

(Strictly speaking, it is throttle setting that is maintained at a fixed value during manually controlled

flight; thrust itself then exhibits some variation with airspeed. For simplicity, thrust will be treated as

the control variable.) However, this report is concerned chiefly with thrust saturation at either maximum or minimum thrust.

Pitch control of flightpath with thrust saturated— It remains to study the control of the flightpath

angle y by varying pitch while thrust remains fixed. In contrast to the control of airspeed by pitch

just discussed, it will be shown that, when flightpath is controlled by pitch while thrust remains

fixed, it is not possible to capture any target point within the steady-state flight envelope, but only

those points that lie at or above the speed for minimum drag. This restriction results from considerations of speed stability when the flig htpath is constrained, which is analyzed in the next section.

Speed Stability With Thrust Saturated

If the tli-htpath angle y is controlled by varying pitch with thrust fixed, equation (2c) shows that

flightpath rate dy/dt can be controlled as desired, as noted previously. However, it is clear from

equation ( I ) that, with the variation of y specified, the longitudinal acceleration dV/dt cannot be

controlled independently when thrust is fixed. For simplicity, it is assumed that the flightpath angle y

is controlled so as to capture a fixed ytarget. Geometrically, the final solution point in figure 8 is

then located at the intersection of the specified fixed-thrust contour with the horizontal line corresponding to the target flightpath.

36
But inspection of figure 8 shows that the intersection of these contours does not determine a unique

solution. Because of its concave-downward form, any fixed-thrust contour has two possible points of

intersection with a horizontal line correspondin(, to a target flightpath, one at an airspeed above the

speed for minimum drag and the other below it. This ambiguity can be resolved by studying the

speed stability at each of these two points of equilibrium (fig. 9(b)), which illustrates longitudinal

stability while maintaining lift equilibrium (that is, dy/dt = 0).

Stable airspeed equilibrium- Considering first the speed stability in the neighborhood of the

equilibrium point to the right ol' the speed for minimum drag (point A in figure 9(b)), it can be seen

that at lower airspeeds to the Ich o1' point A where the target y lies below the fixed-thrust contour for

YPOT, the longitudinal acceleration is positive (eq. (1 c)), so that the airspeed tends toward point A.

Similarly, at higher airspeeds to the right of point A, the acceleration is negative, and again the

airspeed tends toward point A. It is clear that point A is a point of stable equilibrium.

Unstable airspeed equilibrium- By a similar argument, point B is found to be a point of unstable

equilibrium. Physically, this instabilit y at point B results from its location below the speed for

minimum drag. There, the total dra_, fierce is dominated by the induced drag, which increases with

decreasing speed (appendix 13). Thus the tangent dy/dV is positive along the fixed-thrust contour

near point B.

Geometrical regions- Geometricall y , it is clear from figure 9(b) that point A is an attractor point

whose region of attraction includes all points to the riglht of point B on the flightpath target line

through points A and B. l l' the taruct Ili_(Ihtpath angle is increased (or the fixed target thrust is

reduced), points A and B approach each other until they coincide at the speed for minimum drag. If

the target flightpath anglc is increased still tarthcr, it lies above the target thrust contour everywhere.

No steady-state solution then c\ists. and the long itudinal acceleration dV/dt is negative for all points

on the target flightpath line.

Aircraft operating characteristics -1 lie consequences of these facts for aircraft operation areas

follows. if the flightpath targ et lies hclo\y the fixed-thrust contour anywhere, so that some points of

equilibrium exist, then, startin,_ I'rom an y initial point on the flightpath target line to the right of

point B, the aircraft will capture and hold point A no matter what airspeed target has been selected.

On the other hand, startin^u, troni it)% initial point to the left of point B, the airspeed will diverge

toward stalling speed. By selcctln,' the tlxcd (target) thrust appropriately, any target point within the

steady-state flight envelope can he captured. provided that it lies to the right of the speed for mimmum drag. But the aircraft cannot capture a target point that lies within the steady-state envelope to

the left of the speed for minin1un1 (that is, a point of unstable equilibrium). Dynamic response

calculations that illustrate these hcha y iors are presented and discussed in detail in appendix B.

If the aircraft attempts to capture a point that lies above the maximum-thrust contour everywhere, no

steady-state solution exists hccausc the target path exceeds the performance capability of the aircraft.

The airspeed will then diverge to\\ard stalling speed, whatever the initial speed. For example, this

situation could arise following cn,inc failure during high-altitude cruise, if the remaining thrust were

insufficient for level flight. (The aircraft must then "drift down" to some lower altitude at which

sufficient thrust becomes availahle.)

37
The instability characterizing control to a constrained path below the speed for minimum drag with

fixed thrust has been known for a long time (Neumark, 1953). Some early barometric-hold autopilots could stall the aircraft if given sufficient pitch authority. Clearly, this potentially catastrophic

behavior presents a challenge to designers of full-authority fly-by-wire systems to provide some

means of ensuring safety.

On the other hand, operation at a point of stable equilibrium presents no inherent safety hazard even

though the target airspeed is not captured. Overspeed must be avoided, of course, but for some purposes such as level-flight cruise, operation with fixed thrust (that is, with autothrottle off) may be

preferred because all unwanted throttle activity owing to airspeed disturbances is suppressed. Some

wandering of airspeed must then be accepted, but this can be reduced by permitting some altitude

deviation ("soft" altitude control).

Dynamical Behavior Theorem

The dynamical behavior of the aircraft resulting from control of flightpath angle and airspeed by

means of pitch and thrust can be summarized by the following theorem, which results directly from

the aircraft equations of motion:

Theorem— If both pitch and thrust are available for control, then (i) flightpath angle

and airspeed can be controlled independently. If the thrust is fixed so that only pitch

is available for control, then either (ii) airspeed, or else (iii) flightpath angle can be

controlled, but not both.

The aircraft is therefore capable of only three kinds of dynamical behavior:

if thrust is available for control, then

(1) path and speed can both be controlled;

if thrust is fixed, then

(ii) speed can be controlled at the expense of path,

or else

(iii) path can be controlled at the expense of speed.

It is clear from the statement of the theorem that Type (i) control is restricted to the interior of the

steady-state performance envelope of the aircraft, which is the only region of the state space where

thrust is available for control. The previous discussion showed that Type (ii) control is unrestricted,

but Type (iii) control results in airspeed instability at airspeeds below the speed for minimum drag.

Therefore, the theorem can be regarded from a mathematical control-theoretic viewpoint as a qualitative statement of controllability resulting from the form of the differential equations (1) and (2):

if both pitch and thrust are available for control. then both airspeed and flightpath angle can be

controlled throughout the region of interest; if thrust is fixed, then airspeed is controllable throughout the region of interest, but flightpath angle is controllable only within a subset of the region of

interest.

These three kinds of behavior are familiar to pilots. Automated control modes that correspond to

these three fundamental types of control are developed later in this report. Geometrically, the three

types of control partition the flightpath-airspeed plane into several discrete regions, which are

38
tenned stability regions. Within each of these regions, the dynamical behavior of the aircraft is

qualitatively similar. These geometric stability regions are examined next.

Geometrical Stability Regions

Capture trajectories corresponding to the three types of control just discussed are illustrated by the

three diagrams of figure 10.

Type (i) control— In figure I O(a), which illustrates Type (i) control, region I corresponds to the

steady-state flight envelope. Two representative capture trajectories are illustrated. Because the

flightpath response to pitch is much more rapid than the airspeed response to thrust (appendix B), as

a rough approximation the initial trajectory is nearly vertical, so that capture of the path target is

nearly complete before significant change in airspeed has taken place. The final portion is nearly

horizontal, as capture of the speed target is completed with little change of flightpath. No Type (i)

control is possible outside region 1, because thrust is saturated there.

Type (ii) control— Type (ii) control is illustrated by figure 10(b). Representative capture trajectories

when thrust is saturated at maximum thrust are illustrated in regions IV and V, and representative

capture trajectories when thrust is saturated at minimum thrust are illustrated in regions II and 111.

Intermediate thrust settings are not illustrated. It will be seen that each final solution point is located

at the intersection of the specified fixed-thrust contour with the vertical line corresponding to the

target airspeed, as already noted. All these points are points of stable flightpath equilibrium, because

the lift-curve slope is positive for all angles of attack below the stalling angle (appendix B). Target

flightpaths lying in regions II. 11 1. IV, or V are not captured because they lie outside the performance

capability of the aircraft. Portions of the capture trajectories for which the longitudinal acceleration

is constant are parallel to the specified fixed-thrust contours, as noted previously.

Type (iii) control— Type (iii) control is illustrated by figure I O(c), in which the maximum and minimum thrust contours are the same as in figure I O(b). It will be seen that each final solution point is

located at the intersection of the specified fixed-thrust contour with the horizontal line corresponding

to the target flightpath angle. The solution points lying along the lower boundary of region V are

points of unstable equilibrium, from which negative airspeed excursions would cause divergence

toward stalling speed. (Positive airspeed excursions into region I are of no particular concern,

because there the thrust is not saturated and Type (i) control becomes possible.) Attempts to capture

target flightpaths lying above the maximum-thrust contour everywhere in regions IV and V also lead

to airspeed divergence toward stalling speed. No equilibrium solutions exist along these target flightpaths because they lie outside the performance capability of the aircraft. Thus for behavioral classification, the points of unstable equilibrium and of no equilibrium in region V can be grouped

together, because they lead to the same airspeed divergence. Furthermore, target points in region IV

that lie outside the performance capability of the aircraft need not be considered separately, because

the airspeed divergence resulting from attempts to capture them leads inevitably into region V.

39
VI

1

rnCCO

L

m

a

Cr)

LL

Maximum

thrust

VII

Minimum

thrust

Maximum

thrust

VII

Minimum

thrust

1

m

a^

C

L

d

L

LL

VI

a) Type (i) control.

Maximum

thrust

VII

Minimum

thrust

d

a^

m

L

m

_a

LQ1

LL

VI

o Initial point • Target q Final point

b) Type (ii) control.

V MIN VMIN DRAG VMAX

Airspeed -

c) Type (iii) control.

Figure 10. Aircraft dynamical behavior.

40
The final solution points lying above the speed for minimum drag (regions II and IV) are points of

stable airspeed equilibrium. (Points of stable airspeed equilibrium with maximum thrust (region IV)

are often used for high-altitude cruising flight with auto throttle disengaged.) It will be seen that

attempts to capture steeply descending target flightpaths in the interior of region II can cause airspeed divergence toward overspeed. Points on the upper boundary of region III are points of unstable equilibrium. (Airspeed excursions from these points into region I are of no particular concern,

because there the thrust is not saturated and Type (1) control becomes possible.) Positive airspeed

excursions lead into region II where overspeed is possible, but even if a point of stable equilibrium is

reached that avoids overspeed, the increase of airspeed can be excessive. In no case of Type (iii)

control is the target airspeed captured.

Summary— To summarize, the stability regions I, II, 111, IV, and V are discrete regions within each

of which the dynamical behavior of the aircraft is qualitatively similar in response to Type (i),

Type (ii), or Type (iii) control. For logical completeness, regions VI (underspeed) and VII (overspeed) are also defined; region 1 is defined as open with respect to thrust, and the others closed. It

can then be verified by inspection of figure 10 that no point exists in the (V, y) plane that does not lie

in one of the seven identified regions.

41
42
PART II

DESIGN SYNTHESIS

FLIGHT CONTROL SYSTEM

Concept

The flight control system is a major element of the Vehicle Management System, as already mentioned. The following brief functional description is taken from a previous publication (Sherry,

Youssefi, and Hynes, 1995) to summarize the concept.

Manual Control

Augmented manual flight control modes have been developed that accept commands for horizontal

track angle, vertical flightpath angle, and airspeed. During manual flight, the pilot commands trackangle acceleration with the wheel and flightpath angle rate with the column. The pedals command

sideslip. With the controls centered, commanded track angle rate and flightpath angle are held fixed

against external disturbances. For these modes, the high-reliability autothrottle remains engaged at

all times during flight, accepting airspeed commands entered manually into the mode control panel.

By minimizing aircraft response to unwanted external disturbances, this advanced control augmentation improves precision of control and reduces pilot workload (Franklin, Hynes et al., 1986). In

particular, the high-reliability autothrottle alleviates difficulties with manual control of airspeed

owing to the strongly "backsided" variation of drag with speed that characterizes certain transport

aircraft durin g landin g approach.

Automated Control

During fully automated flig ht, a velocity-vector command generated by the guidance function is

injected directly into the same input port of the flight control system as that used during manual

flight. This interface between the guidance and tliuht control functions can be regarded as the

specification of the three components of the aircraft velocity vector in a mixed Earth/airmass

spherical coordinate frame. (In the present report, only the two longitudinal components, that is,

flightpath angle and airspeed, are treated.) This structure satisfies two human-factors criteria. First,

specification of the velocity vector is more meaningful for the pilot than the roll, pitch, and autothrottle loop closures often specified in current aircraft, because the velocity vector relates directly

to the pilot's task. Servo loop closures are confined to the interior of the flight-control function,

together with other vehicle-specific details. Second.. use of the same control algorithms during fully

automated flight as those used for manual flight provides the crew an intuitive understanding of

"what the automated system is trying to do" (Billings, 1996). Thus specifying the velocity vector as

the input command to the tli<Lht control system is a simple, natural choice that is desirable from

several points of view.

This system is similar in concept to the Total Energy Control System developed by Lambregts

(Lambregts, 1983), and successfully evaluated in flight experiments conducted on the NASALangley B-737 research aircraft in 1984. The present NASA-Ames implementation makes use of the

43
nonlinear inverse control concept originated by Meyer (Meyer and Cicolani. 1981), and applied by

Franklin to the NASA-Ames quiet short-haul research aircraft (QSRA) (Franklin, Hynes et al.,

1986). This nonlinear inverse control system contains an internal model of the aircraft, which

enables response characteristics such as column force per unit of normal acceleration (that is, per g)

to be held constant over the entire flight envelope without explicit gain scheduling. A separate control system incorporating conventional pitch damping is used for ground operation.

The discussion of the flight control system now proceeds by describing the system structure. First, a

definition is presented that formalizes the notion of mode so as to apply in general to all real-time

process-control systems. A brief discussion of system structure then shows how the control modes

to be described tit into their supporting hierarchical framework within the Vehicle Management

System. These structural matters are the subjects of the next two sections, after which the design of

the flight control system is examined in detail.

Mode Definition

The design process must begin with careful consideration of exactly how the aircraft is to be

operated under both normal and abnormal conditions. These considerations define the modes from

the engineering design viewpoint. Mathematically, a mode is a set of actions that the machine can

take; that is, a physical behavior. From the control-theoretic viewpoint, a mode is specified by its

topological structure (for example, its block diagram) together with specific details of gains, limiters,

and the like that determine its characteristic behavior. In the human-factors view of aircraft systems,

the human pilot selects a mode in order to obtain its characteristic set of actions, so that mode selection can be regarded as an expression of the pilot's intentions. In the implementation software, a

mode corresponds to a path through the code along which the commands for its characteristic

actions are generated.

Mode Hierarchy

In the system to be described, the flight control modes are organized into a hierarchical structure

with three levels, as illustrated by figure 1. In bottom-up order, the modes at the lowest level are

termed primitive modes. They constitute elements of the higher-level supermodes, but do not themselves contain any subelements; that is, they are not composite. The three primitive longitudinal

control modes to be described correspond to the three types of dynamical behavior of which the

aircraft is capable, as already discussed in detail.

The second level of the mode hierarchy relates to the control tasks required for operation in the ATC

system. such as capturing and holding an assigned altitude or tracking an approach glideslope. During manual operation, the crew defines the desired flightpath by setting the desired altitude and airspeed targets into the aircraft mode control panel. For example, in current aircraft the Flight Level

Change mode occupies the second level of the mode hierarchy. On this second level, operational

efficiency is determined entirely by the crew's manual selections.

The third and hi o hest level of the mode hierarchy enables trajectory optimization for conservation of

time or fuel by trajectory-synthesis algorithms (Erzberger, 1982) resident within the onboard flight44
planning function. Readers can consult a previous publication (Sherry, Youssefi, and Hynes, 1995)

for a more detailed description of the Vehicle Management System.

This report discusses the first level of the mode hierarchy in detail, and shows how the three primitive modes can be combined to form the lowest-level supermode, which is termed Path/Speed

Command. The present work focuses on the design method and does not treat the complete mode

hierarchy, although one second-level supermode termed Altitude Command is developed in detail

in order to illustrate extension of the design method to higher level. Guidelines for extension to the

third level of the mode hierarchy are presented briefly. The three primitive modes, termed y-V Command, V Command, and Y Command, are described in detail in the following sections. As noted

previously, they correspond to the three fundamental kinds of dynamical behavior, namely Type (1)

control, Type (ii) control, and Type (iii) control, respectively.

The complete longitudinal flight control system is illustrated by the block diagrams of figure 11. The

altitude regulator function on the left of the broken vertical line in figure I I (a) is discussed in a later

section, and should be ignored for the present. The three primitive modes to be described next are

illustrated by the structure to the right of the broken vertical line. It can be seen that the external

inputs are the target flightpath angle YTGT and the target airspeed VTGT.

-- - - - - - - - - y-V CMD MODE _ - -- -^ O

OUTER-LOOP CONTROL I INNER-LOOP CONTROL -(Y-V CMD) i

Altitude Command Path/Speed Command i Y CMD MODE

Supermode I Supermode

VTGT — - , CMD MODE IREF

YSPEED-0 V CMD MODE

Diam ond — YPOT TGTi Ref

Chevron— YPOT i -V CMD MODE Voltage

Flightpathsymbol Y ,__ _______________ --- ___

DISPLAY...................................................... ..... ► PILOT

Altitude I Y-VCMD y

leader COL, 7COL MANUAL

symbol I or Y C4 D Q , VCMD (8ELEV)CMD

HTGT HEIGHT YTGT r REF NORMAL >'LIM VCMD pgTH PITCH

REGULATOR 3 ^^ ACCEL O!—^^ REGULATOR REGULATOR O LIMITER YLIM (CMD

V CMD i AUTO

H

--- ---

A

REFERENCE PATH SELECTOR

SPEED

VTGT VTGT AIRSPEED sin SPOT CMD F AUTO 6T CMD

REGULATOR ' THROTTLE

T t 1 1

V Y

a) Regulator structure.

Figure 11. Flight control system.

45
H O = 300 ft HLIM _ 3.0 ft/sec2

^1 ul = sin('(POT MAX + AY) HO —` I —' 2HLIM Alt Capture

I I IAH I > H O

II = sin(YPOT MAX - AY)

HPAR A

AY= 3 deg

ABS HLIM SIGN Ali O ul

AH HCMD YTGT

H TGT _ T

H^

sin-1

Ref path EXP III III selector

T 10 sec II (fig 11a)

H V

Alt hold

IAHI <Ho

b) Height regulator.

--0-

PRE VTGT FILTER

V LIM VLIM

V

g CMD

SPEED 

REGULATOR J

tAcceleration

A limiter V

sin-1 7SPEED To Ref path selector

(fig 11 a)

sinYPOT TGT sin7POT MAX

o--_ sin7POT MIN

Table 5

sinYPOT MAX

sin7POT REF _ sinYPOT CMD

[a—To Autothrottle 1 A smYPOT MIN (fig 11g)

sing

c) Airspeed regulator.

YLIM

YREF

'fREF +UN LIM VYLIM 'SLIM

YO

—^ - T V

+

1

T= 10 sec 1 V -«N LIM 1v

i( 2HLIM Alt capture, Alt hold

(f N LIM = l HLIM Climb, descend

d) Normal acceleration limiter.

Figure 11. Flight control systems (continued).

YLIM

To Path

regulator

(fig 11 e)

46
g )CMD' W )CMD CXCMD ACMD

To Pitch regulator yCMD _ PATH LIFT

REGULATOR INVERSE cos ®0 (Fig 11f)

yCMD

1(

cosy q)tP Y

LEXT

AERO

MODEL

e) Path regulator.

O CMD PITCH gCMD PITCH (^ELEV^ MD

o elevator servo REGULATOR INVERSE

f f f

^1 1 CMD MY EXT

AERO

MODEL

f) Pitch regulator.

TCMD (6T)CMD

sin 'ypOT CMD —• EDENGINE To throttle servo INVERSE

W LD

g) Autothrottle.

Figure 11. Flight control systems (concluded).

y-V Command Mode

Control Law

The y-V Command mode corresponds to Type (i) behavior, and requires that both pitch and thrust be

available for control. The control l.m fOr the y-V Command mode is obtained directly from the aircraft differential equations ( 101 and (20 by specializing them as follows.

in equation (lc). the desired (conmwnded) normalized longitudinal acceleration, denoted by

( I/g)(dV/dt)cmD , is generated h\ the airspeed regulator (fig. 1 1(c)), which compares the measured

airspeed with the desired alr^pccd V, 111 and generates a longitudinal acceleration command intended

to null the airspeed error. If the airspeed regulator contains an integral term, the integrator must be

clamped to prevent wind-up i f' the thrust response becomes rate-limited. For simplicity, it is assumed

that the airspeed regulator contains only a proportional term. The rate-limited reference airspeed

VLIM is obtained by passing the tar g et airspeed VTGT through a pre-filter that limits its rate of change

to a maximum of 2 kt/sec (about U.1 U). Making use of the measured flightpath angle, equation (lc) is

then solved for the desired potential fli g htpath angle, which is denoted by yPOTCMD•

47
In equation (2c), the desired normal acceleration, denoted by (V/g)(dy/dt)CMD , is generated by the

flightpath regulator (fig. 1 I(e)), which compares the measured flightpath angle with the desired

flightpath angle yCMD and generates a normal acceleration command intended to null the flightpath

error. During automated flight, yCMD is obtained by passing the target flightpath angle YTGT through

a rate limiter that limits normal acceleration to 0. I g for passenger comfort (figs. I I (a) and 1 I (d)).

During manual flight, yCMD is obtained from the time integral of column deflection, and is ratelimited by the human pilot (fig. 11(a)).

The control law for the y-V Command mode, which is derived ill the manner just described, is given

by the equations

I (IV— CMD + S111 Y = Sln YPOT CMD (6a)

g dt 

and

g

d7 CMD + COS y = CMD

W 

(6b)

Path errors are fed back to pitch control, and speed errors are fed back to thrust. This topological

structure is the appropriate choice for transport aircraft with small thrust inclination. As already

noted, the characteristics of the airspeed regulator and the flightpath regulator are selected to meet

flying qualities criteria based on extensive operating experience with transport aircraft.

Thrust Command

The thrust command is generated by specializing equation (lb) and solving for thrust, making use of

the prevailing drag calculated from the onboard aircraft model:

TCMD W sill y POT CMD + D (6c)

Tlie parameter yrOT CMD is calculated from equation (6a). The commanded thrust TCMD must be

physically realizable. The throttle servo command is then obtained by inverting the engine thrust

characteristic, as illustrated by the autothrottle diagram of figure 1 I(g).

Thrust Saturation

Thrust saturation must be absent in the y-V Command mode, as previously noted. To avoid overboosting the engines, some means for determining thrust saturation, such as observation of exhaust

gas temperature (EGT), exhaust pressure ratio (EPR), or the like, must be available on board the

aircraft. What is needed for mode selection is a mode-independent method of determining whether

thrust would be saturated if the y-V Command mode were selected under prevailing flight conditions. For simplicity, it will be assumed that maximum thrust TMnx and minimum thrust T MiN can be

calculated from the onboard engine model with sufficient accuracy.

48
To aid the determination of thrust saturation, a reference thrust termed T REF is calculated by

specializing equation (6c):

TREF 

W sin 7 POT REF + D

(7a)

In equation (7a), yPOT REF is calculated from equation (6a), as shown in figure I I (c):

I d t cmn + sin y = sin y POT REF (7b)

g d

The reference parameters TRE,: and 713 0T REF differ from their command counterparts TcMD and

713 0T cm[) because, during an accelerating climb or a decelerating descent, T REF and yPOT REF can

exceed the physically realizable values corresponding to the performance capability of the aircraft

(eq. (1 c)), whereas TcMD and yPOT cmn must be physically realizable. Therefore

TCMD TREF 

when TMIN < TREF C TMAX

(70

Thrust saturation corresponds to the conditions

T <_T T >_ T (7d)

REF MIN REF MAX

or, equivalently, to the conditions

7 POT REF C 'POT MIN 7 POT REF >y POT MAX

(7e)

Equation ( I b) is specialized as follows:

__ TMAX — 

D

sin y

POT MAX W

(7f)

T —D

sin y

POT MIN _ 

MINW(7g)

It should be noted that the parameter yPOT MIN is negative for transport aircraft. Furthermore, the

condition TMAX > T MIN holds except during total propulsion failure.

Pitch Command

The derivation of the elevator servo command is illustrated for completeness by the block diagrams

of figure 1 I (e) and I I (f), but it is not treated in any detail by this report because the pitch control

assumption already made implies that the lift command is identically satisfied. It can be seen that the

angle-of-attack command is obtained by solving equation (6b) for the lift function L = L((x) and then

inverting, as illustrated by fi gure 1 1(e). The pitch command OCMD is then obtained by making use of

49
the measured flightpath angle and bank angle (compare equation (5)). The pitch regulator and the

inversion of the pitching acceleration command to obtain the elevator servo command are illustrated

by figure 1 1(f).

V Command Mode

The V Command mode corresponds to Type (ii) behavior. Thrust is fixed, so that only pitch is

available for control, and airspeed is to be controlled at the expense of flightpath angle by feeding

back airspeed error to pitch control. Again the control law is obtained by specializing the aircraft

differential equations.

Thrust Command

As already noted, this report is chiefly concerned with thrust saturation at maximum or minimum

thrust, but for generality it is assumed for the present that the thrust can be fixed at any physically

realizable value TTGT. In the V Command mode, the commanded thrust is then given by the equation

TCNII TTGT when TMIN C TTGT C TMAX (8a)

Equation (lb) is specialized as Iollmvs:

s " , Y^ =

TTGT — D

7P OT W

Reference Thrust

In the V Command mode, the reference thrust is calculated just as it is for the y-V Command mode

(eqs. (7a) and (7b)).

Control Law

In equation (lc), the desired ilormah/ed longitudinal acceleration, denoted by (1/g)(dV /dt)cMD, is

generated by the airspeed regulator I i (c)), just as in the y-V Command mode. With the thrust

fixed at TTGT, yPOT is fixed at '(r„I r,,l (eq. (8b)), and equation (lc) can be solved for the flightpath

angle required to satisfy the lon_Itudinai acceleration command. Denoting this flightpath angle by

ySPEED, equation (1c) becomes

Il V _ /

dl (\11 ) — sill y POT TGT — — Sill 7SPEED lge)

The derivation ofyspl:ED is illustrated by the block diagram of figure I I(C). ySPEED is then rate-limited

and applied to the input of the path regulator to generate the normal acceleration command

(figs. 1 1(a) and I I (e)).

(8b)

50

- 

 —1
Equation (6b) is solved for the lift command just as it is in the y-V Command mode (fig. I I (e)):

b d W

CMD + COS y = CMD (8d)

It should be noted that equations (8c) and (8d) are not solved simultaneously, because the immediately previous value of the drag D is used for the calculation of yi >OT TGT in equation (8b).

Longitudinal Acceleration Limiting

Following Lambregts (Lambregts, 1983), an acceleration limiter is incorporated within the airspeed

regulator (fig. 1 I (c)) that limits the longitudinal acceleration command in a manner to be described.

The acceleration limiter logic is independent of mode, but it is described here because its function is

essential for the V Command mode. For clarity, the basic concept is presented first without refinements to be incorporated later.

Concept— The acceleration limiter is specified conceptually by the following equations:

(1/g)(dV/dt)CMD Mery < (I W(dV/dt) CMD <— (1 /g)(dV/dt)CMD MAX (9a)

(1/g)(dV/dt)cMD MAX — K v sin 7 POT MAX (9b)

(1/g)(dV/dt)CMD MIN — K v sin 

y POT MIN (9c)

where 0<— Kv < 1.

The parameter Kv determines the division of excess thrust between acceleration and climb, or

between deceleration and descent. For example, assume that thrust is saturated at maximum thrust

and that the target thrust yPOT TGT is set equal to yPOT MAX, and denote the corresponding value of

ySPEED by ySPEED MAX . Then equation (8c) shows that ysPEED MAX is given by the equation

sin y

SPEED MAX - sin y POT MAX - I dV CMD (9d)

Further assume that the commanded longitudinal acceleration (1/g)(dV/dt)c MD takes on its maximum

value of Kv sin yPOT MAX according to equations (9a) and (9b). With this assumption, equation (9d)

becomes

sin 

ySPEED MAX — (I — K V ) Sin 7POT MAX (9e)

Equation (9e) shows that, if Kv = 0, then ySPEED MAX = yPOT MAX, so that all available excess thrust

(TMAX — D)/W = sin 7POT MAX is used for climb. If Kv = 1, then ysPEED MAX vanishes, so that all excess

thrust is used for level-tlilght acceleration. The positive upper bound on commanded acceleration

51
(eq. (9b)) prevents an excessive positive acceleration command from causing the aircraft to descend,

because the right-hand side of equation (9e) is nonnegative for all Kv within its range 0 <_ Kv 5 1.

Similarly, the negative lower bound (eq. (9c)) prevents an excessive negative acceleration command

from causing the aircraft to climb. if thrust is saturated at minimum thrust and the target thrust

YPOT TGT is set equal to 7POT MIN, and if the commanded longitudinal acceleration (1 g)(dV /dt)CMD

takes on its minimum value of Kv sin YPOT MIN, then it can be shown by a similar argument that

equation (9d) becomes

sin 7SPEED MIN — (I — K v ) sin 7 POT MIN (9f)

Because the condition (7POT MIN < 0) always holds for transport aircraft, as already noted, the righthand side of equation (9f) is nonpositive for all Kv within its range 0 <_ Kv 5 1.

Pilot evaluation— Evaluation of these limiter characteristics by means of piloted simulation has

shown that the condition (Kv = 1) is unacceptable, because some definitely positive flightpath angle

is required for climb. Similarly, a definitely negative flightpath angle is required for descent. Therefore, the parameter Kv should be bounded away from unity by adopting the modified specification

05 Kv < 1. The nominal value of Kv has been set tentatively to 0.7, based on pilot opinion obtained

during an exploratory simulation carried out on the NASA-Ames Vertical Motion Simulator (Sherry,

Youssefi, and Hynes, 1995).

Performance degradation— A second refinement is needed to deal with the possibility that the condition (YPOT MAX < 0) might hold, which could occur, for example, following engine failure during

high-altitude cruising flight if aircraft performance became so severely degraded that available thrust

were insufficient for level flight. In that case, equation (9b) shows that the system would command

anomalous negative acceleration unrelated to airspeed error, resulting in airspeed divergence toward

stalling speed.

in order to prevent this potentially catastrophic behavior and ensure that some minimal positive

acceleration capability is always retained, a lower bound of 0.00525 g = 0.1 kt/sec is imposed on the

upper acceleration limit (dV/dt)c^MD MAX. This minimal acceleration capability is selected to coincide

with the acceleration available at maximum cruising altitude (appendix B), which is discussed later.

It is clear from equation (9b) that imposing this lower bound of 0.00525 5 Kv sin YPOT MAX also

requires that the parameter Kv be bounded away from zero.

Limiter properties— With the two refinements just discussed, the final limiter specification can be

stated as follows:

I /g)(dV/dt)cMD 

MIN < (1/g)(dV /dt)CMD 5( i /g)(dV/dt)cMD MAX (9a)

0.005255 ( 1/g)(dV/dt)

CMD MAX — 

K v sin 7 POT MAX (9g)

(1/g)(dV/dt)CMD MiN — K v sin 7 POT MIN

(9h)

52
where 0 < Kv < 1.

The limiter specified by conditions (9a), (9g), and (9h) is characterized by several properties that

will be used extensively during later developments. If aircraft performance is normal, then the

condition (Kv sin 7POT MAX ? 0.00525) holds. In that case, equations (9e) and (9f) show that the

conditions

7SPEED MIN < 0 7SPEED MAX > 0 (9i)

must hold. Furthermore, as a consequence of the physical condition (7POT MIN < 7POT MAX), which

holds in the absence of total propulsion failure, the condition

SPEED MAX > 7 SPEED MIN

(9j)

holds by definition of ySPEED.

If aircraft performance is degraded, so that the condition (Kv sin 7POT MAX ? 0.00525) does not hold,

then the condition (7SPEED MAX > 0) can hold only if the condition (V > V TGT) holds, because in that

case deceleration commanded by the airspeed regulator augments 7SPEED MAX according to equation

(9d). With the specification 0 < Kv < 1, equation (9f) shows that the condition (7SPEED MIN < 0) holds

generally, because as already noted yPOT MIN is negative for transport aircraft.

Pitch Command

In the V Command mode, the pitch command is calculated just as it is for the y-V Command mode

(figs. 1 1(e) and 1 1(f)).

7 Command Mode

They Command mode corresponds to Type (iii) behavior. Thrust is fixed, so that only pitch is

available for control, and iightpath angle is to be controlled at the expense of airspeed by feeding

back path error to pitch control. As before, the control law is obtained by specializing the aircraft

differential equations.

Control Law

In equation (2c), the desired normal acceleration (V/g)(dy/dt)c MD is generated by the flightpath regulator (fig. 1 I(e)), and with the measured flightpath angle 7equation (2c) is solved for (L/W) CMD , just

as it is in the y-V Command mode.

In equation (1c), the normalized longitudinal acceleration ( 1 /g)(dV/dt) is determined by the instantaneous flightpath angle y and the target value of yPOT, which depends on the fixed target thrust

(eq. (8b)). In the y Command mode, there is no closed-loop control of airspeed.

53
The control law for the Y Command mode is given by the equations

i dV + sln Y = sln YPOTTGT (I Oa)

g dt

g cl CMD + cos Y= 

W 

D

(1 Ob) CM

Pitch Command

In the Y Command mode, the pitch command is calculated just as it is for the Y-V Command mode

(figs. 1 1(e) and 1 I (f)).

Thrust Command

III

y Command mode, the commanded thrust is given by equation (8a), just as it is in the

V Command mode.

Reference Thrust

In the y Command mode, the reference thrust is calculated just as it is for the y-V Command mode

(eqs. (7a) and (7b)).

Dynamic Thrust Saturation

Now that the control laws for the three primitive control modes and the details of the longitudinal

acceleration limiter have been specified, it is of interest to study the geometrical stability regions for

each of the primitive modes that correspond to the regions of figure 10, accounting for thrust saturation under dynamic conditions (that is, including the contribution of the (dV/dt)CMD term according

to equation (6a)). It will be shown that contours corresponding to dynamic thrust saturation will

subdivide the (V, Y) plane.

Thrust Saturation Contours

The thrust saturation contour corresponding to the variation of YsPEED MAX with airspeed can be

obtained as follows. Substitute the condition YPOT TGT = YPOT MAX and the definition of YPOT MAX

(eq. (7f)) into equation (8c) to obtain the equation

sin Y = TMAX — D i dV cMD. (1 1 a) SPEED MAX `]^J g dt

In equation (1 1 a), the drag D should be evaluated under the assumption that the normal forces

remain in equilibrium during speed changes, as previously discussed. The variation of TMAX with

airspeed is known (appendix B), and the variation of the commanded longitudinal acceleration

(dV/dt)CMI) is defined by the speed regulator law (fig. I I(c)). It follows that the variation of

YsPEED MAX with airspeed" is determined by equation (1 1 a). Similarly, replacing TMAx by TMIN in

equation (I I a), the variation of YsPEED MiN with airspeed is given by the equation

and

54
sin 

ySPEEll MIN 

EMI 

W

d CMD. (I I b)

g

Equivalent Conditions for Thrust Saturation

As already noted, thrust saturation is evaluated by comparing the reference thrust TREF, which is

calculated continuously, with the maximum thrust TMAx and the minimum thrust T MIN (eqs. (7a) —

(7g)). It can be seen from equations (7a), (7f), and (7g) that this thrust comparison is equivalent to

comparing 'yPOT REF with yPOT MAX and YPOT MIN . Equivalent conditions for thrust saturation that are

useful for study of the corresponding geometrical regions can be developed as follows.

Equation (7b) can be put in the form

sin Y = Sin CMD YPOT REF —

1 dV

t C11

(7b)

Restating equation (8c),

_ 1 dV Sill 7sPEED —Sln YPOTTGT g (fit CMD (I 1C)

Equation ( l lc) can be subtracted from equation (7b) to obtain the equation

Sin — sin 

ySPEED — Sin 7 POT REF — Sin y POT TGT (I Id)

By substituting yPOT MAX and yPOT MIN for yPOT TGT in equation (1 1 d), the following equations for

ySPEED MAX and ySPEED MIN can be obtained:

sin y — Sin y

SPEED MAX — Sin 7 POT REF — Sill 7 POT MAX (I le)

and

Sin y — sin y

SPEED MIN — sin y POT REF — sin 7 POT MIN

(1 1 f)

Equations (1 1 e) and (1 l t) show that the following conditions on measured flightpath angle 7 are

equivalent to the thrust saturation conditions (7e) on YPOT REF:

(y > ySPEED MAX ) — %OT REF > 7 POT MAX) (I I g)

and

(y^ySPEF.DMIN^ (7POTRF.F^yPOTMIN) (1111)

Extensive use will be made of the alternative thrust saturation conditions (I Ig) and (1 1h).

55
Geometrical Stability Regions

The contours corresponding to ysPEED MAX and ysPEED MIN are illustrated by figure 12 for each of the

three primitive control modes. In figure 12, the contour for ysPEED MAX corresponds to the maximum

instantaneous flightpath angle y that can be obtained without thrust saturation while simultaneously

satisfying the longitudinal acceleration command. Similarly, the contour for ysPEED MIN corresponds

to the minimum instantaneous flightpath angle y that can be obtained without thrust saturation while

simultaneously satisfying the longitudinal acceleration command.

It can be seen that the contours of ysPEED MAX and ysPEED MIN separate the (V, y) plane into three

regions that correspond to thrust saturation or to its absence, after accounting for the contribution of

the commanded longitudinal acceleration (dV/dt) CMD to the total thrust required. The hatched central

region corresponds to the absence of dynamic thrust saturation; elsewhere, the thrust control is saturated. It is convenient to designate the regions in which thrust would be saturated if yTGT were captured by defining the conditions P and Q as follows:

P ( yTGT > ysPEED MAX ) Q (yTGT < ysPEED MIN) (11 i)

The regions in which yTGT must lie when P and Q hold are marked on the diagrams of figures 12(a)

and 12(b).

o Initial point • Target q Final point Thrust unsaturated

VTGT

P

D

1 dV C

g dt CMD

A YTGT

Q

1 dV

g dt CMD

`(SPEED MAX

(POT MAX ° T MAX - D

W

YSPEED MIN

TMIN D

7POT MIN ` W

YTGT

0

7

V MIN VTGT VMAX

v

a) y—V Command mode.

Figure 12. Geometric stability regions for primitive modes.
o Initial point • Target q Final point D Thrust unsaturated

0

Y

dV . dV P

D d it—

B

• A

D'

O

9 dt 1-mu 1 dV- - ^

,ISPEED MAX

'/POT MAX = TMAX _ D

w

7SPEED MIN

TMIN - D

'/POT MIN W

V MIN VTGT VMAX

V

b) V Command mode.

o Initial point • Target q Final point Thrust unsaturated

dV

dt

D

E • •

P 0D'

V _ IV

C

A B

ITGT

I

y 0

IPOT MAX 

TMAX - D

W

IPOT MIN TMIN - D

dV W

at

"MIN "MIN DRAG "MIN MAX

V

c) y Command mode.

Figure 12. Geometric stability regions for primitive modes (concluded).

ITGT

57
In figures 12(a) and 12(b), contours of ySPEED MAX and ySPEED MIN for a representative target airspeed

VTGT are illustrated. The forms of these contours result from limiting of the longitudinal acceleration

command, as discussed previously (eqs. (9a)-90)). For airspeeds near V TGT, the commanded

longitudinal acceleration is proportional to the airspeed error (fig. 1 1(c)), so that the portions of the

contours for ySPEED MAX and ysrEED MIN near VTGT are steeply sloping straight lines. (Integral control

within the airspeed regulator would distort their linear form to some extent.)

For larger airspeed errors, the acceleration limiter becomes active. In that case, because the acceleration command is limited to a constant fraction o f'YPOT MAX or yPOT MIN (eqs. (9a), (9g), and (9h)),

the ySPEED MAX and ySPEED MIN contours lie roughly parallel to the maximum and minimum thrust

contours (figs. 12(a) and 12(b)). It can be seen that the displacement of the ySPEED MAX contour from

the yPOT MAX contour is approximately equal, for small angles, to the normalized longitudinal acceleration command (l/g)(dV/dt)c MD , as required by equation (I Ic), and likewise for the displacement of

the ySPEED MIN contour from the yPOT MIN contour.

y-V Command Mode

In figure 12(a), the hatched central region that corresponds to absence of dynamic thrust saturation is

available for operation in the y-V Command mode. Capture of a representative target point (VTGT,

VTGT) is illustrated (point A). Outside the hatched region the thrust control is saturated, so that the

y-V Command mode cannot be engaged there. However, if operation in the y-V Command mode

were permitted with saturated thrust, the dynamical behavior of the system would be the same as it

is in they Command mode, which is discussed shortly.

During operation in the y-V Command mode, any target point can be captured provided that it lies

within the steady-state performance envelope (region I, figure 10(a)), but this is not required of the

initial point. As illustrated by figure 12(a), if the target lies at point A, it can be captured starting

from points such as point D that lie outside the steady-state performance envelope. In this example,

the y Command mode would be selected for the initial part of the capture trajectory DCA, and the

y-V Command mode would be selected when the trajectory enters the central hatched region

(fig. 12(a)).

V Command Mode

In the V Command mode the thrust setting is fixed, as noted previously, but the physical significance of the hatched central region in figure 12(b) is the same as it is in figure 12(a): the hatched

region is that within which the instantaneous operating point (V, y) must lie to enable the longitudinal acceleration command to be satisfied with a physically realizable thrust setting.

During operation in the V Command mode, the flightpath target yTGT is ignored by the system, and

ySPEED is captured instead. For example, suppose the instantaneous operating point (V, y) lies initially

at point D (fig. (12(b)). If yPOT TGT is set to yPOT MAX and the V Command mode is selected, the flightpath angle ySPEED MAX is captured. After path capture is complete, the (V, y) operating point must lie

on the ySPEED MAX contour at some point such as point C', with the acceleration directed toward the

target airspeed (indicated by arrows on the diagram). In figure 12(b), point B indicates the point

on the ySPEED MAX contour with coordinates ( VTGT, ySPEED MAX), which is the point finally captured.

Point B is the best approximation to the target point (point A, as in figure 12(a)) that can be realized

with maximum thrust when the target airspeed is specified as shown.

58
The points on the YsPEED MAX contour to the left of point B correspond to an accelerating climb, and

those to the right of point B correspond to a decelerating climb. Similarly, during minimum-thrust

descent, the (V, y) operating point lies oil YsPEED MIN contour. with the acceleration directed

toward the target airspeed.

y Command Mode

In the y Command mode the thrust setting is fixed, just as it is in the V Command mode, but in the

y Command mode any target flightpath angle yTGT call captured without restriction to the steadystate flight envelope. Because there is no closed-loop control of airspeed, the airspeed target VTCT is

ignored by the system, and no use is made of the commanded longitudinal acceleration (dV/dt)CMD•

The instantaneous longitudinal acceleration is determined from equation (10a), which can be put in

the form

(I/g)(dV/dt) = sin 

yPOT TGT

—sin (1 Oa)

where y is the instantaneous flightpath angle. Equation (10a) shows that, in they Command mode,

the sign of the longitudinal acceleration dV/dt is determined by comparing the instantaneous flightpath angle y with the fixed target thrust yPOTTCTDuring operation in the y Command mode, the sign of the longitudinal acceleration for any selected

value of yTCT can be determined from figure 12(c). For example, suppose that the selected target

(VTCT, yT(;T) lies at point A (fig. 12(c)), the initial operating point (V, y) lies at point C, and yPOTTCT

is set to yPOT MAX . Then the longitudinal acceleration is positive at both point C and point A, as

required by equation ( I Oa). As shown by figure 12(c), the trajectory overshoots the target at point A

and captures point B, where the longitudinal acceleration vanishes. Point B is the best approximation

to the target (point A, as in figure 12(a)) that can be realized with maximum thrust when the target

flightpath angle is specified as shown.

If the initial operating point (V, y) lies at point D, the initial longitudinal acceleration is negative,

becoming positive when the trajectory enters the hatched region as shown (fig. 12(c)). This example

shows how the initial part of the trajectory DCA shown in figure 12(a) can be generated by selecting

the y Command mode while thrust is saturated.

If the y Command mode is selected when the target point lies in region V, then the behavior of the

system is quite different. For example, suppose that the selected target lies above the yPOT MAX contour (point E, figure 12(c)), and the initial operating point lies in region V (point D) or the upper part

of region IV (point D'). In either case, the longitudinal acceleration (marked oil diagram by an

arrow) is negative, as required by equation (10a). The trajectory overshoots the target at point E, and

the airspeed diverges toward stalling speed (fig. 12(c)). Therefore, when the target point lies in

region V or the upper part of region IV above the yPOT MAX contour, selection of they Command

mode would not be acceptable.

59
Summary

Dynamic thrust saturation has been analyzed, and it has been shown how contours corresponding to

dynamic thrust saturation subdivide the flightpath-airspeed plane into geometric regions (fig. 12).

Several examples have illustrated the behavior of each of the three primitive modes for target points

in each of those regions.

These examples suggest some of the dynamical issues that must be addressed during mode selection.

It is essential to provide a comprehensive strategy that ensures appropriate system behavior when

thrust saturates. Before a valid mode control logic can be developed, it is necessary to specify the

requirements for safety and functionality that the system must satisfy, and to define explicitly what

is meant by mode validity. These matters are discussed next.

SAFETY REQUIREMENTS

Transport aircraft safety requirements are based on a priori identification of safety hazards, as are

safety requirements in several other industries (Leveson, 1995). Safety margins intended to provide

protection against these hazards are then applied to the ultimate physical operating limits of the

aircraft to define a safe operatingu cm elope within which all normal operation is required to take

place. Thus the development of satet\ requirements for the longitudinal control system begins with

a survey of known flight hazards that restrict the physical operational envelope of the aircraft.

Flight Hazards

Wing Stall

Wing stall occurs at the ang le of attack tier which the lift function takes on its maximum value

(appendix B). The stalling airspeed depends on aircraft weight and on normal acceleration, and thus

on the flight demonstration techni(lue used during certification to establish the stalling speed experimentally. In some cases, a\ ailahlc pitch control power may not be sufficient to permit demonstration

of a well-defined stall. In others. satct y hazards anticipated from wind tunnel tests (such as deep stall

or pitch-up at high angles of attar k ) make it inadvisable to approach the stall closely during certification flight tests, so that certification is based on a declared maximum angle of attack that can be

demonstrated safely. The consequences of exceeding such a declared limit are presumed to be catastrophic. Whatever the basis, tine values for stalling angle of attack and airspeed for all aircraft

configurations and weights are determined during the certification process.

Thrust Asymmetry

If engine failure occurs, the resultin_u thrust asymmetry generates yawing and rolling moments that

can threaten transport aircraft controllability. Because control power decreases with decreasing

airspeed, a minimum control airspeed exists below which controllability cannot be retained with

maximum thrust applied to the operating engines. Engine-out controllability is assessed during the

certification process, and minimun1 control airspeeds are determined for all aircraft configurations

and weights. The consequences of' % iolating minimum control-speed restrictions are presumed to be

catastrophic.

60
Overspeed

The maximum airspeed is determined at low altitude by structural limits such as excessive airloads

or flutter, and at high altitudes by compressibility (Mach) effects that degrade controllability (for

example, Mach buffet) as shock waves form on the aerodynamic surfaces of the aircraft. Just as for

wing stall, maximum airspeed limits are determined for all aircraft configurations and weights

during the certification process, and the consequences of exceeding those limits are presumed to be

catastrophic.

Ground Contact

At large airports suitable for transport-category aircraft, a survey plane is established at the approach

and departure ends of each runway, and the locations and heights of all obstacles penetrating this

survey plane (nominal gradient 2%) are marked on aeronautical charts. The gradients specified for

all instrument approach procedures for each runway are selected to provide safe terrain clearance in

the vicinity of the airport. Similar surveys determine safe minimum en-route altitudes for all airways

throughout the National Airspace System. The consequences of contact with the ground other than

the runway, or with an obstacle such as a building or a radio tower, are presumed to be catastrophic.

Safety Margins

Airspeed Margins

An airspeed margin equal to 30% of the stalling speed is applied to the stalling speed to determine

the minimum airspeed to be used during final approach. Intentional operation below this reference

approach speed is prohibited in airline service. Other airspeed margins are applied to the takeoff

stalling speed and to the engine-out minimum control speed to establish the takeoff safety speed, and

still others are subtracted from the maximum airspeed limits to determine the maximum safe operating airspeeds for all aircraft configurations and weights in both smooth and rough air.

Safe Descent Margins

At low altitude, the maximum safe descent gradient during instrument approach is determined by the

published approach procedure. At higher altitudes, operational limits on rate of descent are often

imposed by airline operating policy to avoid excessive rates of descent that could lead to violation

of safe altitude limits. At high altitudes where terrain clearance is not an issue, excessive rates of

descent that could lead to overspeed should be avoided. These rate-of-descent limits can be expressed as 1lightpath angle limits on the descent angle ysAFE that vary with airspeed.

Safe Operating Envelope

Application ot' the airspeed margins and the safe descent margins to the physical envelope limits

determine the safe envelope limits VMiN, VMAx, and ySAFF within which the automated control

system is required to operate (fig. 13). To provide protection against violation of safe operating

envelope limits, envelope protection modes are developed in the next section.

Discussion

The presence of these envelope protection modes should not be regarded as reducing the designer's

obligation to ensure that the normal control modes operate safely. To the contrary, if the design of

the normal control modes is valid, envelope protection should be invoked (activated) only in cases

where aircraft performance limitations preclude other alternatives.

61
'ISAFE

Safe I' c

Operating -O

Envelope m

0

a

a)

0

T

O

C

O

U

d

m 0

rn a

c

m W

m

m a a ^

r ^

m 'oc

LL

Descent path protection I

VSTALL V MIN VMAX VNEVER

Airspeed —►

EXCEED

Figure 13. Safety envelope for Path/Speed Command supermode.

Envelope Protection

Envelope Protection Requirements

Envelope protection requirements can be stated as follows. Protection against underspeed should

be provided by setting VT(;T equal to VMIN plus a small tolerance and selecting the y-V Command

mode. Similarly, protection against overspeed should be provided by setting VTGT equal to VMAx

less a small tolerance and selecting the y-V Command mode. In both cases, if the thrust saturates, the

V Command mode should be selected to give priority to airspeed.

Protection against penetration of the ysAFE boundary should be provided by setting yTCT equal to

ysAFE plus a small tolerance and selecting the y-V Command mode. If the thrust saturates, the

y Command mode should be selected to give priority to path. In case of conflict between speed and

path envelope violations, priority should be given to airspeed protection, except in the presence of

strong wind shear. Shear disturbances exceeding the FAA-specified threshold of 2 kt/sec must be

detected, and must cause the control system to transition to a special wind shear recovery mode that

is not treated in this report.

In all cases where envelope protection is invoked, the maximum thrust limit should be increased as

much as possible (takeoff or contingency thrust), and appropriate warnings must be annunciated. It

is also desirable to increase the limits on normal and longitudinal acceleration imposed during fully

automated flight for passenger comfort. The system should revert to normal operation if that again

becomes valid.

Envelope Protection Modes

The envelope protection logic developed to meet these requirements is specified by table 1, which is

presented to illustrate representative control logic for envelope protection modes. Because the focus

of this report is on the modes engaged during normal operation, no validity analysis is performed on

the envelope protection mode logic, and no claims are made for its formal validation. A detailed

description of condition-action decision tables like table i can be found in appendix D.

62
TABLE 1. SELECTION OF ENVELOPE PROTECTION MODES

Condition Underspeed Protection Overspeed Protection Descent Path Protection

VM IN—< V< VMAX

------------ ----------------

TRUE

-----------------

V< VMIN

-------- ----

TRUE

--------------------------------

V > VMAX TRUE

y? ysnr•E

y ^ ysnrr: TRUE

Action Set VTCT equal to Set VTGT equal to VMAX Set yTGT equal to

VMIN + tolerance — tolerance ysAFE + tolerance

Set thrust limit to contingency thrust

Increase acceleration limits

-------------------------------------------------

Select y-V Command mode. If thrust saturates:

Select V Command mode Select

y Command mode

The purpose of the tolerance parameters in table l is to provide hysteresis that prevents repetitive

cycling of mode transitions ("chattering"). Appropriate values for these parameters should be

selected during implementation. What exactly is meant by "giving priority to airspeed or to flightpath angle" is clarified in the next section.

EFFECTIVENESS REQUIREMENTS

Effectiveness Concept

In addition to the a priori safety requirements already discussed, the system must also be effective in

performing its intended function. This notion is termed effectiveness. (In the design procedure to be

presented, effectiveness plays a role similar to that of liveness in computer science.) The specification of desired system functionality in terms of general effectiveness properties is the task of this

section.

For the longitudinal control system, the desired effectiveness can be stated as a general stability

property in the following way. Starting at any initial operating point specified by (V, y) coordinates,

abrupt change of target to a new point specified by ( VT(,T, yTGT) coordinates lying within the closed

flight envelope F- (fig. 8) should cause the aircraft to capture and hold the new target smoothly,

without exceeding (in smooth air) the acceleration limits imposed for passenger comfort. If the target lies outside the closed flight envelope E, the aircraft should capture and hold a point within the

closed envelope that provides an acceptable approximation to the target.

63
The desired safety properties require that the aircraft remain at all times within the envelope safety

limits illustrated by figure 13, as previously discussed. These proposed statements of safety and

effectiveness properties taken together restrict the effective targets to points within the steady-state

(trimmed) performance envelope, and do not permit exploitation of dynamic maneuvers to provide

enhanced performance. This limitation seems consistent with both the mission and the operating

characteristics of transport aircraft, but likely would not be satisfactory for higher-performance

aircraft.

If a single mode (for example, the y-V Command mode) could provide the desired effectiveness

throughout the closed envelope E, that system would consist of a single continuous element, and the

required stability property could be established by known control-theoretic methods. Such use of

the y-V Command mode would require avoidance of thrust saturation, as previously discussed. But

thrust saturation cannot be avoided in practice, because efficient operation during climb and descent

requires operation on the thrust saturation boundary (appendix B). Both the V Command mode and

the y Command mode can deal with thrust saturation, but neither can capture both path and speed

targets simultaneously. Therefore, none of the three primitive modes can provide the desired effectiveness throughout the closed envelope E.

However, it will be shown that the desired effectiveness can be achieved by combining the three

primitive modes into a higher-level entity that will be termed a supermode, with a well-defined

strategy for choosing among the three primitive modes whenever a thrust saturation boundary is

encountered. This supermode, which is termed Path/Speed Command, constitutes a hybrid system as

previously defined. The desired safety and effectiveness properties must therefore be established for

this hybrid system, a problem for whose solution no general theoretical method is known. It is hoped

that the present study may contribute by example to the development of more general methods. The

resulting design method should also be of practical interest to designers of next-generation transport

aircraft avionic systems.

To aid in fixing ideas, the discussion of effectiveness will begin with a detailed example that illustrates use of the three primitive modes already discussed to perform a representative higher-level

task. The task selected is that of capturing an altitude assigned by ATC; other representative tasks

could have been chosen.

Altitude Capture Example

It is assumed that an aircraft in level fli ,,ht at 15,000 ft is cleared to climb to 35,000 ft (Flight Level

350). For efficiency, the aircraft is to climb at 250 kt, and then accelerate to 280 kt for cruise. To

execute this clearance, the first task is to pull up from level flight into a steady climb, maintaining a

constant normal acceleration of 0.1 g during the pull-up. This pull-up task can be accomplished by

the automated control system in the following way.

Pull-up

Referring to figure 1 1(a), the altitude regulator function is illustrated by the structure to the left of

the broken vertical line. In this example, the target altitude HTGT is changed abruptly from 15,000 ft

to 35,000 ft while the measured altitude H remains at 15,000 ft. The altitude error AH is therefore

64
35,000 — 15,000 = 20,000 ft. It can be seen from the upper row of the block diagram of figure 1 1(b)

that the commanded vertical velocity (dH/dt)CMD then becomes

(dH/dt)CMO = 2(3) [JOH1— H () /2] = 6 [20,000 — 150] = 345.1 ft/sec

At 15,000 ft, an equivalent airspeed (EAS) of 250 kt corresponds to a true airspeed (TAS) of

531.9 ft/sec (appendix B). The sine of the commanded flightpath angle yTGT is calculated to be

sin 7TGT = (dH/dt) CMD /V = 345.1/531.9 = 0.6488 7TCT = 40.45 deg

Clearly, the raw 7TGT calculated from the parabolic law greatly exceeds the performance capability

of the aircraft. (It may be recalled that in the numerical example illustrating calculation of the flight

envelope, the maximum climb angle 'JVOT MAX was found to be only 6.92 degrees at sea level with

maximum thrust at 289 kt EAS). In practice, to ensure application of maximum thrust during climb,

the flightpath angle 7ToT is set to an angle 3 degrees steeper than 7POT MAX (fig. I I (b)). This value of

7TCT and the airspeed target VTCT of 250 kt provide the inputs to the primitive mode structure to the

right of the broken vertical line (fig. i I (a)). In the y-V Command mode, the normal acceleration

limiter limits the rate of change of flightpath angle to

d7/dt = (-/V)(0. 1) = (32.174 / 531.9X0.1) = 0.00605 rad/sec = 0.35 deg/sec

and the aircraft pulls up at this constant rate, increasing thrust to maintain airspeed constant

(fig. 1 1(c)). When the reference thrust T KEF exceeds the maximum thrust TMAx the thrust command

saturates (eq. (7d)). The y-V Command mode used during the pull-up is then no longer viable, and

one of the other two primitive modes must be engaged.

Climb

It is assumed that, for efficiency, the climb to 35,000 ft is to be conducted with maximum thrust at

the target airspeed of 250 kt EAS, accepting whatever climb angle results as thrust decreases with

altitude. Such a climb procedure is representative of subsonic jet transport operations (appendix B).

Clearly, it corresponds to operation in the V Command mode, which must therefore be selected

when thrust saturation occurs, settin wy the target thrust TTGT equal to TMAX (figs. 11(a) and I I (c)).

During the initial climb, the 111 g htpath angle target 7ToT remains on its upper limit (fig. 1 1(b)), but

as the aircraft approaches the target altitude of 35,000 ft and the altitude error is reduced, yrGT is no

longer limited, and it decreases smoothly to zero as the aircraft reaches the target altitude. But in the

V Command mode in which the aircraft is operating during the climb, the system captures and holds

ysPEEn, ignoring 7TH ;, (fi g . I I (a)). Therefore, to capture the target altitude smoothly, the y-V Command mode must again be selected as soon as 7TGT becomes equal to or less than 7sPEED MAX . The

aircraft then pushes over to level flight as the altitude error is nulled.

Altitude Capture

Up to this point, the altitude capture example has made use of only two of the three primitive modes.

The aircraft must now accelerate to a cruising airspeed of 280 kt EAS at the top of the climb, the

65
airspeed target being changed abruptly from 250 kt EAS to 280 kt EAS at the start of the push-over

for altitude capture. The increased thrust required for longitudinal acceleration then maintains thrust

saturation during the initial altitude capture. Capturing and tracking the flightpath angle target yTCT

with the thrust saturated requires use of the y Command mode (fig. 1 1(a)), which must be selected at

the start of altitude capture. As the aircraft approaches the target airspeed, the commanded longitudinal acceleration is reduced until eventually the thrust is no longer saturated, and the y-V Command

mode can once again be engaged.

Transition Paths

The transition paths in the (V, y) plane corresponding to the altitude capture example are illustrated

by the diagrams of figure 14, which are similar to those of figure 12. In figure 14(a), point A corresponds to the initial condition in level flight at 15,000 ft and 250 kt. Point B corresponds to the target

point when the target altitude of 35,000 ft is first entered. The target flightpath angle yTGT is limited

to an angle 3 degrees above the maximum thrust contour at the target airspeed of 250 kt, as previously explained. During the pull-up, the rate-limited flightpath angle yLIm traverses the path extending vertically upward from point A as the system, operating in the y-V Command mode, attempts to

capture the target point B. When the thrust saturates at point C, the V Command mode is.selected,

and the system then holds YSPEED at 250 kt (point C) during the steady climb. The target flightpath

angle YTCT remains on its upper limit (point B) until the aircraft approaches the target altitude of

35,000 ft. When the limit is no longer active, the flightpath target (point B') moves downward

toward point C as the altitude error is reduced (fig. 14(b)). When yTGT coincides with point C, the

airspeed target is changed to 280 kt, and the y Command mode is selected. During altitude capture,

the flightpath and airspeed follow the path C-D-E, the thrust remaining saturated until point D is

reached. At point D, the y-V Command mode is engaged, and the altitude capture is completed in

level flight at the cruising airspeed of 280 kt EAS (point E).

O Initial point • Target q Final point

B

/C SPEED MAX

%POT MAX

A

L 0

ma

L

LL "POT MIN

250

Equivalent airspeed, kt

a) Pull-up.

Figure 14. Altitude capture example.

66
YSPEED MAX

(POT MAX

YPOT MIN

1

rncm

L

ma

t

ai

LL

280

Equivalent airspeed, kt —+

b) Push-over.

Figure 14. Altitude capture example (concluded).

As previously noted, there is no closed-loop control of airspeed while thrust is saturated along the

path C-D. Nevertheless, the longitudinal acceleration is positive throughout the altitude capture,

and the airspeed target is captured as expected. On the other hand, premature selection of the

y Command mode before the target flightpath angle has reached point C (that is, before the aircraft

has approached the target altitude closely enough) could result in operation in they Command mode

at point B'. In that case, the longitudinal acceleration would be negative during the initial portion of

the altitude capture, contrary to the desired behavior.

The altitude capture example just presented has brought out several key points. In the next section,

this example is generalized as a first step toward definition of requirements for a systematic mode

selection strategy for the Path/Speed Command supermode.

Path/Speed Command Supermode Specifications

Path/Speed Priority

An essential element of this mode selection strategy is the priority to be placed on controlling path

or controlling speed when thrust saturates, because only one of the two parameters can then be

controlled. It is clear that operation in the y Command mode gives priority to path, because it holds

path at the expense of speed. Similarly, operation in the V Command mode gives priority to speed.

Thus the priority placed on path or speed determines the selection of either they Command mode or

the V Command mode within the Path/Speed Command supermode whenever thrust saturates.

But this priority decision must be made at a higher level within the mode hierarchy where sufficient

information is available. The altitude capture example shows that the correct decision depends on

the phase of flight (initial pull-up, climb, altitude capture, and the like), which is not known within

the Path/Speed Command supermode. Therefore, the path/speed priority must be provided as an

external input to the Path/Speed Command supermode that is specified by the higher-level entity in

the mode hierarchy that invokes the Path/Speed Command supermode as a lower-level element. For

the altitude capture task, this higher-level entity is a supermode termed Altitude Command; it is

discussed in detail in a later section. The path/speed priority transmitted from the upper level to the

lower can be regarded from a general system design viewpoint as control flowing downward.

67
Mode Hierarchy

From the viewpoint of the higher-level supermode invoking the Path/Speed Command supermode,

the higher-level supermode provides to the Path/Speed Command supermode three parameters:

(I) a target flightpath angle, (2) a target airspeed, and (3) a choice of path or speed priority if thrust

saturates. The Path/Speed Command supermode hides all information relative to the performance

capability of the aircraft, its flight envelope, and the differential equations governing control of

flightpath and airspeed, and annunciates to the invoking supermode the effectiveness to be expected

in capturing the flightpath and airspeed targets. In the next section, these general notions are made

precise by formal definition of three different classes of effectiveness.

Effectiveness Definitions

The stability analysis carried out previously shows that, depending on which primitive mode is

engaged, the Path/Speed Command supermode can exhibit three different kinds of behavior in capturing path and speed targets, which correspond to Type (i) control, Type (ii) control, or Type (iii)

control.

Complete effectiveness is defined as capture of both path and speed targets within small

tolerances that account for expected disturbances, which characterizes Type (i) control. If

thrust saturates, Type (i) control is not available, and either Type (ii) control or Type (iii)

control must be selected. In that case, capture of the target that is given priority (either

path or speed) is assured, but the other target is ignored by the system.

Partin/ o.fectiveness is defined as capture of a point of stable equilibrium that provides

an acceptable approximation to the target that is ignored.

Normal effectiveness is defined as follows: If the target path and speed have not yet been

captured, but the normal and longitudinal accelerations have the expected signs leading

toward capture, this behavior is termed normal effectiveness.

It follows from their definitions that complete effectiveness implies partial effectiveness and is

therefore logically dominant, whereas nornial effectiveness is a weaker property that is useful

chiefly in the short term.

Application of these definitions to each of the three primitive modes is described next. To enable

effectiveness to play a useful role in mode selection, it is essential that each effectiveness property

be defined in such a way that evaluation based on its definition is independent of the mode selected

at the time the evaluation is made.

Effectiveness of y-V Command Mode

For the y-V Command Mode, normal effectiveness holds immediately upon engagement, and complete effectiveness holds in the long term. These properties follow directly from the stability of the

flightpath and airspeed regulators. Partial effectiveness does not apply to the y-V Command mode,

which can be engaged only in the absence of thrust saturation.

68
Effectiveness of V Command Mode

In the V Command mode, priority is given to airspeed. The flightpath angle YSPEED is captured, and

subsequent capture of the target airspeed is assured by the stability properties of the path and speed

regulators (figs. 1 1(c) and i 1(e)). Therefore, normal effectiveness for the V Command mode applies

only to capture of the airspeed target, for which it always holds because of the stability of the airspeed regulator. The flightpath target YTGT is ignored, but partial effectiveness of the V Command

mode requires that YsPEED constitute an acceptable approximation to YTGT. How should this requirement be interpreted?

Partial Effectiveness

if the flightpath target YTGT lies in the region of thrust saturation above the YsPEED MAX contour in

figure 12(b) (that is, if the condition P = (YTGT ? YSPEED MAX) holds), then the best physically realizable approximation to YTGT is the point on the YSPEED MAX contour nearest YTGT at the prevailing airspeed. For example, if point D (fig. 12(b)) has the coordinates (VD , YTGT), then the best physically

realizable approximation is the point D', which has coordinates (VD, YSPEED MAX)•

To realize the best approximation whenever the condition P = (YTGT ? YSPEED MAX) holds, the thrust

target YPOT TGT should be set equal tO YPOT MAX, so that YSPEED is equal tO YSPEED MAX; no other physically realizable thrust setting could provide as good an approximation. In contrast, suppose that P

holds, but YPOT TGT is not equal to YPOT MAX. That case should be considered a violation of partial

effectiveness of the V Command mode, because the best approximation is not realized; the same is

true if Q holds, but YPOT TGT Is not equal to YPOT MIN ( fig- 12(b))•

Therefore, expressing logical negation by the word NOT and denoting partial effectiveness of the

V Command mode symbolically as PE (V), a preliminary definition for PE (V) based on general

notions of best approximation can be stated as follows:

PE (V) = NOT [P AND (YPOTTGT $ (POT MAX)] AND NOT [Q AND (YPOTTGT $ 7 POT MiN)]

To relate PE (V) to the geometrical regions illustrated by figure 12(b), its definition must be simplified. It is shown in appendix D by means of symbolic logic that the definition for PE (V) just

stated can be simplified in the following three ways:

If (YPOT TGT — YPOT MAX) holds, then PE (V) = NOT Q.

if (YPOTTGT YPOTMIN) holds, then PE (V) = NOT P.

if (7POTTGT ^ YPOTTGT ^ YPOTMAX) holds, then PE (V) = NOT P AND NOT Q.

(To verify the first statement without the use of symbolic logic, which otherwise will not be needed

until later, assume that (YPOTTGT = YPOT MAX) holds. Then the definition of PE (V) becomes

PE (V) = NOT [P AND FALSE] AND NOT [Q AND TRUE].

69
Because the proposition within the first right-hand bracket is FALSE whatever P may be, its negation

NOT FALSE must be TRUE. The proposition within the second bracket reduces to Q, with negation

NOT Q. With these simplifications, PE (V) becomes

PE (V) = TRUE AND NOT Q,

which reduces to the statement that PE (V) is equivalent to NOT Q, verifying the first result. The

other two statements can be verified in a similar manner.)

These three simplified statements show that PE (V) is related to the regions illustrated by figure

12(b) in the following ways. When 7POT TGT is set equal to YPOT MAX and PE (V) is therefore equivalent to NOT Q, then PE (V) holds \^ hell YT( ;T lies in the region above the YSPEED MIN contour where

NOT Q holds (fig. 12(b)). When 7po l tc;T is set equal to 7POTMiN and PE (V) is therefore equivalent to

NOT P, then PE (V) holds -vvhen y j( , I lies in the region below the YSPEED MAX contour where NOT P

holds (fig. 12(b)). When ypm I( ; I is set equal to an intermediate thrust level and PE (V) is equivalent

to NOT P AND NOT Q, then PL (V) holds when Yi p; I lies in the central hatched region (fig. 12(b))

where NOT P AND NOT Q holds.

It is clear that, in general. \ iolation of' PE (V) would result from inappropriate setting of the target

thrust YPOT TGT.

 The condit I011s (YP() I I(- I # YPOT MAX) and (YPOT TGT # YPOT MIN) are made more specific

later.

Effectiveness of y Command Mode

In the y Command mode. priority is given to path. Following engagement of the y Command mode

with a fixed-path target, capture ofthe selected path target is ensured by the stability property of

the path regulator (fig. I I(c)). 'i he airspeed target VTGT is ignored, but partial effectiveness of the

YCommand mode requires that a point ol'stable airspeed equilibrium be captured that provides an

acceptable approximation to ,, ,, . \1 hat conditions must be imposed to ensure partial effectiveness

of they Command mode?

Partial Effectiveness

After path capture is complete. the instantaneous flightpath angle 7 remains fixed at Y T(;T . It will be

recalled from the previous diScuSSion of' the dynamical behavior of the aircraft that, when flightpath

angle is constrained to a fixed anLde such as YT(;T with thrust fixed, one point of stable airspeed

equilibrium lies above the speed lur minimum drag at the intersection of the horizontal line corresponding to YTGT with the fixed-thrust contour (point A of figure 9(b)). Furthermore, this point of

stable equilibrium will be captured il'the operating point (V, Y) lies within its region of attraction,

which consists of all point, oil horizontal jT( ;j line to the right of the point of unstable equilibrium (point B of figure 9(h) ). a, prc\ iously explained. Depending on the thrust setting YPOT TGT, there

are three cases, the case correspondinu to maximum thrust is treated first.

Maximum thrust— When YI ,„ I i( ; I is set equal to YPOTMAX and YTGT lies in region I (point A of

figure 12(c)), point B is a point ol' stable equilibrium. Its region of attraction consists of the points on

the horizontal YTGT line either ^\ ithin region I or within the lower part of region IV (fig. 12(c)). This

70
region of attraction is defined by the condition (YTGT < 7POT MAX) for region I and by the two conditions (YTGT ? YPOT MAX) and (V > V MIN DRAG) for region IV.

Therefore, a preliminary definition for partial effectiveness of the 7 Command mode (denoted by

PE (7)) based on the requirement that the operating point (V, 7) lie within the region of attraction of

a point of stable equilibrium can be stated symbolically as follows:

PE (7) _ (7TGT < YPOT MAX) OIZ L(YTGT > YPOT MAX) AND (V > VMIN DRAG)

It is shown in appendix D by means of symbolic logic that this definition of PE (Y) can be simplified

as follows:

PE (7) — (7TGT < YPOT MAX) OR (V > VMIN DRAG)

(This result can be verified without the use of symbolic logic, which otherwise is not needed until

later, but that exposition is awkward and is not presented here.)

Violation of PE (y), which requires annunciation to be discussed later, is expressed by its negation,

using the word NOT:

NOT PE (Y) = (7TGT YPOT MAX) AND (VS VMIN DRAG)

It can be seen that, with this logical definition, PE (y) holds if -YTGT lies in region I at the prevailing

airspeed (point A of figure 12(c)), but is violated in region V, where the violation-defining conditions (YTGT ?YPOT MAX) and (V 5 VMIN DRAG) both hold (point E of figure 12(c)). If the operating point

(V, y) should penetrate region V under these conditions, then the airspeed would diverge toward

stalling speed, as explained previously. Thus the required annunciation of PE (y) violation gives

warning of potentially catastrophic behavior that can enable timely recovery action, avoiding invocation of underspeed protection.

Discussion— The preliminary logical definition for PE (y) just stated appears faulty if YTGT lies in the

upper part of region IV above the YPOT MAX contour for all airspeeds within region IV (point D' of

figure 12(c)). In that case, PE (7) holds according to the stated definition, but no point of equilibrium

can be captured because none exists, contradicting the defining property for PE (7). The airspeed

diverges toward stalling speed because the condition (YTGT ? YPOT MAX) holds for all airspeeds

(fig. 12(c)). However, airspeed divergence presents no immediate threat to safe operation while the

operating point remains within region iV. Furthermore, the operating point must eventually penetrate region V, generating a timely warning. Therefore. unnecessary complication can be avoided

without compromising safety by allowing PE (y) to hold everywhere in region iV. The preliminary

definition is then satisfactory in the form stated.

This definition also appears faulty if the condition (YTGT < YPOT MAX) holds at VMAX, because in that

case PE (7) holds according to the definition, but no point of equilibrium can be captured because

none exists below VMAX (fig. 12(c)). Overspeed could occur. However, if 7TGT lies in region I at

VMAX (that is, If the condition (7POT MiN < YTGT < 7POT MAX) holds at VMAX), overspeed can be

71
prevented by selecting the y-V Command mode, which provides closed-loop control of both airspeed

and path, as already noted. The 7-V Command mode is available for selection unless thrust saturates.

Therefore, the stated definition of PE (y) is satisfactory provided that thrust remains unsaturated. The

case in which YTGT lies below region I is treated shortly.

Minimum thrust— When yPOTTGT is set equal to YP OT MIN, a point of stable equilibrium (if one exists)

lies on the yPOT MIN contour to the right of VMIN DRAG (fig. 12(c)). Overspeed could occur if the condition (YTGT < Y POT MIN) holds at VMAX, even though PE (y) holds under the stated definition.

However, YTGT is required to lie above the safe descent limit YsAFE, as previously discussed. At high

altitudes where YsAFE is not constrained by considerations of terrain clearance, airline operating

policy often imposes a limit (dH/dt)s AFE on maximum rate of descent, which is related to YsAFE by

the equation (dH/dt)sAFE = V sin ysAFE• Therefore, overspeed can be prevented by choosing the safe

descent limit so that the condition (YsAFE: ! yrOT MIN) holds at VMAX, and by enforcing the constraint

(YTGT ? YsAFE) on YTGT. These two conditions together imply that the condition (YT(;T? YPOT MiN) holds

at VMAX, which is sufficient to ensure that a point of stable equilibrium will be captured without the

occurrence of overspeed (fig. 12(c)).

Therefore, the stated definition of PE (y) remains satisfactory in this case also, provided that overspeed is prevented by a suitable choice of YsAFE• (At low altitudes, of course, the safe descent limit

could be further restricted by terrain clearance considerations.)

Intermediate thrust— Finally, assume that thrust is fixed at an intermediate level, so that the condition (yPOT MIN C yPOT TGT C YPOT MAX) holds. If the condition (YTGT "'^ yPOT MAX) also holds, then PE (y)

holds under the stated definition. However, airspeed could diverge toward stalling speed if the

condition (YTGT ^! YPOT TGT) holds, or toward overspeed if (YTGT C YPOT T(;T) holds. However, if YTGT

lies in region I (that is, if (yPOT MIN 'c:^ YTGT ^ YPOT MAX) holds), airspeed divergence can be prevented

by selecting the y-V Command mode, which is available for selection unless thrust saturates.

Therefore, the stated definition of PE (y) is satisfactory in that case provided that thrust remains

unsaturated.

If YTGT lies below region I (fig. 12(c)) (that is, if (YTGT < YPOT MIN) holds), the situation is the same as

that discussed previously for mininulm thrust: overspeed could occur, but can be prevented by a

suitable choice of ysAFE• In that case, the stated definition of PE (y) remains satisfactory in the form

stated.

If YTGT lies above region I (fig. 12(c)) ( that is, if (YTGT ? YPOT MAX) holds), the situation is the same as

that discussed previously for maximum thrust: the stated definition of PE (y) is satisfactory in the

form stated.

Summary— To summarize, analysis has shown that, with the stated definition

NOT PE (Y) = (yTGT > YPOT MAX) AND (V S V MIN DRAG)

72
partial effectiveness holds in several situations in which airspeed diverges, and no point of stable

equilibrium is captured. If YTGT lies in region 1, airspeed divergence can be prevented by selecting

the Y-V Command mode unless thrust saturates. Furthermore, only saturation at maximum thrust is

of concern, because at minimum thrust airspeed divergence toward overspeed can be prevented by a

suitable choice of YSAEE• The same is true if yT(;-i lies below region 1. However, if thrust saturates, the

Y-V Command mode is not available for recovery.

Therefore, to ensure that PE (y) holds only in cases where a stable point of equilibrium is captured

(the original definition), or else in cases where airspeed divergence can be prevented by some other

means, the thrust saturation condition (Y _> YSPEED MAX) will be conjoined to the previous definition of

NOT PE (Y), so that the final definition can be stated as follows:

NOT PE (Y) = (YTGT > YPOT MAX) AND (V< VM[N DRAG) AND (Y ^! YSPEED MAX)•

Normal Effectiveness

In the y Command mode, normal effectiveness always holds for capture of the flightpath target

because of the stability property of the path regulator. Normal effectiveness may or may not hold for

capture of the airspeed target, as shown by the altitude capture example.

By definition, normal effectiveness for capture of the airspeed target requires that the sign of the

longitudinal acceleration be matched appropriately to that of the airspeed error. In the y Command

mode, the longitudinal acceleration is given by equation (10a):

(I /g) dV/dt = sin YPOT TGT —sin y (I Oa)

When the flightpath target is captured, the flightpath angle 'y becomes equal to Y TGT, and equation

(10a) becomes

(I /g) dV/dt = sin YPOT TGT —sin YTGT (12)

Equation ( 12) shows that in the medium and long term after path capture is complete, the longitudinal acceleration dV/dt is deternined by comparing the target flightpath YTGT with the target thrust

YPOTTGT .

 Similarly, the airspeed error is determined by comparing the prevailing airspeed V with the

target airspeed YTGT . Nine possible combinations require evaluation, they are summarized by the

following table:

DV/dt > 0

71 GI < YPOT TGT

DV/dt = 0

Yrc r = YPOT -I-G-I

DV/dt < 0

YrG"i > YPOT TGT

V< V-1 -G-r Case I Case 4 Case 7

V = VTGT Case 2 Case 5 Case 8

V < VTG-i Case 3 Case 6 Case 9

73
It can be seen that normal effectiveness holds by definition in cases 1, 5, and 9:

1. V < VTGT DV/dt > 0

V = VTGT DV/dt = 0

9. V > VTGT DV/dt < 0

In the other cases normal effectiveness is violated. To facilitate meaningful annunciation, it is

convenient to group cases 2, 3, and 6 together by defining the property NOT NE I as follows:

NOT NE1 = R V = VTGT) AND ('VTGT < YPOTTGA OR RV > VTGT) AND (YTGT G YPOTTGT)l

If the condition NOT NE 1 holds, the system should annunciate the cautionary message "More drag."

Similarly, the property NOT NE2 is defined by grouping cases 4, 7, and 8 together:

NOT NE2 = [(V =VTGT) AND (VTGT > Y POT TGT)1 OR [(V < VTGT) AND ('VTGT > YPOTTGA

If the condition NOT NE2 holds, the system should annunciate the cautionary message "More

thrust." With the violations NOT NE1 and NOT NE2 defined as stated, normal effectiveness can then

be defined symbolically by the property NE, where

NE = NE1 AND NE2

It should be noted that normal effectiveness is not essential, because its violation presents no

immediate threat to continued safe operation in the y Command mode. Therefore, the required

annunciations should be presented to the human crew as cautions (advisories), not as warnings.

Annunciation Requirements

To assure design integrity, two kinds of requirements for annunciation of the effectiveness of the

Path/Speed Command supermode must be imposed. In the first place, complete effectiveness, partial

effectiveness, and normal effectiveness must be evaluated continuously, and violations must be

annunciated over the whole mode hierarchy up to the top-level entity invoking the Path/Speed

Command supermode, which specifically includes the human crew.

Secondly, the certainty that violations of effectiveness will be correctly identified in every case must

be provided by a guarantee of logical completeness. The foundation for this logical completeness

has already been laid by the previous demonstration that no point exists in the flightpath-airspeed

plane that does not lie in one of the seven geometrical stability regions of figure 10. Therefore,

definition of effectiveness over all seven regions ensures logical completeness.

This statement of annunciation requirements completes the specification of effectiveness for the

Path/Speed Command supermode. In the next section, safety and effectiveness are combined to

define mode validity.

74
MODE VALIDITY

Validity Concept

Definition

Validity is defined to hold when both safety and effectiveness requirements are satisfied; at least

partial effectiveness is required. Under this definition, invalid operation is inevitable if aircraft

performance limitations preclude even partial effectiveness. For example, because envelope protection modes sacrifice effectiveness in favor of safety, by definition they are invalid relative to the

purpose for which the Path/Speed Command mode is selected.

Validity Regions

With validity defined, the next task is to determine the regions of state space that correspond to valid

operation in each primitive mode, as suggested by Heymann (personal discussion). For the aircraft

longitudinal control problem considered here, the relevant state space is that of the two controlled

variables, that is, the (V, y) plane. To avoid an invalid mode transition, the transition boundary

between each pair of candidate modes must lie within the intersection of their regions of validity, as

explained by the previous discussion ("Introduction"). Furthermore, this condition must hold notwithstanding the effect upon the shape of each validity region of external influences (such as wind

shear or engine failure) to which the hybrid system must react.

These regions of validity are determined in two stages. First, validity conditions for each primitive

mode are determined directly from their governing differential equations. Second, these validity

conditions are related to the geometrical stability regions studied previously (figs. 10 and 12).

Validity of y-V Command Mode

Condition on VTGT

The a priori safety requirement that prevailing airspeed remain within the limits VMIN < V < VMAX

imposes the same condition on the target airspeed:

VMIN < VTGT < VMAX (13a)

If the measured airspeed lies outside these safe envelope limits, envelope protection is invoked, as

described previously, but these envelope protection modes are not treated in detail by this report.

Thus for normal operation in the y-V Command mode in the absence of envelope protection, it

follows that both the target airspeed and the measured airspeed must lie within the safe envelope

limits.

Condition on VTGT

Similarly, the a priori safety requirement that the flightpath avoid penetration of the ysAFE boundary

imposes the same condition on the target flightpath:

yTGT ? ysAFE (I 3b)

75
If the measured flightpath penetrates the ysAFE boundary, envelope protection is invoked, as

described previously, but this envelope protection is not treated in detail by this report. Thus for

normal operation in the y-V Command mode in the absence of envelope protection, it follows that

the target flightpath and the measured flightpath must both lie within the safe envelope limit.

Condition on y

For validity of the y-V Command mode, thrust saturation must be avoided, as discussed previously.

Thus the condition TMIN < TREF < TMAx must hold (eq. (7d)). As shown by equations (1 lg) and

(1 1 h), this is equivalent to the condition

ySPEED MIN < y < ySPEED MAX (14)

(To verify condition (14), substitute TREF from equation (7a), TMAx from equation (7f), and TMIN

from equation (7g) into the condition (TMIN < TREF < TMAX), cancel the drag D, divide out the

weight W, and take inverse sines; then substitute the negations of conditions (1 1 g) and (1 1 h).)

The y-V Command mode is valid if and only if conditions (13a), (13b), and (14) hold.

Validity of V Command Mode

Condition on VTGT

In the V Command mode, the same validity condition on the target airspeed must hold as for the

y-V Command mode:

VMIN < VTGT < VMAX (13a)

Condition on ySPEED

The safety condition (13b) is required to hold in general. In the V Command mode, however, yTGT is

replaced by YSPEED. Therefore, the a priori safety requirement that flightpath avoid penetration of the

ysAFE boundary imposes the same condition on ySPEED:

ySPEED > ysAFE (15a)

It can be shown that the system to be developed makes no use of the V Command mode unless condition (15a) holds, provided that aircraft performance is normal (that is, the condition (yPOT MAX ? 0)

holds). However, if aircraft performance is severely degraded (that is, if the condition (yPOT MAX < 0)

holds), then condition ( 15a) could be violated. In that case, no practical alternative exists that could

prevent enforcement of the condition (y >_ ysAFE) by invocation of descent path protection. Therefore,

condition (15a) is not required to hold for validity of the V Command mode.

Condition on PE (V)

The conditions discussed previously that determine the partial effectiveness of the V Command

mode can be summarized symbolically by the statement that, for validity of the V Command mode,

the property PE (V) must hold.

76
Condition on YPOT TGT

As previously discussed, in the V Command mode the target thrust must be set to some physically

realizable value:

TMIN < TTGT < TMAX (15b)

This is equivalent to the condition

7 POTMIN <7 POT TGT <7 POT MAX (15c)

To verify condition (15c), substitute TTGT from equation (8b), TMAX from equation (7f), and TMIN

from equation (7g) into condition (15b), cancel the drag D, divide out the weight W, and take

Inverse sines.

Path/Speed Priority

As previously discussed, for validity of the V Command mode, the path/speed priority must give

priority to speed:

PRIORITY ° SPEED (15d)

As previously discussed, normal effectiveness of the V Command mode applies only to capture of

airspeed, for which it always holds. Therefore, no evaluation of normal effectiveness is required in

the V Command mode. The V Command mode is valid if and only if conditions (13a), (13b), (15c),

and (15d) hold, and partial effectiveness PE (V) holds.

Validity of (Command Mode

Condition on VTGT

In the 7 Command mode, the same validity condition on the target airspeed must hold as for the

7-V Command mode and the V Command mode:

VMIN < VTGT 

G 

VMAX (13a)

Condition on YTGT

In the 7 Command mode, the same validity condition on the target flightpath (eq. (13b)) must hold as

for the y-V Command mode and the V Command mode:

7 TGT 7SAFE (13b)

Condition on PE(y)

The conditions discussed previously that determine the partial effectiveness of the y Command mode

can be summarized symbolically by the statement that, for validity of the y Command mode, the

property PE (y) must hold.

77
For validity of the y Command mode, the normal effectiveness property NE is not required to hold,

as noted previously, but violations must be annunciated as required.

Condition on 'POT TGT

In the 7 Command mode, the requirement that the target thrust be physically realizable imposes the

same condition (eq. (15c)) on YPOT TGT as for the V Command mode:

7 POT MIN 

< y 

POT TGT G y POT MAX (15c)

Path/Speed Priority

As previously discussed, for validity of the y Command mode, the path/speed priority must give

priority to path:

PRIORITY = PATH (16)

They Command mode is valid if and only if conditions (13a), (13b), (15c) and (16) hold, and partial

effectiveness PE (y) holds.

Summary of Validity Conditions

Collecting results, the validity conditions for all three primitive control modes are summarized by

table 2.

Geometrical Regions for Mode Validity

With qualifications to be pointed out, the validity conditions summarized by table 2 are simply

related to the geometrical regions of the flightpath-airspeed plane illustrated by figures 10, 12, and

13, which were discussed previously. The two upper rows of table 2 show that the validity conditions of the target point ( VT(;T, YTGT) apply to all three of the primitive modes. For validity, the target

point must lie in region 1. 11. 111. IV, or V (fig. 10); it cannot lie in region VI or VII, nor below the

YSAFE boundary (fig. 13). Additional requirements are as follows.

1- V Command mode— For validity of the y-V Command mode (first column of table 2), the instantaneous operating point (V, y) must lie within the central hatched region of figure 12(a), within

which the condition (ysPEED MIN < Y ^ YSPEEU MAX) holds and thrust saturation is therefore absent.

V Command mode— For validity of the V Command mode (second column of table 2), the thrust

target YPOTTGT must lie within region i or on its boundary (fig. 10(b)), and priority must be set to

SPEED (not illustrated).

Furthermore, PE (V) is required to hold. The definition of PE (V) (table 2) shows that its truth value

depends on P, Q, and YPOTTGT• 1 f yPOTTGT is set equal to 7POTMAX, then the condition PE (V) = NOT Q

holds, restricting yTGT to lie above the YSPEED MIN contour (fig. 12(b)), as previously noted. If 7POTTGT

is set equal to YPOT MIN, then PE (V) = NOT P holds, restricting 7TG;T to lie below the ysPEED MAX contour (fig. 12(b)), as previously noted. If 7POT TGT is set to some intermediate thrust level, then

PE (V) = NOT P NOT Q holds, restricting 7TG;T to lie within the central hatched region of figure 12(b),

78
TABLE 2. VALIDITY CONDITIONS FOR PRIMITIVE MODES

'y V Command V Command y Command

VTGT VMIN < VTGT < VMAX

'frG'I' YTGT ^! YSAFE

PE(V), PE(V) PE (y)

PE (y)

y Y > YSITI I) MIN

OR YPOT MIN < YPOT TGT YPOT MAX

'y,> o r'rG'r Y ^ yPi i n ^I ^^

PRIORITY SPEED PATH

DEFINITIONS:

PE (V) = NOT [P AND (11,,,1 H I YPOI MAX)] AND NOT [Q AND (YPOTTGT $ YPOT MIN)]

PE (Y) — (YTGT C YPOT M \\^ t )It (` > V MIN DRAG) OR (Y ^ YSPEED MAX)

NOT PE (y) = (yTGT I \I \0 (V < V MIN DRAG) AND (y >

YSPEED MAX)

P — YTGT YSPEED M:1X Q— YIYT YSPI{ED MIN

as previously noted. BeCILISe 1Or \Aidity yPOTTGT is required to be physically realizable (fourth row

of table 2), there are no other caNeN in which PE (V) holds.

y Command mode— For vandll\ Ot' the y Command mode (third column of table 2), the thrust target

yPOTTGT must lie within reg ion I or on its boundary (fig. 10(c)), and priority must be set to PATH (not

illustrated).

Furthermore, PE (y) is required to held. For simplicity, the region is determined within which PE (y)

is violated (that is, within vv hlch \O I PE (y) holds). The definition of NOT PE (y) (table 2) shows

that its truth value depends on y,,, 1 . V. and y. It follows from the definition of NOT PE (y) that, if

NOT PE (y) holds, then the conditions (y161 ? 7POT MAX) and (V 5 VMIN DRAG) must hold, that is, the

point (V, yT(;T) must lie vv ithin region V or oil boundary (fig. 12(c)).

Conversely, assume that the point yr(;T) lies within region V or on its boundary, so that the

conditions (yT(;T ? 'YPOT M \\) and (\' <_ V MIN DRAG) hold. Then for the usual case illustrated by

figure 12 in which the condition (VI(; I > V MIN DRA() holds, (V S VTGT) must hold. In that case,

(YPOT MAX > YSPEED MAX) holds h\ the definition Of YSPEED MAX . But because (yTGT ^! YPOT MAX) holds

by assumption, the condition (yl(, ? YSPEED MAX) must hold. Because path capture takes place

rapidly, as explained previouSl y , the analysis can be simplified further by examining thrust saturation only after path capture is complete (that is, after y becomes equal to yTGT). The condition

(yTGT ? YSPEED MAX) is then equi\ alert to the condition ( y >— ySPEED MAX ), so the conditions

79
(7TGT ^! YPOT MAX), ( V< VMIN DRAG), and (y ^! YSPEED MAX) must all hold. It then follows from its

definition that NOT PE (y) holds.

This simplified analysis shows that PE (y) is violated if and only if the point (V, YTGT) lies within

region V or on its boundary (fig. 12(c)); in regions I, 11, 111, and IV, PE (y) holds.

SYNTHESIS OF PATH/SPEED COMMAND SUPERMODE

The Synthesis Problem

The mode validity conditions summarized by table 2 complete the formulation of the synthesis

problem (see the section "Overview of Design Method," steps 1-8). Its solution ( see the section

"Overview of Design Method," steps 9-15) requires that mode control logic for the Path/Speed

Command supermode be synthesized in such a way that the required safety and effectiveness

properties are established by construction.

As already noted, no general theoretical method is known for synthesizing such a hybrid system so

as to ensure that its dynamical behavior meets requirements specified a priori. The behavior of such

systems is usually assessed by simulation, but this is a logically incomplete process that cannot

achieve formal verification or validation, as noted previously. In this section, a new method is presented for solution of the synthesis problem formulated by the discussion leading to the validity

conditions of table 2. The first step toward synthesis of the required mode control logic is the inversion of table 2, interchanging its arguments with tabulated quantities.

Table 2 specifies the validity of each of the three primitive longitudinal control modes as a function

of the truth values of logical conditions that depend on flightpath, airspeed, and thrust targets, on

measured flightpath and airspeed, and on the path/speed priority parameter. In principle, what is

needed for selection of a primitive mode is an inverted table (that is, a truth table for table 2) that

shows, for each combination of logical conditions, which modes (if any) are valid, and which violations of effectiveness require annunciation to higher levels of the mode hierarchy. However, a naive

attempt to construct such an inverted table by means of brute -force enumeration would lead to a

combinatorial explosion of cases, as the following analysis shows.

Naive Inversion

After separating the validity conditions of table 2 into binary logical propositions that are either true

or false, it is found that there are 5 binary conditions that determine the validity of the y -V Command

mode (first column of table 2), 7 binary conditions that determine the validity of the V Command

mode (second column), and 7 binary conditions that determine the validity of the y Command mode

(third column). If these binary conditions were all independent, there would be 2 5 = 32 combinations

of conditions requiring evaluation for assessment of the validity of the y-V Command mode, 2' = 128

combinations for the V Command mode, and 2 7 = 128 combinations for they Command mode.

After accounting for duplication of conditions between columns, it is found that there are actually

10 independent binary conditions in table 2. It follows that, for assessment of the validity of all three

primitive modes by inversion of the whole table, there would be 2 10 = 1024 combinations requiring

80
enumeration. Furthermore, a mode selection policy would have to be formulated specifying a unique

mode selection for each of these 1024 combinations. Therefore, it must be expected that a naive,

brute-force approach based on enumeration of all cases would be found intractably complex.

Nevertheless, the inversion problem can be made tractable by developing heuristic design strategies

that enable partitioning of the table before inversion. This partitioning process bears a rough analogy

to matrix inversion, which can often be simplified by partitioning the original matrix, inverting the

partitioned elements, and re-assembling the results. To facilitate this development, it is convenient to

express the validity conditions in terms of symbolic logic.

Symbolic Logic

Readers unfamiliar with formal logic would no doubt find unintelligible the summary statement that

logical simplification ofcompoznld logical propositions formed by conjunction and disjunction of

Boolean variables is to be accomplished by application of elementary logical theorems established

by perfect induction based on truth tables, leading to results expressed in the form of conditionaction decision tables and statecharts characterized by logical consistency and completeness. Yet

the solution of the synthesis problem to be described depends vitally on use of the tools of formal

logic, in contrast to the formulation of the synthesis problem just completed, which has depended on

continuous mathematics and on aeronautical knowledge. It is clear that solution of the synthesis

problem will require a significant change in the reader's orientation, a mental "shifting of gears."

Fortunately, only knowledge of elementary formal logic (on the level of an introductory course) is

needed for the developments to follow.

At this point of the discussion, readers should refer to appendix D, which presents a brief tutorial

review of elementary propositional logic, and to appendix E, which discusses its application to realtime computation within embedded systems. Familiarity with this background material is assumed in

what follows, with specific references provided as necessary. In particular, appendix D contains a

reference list of theorems in symbolic logic that are useful for simplifying compound logical propositions such as those in table 2; extensive use is made of these elementary theorems (Dromey,

1989; Bartee, 1985).

Expression of Validity Conditions by Symbolic Logic

Logical Notation

To express the validity conditions concisely, each validity condition is symbolized by a binary

logical proposition denoted by an upper-case letter and number. For example, the validity condition

( VTGT < VMiN) is denoted by the symbol VT1, and the validity condition (VTGT > VMAx) is denoted

by the symbol VT2; mnemonically, VT2 is the second condition imposed on the Velocity Target,

and GT6 is the sixth condition imposed on the Gamma Target.

For typographical convenience, logical relationships between these propositions are denoted by the

following symbols:

Equivalence = Negation ^ Implication =>

Logical OR v Logical AND will be omitted

81
VTI = (V < V ) TGT MIN VT2 = (V > V ) TGT MAX

GTI = (7TGT < 7SAFF 1 GT6 = (7TGT > 7POT MAX)

For example, the logical proposition "p implies q" is expressed symbolically as p => q, and its

negation is expressed as -, (p => q). Similarly, the proposition "p OR q" is expressed as p u q, and

the proposition "p AND q" is expressed as p q.

Symbolic Logical Propositions

The validity conditions oftable 2 are expressed symbolically, using the following notation to

separate the conditions into binary form:

V I = ( V< V MIN DRAG)

Q - ( 7TGT < 7SPG11) NI I\ I P - (7 TGT > y SPEED MAX)

T S I = (Y Y SPLLD MIN ) - ( POT REF < y POT MIN)

TS-1 = (7 1

SLh11)MAX ) (7 POTREF > 7POTMAX)

TTI =- (y =Y P()I \11\) TT2 = (y POT TGT = 7POT MAX)

TT3 = (7POTTGT < Y Pt,I \III ) TT4 = (7 POTTGT > 7POT MAX)

APP = ( PRIORITY SPi•.LD) PP = ( PRIORITY = PATH)

PFI - (y POTMAX -y POT MIN )

A complete list of symbolic log ical propositions can be found in the section "List of Symbols."

Symbolic Validity Conditions

Making use of these binary propositions. the validity conditions of table 2 can be expressed in

symbolic form by table 3.

Conjunction of Symbolic Validity Conditions

Inspection of table 3 shows that, by col joining the validity conditions for each of the three primitive

modes, these conditions can be summarized compactly as follows:

y-V Command mode:

PVT I —,VT2 SGT I Safe envelope limits

AND

STS 1 --,TS2 Absence of thrust saturation

82
V Command mode:

PVT 1 -,VT2 SGT 1

AND

—,PP

AND

PE(V)

y Command mode:

--,VTI --,VT2 —,GTI

AND

PP

AND

PE(y)

Safe envelope limits

Speed priority

Partial effectiveness of V Command mode

Safe envelope limits

Path priority

Partial effectiveness of y Command mode

The condition that the thrust target be physically realizable is satisfied by the heuristic strategy to be

discussed next. For simplicity, it is not included in this summary.

TABLE 3. SYMBOLIC VALIDITY CONDITIONS

y-V Command V Command y Command

VTGT -,VT I --,VT2

yrGT SGT 1

PE(V), PE(y) PE(V) PE(y)

Y OR yPOT TGT STS 1 TS2 --,TT3 —,TT4

PRIORITY =PP PP

DEFINITIONS:

PE (V) = ^[P AND (yPOT TGT # YPOT MAX)] AND [Q AND (yPOT TGT # YPOT MIN)l

PE (y) = (GT6 V I TS2)

APE (y) = (GT6 V 1 TS2)

P - (YTGT ySP) IiD MAX )

Q - (yTGT G 7SPEED MIN)

83
Heuristic Design Strategies

As the first step toward partitioning the validity table (table 3) to simplify inversion, a heuristic

strategy is developed that ensures that the safety conditions

-,VTI = (VTGT > VMIN) —,VT2 — (V TGT < VMAX) ---,GTI = (7TGT > 7SAFE )

are satisfied by screening the target airspeed VTGT and the target flightpath VTGT at the system input.

Target Screening

According to table 3, the validity conditions PVT 1, --,VT2, and SGT 1 are required for all three

primitive modes. The compound condition (PVT I ^VT2 SGT 1) can be established by screening

the flightpath and airspeed targets before initial mode engagement and whenever the safe envelope

llmrts V MIN, VMAX, or YSAFI are changed. The rationale for target screening is that allowing system

operation with invalid targets is nonsensical.

Although continuous screening is necessary in practice to account for changing aircraft performance,

the flightpath and airspeed targets must not be changed after initial engagement without pilot consent. Since the first-level Path/Speed Command supermode has no direct interface with the human

crew, the need for such target changes must be annunciated to the invoking entity, which must then

obtain pilot consent. The screening logic is specified by the following condition-action decision

table (appendix D):

Table 4 shows that the safety conditions

-,VT1 = (VTGT > VMIN) ^VT2 — (VTGT C VMAX) ^GTI = (7TGT > 7SAFE)

must hold after the screening process is complete. Therefore, the effect of the target screening

strategy is the effective removal of those conditions from the validity table, because a condition

known to hold can be dropped from the conjunction of conditions (Theorem 13, appendix D).

TABLE 4. TARGET SCREENING STRATEGY FOR PATH/SPEED COMMAND SUPERMODE

VTGT ^ V MIN VTCI :> VMAX VMIN :5 VTGT :!^ VMAX Y1'G-I :^ YSAFE YFGT^! YSAFE

Set VTGT equal to

VMIN

Set VTGT equal to

VMAX

Accept VT(;T Set VTGT equal to

YSAFE

Accept 'VTGT

Unsaturated Thrust

After the safety conditions just discussed have been removed from the validity table (table 3) by

target screening, it can be seen that in the absence of thrust saturation (that is, if the condition

STS 1 -,TS2 holds), the 7-V Command mode is valid. In that case, it should be selected.

84
The rationale for this mode selection strategy is that it maximizes system effectiveness. The

T-V Command mode provides complete effectiveness (that is, capture of both the flightpath target

and the airspeed target), whereas either of the other two primitive modes could, at best, provide

partial effectiveness (that is, capture of one of these targets, but not both). Logically, control of both

path and speed dominates control of only one of them.

This heuristic decision to select the T-V Command mode when thrust is unsaturated removes the first

column from the validity table (table 3), leaving selection of either the V Command mode or the

yCommand mode as the only remaining possibilities. The same decision also removes the condition

('/POT MIN ^ TPOTTGT -`^ TPOT MAX) for absence of thrust saturation from the second and third columns,

leaving only the two possibilities

T I = (7110T TGT — TPOT MIN) OR TT2 = (TPOT TGT — TPOT MAX)

The definition of PE(V) can now be simplified as follows:

PE (V) = ^(P TTl) ^(Q TT2)

The following heuristic strategy for setting the target thrust TPOT TGT determines which of the two

possible thrust settings TTI or TT2 is appropriate for operation in the V Command mode and the

T Command mode.

Target Thrust

When thrust is saturated, the thrust target should be set so as to provide the best physically realizable

approximation to the reference thrust TPOT REF. Therefore, the target thrust should be set to TPOT MIN

when the thrust saturation condition TSI = (TPOT REF < TPOT MIN) holds, and to TPOT MAX when the

condition TS2 = (TPOT RH ? TPW MAX) holds.

When thrust is unsaturated, the y-V Command mode is selected, as already noted. In that case, the

fixed target thrust is not used by the automated system, because it is used only when either the

V Command mode or the y Command mode is selected. However, it is convenient to set the target

thrust as it would be set by the best approximation rule just described, if thrust saturation resulted

from capture of the flightpath target YTGT. This strategy avoids unnecessary violation of the partial

effectiveness of the V Command mode by updating the target thrust appropriately whenever possible. In the absence of total propulsion failure (that is, when the condition ^PF 1 holds), maximum

thrust remains comp >_Itationally distinct from minimum thrust. The complete strategy for setting

target thrust is specitied by the following condition-action decision table (table 5):

TABLE 5. STRATEGY FOR SETTING TARGET THRUST

PF1 PF1

TS1 TS2 --,TS1 —,TS2

QP —, P —IQ

Set Set Set Set Set yPOT TGT

TT l TT l TT2 TT I TT2 not

TRUE ; TRUE ; TRUE ; TRUE ; TRUE ; updated

85
If the condition -,PFI -,TS I —,TS2 --,P —Q holds, table 5 shows that the thrust target 7POT TGT is

not updated. in that case, the thrust target is not used by the flight control system. if the condition

--,PFi -,TSI -,TS2 ^P -,Q holds during initialization, the thrust target 7POTTCT is initialized

arbitrarily to 7POT MIN.

Because it ensures that the physical realizabiIity conditions --'TT3 = (yPOT TGT ? 7POT MiN) and

--,TT4 = (7POT TcT < 7POT MAX) hold, the strategy for setting target thrust effectively removes them

from the mode validity table (table 3).

Partitioning and Inversion of Validity Table

Partitioning

With the safety conditions (first two rows of table 3) removed by target screening, the first column

removed by selection of the 7-V Command mode when thrust is unsaturated, and the conditions

-,TT3 and -,TT4 (fourth row) removed by the strategy for setting target thrust, the validity table

(table 3) has been greatly simplified by this partitioning. The reduced table that remains when thrust

is saturated is now as follows:

V Command y Command

Partial Effectiveness

PRIORITY

PE (V)

=PP

PE (y)

PP

Inversion

This reduced table can now be inverted by inspection. Only three binary conditions remain: PE (V),

PE (7), and PRIORITY. Therefore, there are 2 3 = 8 combinations, which can be arranged as an

enumerated list with 8 rows. This enumerated list forms the inverted decision table (table 6) that

constitutes the solution to the mode selection problem when thrust is saturated; that is, table 6 is a

truth table (appendix D) for the reduced validity table just discussed.

For each of these 8 combinations, a unique mode selection policy must be formulated_ It can be seen

that, in half the cases enumerated in table 6, neither the V Command mode nor the y Command

mode is valid. Nevertheless, in each of these cases, one of these modes must be selected. The next

section turns to a discussion of mode selection criteria.

Mode Selection Criteria

III 3, 4, 6, and 8, one of the two modes is valid and the other invalid. Therefore, the mode

selection strategy can be based entirely on validity, and consists simply of avoiding the selection

of an invalid mode. In cases I and 5, the condition -,PE (V) APE (y) holds, so that neither the

V Command mode nor the 'y Command mode is valid (table 3). Because partial effectiveness does

not provide a basis for choice, mode selection must be based on priority, selecting the V Command

mode when priority is set to SPEED (case 1), and selecting the y Command mode when priority is set

to PATH (case 5). This strategy makes use of control flowing down from higher level, but it leaves

cases 2 and 7 unresolved.

86
TABLE 6. INVERTED VALIDITY TABLE FOR PATH/SPEED COMMAND SUPERMODE

Condition V Command y Command

1. SPEED -APE (V) APE (y) INVALID INVALID

2. SPEED APE (V) PE (y) INVALID INVALID

3. SPEED PE (V) APE (y) VALID INVALID

4. SPEED PE (V) PE (y) VALID INVALID

5. PATH APE (V) —,PE (y) INVALID INVALID

6. PATH -,PE (V) PE (y) INVALID VALID

7. PATH PE (V) APE (y) INVALID INVALID

8. PATH PE (V) PE (y) INVALID VALID

In both cases 2 and 7, the selection could be based on partial effectiveness if the priority were

changed; that is, there is logical conflict between priority set at higher level and the relevant information available at the primitive level based on partial effectiveness. In cases I and 5, where the

condition -,PE (V) APE (y) holds and neither mode is valid, it is clear that the dilemma must be

resolved at higher level by the invoking entity, because no relevant information is available within

the Path/Speed Command supermode. In cases 2 and 7 relevant information is available, but that

information is in conflict with the priority specified by the invoking entity. Therefore, because the

relevant information available is insufficient to resolve the conflict, the strategy should be the same

for cases 2 and 7 as for cases 1 and 5: base mode selection entirely on priority, and annunciate relevant information based on effectiveness violation to the invoking entity for resolution there. This

strategy leads to the selection of the V Command mode in case 2, where priority is set to SPEED, and

to selection of the y Command mode in case 7, where the priority is set to PATH. With this system

structure, annunciation of the condition ^PE(V) -,PE(y) to the invoking entity constitutes information flowing upward, and the path/speed priority constitutes control flowing downward. The decision

determining priority should be made at the lowest level within the control hierarchy at which sufficient information is available.

With the adoption of this policy, which bases mode selection at the primitive level entirely on

priority when thrust is saturated, partial effectiveness becomes nonrelevant for the selection strategy,

and mode selection based on table 6 when thrust is saturated collapses to the following drastically

reduced table:

Condition V Command y Command

APP

PP

TRUE

TRUE

87
Integrated Mode Selection Strategy

When the mode selection strategy for thrust saturation is combined with that for unsaturated thrust

discussed previously, the complete mode selection table for the Path/Speed Command supermode is

obtained (table 7):

TABLE 7. MODE SELECTION WITHIN PATH/SPEED COMMAND SUPERMODE

Condition y-V Command V Command y Command

--,TS1 —,TS2

--------------

TS1 u TS2

TRUE

--------------- -------------------------------

TRUE

—1PP

--------------

PP

TRUE

--------------------------------

TRUE

Definitions

STS 1 -,TS2: Thrust unsaturated TS I u TS2: Thrust saturated

PP: SPEED priority PP: PATH priority

In this condition-action mode selection table (appendix D), each column of the table corresponds to

a single mode, and each row corresponds to a logical condition. The conditions that must hold for

selection of any mode are designated by the entry TRUE in the body of the table in the column

corresponding to that mode. For example, for selection of the V Command mode, the conditions

APP and TS I u TS2 must hold, as indicated by the entry TRUE in the second and third rows of

the second column. Blank spaces in the body of the table are not relevant to mode selection

(appendix D).

The mode selection strategy specified by table 7 constitutes the solution of the synthesis problem for

the Path/Speed Command supermode. An alternative form of specification for this mode selection

strategy can be obtained by constructing the equivalent statechart (appendix E), which is discussed

next.

Construction of Statechart

Mode Structure

To enable the state chart for mode selection to reflect the same partitioning that is evident in the

decision table (table 7), it is convenient to combine the V Command mode and the 7 Command

mode to form a supermode that is termed 7 O V Command. The statechart for mode selection 111ustrated by figure 15 call be constructed directly from table 7, as explained next. A simplified

discussion of statecharts can be found in appendix E.

Statechart for Mode Selection

Because the 7-V Command mode is selected according to table 7 whenever the condition

-,TS i TS2 holds, whatever the previous state, a transition arrow labeled with the condition

98
STS 1 -,TS2 must lead to the y-V Command mode from they OR V Command supermode, and a

second arrow labeled -,TS 1 TS2 must lead to the y-V Command mode from the initial state outside

the Path/Speed Command supermwde boundary (fig. 15). Similarly, a transition arrow labeled with

the condition TS I v TS2 must lead to the y OR V Command supermode from the y-V Command

mode. Within the y OR V Command supermode, a transition arrow labeled with the condition PP

must lead from the V Command mode to the y Command mode, an arrow labeled with the condition

-,PP must lead from the y Command mode to the V Command mode, and similarly for initialization.

Statechart for Setting Target Thrust

The strategy for setting target thrust (table 5) can be represented as a concurrent state machine

within the Path/Speed Command supermode (fig. 15) by following a similar construction method.

It can be seen that the case in \\ hich the condition ^PF I -,TS 1 TS2 -,P --,Q holds, for which the

target thrust is not updated (tahle 5), is represented in the statechart by transition arrows that return

to the previous state.

Other Statecharts

The diagram of figure 15 also sho p\ s that the strategy for target screening and for evaluation of the

conditions APE (V), APE (y). and NE call also be represented as concurrent state machines within

the Path/Speed Command supernnlde. Their internal details, which are omitted from figure 15, are

specified for target screening, h\ tahle -t. and for effectiveness evaluation by the definitions of

APE (V), -,PE (y), and NE di ,,cu»ed previously.

Initial state Initial state

PATH/SPEED COMMAND

,PF1

MODE SELECTION E O I THRUST PF1

,TS1 -V COMMAND TS2 ,PF

,TS2 TS1

TGT I

I

I

I TMAX P TMIN

F ^\ ( ( TS1 U TS2 I ,TS1

'for V COMMANL) ,TS2

,PP

,PP PP APP

/COMMAND

,I

TT2 -PFI ,TS1 ,TS2 TT1

I Q

I Q TS1 ,PF1 I Q ,PF1

,PF1PF1

,TS1 ,TS2

1p-Q

,TS1 ,TS2

I

,P,Q

— — — — — —

I

I— — — — — i —

SCREEN V TGT I

I I

SCREEN vTGT

I I

-- - - - - - - - - - - -r- - - - - - -

EVAL PE V EVAL PE a I EVAL NE

I I

I

I

I

I /

,PF1

,TS1

,TS2

89
Statechart for Path/Speed Command Supermode

Figure 15 shows that the statecharts for all the concurrent state machines just described are combined to form the statechart for the Path/Speed Command supermode. The resulting state machine

could, of course, also be specified in final form by table 7. Indeed, such decision tables may be

preferred to their equivalent statecharts for some purposes, such as providing a reference document

that can conveniently be reproduced.

However, the statechart of figure 15 provides a compact representation that is graphically suggestive

of the dynamical function of the state machine, and may be preferred to equivalent decision tables

for tutorial purposes after the interpretation of statecharts becomes familiar. Statecharts also facilitate verification of the essential logical properties of consistency and completeness.

Verification of Consistency and Completeness

Mode selection would be logicall y inconsistent it two or more transition arrows leading away from

any mode were labeled with the same condition. In that case, mode selection would be ambiguous

and would fail to be mutually exclusive, because two or more modes could be selected at the same

time.

Mode selection would be logically incomplete if any combination of conditions could occur for

which no transition is specified. In the statechart diagrams, clutter can be reduced by adopting the

convention that. in the absence of any defined transition away from each mode, the system remains

in that mode by default. If this convention is adopted, completeness can no longer be assessed

directly by inspection of the diagram, and must therefore be verified independently.

For a decision table, consistency would be violated if any two columns of the table contained the

same pattern of truth conditions, and completeness would be violated if the disjunction of truth

conditions involving each tested quantity failed to hold tautologically (appendix D). For example, in

table 7 there are two conditions involving TS I and TS2. Because the condition TS i v TS2 is logically equivalent to the negation of the condition STS 1 TS2 (Theorem 11, appendix D), their junction (TS l v TS2) v (STS 1 -,TS2) is tautologically true (Theorem 4, appendix D). Therefore,

table 7 is logically complete with respect to the conditions TS 1 and TS2. Evaluation of complex

decision tables for consistency and completeness is accomplished in practice by means of utility

programs developed for that purpose.

Implementation

A more subtle point regarding statechart representation arises during implementation. Conceptually,

the concurrency specified by the statechart of figure 15 could be realized by 7 processors (one for

each concurrent machine) operating in parallel, each executing a re-entrant program that would

repeat continuously. Such a system cannot be implemented exactly by a single sequential processor,

because such a processor can execute only one instruction at a time. Therefore, certain temporal

approximations must be made during implementation for sequential machines like those installed in

current transport aircraft. In consequence, the specification provided by the statechart of figure 15

must be regarded as ambiguous or incomplete for such implementations.

These issues are discussed in detail in appendix E, in which certain changes to standard statechart

semantics are proposed that enable exact implementation within a sequential processor, eliminating

90
LL

m

rn

m

ma

L

Q1

7SPEED MIN y- V COMMAND

the need for introduction of temporal approximations during implementation. Such temporal approximations could be a source of design error that could void the behavioral guarantees on which formal

validation depends. The same difficulties would, of course, be encountered during implementation

from equivalent decision tables. However, based on experience with implementation of similar systems for state estimation and flight control in experimental aircraft for which timing could be critical, the authors are of the opinion that statecharts offer unique clarity for understanding and solving

such problems.

System Properties for Path/Speed Command Supermode

Geometrical Regions for Mode Selection

For the system specified by the statechart of figure 15, selection of the y-V Command mode or the

y OR V Command supermode is determined entirely by the thrust saturation conditions

TSI —(7 POT RI:F 

G y

POT MIN) TS2 — (7 POT REF j 7 POT MAX)

which, as already noted, are equivalent to the conditions

TSI = (7< 

ySPEED MIN ) TS2 (y >_ 7SPEED MAX)

These conditions are physical, and correspond to well-defined geometrical regions within the (V, y)

plane, as discussed previously (fig. 12). Therefore, each region can be identified by the corresponding mode, as illustrated by figure 16. It can be seen that the y-V Command mode is selected when

the (V, y) operating point lies within the central region within which thrust saturation is absent, and

the yOR V Command supermode is selected elsewhere. (Within they OR V Command supermode,

the V Command mode is selected when priority is set to SPEED, and the y Command mode is selected when priority is set to PATH; these selections are not illustrated by figure 16.)

y or V COMMAND

YSPEED MAX

Tor V COMMAND

V MIN VTGT VMAX

Airspeed —►

Figure 16. Geometric regions for mode selection within Path/Speed Command supermode.

91
Safety Properties

During operation in the Path/Speed Command supermode, the safety properties discussed previously

are enforced by screening the targets at the system input, as specified by table 4, and by the envelope

protection modes previously described. Therefore, the system behavior is constrained to respect the

safety envelope boundaries illustrated by figure 13. Invocation of any envelope protection mode,

which should occur only under abnormal conditions, is required to be annunciated by a suitable

warning.

Effectiveness Properties

During operation in the Path,'Speed Command supermode, the effectiveness of system behavior is

summarized as follows:

7 V Command mode- During operation in the y-V Command mode, capture of both the flightpath

target and the airspeed target are assured by the stability properties of the path and speed regulators

within the flight control system (fi gs. I I (c) and 11(e)). Therefore, as defined previously, the

y-V Command mode is completely effective.

V Command mode- Durinu operation in the V Command mode, capture of the airspeed target VTCT

is assured by the stability property ol' the speed regulator within the flight control system (fig. i i (c)).

The flightpath angle yspl :,:, ) is raptured. which provides an acceptable approximation to the flightpath

target yTCT provided that partial effectiveness (that is, PE (V)) holds for the V Command mode.

yCommand mode- Dunn_, operation in the yCommand mode, capture of the flightpath target yrcT

is assured by the stabilit y propert y of the path regulator within the flight control system (fig. 1 1(e)).

The airspeed target VTR 1 is not captured. but an acceptable point of stable airspeed equilibrium is

reached provided that partial cffecti\cness (PE (y)) holds for the'yCommand mode.

Longitudinal acceleration has the correct sign leading to capture of the airspeed target VTCT provided

that the normal effectiveness properties NEI and NE2 hold. Violation of NE1 results in the annunciation "More drag," and violation of' NE2 results in the annunciation "More thrust."

Required annunciations- All effectiveness violations must be annunciated to the human crew, and

also to the invoking entity. Assurance that all such violations will be identified and annunciated as

required is provided by log ical completeness based on the geometrical regions discussed previously.

Concluding Remarks

The simplicity of the final mode selection strategy for the Path/Speed Command supermode, which

is specified by table 7, stands in ,harp contrast to the complexity of the table that would result from

brute-force inversion of table \y hich as noted previously would contain 1024 rows.

It should be noted that the Path/Speed Command supermode does not constitute a complete automaton, because the essential path/speed priority must be determined by the invoking entity (that is, a

92
second-level supermode), accounting for all relevant information available at higher level. The

means by which that determination is accomplished is discussed in the next section, which describes

a supermode on the second level of the mode hierarchy.

SYNTHESIS OF ALTITUDE COMMAND SUPERMODE

In order to extend the synthesis method to higher level and to develop a system that constitutes a

complete automaton, this section discusses the synthesis of a second-level supermode to be termed

Altitude Command. Its development makes use of the same methodology employed for synthesis

of the Path/Speed Command supermode already described (see the section "Overview of Design

Method," steps 1-15). The Path/Speed Command supermode, which lies on the lowest level of the

three-level mode hierarchy, accepts flightpath angle and airspeed targets, as explained previously.

The Altitude Command supermode, which lies on the second level of the mode hierarchy, makes use

of the first-level Path/Speed Command supermode as an internal element, but generalizes its function to enable the system to accept altitude and airspeed targets. These targets can be entered

manually by the crew, providing operation functionally similar to that of the Flight Level Change

supermode in the autoflight systems of current transport aircraft.

Alternatively, the Altitude Command supermode can be invoked, and its altitude and airspeed

targets can be specified, by a supermode on the third level of the mode hierarchy. By this means,

operation similar to that of the vertical planning and guidance modes in current aircraft can be

provided, while avoiding functional duplication.

In general. it must be expected that moving upward to a higher level in the mode hierarchy will

involve consideration of new supermodes, each of which constitutes a hybrid system whose

continuous and discrete elements must both be specified. This is the case for the second-level

Altitude Command supermode, just as it is for the first-level Path/Speed Command supermode

discussed previously. For the Altitude Command supermode, there is only one continuous element:

the function of altitude regulation, which is described next.

Altitude Regulation

Because the aircraft altitude is governed by a differential equation, the aircraft model described

previously (eqs. (1), (2), and (4)) must be augmented by the altitude equation

DH/dt = V sin y

where the symbol H denotes height above mean sea level. In the flight control system illustrated by

figure I I, the height regulator is shown on the left of the broken line in figure 1 I (a) that separates

the Altitude Command supermode (outer-loop control) from the Path/Speed Command supermode

(inner-loop control). Its details are illustrated by figure 11(b).

Figure 1 1(b) shows that the height regulator combines two different height regulation laws. For

small height errors of 300 ft or less, the commanded vertical velocity (dH/dt) CMD is linearly proportional to the height error AH, providing exponential convergence to the target altitude (lower row of

93
diagram, figure 1 1(b)). For larger height errors, a parabolic law (upper row of figure 1 I (b)) is used

to obtain constant normal acceleration (approximately 0.1g) during the altitude capture maneuver,

avoiding excessive normal accelerations that would be commanded if the exponential law were used

for large height errors.

Because both the vertical velocity and the normal acceleration commanded by the parabolic law are

matched to those commanded by the exponential law at the point of transition, the commanded

vertical velocity (dH/dt)c MD is specified uniquely and continuously as a function of altitude error. It

is then divided by inertial speed to obtain the quantity sin yTCT, which is limited to ensure realizability before inverting to obtain the flightpath target yTGT (fig. I I (b)).

Mode Structure

In order to relate the function of the Altitude Command supermode directly to the pilot's task during

operation within the National Airspace System, four mode elements termed Climb, Descend, Altitude Capture, and Altitude Hold are specified as internal elements of the Altitude Command supermode. Each of these four modes contains the Path/Speed Command supermode as an internal

element. It may be recalled from the previous discussion that the Path/Speed Command supermode

contains the primitive modes y-V Command, V Command, and y Command as internal elements.

The Altitude Capture, Altitude Hold, Climb, and Descend modes are related to each other and to the

height regulator law in the following way.

Altitude Capture and Altitude Hold Modes

For altitude errors smaller than 300 ft, the height regulator makes use of the exponential law, as

already described. This exponential law corresponds to the Altitude Hold mode. For larger altitude

errors, the height regulator uses the parabolic law, which corresponds to the Altitude Capture mode.

In either the Altitude Capture or the Altitude Hold mode, priority is set to PATH. When the Path/

Speed Command supermode is invoked and the PATH priority is passed to it, the primitive

y-V Command mode is selected if thrust is unsaturated, as already explained. in that case, both the

path and speed targets are captured. If thrust saturates, with PATH priority the primitive y Command

mode is selected. In that case, only the path target is captured. Therefore, if thrust saturates, the

Altitude Capture mode and the Altitude Hold mode both capture the target flightpath yTGT at the

expense of the the speed target. Capture of the altitude target HTCT is then assured by the stability

property of the height regulator (fig. 1 1(b)).

Climb and Descend Modes

Foi- altitude errors so large in magnitude that the target flightpath angle yTGT commanded by the

height regulator (fig. I i (b)) lies outside the aircraft performance envelope (fig. 17), this commanded

flightpath target should be approximated by selecting the nearest point on the boundary of the performance envelope at the target airspeed as the best physically realizable approximation for steady

climb or descent. If the altitude error AH is positive (that is, if the target altitude lies above the prevailing altitude), such operation corresponds to the Climb mode. If the altitude error OH is negative,

such operation corresponds to the Descend mode. For example, if the commanded flightpath target

yTCT lies above the upper boundary of the performance envelope (point A of figure 17), then point B

94
1

m

s

a

rn

LL

VTGT

VTGT

A

A(

B

D

JAC

7SPEED MAX

YSPEED MIN

on the maximum-thrust contour of figure 17 at the target airspeed VTGT should be selected for

operation in the Climb mode.

It should be noted that the angular difference Dy between yTGT and 7POT MAX (fig. 17) is limited to a

maximum of 3 degrees by the limit imposed on 7T<;T within the height regulator (fig. 1 1(b)). This

angular increment is sufficient to ensure that maximum thrust is commanded during the climb, even

if moderate errors should enter the onboard performance calculation that estimates yPOT MAX. A

similar angular difference between yTGT and yPOT MIN ensures that idle thrust is commanded during

descent. These limits imposed on yTGT also serve to confine the corresponding symbol within the

field of view of the primary flight display (fig. 11(a)).

In the Climb mode, priority is set to SPEED. When the Path/Speed Command supermode is invoked

and the flightpath and speed targets and the SPEED priority are passed to it, the primitive 7-V Command mode is selected if thrust is unsaturated. If the thrust saturates, with SPEED priority the primitive V Command mode is selected, with target thrust set at maximum. In that case, the flightpath

angle ysPEED MAX is captured, leading to capture of the speed target VTGT. Steady climb at point B

(fig. 17) then results.

If the commanded flightpath angle yTGT lies below the lower boundary of the performance envelope

(point C of fi gure 17), operation in the Descend mode is obtained in a similar way. Priority is set to

SPEED. Invoking the Path/Speed Command supermode and passing to it the flightpath and speed

targets and the SPEED priority results in steady descent at point D (fig. 17).

MIN VTGT uMAX

Airspeed —i

Figure 17. Approximation of flightpath target.

95
Path/Speed Priority

It is clear from this discussion that the Climb mode and the Descend mode both require the path/

speed priority to be set to SPEED. In contrast, the Altitude Capture mode and the Altitude Hold mode

both require that the priority be set to PATH to enable capture of the target altitude. Setting priority is

an action that must be associated with mode selection on the second level of the mode hierarchy.

Functional Specification

Accounting for the mode structure just discussed, the functional specification for the Altitude

Command supermode can be summarized as follows. The control flow and information flow within

the supermode hierarchy, which are similar for all the second-level supermodes, are illustrated by

the block diagram of figure 18. The discussion that follows relates only to the Altitude Command

supermode; the other supermodes illustrated by figure 18 are discussed later, and should be ignored

for the present.

Inputs and Outputs

The Altitude Command supermode can be invoked by the human crew via the mode control panel

during manual operation (fig. 18), or, alternatively, by a supermode on the third level of the mode

hierarchy (not illustrated by figure 18). The Altitude Command supermode accepts from the invoking entity the following two inputs: the altitude target HTGT and the airspeed target V TGT . The quantities VMIN, VMAX, HSAFE, and HMAX must also be specified for use in screening the altitude and

airspeed targets (fig. 18). The Altitude Command supermode must determine the flightpath target

yTGT from the height regulator law (fig. 1 I (b)). In addition, the Altitude Command supermode must

Cockpit Interface

MODE I OTHER SECOND-LEVEL SUPERMODES :........................I..... ANNUNCIATION......................................... ILS APPROACH SUPERMODE

I I

I Supermode ALTITUDE COMMAND SUPERMODE selection

MODE

0-

I

I CONTROL I HTGT VTGT Level 2 PANEL Related to operation task

I I

H SAFE. HMAX VTGT, VTGT PE(V)

Control Priority PE(()

V MIN, VMAX flow VMIN VMAX NE (^

P, Q

Onboard

calculation

PATH/SPEED COMMAND SUPERMODE

Information

flow

Discrete - ........•.. Level 1

Related to aircraft behavior

Continuous

Figure 18. Distributed decision-making: control flow and information flow within

supermode hierarchy.

96
determine the path/speed priority as a Boolean control variable. The Altitude Command supermode

invokes the first-level Path/Speed Command supermode, and passes to it the following three outputs:

the flightpath target yTGT, the airspeed target VTGT, and the Boolean path/speed priority (fig. 18).

The Path/Speed Command supen-node accepts from the invoking entity (that is, from the Altitude

Command supermode) the following three inputs: the flightpath target 7TGT, the airspeed target VTGT,

and the Boolean path/speed priority. Based on thrust saturation and on the Boolean path/speed

priority, the Path/Speed Command supermode selects one of the three primitive modes y-V Command, V Command, or y Command. The selected mode determines the elevator and throttle servo

commands from the continuous elements of the flight control system (fig. 11).

In addition, the Path/Speed Command supermode evaluates the partial effectiveness of the y Command mode and of V Command mode, and the normal effectiveness of the y Command mode, as

previously defined, and returns them to the invoking entity (fig. 18). The Path/Speed Command

supermode must also evaluate and return the two conditions P and Q (fig. 18) that will be used by

the Altitude Command supermode for mode selection. These Boolean variables were previously

defined (eq. (1 11) as follows:

P (7TGT > ySPEED MAX ) Q - (7TGT < 7SPEED MIN)

Annunciation requirements

The mode selection status of the primitive y-V Command mode, y Command mode, and y Command

mode are also annunciated to the crew, together with the caution and warning messages generated

within the Path/Speed Command supermode (fig. 18). All other lower-level details, such as thrust

saturation, regulator errors, and the like, are hidden within the Path/Speed Command supermode.

Mode Control Panel

The Altitude Command supermode is selected manually by means of the Mode Control Panel.

A representative implementation for the mode control panel is described briefly in this section,

omitting details for clarity. Flight control system architecture relating the Mode Control Panel to the

Altitude Command supermode is illustrated in statechart form by figure 19(a), and representative

Mode Control Panel functions are illustrated by the statecharts of figures 19(b) and 19(e) and the

block diagram of figure 19(d).

This description of the Mode Control Panel is presented in order to illustrate a representative interface with the human crew. Because the focus of the present work is on the Altitude Command

supermode, no claims are made for formal validation of the Mode Control Panel functions illustrated

by figures 19(b), 19(c), and 19(d). Features of the Mode Control Panel termed display blinking and

time-out are described briefly in this section, their purpose is to provide protection against certain

human errors to be discussed in detail later.

97
Mode Selection

It is assumed that the Altitude Command supermode is one of several second-level supermodes

available for manual selection (fig. 18). Supermode selection must be mutually exclusive. (Modes

internal to the Altitude Command supermode such as the Climb and Descend modes cannot be

selected manually.) The ALTITUDE DISPLAY statechart (fig. 19(b)) and block diagram (fig. 19(d)),

I

MODE CONTROL PANEL

I

1 I

ALTITUDE DISPLAY I AIRSPEED DISPLAY

I I

I I

I I

I

l i

I I

I

-

I

a) System architecture.

ALTITUDE DISPLAY

Initialize

Pilot request H NORMAL

ALTITUDE CMD -,H1 -H2

holds

Set H DISP = HTGT

Pilot set HKNOB

Set H DISP - HKNOB

[Reset 10-sec timer,

Start 10-sec timer Set HTGT - HDISP Time

out

H PROMPT

Pilot enter HTGT

1 sec on

1 sec off 1

Blink H display

b) ALTITUDE DISPLAY statechart.

Figure 19. Mode control panel.

98
b) AIRSPEED DISPLAY statechart.

Request

ALTITUDE CMD 1 4 Enter HTGT H SAFE H MAX H prompt H prompt pushbutton ? pushbutton HDISPLAY 1 BLINK i Pilot enter HTGT

.............

PILOT HKNOB SCREEN O^ ► HOLD HTGT ALTITUDE CMD -H1 -1-12 holds t H normal

pushbutton light VKNOB SCREEN -VT1 ^VT2 H normal

d) Block diagram for ALTITUDE DISPLAY (AIRSPEED DISPLAY similar).

Figure 19. Mode control panel (concluded).

show that the crew requests the Altitude Command supermode by pushing a labeled button, which is

then magnetically latched. The crc^\ is prompted for entry of altitude and speed targets, which must

be completed before the systen) cnua g es the requested supermode. Prior to engagement, the system

continues to operate in the pre% iouslV engaged supermode, or in manual control. Supertnode engagement status is indicated by illumination of its pushbutton (fig. 19(d)). The Altitude Command supermode is de-selected h_y pushing the illuminated button.

Altitude and Airspeed Targets

The mode control panel displa y , the altitude and airspeed targets in display windows. The pilot

adjusts the displayed altitude Hl,lsrt.,» by turning an adjacent knob (figs. 19(b) and 19(d)). After the

altitude is set as desired, it is entered into the system by pressing a button adjacent to the altitude

99
display window, which causes the internally stored altitude target HTGT to be set equal to HDISPLAY.

If the pilot resets the altitude knob, so that HDISPLAY is no longer equal to HTGT, the window blinks to

prompt the pilot to enter the new altitude target. If entry is not completed within 10 sec, HDISPLAY

again displays the previous HTGT. Airspeed targets are entered in a similar manner (figs. 19(c) and

19(d)).

Mode Annunciation

The engagement status of modes internal to the Altitude Command supermode is annunciated to the

crew by a mode display panel. The engagement status of the primitive modes within the Path/Speed

Command supermode is also indicated by suitable symbols within the primary flight displays,

enabling the crew to anticipate mode transitions as two symbols approach coincidence. This symbology is discussed in detail in the section "Design Recommendations."

Safety Requirements

In addition to the safety requirements on VTC;T and yTGT previously imposed on the Path/Speed

Command supermode, further safety requirements on target altitude and airspeed must be added for

the Altitude Command supermode, as follows.

Minimum Altitude

The minimum safe altitude is determined by requirements for safe terrain clearance. This minimum

safe altitude HSAFE should be determined from the National Airspace System database as a function

of the geographic position of the aircraft. In order to make the Altitude Command supermode

suitable for use with area navigation, the restriction HSAFE ? 1500 ft above ground level must be

imposed for safety. Operation below 1500 ft above ground level requires more precise navigation,

which would be obtained from an approach navigation aid such as an Instrument Landing System

(ILS) during operation in a suitable approach mode. Fully automated operation in the Altitude

Command supermode can be permitted at minimum altitudes HMIN as low as 400 ft above ground

level after takeoff, provided that the target altitude meets the requirement HTGT ? HSAFE.

Maximum Altitude

The maximum altitude is determined by the reserve thrust required at the target airspeed to avoid

small losses of airspeed during coordinated turns, which result from the increase of induced drag

(appendix B) owing to the increased lift required in coordinated turning flight (appendix Q.

Calculations for the generic transport aircraft described in appendix B show that, after accounting

for the thrust needed for a coordinated turn with approximately 20 degrees of bank, the thrust

required is near that available at the optimal cruising altitude. Therefore, the maximum altitude

HMAX is closely approximated by the optimal cruising attitude, which ranges from 28,000 ft to

43,000 ft depending on aircraft wing loading (table B-3, appendix B). The exact value of HMAx

under prevailing conditions must be determined from the performance database of the aircraft. The

required performance at H MAx is discussed in more detail later.

Minimum Airspeed

In order to mitigate the adverse safety consequences of invocation of underspeed protection, the

minimum airspeed VMIN should be set equal to the minimum-drag airspeed VMIN DRAG. This mitigation strategy resolves a conflict between safety and effectiveness to be discussed after defining

100
effectiveness for the Altitude Command supermode. In practice, the performance envelope diagram

for the generic transport discussed in appendix B (fig. B-7, appendix B) shows negligible performance degradation for airspeeds as low as 20 kt EAS below VMiN DRAG, owing to the characteristic

increase of thrust with decreasing airspeed (fig. B-4). Therefore, the minimum airspeed VMiN for the

Altitude Command supermode can be set 20 kt EAS below the minimum-drag speed VMiN DRAG (or,

in the takeoff configuration with wing flaps extended, 5 kt EAS below the takeoff safety speed Vz)

without significant performance penalty.

Maximum Airspeed

The maximum airspeed VMAx is limited by structural considerations at low altitude, and by compressibility (Mach) effects at high altitude (appendix B). For a fixed maximum operating Mach number,

the corresponding equivalent airspeed V I, decreases with altitude until the maximum altitude HMAx

is reached (eq. (B-7m), appendix B).

Safety Envelope

The restrictions on altitude and airspeed just discussed combine to limit operation in the Altitude

Command supermode to the safety envelope illustrated by figure 20. The limits on prevailing

airspeed are enforced by the underspeed and overspeed protection modes discussed previously

during development of the Path/Speed Command supermode. The limits HMiN and HSAFi? on prevailing altitude can be enforced by the descent path protection mode discussed previously, by making

the safe descent flightpath limit ysAFE depend appropriately on HMiN and HSAFE and on inertial speed.

Therefore, the limits on prevailing altitude and prevailing airspeed can be enforced by the envelope

protection modes already discussed, and impose no new safety requirement on the Altitude Command supermode. On the other hand, the limits on target altitude and target airspeed must be

enforced by the target screening algorithms that are included within the Altitude Command supermode, which will be discussed in detail later.

HMAX

H

C7FHSAFE

MIN uMAX

Airspeed

Figure 20. Safety envelope for Altitude Command supermode.

101
Effectiveness Requirements

Effectiveness definitions

The effectiveness properties defined previously for the Path/Speed Command supermode can be

generalized as follows for the Altitude Command super-node and its elements, the Altitude Capture,

Altitude Hold, Climb, and Descend modes. Complete effectiveness is defined to hold if and only if

both the altitude target HT( ;-t and the airspeed target VTGT are captured.

Partial effectiveness is defined to held for the Altitude Capture and the Altitude Hold modes if and

only if the altitude target H T( ; 1 is captured, and a point of stable airspeed equilibrium is reached that

constitutes an acceptable approximation to VT6T. Partial effectiveness is defined to hold for the

Climb and Descend modes if and only if the speed target VTGT is captured, and a point of stable path

equilibrium is reached that constitute an acceptable approximation to YTCT•

Normal effectiveness is defined to hold if the vertical velocity dH/dt and the normal acceleration

both have the correct sign fir capturr of the altitude target HTGT, and the longitudinal acceleration

dV/dt has the correct sign for rapture of the airspeed target VTGT. In practice, the magnitude of the

vertical velocity should be required to exceed a nominal threshold value during climb and descent.

These stronger conditions are termed climb and descent effectiveness. The property of normal

effectiveness is closely related to the Smoothness of the altitude and speed capture maneuvers, which

are discussed later.

Altitude Command Supermode

If complete effectiveness hold', for the Path,'Speed Command supermode as previously defined,

which ensures that both the Ii g htpath tar^^ct yTGT and the airspeed target VTGT are captured, complete

effectiveness for the Altitude CO 11111 and supermode then follows from the stability property of the

height regulator. Conditions sufl icicnt to ensure complete effectiveness are discussed later.

Altitude Capture and Altitude Hold Modes

Because the Altitude Capture and Altitude Hold modes both use the primitive yCommand mode

during thrust saturation, as alread\ noted. partial effectiveness of the y Command mode is required

to ensure partial effectivcncss of hoth the Altitude Capture mode and the Altitude Hold mode. If

partial effectiveness holds li)r the y Command mode, which ensures that the flightpath target yTGT is

captured and that an acceptablc point ofairspeed equilibrium is reached, partial effectiveness of both

the Altitude Capture mode and the Altitude Hold mode then follows from the stability property of

the height regulator. Denoting partial effectiveness of the Altitude Capture mode and the Altitude

Hold mode by PE (CH), thi ', propert y can be expressed symbolically by the equivalence

PE (CH) = PE (y).

Climb and Descend Modes

Because the Climb and Descend modes both use the primitive V Command mode during thrust

saturation, as already noted. partial effectiveness of the V Command mode is required to ensure

partial effectiveness of both the Climb mode and the Descend mode. If partial effectiveness holds for

the V Command mode, which ensures that the airspeed target VTGT is captured and that the flightpath angle ySPEED provides an acceptable approximation to the flightpath target yTGT, partial effectiveness of both the Climb mode and the Descend mode then follows from the stability property of

102
the speed regulator. Denoting partial effectiveness of the Climb mode and the Descend mode by

PE (CD), this property can be expressed symbolically by the equivalence PE (CD) = PE (V).

In addition, climb effectiveness should be required to hold in the Climb mode, and descent

effectiveness should be required to hold in the Descend mode, as already noted. The nominal

threshold vertical velocity, which is based on the minimum climb performance required at the

maximum altitude HMAX, is discussed later.

Annunciation Requirements

Any violation of partial effectiveness of the Altitude Command supermode or any of its internal

elements should be annunciated to the human crew and to any other invoking entity. Because partial

effectiveness of the Altitude Capture mode and the Altitude Hold mode is required to ensure capture

of the target altitude, violation of partial effectiveness PE (CH) could result in an altitude clearance

violation.

Trajectory Prediction and Replanning

Altitude overshoot can be predicted if, at any time during altitude capture, the normal acceleration

commanded by the height regulator exceeds the limit on normal acceleration imposed by the normal

acceleration limiter (fig. 1 i (d)). To provide sufficient authority for correction of errors resulting

from atmospheric disturbances and the like, the limiter setting a N LIM is made equal to twice the

maximum normal acceleration expected during altitude capture (fig. 1 I(d)). If the acceleration

commanded by the height regulator, which is equal to the product V dy R ,; F/dt (fig. 1 I (d)), exceeds

this limiter authority setting, then the authority should be increased temporarily (with pilot consent)

to avoid altitude overshoot. (For a definition of management by consent, see Billings, 1996,

page 104.)

Because the planned trajectory during altitude capture is specified implicitly by flight control system

parameters such as limiter authority, such a temporary increase of limiter authority amounts to

replanning of the trajectory segment that comprises altitude capture. This replanning illustrates a

general design principle that is capable of generalization to higher levels in the mode hierarchy: Any

violation of trajectory constraints should be predicted, and should force trajectory replanning so as to

satisfy those constraints if possible.

In general, such violations should be annunciated on a case-by-case basis to higher levels within the

mode hierarchy (fig. 18) for resolution there (or, ultimately, by the human crew). In some cases,

local resolution is possible simply by changing path/speed priority appropriately. In other cases,

resolution could require strategic action at the very top of the mode hierarchy such as development

of a completely new flight plan, terminated perhaps by emergency landing at an alternate airport.

Such extensive replanning is beyond the scope of this report, which focuses on the tactical levels of

the mode hierarchy.

However, the distributed decision-making structure developed here lays a foundation for treating

such replanning problems by future extension. This concept of distributed decision-making is

illustrated by figure 18: Information flows upward to provide a basis for setting policy at higher

level, and control flows downward to provide policy for decision-making at lower level.

103
I L

v

mc

t

a

`_______

All engines operating

(AEO)

One engine out

(OEO)

1 B

YPOT MAX. AEO

fPOT MAX OEO

Safety Versus Effectiveness

In the trajectory replanning example just discussed, conflict between an external constraint imposed

at high level within the mode hierarchy and an internal constraint at lower level was resolved by

modifying the lower-level constraint. A related example shows how information available at higher

level within the Altitude Command supermode can be used to resolve a conflict between safety and

effectiveness by modifying a safety envelope constraint imposed within the lower-level Path/Speed

Command supermode.

Underspeed Protection

Invocation of the Underspeed Protection mode can have adverse consequences for flight safety,

even though all a priori safety requirements are satisfied. If terrain clearance becomes critical, it is

essential for flight safety to achieve the best climb gradient of which the aircraft is capable. However, this objective is not, in general, achieved by the envelope protection modes previously

discussed, which sacrifice effectiveness (that is, performance) in favor of safety requirements

imposed a priori.

For example, aircraft performance limitations following engine failure could preclude capture of the

flightpath target. Following engine failure, selection of PATH priority could lead to airspeed divergence toward stalling speed, resulting in invocation of underspeed protection. Priority would then be

given automatically to speed, and the primitive V Command mode would be selected, as previously

discussed. The aircraft would then stabilize at the minimum airspeed V MIN at the flightpath angle

determined by maximum available engine-out thrust. The performance envelope of figure 21 shows

that this operating point (point A) would result in significantly poorer performance (that is, reduced

climb gradient) than that available at the speed for best angle of climb (point B), which lies near the

speed for minimum drag (appendix B).

7POT MIN

V MIN VMIN DRAG VMAX

Airspeed — ►

Figure 21. Engine-out performance.

LL

104
The adverse consequences of this conflict between safety and effectiveness can be mitigated almost

completely by imposing an additional restriction on the safe operating envelope limits selected a

priori. This additional envelope restriction, which is discussed next, provides improved performance

by adjusting the a priori safety envelope limits (fig. 13) so as to match them more closely to the

needs of the specific operational situation.

Mitigation strategy

By redefining the minimum-airspeed safety envelope limit VMIN so as to make it equal to the

minimum-drag airspeed V MIN DRAG as a default value, the adverse consequences of invocation of

underspeed protection can be avoided, and the best possible performance can be assured. In the

Underspeed Protection mode, the airspeed is stabilized near the redefined VMIN (that is, near

VMIN DRAG). It can be seen from the performance envelope that the resulting operating point

(VMIN DRAG, ynoT MAX) (that is, point B of figure 21) achieves the maximum available climb angle.

For many operational situations, such as drift-down to lower altitude following engine failure during

high-altitude cruising flight, this behavior is optimal. The envelope restriction imposed by setting

VMIN equal to VMIN DRAG; is unimportant during climbing, cruising, or descending flight, because in

normal operation the airspeeds scheduled for those flight phases exceed the speed for minimum drag

(appendix B). Those are, of course, the flight phases in which the Altitude Command supennode

would usually be selected.

However, other situations require operation below the Mill mum-drag speed, such as climb just after

takeoff where obstacle clearance precludes immediate acceleration. Furthermore, some transport

aircraft operate below the minimum-drag speed during landing approach. These special cases can be

handled by enabling the higher-level entity of the mode hierarchy that invokes the primitive level to

adjust the default value of VMIN as necessary (fig. 18). In this way, the numerical value of VMIN can

be made to depend on higher-level modes and/or phase of flight in whatever manner is considered

desirable, a strategy providing great design flexibility. For safety, it is of course essential that any

such redefined envelope limits lie within the a priori safety envelope.

To summarize, basic safety is assured by invocation (if necessary) of envelope protection modes.

Restricted envelope limits should depend appropriately on the higher-level supermode engaged

and/or the phase of flight. Within those envelope limits, aircraft performance and safety can both be

maximized by timely high-level decisions that avoid invocation of envelope protection.

Mode Validity for Altitude Command Supermode

Mode validity is defined to require that both safety requirements and effectiveness requirements be

satisfied. The following validity conditions on the altitude target HTGT and the airspeed target VTGT

apply to all the internal elements of the Altitude Command supermode.

Condition on HTGT

As already noted, the altitude target HTGT must lie within the following envelope limits:

HSAFE < H TGT C HMAX

(17a)

105
By defining the binary logical conditions H 1 = (HTGT < HSAFE) and H2 = ( HTCT > HMAX), condition

(17a) can be expressed symbolically as ^H 1 -,H2.

Condition on VTGT

The validity requirements on the airspeed target V TGT for the Altitude Command supermode are

formally the same as those for the Path/Speed Command supermode:

vMiN vTGT ` vMAX (17b)

By using the binary logical conditions VT = (VTGT < VMiN) and VT2 = (VTGT > VMAx), as defined

previously, condition (17b) can be expressed symbolically as —,VTI —,VT2. The numerical value of

VMiN is increased during operation in the Altitude Command supermode, as already discussed, in

order to mitigate the performance penalty and the associated adverse safety consequences resulting

from invocation of underspeed protection.

Validity of Altitude Capture and Altitude Hold Modes

For validity of both the Altitude Capture and the Altitude Hold modes, partial effectiveness must

hold for the y Command mode, as already noted. For validity of the Altitude Hold mode, the

condition I AH <_ H„ must hold for the altitude error OH. The altitude deviation threshold H„ is set

nominally to 300 ft. Therefore, validity of the Altitude Hold mode assures operation within ATC

tolerances.

For validity of the Altitude Capture mode, the condition I AH I > Ho must hold.

Validity of Climb and Descend Modes

For validity of both the Climb and Descend modes, partial effectiveness must hold for the primitive

V Command mode, as already noted. For validity of the Climb mode, the condition AH >_ 0 must

hold for the altitude error AH, and the climb effectiveness condition dH/dt >_ (dH/dt)o should hold for

the vertical velocity dH/dt. Similarly, for validity of the Descend mode the condition AH < 0 must

hold for the altitude error OH, and the descent effectiveness condition dH/dt <— —(dH/dt)o should hold

for the vertical velocity dH/dt.

If climb effectiveness holds, altitude error is reduced monotonically during climb. Therefore, climb

effectiveness ensures that the target altitude will eventually be reached. Similarly, if descent effectiveness holds during descent, the target altitude will eventually be reached. Violation of climb or

descent effectiveness should be annunciated to the crew, or to any other higher-level entity invoking

the Altitude Command supermode.

It should be noted that violation of climb effectiveness does not imply an immediate threat to continued safe operation in the Climb mode. Therefore, climb effectiveness is not required for validity

of the Climb mode, but any violation must result in a cautionary annunciation. Such an annunciation

could occur, for example, during manual operation if the pilot failed to follow flight director indications with sufficient accuracy. Similarly, descent effectiveness is not required for validity of the

106
Descend mode, but any violation must result in a cautionary annunciation. A suitable threshold value

(dH/dt)() for the vertical velocity can be determined as follows.

Condition on Vertical Velocity

During climb, the vertical velocity decreases with altitude as available thrust decreases (appendix B). At the maximum altitude HMAX, a small thrust reserve is necessary to avoid loss of airspeed

during turns, as previously noted. In wings-level climbing flight, the same thrust reserve enables a

minimal positive vertical velocity to be maintained.

Calculation of this minimum vertical velocity for the generic transport aircraft described in

appendix B shows that a nominal vertical velocity of 250 ft/min can be required over the whole

altitude range up to HMAX:

Climb effectiveness: dH/dt >— (dH/dt) o

(18a)

where (dH/dt)o = 250 ft/min.

The threshold vertical velocity for descent can conveniently be chosen as —250 ft/min:

Descent effectiveness: dH/dt 5 —(dH/dt) o

(18b)

where (Dh/dt)o = 250 ft/min. Climb effectiveness is denoted symbolically as CE, and descent

effectiveness as DE.

It is found that, during initial pull-up or push-over before the vertical velocity has stabilized, annunciation based on the conditions ( 18a) or (18b) could generate nuisance warnings. During initial pullup or push-over, the nornial acceleration limiter (fig. I I (a)) is active, but during steady climb or

altitude capture it can be shown that the limiter is inactive. Therefore, nuisance warnings can be

suppressed by conjoining conditions (18a) and (18b) with the requirement that the normal acceleration limiter be inactive:

dH/dt I >- ( dH/dt)„ AND I V d7,F,:/dt I < I aN LIM I (18c)

where (dH/dt)o = 250 ft/min.

Definition of HMAX

At the cruising speed corresponding to M = 0.825 (appendix B), the condition (dH/dt _> 250 ft/min)

corresponds to the condition (7 1'()T MAX >— 0.3 degree) on 7roT MAX. This latter condition will be taker

as the defining condition that establishes HMAxSummary of Validity Conditions

The validity conditions for the Altitude Command supermode just discussed are summarized by

table 8.

107
TABLE 8. VALIDITY CONDITIONS FOR ALTITUDE COMMAND SUPERMODE

Altitude Capture Altitude Hold Climb Descend

HTGT

VTGT

HSAFE < HTGT < HMAX

VMIN < VTGT < VMAX

AH I AH I > H„ I AH I <_ H„ AH >_ 0 AH < 0

PE (•) PE (y) PE (V)

Heuristic Strategy

Validity conditions are not sufficient, in general, to determine mode selection logic. Avoiding the

selection of an invalid mode is an obvious requirement, but choosing the most desirable mode

selection from several valid possibilities requires a mode selection strategy that goes beyond

questions of validity. Such a strategy can be based on the general notion of maximizing system

effectiveness. For example, complete effectiveness should be chosen in preference to partial

effectiveness, as noted previously during development of the Path/Speed Command supermode.

The mode selection strategy might also have to deal with a situation in which none of the modes are

valid. Selection should then favor the choice that minimizes adverse consequences, but determining

the least adverse choice requires detailed analysis of each possible flight situation. No general policy, such as sacrificing effectiveness in favor of safety requirements imposed a priori, is certain to

minimize adverse consequences under all conditions. After presenting the strategies to be used

for screening the altitude and airspeed targets, the mode selection strategy is discussed in detail.

Initialization of the Altitude Command and the Path/Speed Command supermodes are discussed

after presenting the final mode selection strategy.

Target Screening

At engagement, the Altitude Command supermode must screen the candidate values of the altitude

and airspeed targets to ensure that the target operating point lies within safety limits and within the

performance capability of the aircraft. At any time after engagement, the crew (or other invoking

entity) must be permitted to change the altitude and airspeed targets as desired, subject only to

screening. Continuous screening is necessary to account for changing performance capability, but

manually selected targets must not be changed after entry without pilot consent.

Denoting by HKNOe and VKNO13 the altitude and airspeed set by the pilot by adjusting the mode

control panel knobs (fig. 19), the target screening strategy is summarized by table 9. When the pilot

enters HOls p , HTGT is set equal to HoISP (fig. 19(b)). Similarly, when the pilot enters Vols ►', VTGT is

set equal to VDISP (fig. 19(0).

Partitioning of Validity Table

Because the target screening strategy ensures that the validity conditions on HTGT and VTGT (table 8)

always hold, these conditions can be dropped from the table (Theorem 13, appendix D). Other useful

simplifications of the validity table can be obtained by means of two heuristic revisions to the mode

structure, which are described next.

108
TABLE 9. TARGET SCREENING STRATEGY FOR ALTITUDE COMMAND SUPERMODE

H KNOB ":^ "SAFE HKNOB -- H MAX HSAFE S HKNOB :!^ "MAX

Set HDISP = H SAFE Set H DISP = H MAX Set HDISP = HKNOB

VKNOB ':^: VMIN VKNOB > VMAX VMIN S VKNOB 5 VMAX

Set VDISP = VMIN Set VDISP = VMAX Set VDISP = VKNOB

Altitude Capture/Hold supermode— Because the height regulator laws specify the target flightpath

angle YrGT uniquely and continuously as a function of altitude error, as already noted, it is convenient

to combine the Altitude Capture and Altitude Hold elements into a single Altitude Capture/Hold

supermode. Within this supermode, transitions between the Altitude Capture and Altitude Hold

states are controlled by the magnitude of the measured height error (fig. 11(b). Because within the

Altitude Capture/Hold supermode one or the other of the conditions on I AH I must always hold, both

of the conditions can be dropped from the revised table.

To verify this formally, note that within the Altitude Capture/Hold supermode the conditions

( I OH I <_ Ho) and the condition ( AH I > Ho) form a logical disjunction that holds tautologically,

because the disjunction [( I AH I <_ H O ) OR ( I AH I > H 0I )] - TRUE. Therefore, these conditions on I AH

can be dropped from the revised validity table for the Altitude Capture/Hold supermode.

Climb/Descend supermode— In a similar manner, combining the Climb mode and the Descend

mode into a single Climb/Descend supermode enables the conditions on AH to be dropped from the

revised validity table for the Climb/Descend supermode. It is clear that the Climb and Descend

modes are functionally similar, differing only in the sign of the altitude error AH, which determines

the sign of the flightpath target yTGT according to the height regulator law. Therefore, it is convenient

to combine the Climb and Descend elements into a single Climb/Descend supermode. Within this

supermode, transitions between the Climb and Descend states are controlled by the measured height

error AH, which must be nonnegative for the Climb mode and negative for the Descend mode.

Within the Climb/Descend supermode the disjunction [(AH 5 0) OR (AH > 0)] holds tautologically;

therefore, the conditions on AH can be dropped from the revised validity table for the Climb/Descend

supermode.

Mode selection strategy— Within the Altitude Capture/Hold supermode and the Climb/Descend

supermode, the strategy for selecting the Altitude Capture, Altitude Hold, Climb, and Descend

modes and for setting priority can be summarized by the condition-action mode selection process

(appendix D) shown in table 10:

109
TABLE 10. MODE SELECTION WITHIN ALTITUDE CAPTURE/HOLD SUPERMODE AND

CLIMB/DESCEND SUPERMODE

Altitude Altitude

Condition Capture Hold Climb Descend

ALTITUDE

CAPT/HOLD TRUE

selected

----------- --------------------------------------------------

CLIMB/

DESCEND TRUE

selected

I AH 15 H„

----- ------ ------------

TRUE

------------

I AH I > H ii TRUE

AH >_ (l

-----------

TRUE

-------------------------

AH < 0 TRUE

Actions Set PATH priority Set SPEED priority

Select PATH/SPEED COMMAND supermode

Enter table 7

Inversion of Reduced Validity Table

After removing from table 8 all the conditions just discussed, only the partial effectiveness

conditions PE (V) and PE (y) remain, forming the following reduced validity table:

ALTITUDE CAPT/HOLD CLIMB/DESCENT

PE (•) PE (y) PE (V)

This reduced validity table can be inverted by inspection, with the resulting four cases enumerated as

shown in table 11.

TABLE 11. INVERSION OF REDUCED VALIDITY TABLE FOR ALTITUDE COMMAND

SUPERMODE

Condition ALTITUDE CAPT/HOLD CLIMB/DESCEND

I. APE (y) APE (V) INVALID INVALID

2. APE (y) PE (V) INVALID VALID

3. PE (y) APE (V) VALID INVALID

4. PE (y) PE (V) VALID VALID

110
Table I 1 shows that cases 1, 2, and 3 are abnormal, because each involves invalidity of one or both

superrnodes. Mode selection strategy is discussed first for these abnormal conditions.

Mode Selection Strategy for Abnormal Conditions

If partial effectiveness is violated for the primitive y Command mode but holds for the primitive

V Command mode (case 2), then only the Climb/Descend supermode is valid. It should therefore be

selected.

If partial effectiveness is violated for the primitive V Command mode but holds for the primitive

y Command mode (case 3), then only the Altitude Capture/Hold supermode is valid. It should

therefore be selected.

If partial effectiveness is violated for both the primitive y Command and V Command modes

(case 1), then neither the Altitude CapturelHold supermode nor the Climb/Descend supermode is

valid. The Performance Degradation Theorem (Theorem 1, appendix F) shows that the condition

APE (y) APE (V) can hold only if yPOT MAX < 0; that is, if aircraft performance becomes so severely

degraded that available thrust is insufficient for level flight. Detailed analysis of this situation, which

could occur following engine failure at high altitude, shows that selection of the Climb/Descend

mode is the only appropriate choice. Therefore, in case 1 the Climb/Descend supermode should be

selected.

This completes the formulation of the supermode selection strategy for abnormal conditions, for

which the strategy is based on considerations of validity. For normal conditions (case 4), for which

both supermodes are valid, the selection strategy can be based on considerations of effectiveness,

which are discussed next.

Mode Selection Strategy for Normal Conditions

When partial effectiveness holds for both of the primitive V Command and y Command modes,

table 1 I shows that both the Altitude Capture/Hold supermode and the Climb/Descend supermode

are valid. In that case (the normal situation), the mode selection strategy can be based on the desire

for a smooth altitude capture, which can be achieved by avoiding violations of the normal effectiveness properties previously defined. There are two design issues: first, smoothness of normal acceleration and flightpath; and second, smoothness of longitudinal acceleration and airspeed. Both issues

can be clarified by examining the geometric stability regions traversed during altitude capture

(fig. 22).

Flightpath smoothness— If the magnitude of the altitude error AH is so large that the target flightpath angle yI(;I commanded by the height regulator (fig. 1 1(b)) lies in a region where thrust is

saturated (that is, the condition 1' Utz Q holds, where P and Q are defined by equation (1 11)), the

Climb/Descend mode should be selected, as already noted. The system then captures the flightpath

ysPEED- if capture of the target airspeed is also complete, the operating point (V, y) coincides with

the point (VTCT, ysPEED)• If airspeed capture is not yet complete, the operating point lies elsewhere

(fig. 22) on the ysPEED MAX boundary during climb or on the ysPEED MIN boundary during descent, with

the longitudinal acceleration (indicated by arrows in the diagram) directed toward the target airspeed

VTGT-
r

H

O

m

CC 0

CU

z

a

a^

-ENE NE

N

"More thrust"

NE

P

-P -,O

NE

-NE

O More drag"

NE

YSPEED MAX

YPOT MAX

YSPEED MIN

YPOT MIN

u MIN VTGT uMAX

Airspeed —

Figure 22. Geometric regions for mode selection within Altitude Command supermode.

As the aircraft approaches the tarlel altitude, the magnitudes of the height error IOH I and of the

flightpath target IyToTI steadily dccreasc toward zero, so that the condition

--,I 

-^Q — ( SPIN{D MIN ^ yTGT < SPEED MAX

must eventually hold (fig. 2-1 ). \\ hcn the Altitude Capture/Hold mode is selected, the system shifts

from capture of ysPEED to capture ut * the target flightpath yTGT. Therefore, to ensure smoothness of

both normal acceleration and fli g htrath during the transition, the Altitude Capture/Hold mode

should be selected when y l ^, l coincides with ysPla:D; that is, as soon as the condition -,P -,Q holds. It

remains to determine whether this simple mode selection strategy also ensures smoothness of longitudinal acceleration and airSpeeLl.

Airspeed smoothness- It \^ ill he recalled that the normal effectiveness (NE) property of the primitive y Command mode holds \^ hcn the longitudinal acceleration has the correct sign leading toward

capture of the airspeed target. Violation of normal effectiveness generates cautionary annunciations

("More thrust" or "More drag." as shown by figure 22). Because violation of normal effectiveness

leads to an airspeed reversal and possihly to a thrust reversal, such violations should be avoided to

I 1
ensure a smooth altitude capture, even though normal effectiveness is not required for validity of the

Altitude Capture/Hold mode.

During altitude capture, the flightpath target yTGT approaches the V axis monotonically (fig. 22)

according to the height regulator law. If yTGT changes continuously, as it does during a normal altitude capture for which the altitude target HTGT remains fixed, the stability property of the path regulator ensures that the actual flightpath angle y tracks the target y TGT closely. Therefore, it may be

expected that under normal circumstances, if the condition

'P 'Q (SPEED MIN `:^^TGT 7SPEEDMAX)

holds, then the condition (ySPEED Mw ^ y ^ ySPEED MAX) also holds, ensuring that thrust is unsaturated

(eqs. (11 g) and (1 1 h)). The primitive y-V Command mode is then selected, for which normal effectiveness always holds. Figure 22 shows that, when the flightpath target enters the central region in

which the condition —,P --,Q holds, it remains in that region as it moves toward the V axis during

altitude capture. Therefore, the simple mode selection strategy of selecting the Climb/Descend mode

if the condition P v Q holds and selecting the Altitude Capture/Hold mode if the condition —,P —,Q

holds ensures that normal effectiveness holds during altitude capture under normal circumstances.

If a small change of the altitude target should be entered by the flight crew during altitude capture,

the result would be a discontinuous change in yTGT that could not be tracked closely by the actual

flightpath angle y. It is then possible that thrust could be saturated and that normal effectiveness

could be violated during the short term before path capture is completed, even if the condition

-,P -,Q holds. Under these exceptional circumstances, temporary violation of normal effectiveness

can be permitted, provided that partial effectiveness of they Command mode holds.

Undesired mode transitions— Near the boundaries of the central -,P —,Q region, altitude variations

owing to atmospheric disturbances could cause repetitive cycling between the conditions --IQ

and P vQ, resulting in repetitive mode transitions ("chattering"). Suppression of unwanted mode

transitions must be dealt with during implementation, when uncertainties in the measurement and

estimation of physical quantities ("noise") can be accounted for by means of simulation. In order to

prevent repetitive mode transitions owing to noise, it will probably be necessary to incorporate

hysteresis bands at the boundaries of the geometric regions governing mode transitions. However,

hysteresis that prevents repetitive cycling owing to noise might not be sufficient to suppress all

undesired mode reversions. Furthermore, the simple mode selection strategy just discussed is more

restrictive than necessary to prevent violation of normal effectiveness.

In figure 22, the regions in which normal effectiveness holds for the Altitude Capture/Hold mode

are marked with the legend NE. It can be seen that there are regions adjacent to the central --,P ^Q

region (indicated by hatching) in which reversion to the Climb/Descend mode to prevent violation

of normal effectiveness is unnecessary, because normal effectiveness would continue to hold unconditionally without reversion. In other regions (indicated by absence of hatching), normal effectiveness holds temporarily for the Altitude Capture/Hold mode, but the airspeed trend (indicated by

acceleration/deceleration arrows) would lead to future violation. A mode selection criterion based on

prediction of future states would be excessively complex. The situation is further complicated by the

113
fact that the target airspeed must be reset as a function of flight phase (for example, climb, cruise, or

descent) according to a schedule of optimal speeds (appendix B). Such changes in target airspeed

could cause unnecessary mode reversions by shifting the boundaries of the -,P -,Q region horizontally relative to the prevailing operating point.

Mode latching- A simple method sometimes used in the past to suppress unwanted mode reversions

was to "latch" the mode selection logic; for example, with such latching incorporated, the transition

to the Altitude Capture/Hold mode would become a one-way transition. Latching can be regarded as

a kind of hysteresis applied to the mode selection logic itself. In contrast to the conventional hysteresis discussed previously, which would blur to a minor extent the regional boundaries treated in this

report as mathematically sharp, latching would destroy the relevance of those boundaries for mode

selection because, if a latched mode state were entered, it would be maintained without regard to

conditions based on geometrical regions.

Discussion- Mode latching would be unacceptable for the synthesis method developed in this

report. If latching were incorporated, because mode selection would then depend partially on previous mode states, the desirable Markovian property of the selection logic (to be discussed later)

would be destroyed, together with the unique relation of the selection logic to the geometrical

regions already described. Aircraft behavior would then become dependent not only upon the

regions in which the target point ( VTGT, yrcT) and the actual operating point (V, y) lie, but also upon

the sequence in which those regions were traversed. This unwelcome increase in complexity would

complicate analysis of system properties and could lead to unpredictable behavior, a situation that

should be considered unacceptable for safety-critical systems.

Future development- The development of a more sophisticated mode selection strategy that would

suppress unnecessary mode reversions without introducing unpredictable system behavior is left as

a problem to be addressed in future work. Until simulation based on implementation of the present

design has indicated the extent to which unnecessary mode reversions are objectionable, further

development seems premature.

Summary of Supermode Selection Strategy

The complete supermode selection strategy for the Altitude Command supermode is summarized by

the following condition-action mode selection table (table 12).

Altitude Capture Example

To illustrate the sequence of mode selection during performance of a representative task, the same

altitude capture task discussed previously is selected. it is assumed that the conditions PE (y) and

PE (V) hold throughout the altitude capture process; that is, operating conditions are normal.

Initial conditions- It is assumed that an aircraft initially in level flight at 15,000 ft with the Altitude

Command supermode engaged is cleared to climb to 35,000 ft (Flight Level 350) at an airspeed of

250 kt. In level flight, the condition -,P -,Q holds (fig. 22). It then follows from table 12 that, initially, the Altitude Capture/Hold supermode is selected. The mode selection process then continues

with table 10.

114
TABLE 12. SUPERMODE SELECTION WITHIN ALTITUDE COMMAND SUPERMODE

Conditions ALTITUDE CAPT/HOLD CLIMB/DESCEND

NORMAL ABNORMAL NORMAL ABNORMAL

PE (Y) TRUE

------------------

TRUE

------

TRUE

-------- ------------- -----------

-,PE (Y)

---

TRUE

PE(V)

--- ---

TRUE

------------------ ------

TRUE

----- ------------- -----------

--- 1PE(V) TRUE

—,P -IQ TRUE

-------- -- ------------ ------------- -----------

P U Q

--- ----------

TRUE

Action ErIter table 10

Definitions

PE (Y) - (YTGT C YPOT MAX) OR (V VMIN DRAG) OR (Y C YSPEED MAX)

PE (V) = --,[P AND TT 1 ] AND —[Q AND TT2]

P - (YTGT > YSPEED MAX) Q - (YTGT < YSPEED MIN)

-P -Q - (YSPEED MIN ':^ YTGT ^ YSPEED MAX)

P U Q = (YTGT ^! YSPEED MAX) OR (YTGT < YSPEED MIN)

It is assumed that the initial altitude error is small, so that the condition I OH <_ H IS holds. In that

case, it follows from table 10 that the Altitude Hold mode is selected, priority is set to PATH, and the

first-level Path/Speed Command supermode is invoked. The mode selection process then continues

with table 7.

Because by assumption the aircraft is initially in level flight, the thrust is unsaturated, as already

noted; that is, the condition STS 1 -,TS2 holds. It then follows from table 7 that the primitive

y- V Command mode is selected initially.

Pull-up After verifying the legality and feasibility of the clearance (fig. 1), the flight crew initiates

the climb by setting the target altitude to 35,000 ft in the altitude window of the Mode Control Panel,

and pressing the ENTER button (fig. 19). Upon entry of the ne^,v altitude target, a new flightpath target is calculated as follows. The altitude error becomes (fig. I I (b))

OH = 35,000 — 15,000 = 20,000 ft.

115
Because the absolute height error exceeds the threshold value Ho = 300 ft, the parabolic altitude

capture law is used (fig. 1 1(b)) to calculate the flightpath target yTGT, which is limited to an angle

3 degrees larger than the maximum steady climb angle yPOT MAX (fig. 1 1(b)). Therefore, the condition

(yTGT ^! 7POT MAX) holds. Because 7POT MAX = 7SPEED MAX holds at V = VTGT, the condition

P — (yTGT — 7SPEED MAX

holds on entry of the new altitude target. It then follows from table 12 that the Climb/Descend supermode is selected, and from table 10 that the Climb mode is selected. Priority is set to SPEED, and the

Path/Speed Command supermode remains invoked ( table 10).

The aircraft pulls up as the y- V Command mode attempts to capture yTGT, subject to the normal

acceleration limit imposed by the acceleration limiter (fig. I l (a)). During pull-up, the increase in

flightpath angle is fed forward to command increased thrust, and the airspeed regulator maintains the

target airspeed of 250 kt (fig. 1 1(c)).

Climb— When the Ilightpath angle y reaches 7SPEED MAX (fig. 22), the thrust saturates ( the condition

TS2 holds). With SPEED priority, the primitive V Command mode is selected (table 7). The target

thrust 7POTTGT is then set to 7POT MAX (table 5). The airspeed regulator (fig. 1 1(c)) maintains the

target airspeed of 250 kt during climb.

Altitude capture— As the aircraft approaches the target altitude of 35,000 ft, the altitude error is

reduced. The target flightpath angle yTGT is likewise reduced, and is no longer limited. When yTGT

reaches 7SPEED MAX and the condition --,P -,Q holds (fig. 22), table 12 shows that the Altitude

Capture/Hold supermode is selected. Table 10 then shows that, depending on the magnitude of the

height error, either the Altitude Capture or the Altitude Hold mode is selected. In either case, priority

is set to PATH (table 10), the Path/Speed Command supermode is invoked, and the primitive

y Command mode is selected while the thrust remains saturated. It is assumed that the height error

initially exceeds the threshold value of 300 ft, so that the Altitude Capture mode is selected. In that

case, the altitude capture trajectory is governed by the parabolic law (fig. 1 1(b)) until the height error

has been reduced to 300 ft. When the condition

--,TS2 ° (y < 7SPEED MAX)

holds, the thrust becomes unsaturated, and the primitive y-V Command mode is selected (table 7).

Altitude hold— When the height error becomes equal to the threshold value of 300 ft, the Altitude

Hold mode is selected (table 10). The aircraft trajectory is then governed by the exponential law

(fig. 1 1(b)), and the height error is nulled. The aircraft stabilizes at the target altitude of 35,000 ft

and the tar<let airspeed of 250 kt, completing the example.

Initialization

For initialization of the Altitude Command supermode, the first task is initialization of the target

thrust yPOTTGT, which is carried out within the Path/Speed Command supen-node by the strategy for

116
setting target thrust, as discussed previously. Inspection of the strategy for setting target thrust

(table 5) shows that this strategy is applicable for initialization except when thrust is unsaturated and

the condition -,P ^Q holds, in which case the target thrust is not determined.

But in that case, the y-V Command mode is selected because thrust is unsaturated (table 7). Because

the target thrust yPOTTGT is nonrelevant for operation in the y-V Command mode, it can be initialized

arbitrarily to 7POT MIN . Therefore, invoking the Path/Speed Command supermode (with priority

assigned arbitrarily) returns the quantities PE (7), PE (V), P, and Q, which determine initial mode

selection for the Altitude Command supermode according to the usual mode selection strategy

(table 12).

A simpler alternative is to initialize the Altitude Command supermode unconditionally to the Climb/

Descend mode. The rationale for this simplified strategy is that, under normal conditions, it corresponds to the supermode selection when P u Q holds (table 12), the least restrictive possibility. If

the condition PE (V) is violated initially, the mode validity table (table 8) shows that this simplified

initialization strategy could result initially in operation that is invalid. Nevertheless, the following

analysis shows that this initialization is acceptable. There are two possibilities.

First, if PE (y) is also violated, so that APE (y) -,PE (V) holds, the Climb/Descend mode would be

selected according to the mode selection strategy (table 12). Therefore, the simplified initialization

strategy is in agreement with the mode selection strategy for this abnormal case.

Second, if PE (7) holds, so that PE (7) -,PE (V) holds initially, then the Altitude Capture/Hold mode

is selected (table 12) after one frame (appendix E) of operation in the Climb/Descend mode. Detailed analysis shows that system behavior during the first frame is the same for operation in the Climb/

Descend mode as it would be in the Altitude Capture/Hold mode, and that during subsequent frames

system behavior is governed by the mode selection strategy (table 12), as previously discussed.

Therefore, the simplified initialization strategy is acceptable.

Re-initialization— If a new altitude target is entered after the Altitude Capture/Hold mode has been

selected, so that the condition P u Q again holds, the system should revert to the Climb/Descend

mode, as already noted. Iflivsteresis has been applied to the regional boundaries (fig. 22) to suppress

repetitive mode transitions ownw, to noise, as discussed previously, the whole system including the

hysteresis bands should be re-initialized, and the Altitude Command supermode should be

re-initialized to the Climb/Descend mode.

This re-initialization to the Climb/Descend mode does not apply to the entry of a new airspeed

target. Such re-initialization must be ruled out because it could allow the aircraft to deviate from the

target altitude during capture of the new airspeed target, violating the partial effectiveness of the

Altitude Command supermode.

The rationale for this difference in re-initialization strategy is that the altitude target is regarded as an

external constraint imposed by ATC that determines the pilot's task. In contrast, the airspeed target

can be chosen freely for performance optimization (appendix B). This rationale holds despite the

fact that external airspeed restrictions are sometimes imposed by ATC, because in those cases the

altitude constraint always remains primary.

117
Construction of Statechart

The statechart for supermode selection (fig. 23(a)) can now be constructed directly from table 12. It

may be seen that there are two scenarios (columns) for selection of the Altitude Capture/Hold supermode. For normal conditions, the conditions PE (y), PE (V), and -,P -,Q must hold. Therefore,

transition arrows labeled with those conditions must lead to the Altitude Capture/Hold supermode

from the Climb/Descend supermode (fig. 23(a)). For the abnormal condition PE (y) APE (V), a

transition arrow labeled with that condition (shown broken to indicate abnormality) must lead from

the Climb/Descend supermode to the Altitude Capture/Hold supermode.

Similarly, table 12 shows that there are two scenarios (columns) for selection of the Climb/Descend

supermode. For normal conditions, the conditions PE (y), PE (V), and P U Q must hold. Therefore,

transition arrows labeled with those conditions must lead to the Climb/Descend supermode from the

Altitude Capture/Hold supermode. For the abnormal condition APE (y), a transition arrow labeled

with that condition (shown broken to indicate abnormality) must lead from the Altitude Capture/

Hold supermode to the Climb/Descend supermode.

By following the construction process just described, the statechart illustrated at the left of

figure 23(a) is obtained. The two priority states PATH and SPEED can be represented in statechart

form by a two-state machine. The statechart for setting priority illustrated at the right of figure 23(a)

can be synthesized directly from table 10.

Certain Mode Control Panel actions are indicated schematically in statechart form by figure 23(a),

but many details are omitted for clarity. As indicated, new altitude or airspeed targets can be entered

at any time after initial engagement. It should be noted that entering a new altitude target HTCT

results in re-initializing the Altitude Command supermode to the Climb/Descend mode, as illustrated. However, entering a new airspeed target VTGT has no effect on mode selection, as required by

the re-initialization strategy already discussed.

The internal elements of the Climb/Descend supermode can be synthesized directly from table 10,

and are illustrated in detail by the statechart of figure 23(b). It can be seen that violation of the climb

effectiveness CE or the descent effectiveness DE generate appropriate warnings, which are annunciated to the human crew and also to any other invoking entity.

The internal elements of the Altitude Capture/Hold supermode can also be synthesized directly from

table 10. They are illustrated in detail by the statechart of figure 23(c). Figures 23(b) and 23(c) show

that the first-level Path/Speed Command supermode (fig. 15) constitutes an internal element of the

second-level Climb and Descend modes (fig. 23(b)) and of the second-level Altitude Capture and

Altitude Hold modes (fig. 23(c)).

118
Initial state

Pilot request Pilot enter Pilot enter

ALTITUDE COMMAND HTGTVTGT

FLIGHT CONTROL COMPUTER

H NORMAL= -H1 -H2 I

V NORMAL= VT1 ^VT2 ExtinguishI PRIORITY

(Figure 19) pushbutton light

I SPEED Illuminate

pushbutton light Pilot U select

ALTITUDE I

COMMAND I ALTITUDE COMMAND

I

CLIMB/DESCEND I ALTITUDE

CAPTURE/HOLD

I

I

-PE(V) -PE(Y) CLIMB/DESCEND

PE(V) PE(V) I

P ^Q PE(()

PE(() ` ALTITUDE PE°> FPATH

j CAPTURE /HOLD

I

I

I

Normal Abnormal -

a) Altitude Command and Priority supermodes

Initial state

CLIMB / DESCEND

AH ? 0 .AH < 0

CLIMB DESCEND

AH ? 0

PATH/SPEED COMMAND PATH/SPEED COMMAND

AH < 0 S CE ODE

WARNING WARNING

b) Climb/Descend supermode.

Figure 23. Statechart for Altitude Command supermode.

119
Initial state

ALTITUDE CAPTURE/HOLD

IoHI > H O / \ JAHI < HO

ALTITUDE CAPTURE ALTITUDE HOLD

PATH/SPEED COMMAND IAHI > HO PATH/SPEED COMMAND

IHI < Ho

c) Altitude Capture/Hold supermode.

Figure 23. Statechart for Altitude Command supermode (concluded).

System Properties for Altitude Command Supermode

Functional Dependence of Mode Selection Logic

Mode selection logic for the Altitude Command supermode is governed by the Boolean variables

PE (y), PE (V), P, and Q, as already noted. The definitions are repeated for convenience as follows:

_PE (Y) — (YTGT YPOT MAX) AND (V < V MIN DRAG) AND (y YSPEED MAX)

APE (V) = [P AND ( yr(IT TGT = YPOT MIN)] OR [Q AND (YPOTTGT = YPOT MAX)]

P — (YT(;T ^! YSPEED MAX) Q = (YTGT < YSPEED MIN)]

From these definitions, it can be seen that their arguments fall into three categories. First, the argument YTGT is the flightpath target. Second, the arguments yPOT MAX, YPOT MIN, VMIN DRAG, Y, and V are

physical quantities. Third, the arguments YPOTTGT, YSPEED MAX, and YSPEED MIN, are computed quantities whose functional dependence requires further analysis.

Inspection of the strategy for setting the thrust target 'yPOT TGT (table 5) shows that YPOT TGT depends

on the physical quantities y, '/POT MAX, and YPOT MIN, and on the flightpath target YTGT. The definitions

(eqs. (8a) and (9d))

YSPEED MAX = YPOT MAX —(I /g)(dWd t)('MD YSPEED MIN = YPOT MIN —(I /g)(dV/dt)CMD

120
show that ysPEED MAx and ysPFED MIN depend on the physical quantities yPOT MAx and YPOT MIN and on

the commanded longitudinal acceleration (dV/dt)(,Mt), which in turn depends on the airspeed error

AV = VTGT — V and on the acceleration limits, which are physical.

Therefore, it can be concluded that mode selection depends only on the target point (VTGT, yTGT), the

operating point (V, y), and the other physical quantities just mentioned. This functional dependence

enables mode selection to be specified geometrically in the following way.

Geometrical Regions for Mode Selection

The geometrical regions cor-respondin g to selection of the Climb, Descend, and Altitude Capture/

Hold modes are illustrated by fi_lures 24(a) and 24(b). It can be seen that, after path capture is

complete, mode selection is determined entirely by the geometrical regions in which the target

point lies, and is independent of the sequence in which these geometrical regions are traversed.

Markovian Property

This independence ofmode selection from mode states previous to the current states is termed

the Markovian property of the mode selection strategy (that is, selection of the next set of modes

depends only on current modes and on fig ht conditions). Based on this mathematical property,

general theorems can be estahlishcd that govern system behavior, enabling its safety and effectiveness to be assessed theoreticall y . hive such theorems are discussed next; these theorems provide a

check of system design intcgrm that is independent of the synthesis process, and enable formal

validation of the complete m stem to he achieved. Proofs of these theorems can be found in appendix F. It should be noted that currentl y available codes for automated hypothesis testing can provide

the basis for a theorem-pro\ imp, tool. tllrther discussion can be found in appendix F.

H < HMAX

CLIMB

ALTITUDE

CAPTURE/HOLD

DESCEND

(SPEED MAX

'ISPEED MIN

F

C7

H

rn

c

m

CD

r

m_a

L

LL

V MIN VTGT VMAX

Airspeed —i

a) Normal conditions.

Figure 24. Supermode selection within Altitude Command supermode.

121
H > HMAX

CLIMB.

-PE('()

Tr o

d

c _

'POT DESCEND

L MAX

a

L

ALTITUDE

LL CAPTURE/HOLD

IPE(V)

YSPEED MAX

YSPEED MIN

V MIN VMIN DRAG VTGT VMAX

Airspeed —

b) Degraded aircraft performance. Thrust target set to maximum thrust

(yPOT TGT - yPOT MAX)- VTGT ^ VMIN DRAGFigure 24. Supermode selection within Altitude Command supermode (concluded).

Performance Degradation

The first issue to be evaluated relates to the soundness of the design decision to select the Climb/

Descend mode in the case where both PE (y) and PE (V) are violated, so that neither the Climb/

Descend mode nor the Altitude Capture/Hold mode is valid. The first theorem shows that this

situation can arise only if aircraft performance has become so severely degraded that maximum

available thrust is insufficient for level flight:

Theorem I (Pernrmanc•e Degradation Theorem)

If both PE (y) and PE (V) are violated, then the condition ('yroT MAX < 0) must hold.

Proof can be found in appendix F.

Recovery from --,PE(y) —,PE (V)

Severe performance degradation could result from engine failure at high altitude. The aircraft must

then descend ("drift down") to a lower altitude at which sufficient thrust is available. Safe recovery

from severe performance degradation is demonstrated by the second theorem, which shows that

aircraft behavior is near optimal even without intervention by the human crew:

122
Theorem 2 (—,PE (y) -,PE (V) Recovery Theorem)

If both PE (y) and PE (V) are violated initially, and if the Altitude Command supermode

is selected and the target altitude HTGT and the target airspeed VTGT remain fixed, then in

the absence of total propulsion failure

(a) the condition ( VTCT < V :5 VMiN DRAG) must hold initially;

(b) recovery from the condition APE (y) APE (V) occurs before VTCT is captured;

(c) if the conditions APE (y) PE (V) and TC1 ° ( yPOT MAX < 0) hold at capture of VTCT

and continue to hold thereafter, then the aircraft stabilizes in descent at V = VTCT,

and the V Command mode remains selected; and

(d) if a lower altitude is reached where the condition (yPOT MAX = 0) holds in the long

term, then the aircraft stabilizes in level flight at V = VTCT.

Proof can be found in appendix F.

Assurance of safe terrain clearance at the final stabilized altitude is provided by appropriate aircraft

certification and operation requirements.

It should be noted that the effects of thrust asymmetry on flight control have not been considered,

but it is reasonable to suppose that advanced automated control systems in future transport aircraft

can incorporate suitable means for handling asymmetric thrust effects, especially those systems with

full-authority, fly-by-wire capabilities.

Recovery from PE(y) APE (V)

The third theorem shows that violation of PE (V) is self-correcting without intervention by the

human crew:

Theorem 3 (PE (21 —,PE (V) Recovery Theorem)

If PE (V) is violated initially, but PE (y) holds, and if the Altitude Command supermode is selected and the target altitude HTGT remains fixed with HTGT < H MAx, then

in the absence of total propulsion failure PE (y) PE (V) must eventually hold.

Proof can be found in appendix F. The hypothesized condition corresponds to inappropriate setting

of the target thrust, so that idle thrust is set when maximum thrust is desired, or the contrary. This

condition can be induced by pilot abuses such as entering a lower altitude target during climb or

engaging the Altitude Command supermode at an operating point that lies outside the performance

envelope of the aircraft. Failures and abuses are discussed in detail in the next section.

123
Recovery from APE (y) PE (V)

The fourth theorem shows that violation of PE (y) is self-correcting without intervention by the

human crew:

Theorem 4 (APE ()I PE (V) Recovery Theorem)

If PE (y) is violated initially, but PE (V) holds, and if the Altitude Command supermode is selected and the target altitude HTGT remains fixed with HTG7T < HMAX, and

if climb effectiveness holds while in the Climb mode, then in the absence of total

propulsion failLIN the condition PE (y) PE (V) must eventually hold.

Proof can be found in appendix F. The hypothesized condition is classified as abnormal, but holds

during steady climb at airspeed ,, helms the speed for minimum drag (for example, just after takeoff).

However, because the Climb,'Descend supermode is selected during steady climb, PE (y) is not

required for validity. PE (y) holds \\ hen the aircraft approaches the target altitude, provided that the

target altitude lies at or belox\ I Im %\.

The hypothesized condition could also result from engine failure during climb after takeoff, drastically reducing available thrust. 11OWever, assurance that the condition (yrOT MAX > 0) continues to

hold is provided by the climhgradient required for certification. If engine failure should

occur during operation in the Altitude Capture/Hold supermode, for which PE (y) is required for

validity, the system would rc\ ert to the Climb/Descend supermode until the aircraft approaches the

target altitude more closely, so that the ;Altitude Capture/Hold supermode again becomes valid. A

failure of this kind is discussed in detail III next section.

Altitude Command Supermode Effectiveness

The final theorem guarantee the c 1 'tccti\ mess ofthe Altitude Command supermode under general

conditions:

Tlieorenr _S (AItimile Command Supermode Effectiveness Theorem)

If the target altitude I I,,, t hc^ at or below H MAx and HTGT remains fixed, and if climb

effectiveness holds \^ hile in the Chinh mode, and if descent effectiveness holds while

in the Descend mode, then selection of the Altitude Command supermode ensures

that

(a) the target altitude I1 1 ,, 1 \v ill he captured: and

(b) if normal ettectivencss of the y Command mode holds while in the Altitude

Capture/Hold mode. then the target airspeed VTGT will also be captured.

Proof can be found in appendix F. It should be noted that violation of any of the effectiveness conditions required by the hypothesis is annunciated to the human crew, and also to any other higherlevel entity invoking the Altitude Command supermode. Certainty that such violations will be

detected and annunciated as rcduircd is provided by the logical completeness properties described

124
previously. Therefore, in the absence of such annunciations, the human crew can have complete

confidence in the effectiveness of the Altitude Command supermode.

Failures and Abuses

Assurance of safe and effective system behavior under all possible conditions is provided by the

general theorems just presented. However, it may not yet be clear how the design characterized by

these general properties can protect the system against various specific failures and abuses without

special-purpose algorithms ("error traps") like those employed in the past to identify specific faults

and take remedial action.

This point is crucial for the design of new systems, because the enumeration of specific faults is

necessarily incomplete even after extensive operational experience has been accumulated. To illustrate the remedial action provided by general-purpose protective mechanisms, two representative but

challenging situations are analyzed in detail.

Engine Failure After Takeoff

It is assumed that engine failure occurs during climb after takeoff with the Altitude Command supermode engaged and operating in the Altitude Capture/Hold supermode, and that the resulting drastic

reduction of available thrust causes the target flightpath angle YTGT commanded by the height regulator to exceed the aircraft performance envelope (fig. 6). It is further assumed that the effects of thrust

asymmetry on flight control are dealt with by the continuous elements of the flight control system.

Because the condition

_PE (y) = (7TGT YPOT > MAX) AND (V S VMIN DRAG) AND (Y> ySPEED MAX)

holds, PE (y) is violated, causing the Altitude Capture/Hold supermode to become invalid. If the

Altitude Capture/Hold supermode were to remain selected and continued operation were attempted,

flightpath would be controlled at the expense of a rapid decrease of airspeed, resulting in potentially

catastrophic wing stall or other loss of control (fig. 6).

Because the condition APE (y) PE (V) holds after the engine failure occurs, according to the Altitude

Command supermode selection strategy the Climb/Descend supermode is selected because it is the

only valid choice, and the system reverts to the Climb mode. In the Climb mode, airspeed is controlled at the expense of flightpath, as expressed by selection of SPEED priority.

After the engine failure occurs, the thrust saturation condition (y> YSPEEDMAX) holds. According to

the strategy for setting target thrust, the target thrust yPOT TGT is set to YPOT MAX, and the primitive

V command mode is selected. The system pushes over to capture the flightpath angle ySPEED MAX,

resulting in capture of the target airspeed VTGT. Climb then continues in the V Command mode at

the flightpath angle ySPEED MAX, which is the steepest climb angle of which the aircraft is capable at

the target airspeed with the maximum thrust available after engine failure (fig. 6). Assurance of safe

obstacle clearance at this reduced climb angle is provided by the minimum engine-out climb gradient required for certification. Provided that the target altitude lies at or below the reduced HMAx

characterizing the engine-out condition, as the aircraft approaches the target altitude the target

flightpath angle commanded by the height regulator is reduced to a value less than yPOTMAX, the

125
condition PE (y) again holds, and PE (y) PE (V) holds, as required by the APE (y) PE (V) Recovery

Theorem. The Altitude Capture/Hold supermode is again selected, and the target altitude is captured.

It should be noted that no identification of engine failure is required to enable the sequence of events

just described. To the contrary, the general algorithm for determination of the performance envelope

accounts for engine failure, without specific identification of the cause of the reduced performance.

It follows that a similar performance reduction resulting from any other cause, such as tailwind shear

or failure of landing gear retraction owing to some hydraulic system fault, would result in the same

system behavior, and therefore would result in a similar safe recovery.

Climb Engagement Abuse

It is assumed that, during operation in manual control, the aircraft is pulled up into a steep climb at a

flightpath angle exceeding the upper limit of the aircraft performance envelope, and that the Altitude

Command supermode is engaged with a target altitude below the altitude prevailing at the instant of

engagement. Because the thrust saturation condition (y> ysPEED MAX) holds, according to the strategy

for setting target thrust the target thrust yPOT TGT is set to yPOT MAX (table 5). Because the condition

Q = (7TGT < ySPEED MIN) also holds, the partial effectiveness of the V Command mode is violated; that

is, the condition

APE (V) = [P AND (YPOT TGT = yPOT MIN)I OR [Q AND (YPOT TGT = 7POT MAX)1

holds. Therefore, the condition PE (y) -,PE (V) holds.

This abnormal condition results because maximum thrust is required for consistency with the

engagement condition, but minimum (idle) thrust is required for consistency with the target condition. Because the condition Q = (yrGT < y sPEED MIN) holds, if thrust were unsaturated the target thrust

yPOT TGT would be set to yPOT MIN , but so long as thrust remains saturated at maximum thrust owing to

the anomalous engagement condition, according to the thrust setting strategy the target thrust cannot

be reset to idle (table 5). If operation in the Climb/Descend mode were attempted, which would be

consistent with the target condition, the aircraft would continue to climb with maximum thrust

instead of descending with idle thrust as desired.

The Altitude Command supermode selection strategy resolves this problem by selecting the Altitude

Capture/Hold supermode because the Climb/Descend supermode is invalid when APE (V) holds

(table 12). The system then attempts to capture the target flightpath by pushing over toward yTGT.

Since Q - (yTGT < ySPEED MIN) holds by assumption and the condition (y SPEED MIN < 0) always holds

by the property of the longitudinal acceleration limiter, as already noted, the flightpath angle y is

driven downward toward zero immediately upon engagement, so that the thrust becomes unsaturated. But when the thrust becomes unsaturated, the target thrust yPOT TGT is reset to 'YPOT MIN

(table 5). Therefore, PE (V) holds, the normal condition PE (y) PE (V) holds as required by the

PE (y) APE (V) Recovery Theorem, and the Climb/Descend supermode becomes valid and is

selected. The aircraft then descends in the Descend mode as desired.

The same abnormal condition could be induced after initial engagement if, during climb, the crew

entered a target altitude below the instantaneously prevailing altitude, perhaps in response to a

request from ATC. A similar abnormal condition could occur during descent, if the crew entered a

126
target altitude higher than the instantaneously prevailing altitude. Whatever the specific details of the

abuse leading to the abnormal condition PE (y) APE (V), assurance of safe recovery is provided by

the general PE (y) --,PE (V) Recovery Theorem.

Concluding Remarks

Engineering design of the Altitude Command supermode is now complete. Decision tables and

statecharts have been presented that specify the mode selection strategy in forms that, together with

semantic conventions described in appendix E, are suitable for exact implementation within single

sequential processors like those installed in current transport aircraft. The dynamical behavior of the

complete system has been summarized by general theorems that enable formal validation to be

achieved.

Furthermore, methodology has been developed for synthesizing mode selection logic directly from

design requirements, this methodology can be applied to development of other modes not treated by

this report. In the next section, guidelines for simplified development of other second -level and

third-level modes are presented briefly.

OTHER SECOND-LEVEL AND THIRD-LEVEL SUPERMODES

This section presents guidelines for simplified development of other second -level and third-level

supermodes based on modifications to the second-level Altitude Command supermode just discussed, and shows how the complete Vehicle Management System could be used in airline service.

Approach Supermodes

Second-level approach supermodes are needed that are suitable for executing well-defined approach

procedures based on ILS facilities, on other ground- based radio aids, or on satellite navigation.

These second-level approach supermodes occupy positions within the mode hierarchy similar to that

of the Altitude Command supermode, as illustrated by the block diagram of figure 18. If a reliable

electronic library of approach procedures ( that is, approach plates) were available on board, the

flight crew could select the destination procedure by name from a displayed menu, radio frequencies, identifiers, weather mininia. the missed approach procedure, and various numerical parameters

specific to the selected approach would then be entered automatically into the system.

Tracking of an approach glideslope can be achieved by generalizing the altitude capture and hold

function of the Altitude Command supermode (previously described in detail) to define'the approach

path by means of a dynamically varying tar^^et altitude. To avoid an altitude bias error while tracking

the glide slope, a commanded fli g htpath angle equal to the published glide-slope angle must be

added to the system within the path regulator ( fig. i i (e)). For details, consult a previous publication

(Sherry, Youssefi, and Hynes, 1995).

The safety envelope for an approach mode is defined by appropriate limits on lateral and vertical

deviations from the intended approach trajectory, and by the published minimum descent altitude.

Under normal conditions, approach mode operation should terminate with transition to a flare mode

127
(either manual or automated), or else (under abnormal conditions) with transition to the published

missed-approach procedure.

Go-Around Supermodes

During go-around following a missed approach, initial climb can be achieved in a simple way by

specifying targets for climb angle and airspeed, setting priority to SPEED, and invoking the first-level

Path/Speed Command supermode. To maximize obstacle clearance, the airspeed target should

remain fixed at the final approach airspeed; because no acceleration is then required, all excess

thrust is used for climb. The climb angle target can conveniently be set to a fixed angle (perhaps

10 degrees) corresponding to use of maximum thrust at an aircraft weight intermediate between

maximum and minimum landing weight. This choice results in use of maximum thrust and maximum available climb angle at heavy weight, and avoids excessive thrust at light weight while ensuring safe obstacle clearance (Lambregts, 1983). After safe obstacle clearance has been achieved, the

published altitude at the missed-approach holding fix should be selected as the altitude target, and

the second-level Altitude Command supermode should be invoked.

Departure Supermodes

Second-level departure supermodes are needed that are suitable for executing well-defined departure

procedures (Standard Instrument Departures). These second-level departure supermodes can include

noise-abatement procedures to be used for departures from specific runways. If a reliable electronic

library of such procedures were available on board, the flight crew could select the departure procedure by name from a displayed menu; radio frequencies, identifiers, weather minima, and various

numerical parameters specific to the selected procedure would then be entered automatically into the

system.

Tracking of the departure flightpath specified for each segment of the departure procedure can be

achieved in the same manner as for the Go-Around supermode just described, by specifying targets

for climb angle and airspeed, setting priority to SPEED, and invoking the first-level Path/Speed

Command supermode. For unrestricted departures, manual operation following takeoff would be

continued until the Altitude Command supermode can be selected at 400 ft above ground level.

The safety envelope for a departure mode is defined by appropriate limits on lateral and vertical

deviations from the intended departure trajectory. After safe obstacle clearance is achieved, departure mode operation should terminate with transition to the Altitude Command supermode for climb.

Third-Level Supermodes

At least one third-level Vertical Navigation supermode is needed to enable the aircraft to follow

optimized fuel-conservative and time-conservative trajectories during climb and descent (Erzberger,

1982). In general, it must be expected that each third-level supermode would constitute a hybrid

system containing both continuous and discrete elements, as pointed out previously. However, in

this case such modes can be developed simply by selecting appropriate altitude and airspeed targets

from the Reference Flight Path (fig. 1) and invoking the second-level Altitude Command supermode

(previously described). By this means, the aircraft can be made to follow any trajectory in the

128
vertical plane (within its performance capability) that is composed by joining straight-line segments

in a piecewise-continuous manner, with appropriate smoothing at the joints (control points) between

segments. Mathematically, such third-level modes contain only discrete elements, because all

hybrid-system aspects of the design are confined to the second level (provided that third-level system dynamical behavior can be approximated as quasi-static, which is assumed).

Nevertheless, if a trajectory with continuous curvature in the vertical plane were generated by

varying the altitude target dynamically, the aircraft would follow the curved path with an altitude

bias error dependent on path curvature. Elimination of such bias errors would require development

of a new path regulator on the third level, instead of making use of the second-level height regulator

(fig. 1 1(b)) already available. The third-level modes would then become hybrid systems, with significant increase of complexity.

It seems likely that curved-path bias errors characterizing the simplified design will be found to be

insignificantly small compared with other errors within the modernized ATC system. However, if

future ATC system refinement indicates the need, third-level modes that enable an aircraft to follow

any feasible path with high accuracy can be developed by applying the synthesis methods described

in this report.

Operational Use of Automated System

Operational use in airline service of the Vehicle Management System described by this report

(fig. 1) can be summarized as follows. Takeoff is accomplished manually; it is assumed that all the

remaining flight phases are to be automated. At any time, partial automation could be chosen at the

pilot's option by selecting augmented manual control. In that case, only the guidance and display

functions would be automated; the pilot's manual control task would be to follow the guidance

symbology displayed by the primary flight displays.

The initial climb after takeoff would make use of a Departure supermode specialized to the runway

in use and selected by name; the specified departure flightpath would include any required noiseabatement procedure.

The climb, cruise, and descent would all make use of a third-level Vertical Navigation supermode,

which would select appropriate altitude and airspeed targets for each flight segment from the

onboard Reference 17110ht Path. and would invoke the Altitude Command supermode for execution.

Automation of the task of updating the Reference Flight Path with the aid of an air-ground datalink

is discussed later, in the section "Future Work."

At the destination airport, the instrument approach would make use of an Approach supermode

specialized to the runway in use and selected by name. Landing flare, touchdown, and roll-out would

make use of an Autoland supermode similar to those in current use (not treated by this report). For a

missed approach, a Go-Around supermode would be used to execute the specified missed-approach

procedure.

129
The flight profile just described shows that, with the exception of takeoff, the whole of a typical

airline flight could be carried out by means of only five supermodes selected directly by the flight

crew. The simplicity of this mode structure stands in sharp contrast to the complexity and functional

duplication (Lambregts, 1983) characterizing the mode structure of the flight management systems

installed in current transport aircraft.

130
PART III

CONSEQUENCES

AIRWORTHINESS, CERTIFICATION, AND COCKPIT INTERFACE DESIGN ISSUES

As stated in the "Introduction." the present work is directed toward three specific objectives: (1) to

enable formal validation by dc\ eloping a practical design procedure for synthesis of hybrid systems

that satisfy general safety and cffcctiveness properties specified a priori; (2) to realize the potential

of formal validation for impro%cd operational safety, with particular concern for the design integrity

of the complete system, includin,1 the human/machine cockpit interface, and to provide a firm technical basis for new certification criteria; and (3) to contribute to the development of more general

theoretical methods for synthesizing h y brid systems directly from design requirements.

The first of these three objcctr\ es has been achieved. Development of methodology for engineering

design of the hybrid system for transport aircraft longitudinal control illustrated by the block diagram of figure 1 is complete. The third objective has been achieved in part by means of this detailed

design example (fig. 1), the potcntial fi r g eneralization of the design methodology to other hybrid

systems not related to aircraft is discussed later, in the section "Future Work." This section addresses

the second objective, by assessrn;, the implications of the design methodology for airworthiness and

certification, and for design of' the h1.liiianimachine cockpit interface.

Airworthiness and Certification Issues

The arguments presented tall into m o catc(ories. First, the safety and effectiveness properties

imposed on the design of the h% hnd s y stem for aircraft control (fig. 1) were not selected arbitrarily.

On the contrary, these properties are closely related to design criteria used by the aircraft industry,

such as Military Standard 1707 ( An0nVn10US, 1985), and to certification criteria used by regulatory

authorities, such as Part 2^ of the federal Air legulations (Title 14, Code of Federal Regulations,

2001). These criteria are based on more than 40 years of operating experience with both civil and

military jet transport aircraft. and specify functional requirements for aerodynamic, structural, and

propulsion design. Howc\ cr. for reasons to be discussed, no such broad functional criteria apply to

the design of avionic systems.

The authors believe that safct\ anal effectiveness properties similar to those developed in this report

can provide a suitable basis for nc%\ criteria for design and certification of avionic systems, and that

application of such criteria can inrprov e operational safety. This view is supported by analysis of

transport aircraft accidents aiiLl rncidcnts in which certain actions by the avionic system played a key

role, and several such cases are discussed for illustration. These matters are all questions of enginering desi gn, which tell into the first category for discussion.

131
Cockpit Interface Design Issues

The second category relates to design of the human/machine cockpit interface. To clarify the humanfactors issues involved, an analogy is developed between delegation of a cockpit task to the automated system, and delegation of the same task to a human crewmember. It follows that direct mode

selection by the pilot can be regarded as an expression of the pilot's intentions. The discussion

shows how the dynamical behavior theorems developed in this report can guarantee achievement

of the pilot's intentions under all normal operating conditions; exceptions are required to generate

appropriate warnings.

The term trustworthiness is used to characterize this desirable behavior in carrying out an assigned

task, and it is argued that today's automated systems often exhibit a lack of trustworthiness that

would be recognized as unacceptable if displayed by a human crewmember. Several cases are

illustrated, and several heuristic guidelines for system and interface design are proposed. The discussion leads to recommendations that cockpit interface design be integrated into the system design

process, and that formal validation be extended to include the cockpit interface.

Before considering the airworthiness and certification issues in detail, two categories of failures

involving system and aircraft hardware elements are briefly discussed.

Hardware Failures

Sensor and Computer Hardware Validity Requirements

It should be noted that nothing has been said thus far concerning system hardware reliability. Except

for a brief discussion in appendix E of certain computational limitations on failure detection, no

system errors or failures have been treated, and the synthesis process has been developed under the

tacit assumption of ideal system reliability. A complete discussion of these issues lies beyond the

scope of this report, and would necessarily be specific to particular systems and aircraft.

However, it is an obvious extension of the concept of mode validity developed previously to add the

requirement that for validity of any mode to hold, each of the parameters that enter the computations

specified for that mode must be determined with sufficient accuracy. Therefore, sensor or computer

hardware failures that violate this requirement must result in mode invalidity. These hardware

requirements can be handled within the framework of the synthesis methodology already developed,

by conjoining them with other conditions required for mode validity.

Engine and Aircraft System Failures

In contrast to sensor and computer hardware failures within elements that are internal to the Vehicle

Management System, engine failure and other aircraft system failures (within the aircraft hydraulic

system, electrical system, and the like) are failures external to the Vehicle Management System to

which that system is required to react (fig. 1). Engine failure, which has consequences that are

similar for most transport aircraft, has been treated in some detail.

Failures within other aircraft systems have consequences for the Vehicle Management System that

are specific to each aircraft type, and cannot be treated in general by means of examples like those

presented for engine failure. Nevertheless, when the failure modes and effects are known in detail

132
for a specific aircraft type, aircraft system failures can be handled in a manner similar to that illustrated by the engine failure examples. A simple example based on failure of a single hydraulic

system illustrates the process.

Hydraulic Failure Example

Assume that an aircraft hydraulic system failure renders the yaw damper inoperable while the

aircraft is cruising at 35,000 ft, and assume further that this failure makes it necessary to restrict the

maximum operating altitude of the aircraft to 25,000 ft. (Otherwise, objectionable motions could

result, owing to excitation of the dutch-roll mode at higher altitudes where aerodynamic dutch-roll

damping becomes especially weak.) To account for the effect of yaw damper inoperability upon the

Vehicle Management System, its detection must cause appropriate restriction of the calculated

maximum altitude HMAx of the aircraft (fig. 20). Because by assumption the currently prevailing

altitude of the aircraft exceeds Hm Ax, the system is then required (Theorem 5) to generate an appropriate annunciation to the flight crew, prompting the crew to request clearance to a lower altitude.

As pointed out previously, the performance envelope limits of the aircraft must be recalculated

continuously by the onboard system to enable target screening. However, after initial system

engagement the target screening algorithm is not permitted to change the target altitude value

without pilot consent, because that requires a strategic action (obtaining an amended clearance) that

is beyond the scope of the tactical system (fig. 1).

As already noted, mode selection depends only on the geometric regions of the performance envelope within which the target point and the operating point lie; mode selection is independent of the

sequence in which those regions are traversed (the Markovian property). Therefore, once the aircraft

maximum altitude has been restricted appropriately, no other Vehicle Management System modifycation is required to account for the effect of the assumed hydraulic failure.

Avionic System Certification

Background

Historically, the autoflight system (AFS) evolved from the older autopilot. In contrast, the flight

management systems (FMSs) in current transport aircraft were developed during the late 1970s. The

FMS contains the trajectory synthesis structure corresponding to the third-level supermodes in the

system discussed in previous sections of this report, and is much more complex than the AFS. In the

first-generation aircraft, weak integration of the FMS with the AFS may have justified their treatment as two separate systems.

The following comments relating to certification issues are based on discussions with the late

H. B. (Berk) Greene, FAA certification pilot and system specialist. According to Greene, the regulatory basis for certification of current flight management and flight control systems is that these

systems (with the exception of autoland) are regarded as pilot aids that are not to be used under

safety-critical conditions (Greene, personal communication, 1994). This long-standing regulatory

posture avoids detailed specification of system functionality by placing on the flight crew the burden

of determining whether system actions are safe and appropriate, despite mounting human-factors

evidence that, faced with the complexity of today's systems, the crew cannot always identify unsafe

or inappropriate system actions in time to avoid potentially catastrophic consequences.

133
Discussion

It seems to the authors doubtful whether the position that pilot aids are not safety-critical can be

maintained for the future, as the level of automation advances and system integration is strengthened. An alternative position that is taken here holds that any violation whatever of the safety and

effectiveness properties established by design synthesis should be considered potentially safetycritical.

This alternative view is supported by the analysis of selected transport accidents and incidents that

follows. Simple but plausible analysis shows that, although the causes of these accidents and incidents differ greatly in detail, each of them resulted from some violation of the safety and effectiveness properties developed in this report. Furthermore, these problems have not been alleviated by

experience, because the most recentl y designed systems are characterized by violations of safety and

effectiveness properties similar to those encountered in previous design generations.

At this point of the discussion readers should refer to appendix G, which summarizes the aspects of

four selected accidents and incidents that are considered relevant to issues of system design. No

criticism of the design or certification of the systems installed in those aircraft is intended or should

be inferred, because the methods employed were based on the state of the art available at the time.

Four aircraft have been selected. \^ rth installed systems that represent each avionic design generation

since the first digital systems. To relate the systems in the aircraft involved in these accidents and

incidents to those synthesized in the previous sections of this report, it should be noted that the AFS

in current transport aircraft contains the fli g ht control structure that corresponds to the first-level

Path/Speed Command supermode and the second-level Altitude Command supermode discussed

previously, the FMS in current transport aircraft corresponds roughly to the third-level supermodes.

L-1011, Everglades, 1972 (Analog System)

Since the barometric hold nmdc \\ as engaged directly by the pilot and its purpose was to hold

altitude, a reasonable interpretation of'cilectiveness for that mode would reduire that barometric

altitude be held accurately unless the niode were disengaged intentionally by the pilot. (Bumping the

control column is not a suitahle means oh disengagement because of the possibility of accidental

disengagement, and violates the first and second of the seven cockpit interface guidelines to be

presented later.) From this y ic%\ point. it is clear that, because the target altitude was not held, the

reversion from the barometric altitude hold mode to the pitch attitude hold mode in the aircraft

violated the effectiveness of the haromctric altitude hold mode. Furthermore, a crucially important

safety property was violated. hccausc ( from the present viewpoint) penetration of an appropriate safe

descent limit should have caused rc\ ersion to an envelope protection mode, with an appropriate

warning.

B-767, San Francisco, Late 1980s (First-Generation Digital System)

Since the supermode engaged by the crew was intended to result in capture of the target altitude,

failure to transition to the altitude capture mode violated supermode effectiveness, because the target

altitude was not captured. FUrthcnnorc, the safety hazard resulting from the altitude overshoot was

compounded by the absence of any annunciation.

134
Detailed analysis shows that the aircraft mode transition logic contained three separate faults. First,

no reasonableness test can be logically complete, because only a subset of invalid signals can be

detected—logically complete failure detection requires at least duplex redundancy. Second, the

numerical criterion used for the reasonableness test was incorrectly related to the performance

capability of the aircraft, generating false invalidities. Third, the action taken (that is, skipping the

transition test) was logically erroneous, because it permitted continued operation in the climb mode

under invalid conditions. The presence of these deficiencies in a certificated system shows the

weakness of current avionic certification standards.

B-737, Early 1990s (Second-Generation Digital System)

Since the ILS approach mode is engaged by the crew in order to track the ILS glide-slope, reversion

from the ILS approach mode to the vertical velocity hold mode following failure of the glide-slope

receiver in the aircraft violates the effectiveness of the ILS approach mode, because the ILS glideslope is not tracked.

It should be noted that operation in the vertical velocity hold mode in the aircraft has no exact

counterpart in the system described in this report because an "open" descent of this kind is not

allowed, but it corresponds roughly to operation in the Altitude Command supermode with the target

altitude set to ground level, which could cause the aircraft to fly into the ground. In the system

described in this report, such operation would violate two safety properties: first, the validity condition that restricts the target altitude to lie above 1500 ft above ground level; and second, the validity

condition that restricts operation in the Altitude Command supermode to measured altitudes above

400 ft above ground level. These safety violations would generate appropriate warnings.

To summarize, glide-slope receiver failure violates the effectiveness of the approach mode in the

aircraft without generating an appropriate warning, and subsequent operation in the invalid vertical

velocity hold mode following reversion is potentially catastrophic.

A-330, Toulouse, June 1994 (Third-Generation Digital System)

Since the supermode engaged by the crew was intended to result in capture of the target altitude, it is

clear that continued operation in the altitude capture mode after the engine cut violated supermode

effectiveness, because the target altitude was not captured. The discussion of the dynamical behavior

of transport aircraft presented previously shows that in this situation (path target exceeding maximum steady climb angle), the airspeed must decay Until either an underspeed protection mode is

invoked or else some flight envelope boundary is violated, unless path control is given up temporarily in favor of airspeed control. In the case of the A-330 accident, the airspeed penetrated the

mimmumcontrol-speed boundary for asymmetric thrust (fig. 6), resulting in catastrophic loss of

control.

As pointed out previously, the availability of envelope protection modes should not be regarded as

reducing the designer's obligation to ensure that the normal modes operate safely. Stated less formally, the authors' position is that, since the envelope protection modes are the last line of defense

against potentially catastrophic system behavior ( like a parachute), they should not also be the first

line of defense. Restricting attention to operation of the normal modes, the A-330 accident can be

considered to have resulted from flawed mode selection logic that permitted continued operation in

135
the altitude capture mode following a loss of thrust which rendered that operation invalid. It is also

true that, in the case of the A-330 accident, envelope protection modes were not effective for

accident prevention.

Summary

Analysis of the transport aircraft accidents and incidents just presented has shown the broad applicability of airworthiness principles based on the safety and effectiveness properties developed in this

report. It follows that new certification criteria using these principles might significantly improve

operational safety.

However, realization of the potential for improving operational safety depends on effective communication of system annunciations and warnings to the human crew. The discussion turns next to

cockpit interface design.

Cockpit Interface Design

Design of Annunciation Systems

A major challenge for cockpit interface design is to develop interfaces that make all necessary

information relative to aircraft and system operation available to the human crew, without overloading them or interfering with higher-level tasks. The design synthesis methodology already

developed might aid design of improved interfaces, if interface design were based on the required

annunciations emerging from the design synthesis process. Because these annunciations constitute

essential safety-critical information, redundant information might be eliminated and information

overload reduced.

Furthermore, the assurance of logical completeness provided for the annunciation system by formal

validation might enable the crew to limit their attention to higher-level system elements while

retaining confidence that, in the absence of annunciations, lower-level details of aircraft and system

operation are being properly managed; the concept has been termed management by exception

(Billings, 1996). By this means, the mental workload associated with system monitoring and supervision might be reduced. These are issues for interface design that are broader than that of information transfer.

Delegation of Authority

As defined previously, a mode consists of a set of actions that the machine can take; that is, a

physical behavior. From the human-factors viewpoint, the pilot selects a mode in order to obtain its

characteristic set of actions, so that mode selection constitutes an expression of the pilot's intentions.

At the same time, by selecting a mode, the pilot delegates to the system the authority to perform that

set of actions. Thus, by analogy, mode selection can be regarded as a command given to the system,

just as if it were given to a human crewmember.

System Behavior

This viewpoint immediately raises the issue of the dynamical behavior of the automated system

following the pilot's mode selection, because it is this subsequent behavior that determines whether

the pilot's intentions will be carried out. For example, the actions characteristic of the Altitude

Command supermode involve capturing (and subsequently holding) the altitude and airspeed targets

136
selected by the crew, as previously described in detail. Therefore, selection of the Altitude Command supermode indicates to the system that the pilot intends to capture these targets.

Assurance that the system will carry out this task properly (that is, assurance of system effectiveness) is provided by Theorem 5 (Altitude Command Supermode Effectiveness Theorem). Conditions

sufficient to ensure that the theorem holds are stated explicitly in the hypothesis, and violation of

any of these conditions is required to generate an appropriate warning. Certainty that such violations

will be detected and annunciated as required is provided by the logical completeness properties

described previously. Therefore, in the absence of such annunciations, the crew can have complete

confidence in the effectiveness of the Altitude Command supermode.

The term trustworthiness is used to characterize this desirable behavior in carrying out an assigned

task, since this term seems equally applicable whether the task is assigned to the automated system

or to a human crewmember. With this definition, the discussion that follows shows that today's

automated systems often exhibit a lack of trustworthiness that would be recognized as unacceptable

if displayed by a human crewmember. This anthropomorphic viewpoint is an interesting one from

which to study the accidents and incidents previously analyzed from the system perspective.

L-1011, Everglades, 1972 (Analog System)

In the L-101 1 accident, the system exhibited a lack of trustworthiness because it failed to hold the

assigned altitude after being instructed to do so. (It decided to hold pitch attitude instead.) The

resulting safety hazard was compounded by absence of an appropriate amlunciation; the mode

reversion should have generated a warning, but the annunciation in the aircraft was cautionary in

nature and was not recognized by the crew.

B- 767, San Francisco, Late 1980s (First-Generation Digital System)

In the B-767 incidents, the system exhibited a lack of trustworthiness because it failed to capture

the assigned altitude after being instructed to do so. (It decided to wait and see whether the vertical

velocity, erroneously considered invalid. would become valid again.)

B-737, Early 1990s (Second-Generation Digital System)

In the B-737 incidents, the system exhibits a lack of trustworthiness because it cannot track the ILS

glide-slope after glide-slope receiver failure, and does not provide an effective warning to the pilot.

(It decides to hold vertical velocity instead, and provides only a cautionary annunciation—compare

with the L-101 1 accident.)

It should be noted that, by selecting the ILS approach mode, the pilot has expressed to the system the

intention to make an ILS approach. Safety considerations based on terrain clearance require that

such an approach must terminate in one of only two ways: under normal conditions, by transition to

landing flare; under abnormal conditions, by transition to go-around. Therefore, reversion to the

vertical velocity hold mode is inconsistent with the pilot's intentions, and should not be permitted

under certification criteria based on safety and effectiveness properties.

It is true that following glide-slope receiver failure the pilot might decide to continue the approach to

the localizes-only minimum altitude, and might use the vertical velocity hold mode for that purpose

if "open" descent were allowed during final approach. Nevertheless, the descent velocity required in

137
that case would not generally coincide with that chosen by the system, which holds the vertical

velocity that happens to prevail at the instant of failure, perhaps during a downward correction to

the glideslope. In that case, continued operation in the vertical velocity hold mode would cause the

aircraft to fly into the ground short of the runway.

On the other hand, the reported ceiling and visibility might be below localizes-only minimums, so

that the appropriate decision would be to go around. The system behavior here goes beyond a simple

lack of trustworthiness, greatly exceeding the authority properly delegated to it by the pilot's

selection of the ILS approach mode.

A-330, Toulouse, June 1994 (Third-Generation Digital System)

In the A-330 accident, the system behavior went beyond a simple lack of trustworthiness, because

it blindly commanded the altitude capture trajectory appropriate for normal operation with both

engines, even after it became clear that this trajectory was beyond the performance capability of the

aircraft with one engine out. The catastrophic loss of airspeed resulted.

The resulting safety hazard was compounded by the absence of mode annunciations from the

primary cockpit displays at the most critical time. (The system had decided not to bother the flight

crew with mode annunciations at excessively steep nose-high pitch attitudes, in order to avoid

overloading the crew with unimportant details at a critical time.) The information removed by

de-cluttering the primary display was crucial, and its absence may have fatally delayed the pilot's

decision to take over manually. This de-cluttering behavior exceeded the authority properly delegated to the system by the pilot's mode selection.

Discussion

No doubt anthropomorphic comments like those above seem inappropriate when they are applied to

automated systems. Nevertheless, they may perhaps drive home the point that pilot "aids" like those

just described cannot reasonably be considered not to be safety-critical.

Summary

In all the cases just analyzed, poor annunciation compromised effective supervision of system

actions by the human crew. The analysis suggests strongly that the design integrity of the cockpit

interface cannot be separated from the design integrity of the underlying aircraft systems. If those

systems are not trustworthy in carrying out the pilot's intentions as expressed by mode selection,

improved information transfer at the interface cannot remedy those basic system deficiencies.

Design Recommendations

In order to realize the potential for improved operational safety made possible by the design synthesis methods developed in this report, design of the cockpit interface must be treated as an integral

part of the system design process, and current statements of human-centered automation philosophy

(Billings, 1996) must be expanded and combined with synthesis methods to form complete system

design and certification criteria on which new airworthiness standards can be based. In the meantime, the rationale just presented leads to several heuristic guidelines for system and interface

design.

138
Because mode selection expresses the pilot's intentions directly, the system should never attempt to

infer those intentions from observation of aircraft states such as configuration, thrust setting, control

deflection, or the like (although limit manual control deflection should probably cause reversion to

fully manual control, as it does for many current transport aircraft). For the same reason, the system

should not change the pilot's selection by automated mode reversion, unless violation of safety

limits invokes envelope protection. In that case, appropriate warning should be annunciated, and the

system should return to the pilot's selected mode if it again becomes valid.

This prohibition of automated mode reversion does not apply to automated transitions between

lower-level elements of a supermode selected by the pilot, because those transitions are included

within the set of characteristic actions to be expected by the pilot when selecting that supermode.

For example, suppose the pilot selects the second-level Altitude Command supermode. Then automated transitions among its elements Climb, Descend, Altitude Capture, and Altitude Hold are

expected actions for which authority has been delegated by the pilot's supermode selection, although

they should of course be annunciated as they occur. On the first level of the mode hierarchy, the

Path/Speed Command supermode is automatically invoked to perform the necessary control tasks,

and transitions between its elements (the three primitive modes) should also be expected. It seems

clear that, when selecting a mode, the pilot needs to know exactly what actions to expect over the

entire mode hierarchy invoked by that selection.

Anticipating Mode Transitions

To assist the flight crew in actively supervising operation of the system instead of reacting passively

to its initiatives, it seems desirable to provide symbology integrated with the primary flight displays

that enables the crew to anticipate at least the primitive mode transitions. The Bray/Hynes head-up

display (Bray, 1980; Hynes, Franklin. Hardy, Martin, and Innis, 1989) may be regarded as presenting to the crew a vertical cross-section through the aircraft performance envelope (fig. 25) at the

prevailing speed, so that the fundamental dynamical behavior of the aircraft is made visible. (Readers familiar with the well-known Flight Dynamics head-up display currently in airline service will

recognize its similarity to the illustrated concept, this similarity results from the fact that NASAAmes flight research provided a basis for the commercial display development.) As illustrated by

figure 25, the symbology required for mode anticipation fits naturally into this flightpath-centered

display concept.

Head-up Display Symbology

Figure 25 illustrates display indications during the maneuvers involved in the altitude capture

example discussed previously in detail. As noted previously, the corresponding transition paths in

the (V, y) plane are illustrated by the diagrams of figure 14, which for clarity are repeated at the right

side of figure 25 with the same vertical (flightpath) scale as that for the diagrams on the left. (In the

aircraft cockpit, head-up display scaling is determined by the requirement for conformality of the

display with the outside world view.)

139
O Initial point • Target

d YPOT

MAX

ca

L

a 0

L

LL YPOT

MIN

250

•B

• B,

q Final point

1

m

a^

c

CU

L

m

_a

L

rn

YPOT

MAX

POT

LL MIN

Altitude leader B

symbol 50

c 

Flightpath acceleration

symbol

Horizon A / Flightpath symbol

a) Pull-up

Altitude leader B

symbol B'

C Q^^ Flightpath symbol

Horizon

b) Push-over

280

Equivalent airspeed

Figure 25. Head-up display symbology.

On the head-up display (left-hand diagrams of figure 25), the flightpath symbol represents the

aircraft velocity vector; it lies above the horizon line by an angle equal to the flightpath angle y

(fig. I I (a)). The flightpath acceleration symbol (the chevron) at the left of the flightpath symbol

displays YPOT (fig. 1 1(a)), which is defined by the expression sin 'YPOT = (T — D)/W (eq. (1b). The

angular difference yPOT —'y corresponds to the normalized acceleration along the flightpath (eq. (I c).

The maximum steady-state climb angle YPOT MAx available with maximum thrust is indicated by the

diamond symbol, and the flig htpath ang le target YTGT is indicated by the altitude leader symbol

(fig. 1 1(a)), which also displays the altitude target numerically (fig. 25(a)).

Altitude Capture Example

At the start of the altitude capture example, an aircraft in level flight at 15,000 ft is cleared to climb

to 35,000 ft at an airspeed of 250 kt. When the pilot enters the target altitude of 35,000 ft (Flight

Level 350) into the mode control panel, the numerals 350 are displayed by the altitude leader symbol

(fig. 25(a)). Since the altitude error relative to the target altitude is initially large, the altitude leader

symbol is limited to a position (point B, fig. 25(a)) 3 degrees above YPOT MAX (fig. I l (b)). When the

Climb mode is engaged, the diamond symbol appears on the display (point C), ]ndlcating YPOT MAX-

(If the Descend mode were engaged, the diamond would indicate YPOT MIN-) The diamond is the only

symbol added to the head-up display to enable mode anticipation, minimizing display clutter. Since

the aircraft is initially in level flight. the flightpath symbol lies on the horizon (point A, fig. 25(a)),

and the primitive y-V Command mode is selected.

140
During the initial pull-up at constant airspeed with increasing thrust, the flightpath symbol and the

chevron move upward together toward the altitude leader as the y-V Command mode attempts to

capture 7TGT at point B (fig. 25(a)). When the thrust reaches its maximum limit, the chevron coincides with the diamond at point C, and the system transitions to the V Command mode. The pilot

can anticipate this primitive mode transition by observing approach of the chevron toward coincidence with the diamond (fig. 25(a)). During the steady climb, the flightpath symbol continues to

coincide with the diamond, and the V Command mode remains selected.

As the aircraft approaches the target altitude, the altitude error is reduced (fig. 1 1(b)), and the

altitude leader symbol moves downward (point B') off its limit toward the diamond (point C,

fig. 25(b)). When the altitude leader symbol coincides with the diamond (point C), the system

transitions to the Altitude Capture mode, and the diamond vanishes. Again the pilot can anticipate

this mode transition. Upon transition to the Altitude Capture mode, the airspeed target is reset to

280 kt, as explained previously. Durin g the push-over, the altitude leader symbol and the flightpath

symbol move downward together. as the aircraft follows the curved trajectory CDE shown at the

right of figure 25(b). When the altitude error is reduced to 300 ft, the altitude leader symbol vanishes

to indicate transition to the Altitude Hold mode (fig. 1 1(b)).

This example shows that, with the svmholo gy described, the pilot can anticipate mode transitions

and maintain mode awareness durin_l ty pical maneuvers by observing the primary flight display,

without scanning separate tliuht modc annunciators. This display was evaluated favorably by NASA

and industry test pilots during an c\ploratory simulation carried out on the NASA-Ames Vertical

Motion Simulator (Sherry, Youssch. and Hynes, 1995). Based on that preliminary evaluation, it

seems possible to extend the head-up display concept, including mode anticipation, to conventional

head-down primary displays. I urthcr research is needed to verify this conjecture.

Summary of Cockpit Interface Design Guidelines

The guidelines for cockpit interface dcsi g n can be summarized as follows:

1. The flight crew should he rcyuircd to express their intentions clearly by direct mode selection.

2. The automated system should never attempt to infer pilot intention from observation of system

states such as aircraft ContieUration or thrust setting.

3. Automated mode reversion should never over-ride the pilot's mode selection unless an envelope

protection mode is invoked 16r safety.

4. In that case (0), appropriate %^arning should be provided, and the system should revert to the

pilot's selected mode if that again hccomes valid.

This limitation on automated mode reversion (#3) does not apply to sub-modes within a pilotselected supermode, because transitions between such sub-modes are characteristic actions for

which authority has been delc__ated by supermode selection.

6. Symbology integrated with primary flight displays should enable pilots to anticipate primitive

mode transitions.

7. Training should familiarize pilots with characteristic actions to be expected for each pilotselected mode or supermodc.

141
FUTURE WORK

The elements of the Vehicle Management System treated in detail by this report are indicated by the

shaded blocks in the diagram of figure 1, as previously explained, and the elements for which guidelines for simplified development are presented are indicated by cross-hatching. On the right-hand

(Tactical) side of the diagram, it can be seen that the continuous elements treated are the guidance

function, the outer-loop control, the inner-loop control, and the aircraft itself together with its control

surface and throttle servos; the discrete elements treated consist of the mode control logic for the

three levels of the mode hierarchy. The navigation function and the corresponding elements for

lateral-directional control can be treated by applying the synthesis methodology developed in this

report.

It can be seen that, on the right (Tactical) side of the vertical dashed line in figure 1, the two remaining elements are, first, the cockpit interfaces grouped within the display function, and second, the

human crew's role in tactical supervision. The first part of the following discussion is concerned

with the human-factors research needed to model the cockpit interfaces and the human crew's role in

tactical supervision. As previously explained, application of the synthesis method described in this

report to the aircraft guidance and control systems results in drastic simplification of mode structure.

This simplification can be expected to clarify the problems involved in modeling the crew's role;

such modeling could enable complete integration of the human-automation system to be achieved on

the tactical level.

On the left (Strategic) side of the diagram (fig. 1), the data-entry task (accomplished manually in

current aircraft) is discussed, and the need for automation is pointed out. Brief comments are offered

on automation of knowledge-based activities. Finally, the potential for generalizing the synthesis

methodology developed in this report to other safety-critical systems such as those for

petrochemicals and nuclear power is discussed in some detail.

Human-Automation Integration

Tactical Supervision

At a later stage, it may become feasible to extend formal validation to the complete human/machine

interface by focusing on the human crew's activities in selecting system modes so as to enable the

aircraft to fly a clearance that has already been accepted. Because this selection process is rule-based

(after the clearance has been accepted and the desired aircraft trajectory is known), mode selection

could, in principle, be fully automated. Alternatively, mode selection can be partially or frilly manual, as in current aircraft.

It may be possible to capture the essential aspects of this rule-based pilot behavior by modeling the

human pilot's activities in selecting modes and monitoring displays, in effect treating the pilot at the

rule-based level as part of the machine. To represent the pilot's behavior realistically, the model

must allow mistakes, such as pressing a wrong button, failing to notice an inconspicuous display,

skipping a checklist item, or the like. Assessment of the complex system dynamical behavior

characterizing modal transitions could then include the contribution of likely pilot errors, enabling

formal proof of design integrity to be extended to include the complete human/machine system.

142

1
Studies directed toward modeling human supervisory activities would require an interdisciplinary

approach coordinating the efforts of human factors research and engineering design groups.

Although the results to be expected must remain speculative for the present, the proposed human

modeling effort seems worthwhile because pilot behavior at the tactical level is rule-based, and is,

furthermore, tightly constrained by the definition of the mode selection/annunciation machine

interface (fig. 1).

It should be noted that studies of crew interaction with flight management systems up to this time

have necessarily been based on the systems in current aircraft, despite the obstacles that excessive

system complexity and flawed design concepts (Lambregts, 1983) have placed in the path toward

successful modeling of crew behavior. As mentioned in the "Introduction," system architectures

capable of formal validation must make use of a drastically simplified mode structure. Piloted

simulation studies of crew errors in the use of such simplified systems known to be free of logical

design flaws may be expected to clarify the modeling problem at the tactical level. An example

based on the Mode Control Panel specification is presented next to show how human-factors cockpit

interface design issues might be identified and resolved by low-level modeling of tactical supervision tasks.

Mode Control Panel Design Example

The tactical supervisory task selected for analysis is that of manual entry of a desired target altitude

into the Mode Control Panel, and of checking the resulting system setup for correctness. It will be

shown that even this apparently simple task is vulnerable to human error induced by task interruption, with potentially catastrophic consequences. Furthermore, such errors are a direct result of wellknown limitations on the capacity of human short-term memory, and it must be expected that such

errors will be committed in flight unless specific precautions are taken to prevent them.

For example, system redundancy could be increased operationally by requiring both pilots to verify

the system setup independently whenever the target altitude is changed, but this requirement would

increase both task complexity and human workload. Alternatively, by adding to the mode control

panel specification the features of display blinking and time-out described in a previous section, the

automated system can be made robust against expected operator errors. As mentioned previously,

two hypothetical scenarios will show the purpose of these features.

First, assume that the aircraft is in level flight at 10,000 tt with the Altitude Command supermode

engaged, and that the pilot wishes to change the target altitude from 10,000 ft to 35,000 ft (Flight

Level 350). After setting 35,000 ft into the Mode Control Panel altitude window by turning the

altitude knob (fig. 19), the adjacent ENTER button must be pressed to enter the new altitude target

into the system. Suppose now that the pilot is interrupted by another task (such as a radio call)

before the ENTER button has been pressed. If, owing to a lapse of short-term memory, the pilot

forgets that the ENTER button has not been pressed, the setup appears to be correct.

Nevertheless, the aircraft continues to be controlled to the previous internally stored altitude target

of 10,000 ft, which differs drastically from the number displayed in the altitude window (35,000 ft),

but is not displayed anywhere. If high terrain lies ahead, this situation is potentially catastrophic. The

blinking feature added to the specification (figs. 19(b) and 19(d)) provides protection by causing the

altitude displayed in the altitude window (35,000 ft in this example) to blink whenever it differs

143
from the internally stored altitude target, alerting the pilot to the fact that the system setup is incomplete. Furthermore, the specification ensures that blinking can cease only when the ENTER button is

pressed, which replaces the previous target (10,000 ft) with the new target (35,000 ft), correcting the

discrepancy.

A second example based on likely human error illustrates the purpose of the time-out feature. The

airspeed target is selected by means of a window and a knob on the Mode Control Panel similar to

the altitude window and knob, and adjacent to them (fig. 19(c)). Suppose that the pilot wishes to

select a new airspeed target, but turn; the altitude knob by mistake. Pilots often use the altitude

window as an electronic scratch pad in which to record the clearance altitude. in the absence of a

back-up record, the pilot's Ilypotllctical error has destroyed the only onboard record of the clearance

altitude. Since reliance on unsupported memory for clearance altitude is potentially catastrophic, the

crew has no alternative to all embarrassing query to ATC.

The time-out feature added to the specification (figs. 19(b) and 19(d)) requires that the ENTER button

be pressed within 10 sec after the altitude knob is turned; otherwise, the system returns to its previous state, and the previous altitude tar get is again displayed in the window. In the hypothetical

example, the pilot has to wait onl y a few seconds for time-out to recover the clearance altitude

destroyed by mistake. More g unurall y , the time-out feature protects the system against entry of stale

data (that is, data no longer operationally relevant) by requiring a connected sequence of actions to

take place within a limited time intcr\ al.

in both of the examples just discussed. the human errors involved resulted from well-known human

limitations that could. in principle. he modeled, and their consequences for system design assessed.

It seems likely that research etiirrts in those directions could enable the need for new features such

as blinking and time-out to he identified by a computational synthesis process, instead of relying on

experience and ingenuity as at present. The general objective of this research would be detection of

usability problems that mi g ht other\\ ise be overlooked until their presence is revealed by incidents

or accidents in flight. Furthermore. s y nthesis methods similar to those described in this report could

achieve formal validation of' the complete automated system, including the cockpit interfaces,

guaranteeing that the addition of features such as display blinking and time-out does not introduce

new deficiencies into the dcs1211.

Strategic Planning

On the left (Strategic) side of the block diagram (fig. 1 ), the planning activities illustrated are in

general knowledge-based because they require cause-and-effect understanding of whole disciplines

such as meteorology and airline fli,,ht operations, as explained previously. However, the rule-based

tasks involved in data entr y constitute an important exception.

In current aircraft dependent on %oice radio conlnlunications for transmission of ATC clearances

between ground and aircraft, those data-entry tasks must be accomplished manually. As a practical

consequence, the flight crew cannot afford the time required for manual data entry in a radarvectored environment with rapid and unpredictable clearance changes, a situation often encountered

during descent into busy terminal areas (Cas p er. 1994). Under such conditions, the crew is forced to

abandon flight-plan updating (accomplished by means of the control display unit (CDU)), and to fall

144
back on second-level (autoflight) operation (accomplished rapidly by means of the mode control

panel (MCP)). Efficiency is exchanged for simplicity of operation.

The prospective availability of air-ground communications by two-way datalink will enable elimination of most manual data-entry tasks by means of appropriate automation, allowing automation of

the entire Trajectory Synthesis function (left side of figure I) throughout the flight. (Indeed, with

selection of appropriate third-level guidance supermodes, operation of the entire tactical system

(right side of figure I ) could then be automated, except the pilot's role supervising execution of the

flight plan.) Trajectory synthesis algorithms are well understood (Erzberger, 1982), and form the

basis of flight management systems in current aircraft.

In the opinion of the authors, low-level, labor-intensive, error-prone data-entry tasks are inappropriately placed on the human operator in current aircraft. It should be noted that these low-level

tasks are sometimes viewed as beneficial because they increase the pilot's involvement in planning.

The authors disagree with that viewautomation of low-level tasks allows the flight crew to concentrate on the high-level strategic planning and checking tasks (left side of figure 1) that require

human judgment. Because the data-entry tasks are rule-based, the necessary automation could in

principle be developed by taking the same human modeling approach already discussed for the

interfaces involved in tactical supervision.

In contrast, crew modeling at the planning level would involve knowledge-based behavior, and its

full scope would extend over the entire strategic flight planning and execution functions. Research

directed toward limited-scope decision aiding is currently extending the crew modeling knowledge

base (Geddes, 1985). However, within the dynamically varying environment of worldwide flight

operations over the 20-25 year service lifetime expected of a new aircraft model, knowledge-based

modeling sufficiently comprehensive to provide a basis for formal validation seems too broad in

scope to be attempted with present knowledge.

Generalization to Other Safety-Critical Systems

The question can be raised of the extent to which the design method described in this report could be

generalized to enable the solution of hybrid-system control problems in other safety-critical systems,

such as the ATC system, or hig hly automated industrial process-control plants for petrochemicals

and nuclear power. No attempt has been made to study this matter systematically, but it seems obvious that most of the steps in the design method discussed previously (fig. 5) could be generalized.

One important limitation results from the use of geometrical methods to partition the state space.

Number of dimensions

Since geometrical methods are most useful when the number of dimensions is small, it is of interest

to review briefly the steps by which the six-degree-of-freedom aircraft problem is reduced to two

dimensions (appendix B). First, the bilateral symmetry of the aircraft separates its six-degree-offreedom system of equations into two independent groups, each of three degrees of freedom. Next,

the three-degree-of-freedom longitudinal equations are reduced to two degrees of freedom by the

assumption that pitch control can generate any desired lift variation without saturation. This

assumption is justified for transport aircraft designed to meet applicable flying qualities criteria for

manual control, because pitch bandwidth and control power are much higher than required for low145
bandwidth automated control of path and speed, especially when modest acceleration limits are

imposed for passenger comfort. (High-bandwidth tasks such as automatic landing are not considered

in this report.) This pitch-control assumption reduces the longitudinal system from three to two

degrees of freedom by eliminating the pitching-moment equation, and enables the aircraft to be

treated as a point mass concentrated at its center of gravity. (Simulation of the three-degree-offreedom system shows response differences that are quite insignificant relative to the response of the

two-degree-of-freedom system assumed (appendix 13)).

The addition of closed-loop control of path and speed to the basic aircraft could result in additional

degrees of freedom associated with differential equations specified by the control laws. However,

the nonlinear inverse control employed here cancels aerodynamic and propulsion feedbacks, so that

the aircraft in cascade with its inverse is reduced to a simple chain of integrators. In consequence,

the specification of primitive modes characterized by the same dynamical behavior as the basic

aircraft results in control laws that do not contribute additional degrees of freedom. It should be

noted that only this closed-loop behavior is of interest for the design of the hybrid system.

Higher-level modes in the system hierarchy (for example, height control) involve additional degrees

of freedom, but separation of the system into hierarchical levels with different time scales (that is,

higher-level modes are characterized by less rapid motions) avoids the need to consider all the

degrees of freedom at the same time.

All these methods of reducing the number of dimensions can be expected to apply to other systems

not related to aircraft. Thus the practical limitation to a small number of dimensions may not prove

to be so great an obstacle to generalization of the method as initial impressions might suggest. The

same is true with regard to the restriction of desired (target) values of response states so as to lie

within the steady-state performance envelope of the aircraft.

Definition of System Properties

It seems likely that specification of the desired safety and effectiveness properties will be the most

difficult element of the design process to generalize. This specification must make a sharp distinction between acceptable versus unacceptable system behavior. On the one hand, from the system

design viewpoint the defined properties should be strong and specific, enabling proof of safety and

effectiveness theorems that provide assurance of desired system behavior while ruling out behaviors

that are undesired or unsafe. If the system can misbehave without generating a warning based on

violation of a defined property, then the guarantees provided by formal validation become worthless.

On the other hand, from the human-factors viewpoint the system behavior theorems should hold

under weak, general conditions, reducing to a minimum the number of violations that must be

detected and annunciated. Unless violations of safety and effectiveness properties are isolated events

and the significance of each annunciation is clear, the human operator could be presented with an

impossibly demanding task.

146
Finding an appropriate balance between these conflicting objectives will doubtless require an iterative design process, and the contribution of formal validation to overall design success can be evaluated only a posteriori. It is the authors' hope that the present results may contribute by example to

the development of more general theoretical methods for synthesis of hybrid systems. They should

also be of practical interest to designers of next-generation transport aircraft avionic systems.

CONCLUSIONS

Methods have been demonstrated for synthesizing hybrid systems for aircraft longitudinal control

directly from design requirements. Systems were developed that satisfy general safety and effectiveness properties, enabling formal validation to be achieved. Three primitive modes were developed

for control of path and speed that correspond to the three kinds of dynamical behavior characterizing

transport aircraft. Validity conditions for each of these primitive modes were derived directly from

the governing differential equations and from safety limits imposed a priori, and were related geometrically to the aircraft performance envelope. The three primitive modes were then combined to

form the lowest-level hybrid system. Mode transition logic within this lowest-level supermode was

synthesized from the validity conditions, and was simplified by heuristic arguments based on general

notions of maximum effectiveness and logical dominance.

In cases where aircraft performance limitations preclude capture of path or speed targets, the exact

nature of the limitation is annunciated for resolution at higher levels within the mode hierarchy, or

by the human crew, with assurance of logical completeness. Extension to higher-level supermodes

was described.

At all times, selection of the next set of modes depends only on currently selected modes and on

prevailing flight conditions, and is independent of past history. It was shown that, following engine

failure, correct mode selection does not require specific identification of engine failure.

Airworthiness and certification issues were discussed, and analysis of selected transport accidents

and incidents led to the suggestion that new airworthiness criteria based on general safety and

effectiveness properties might improve operational safety.

These general properties might also provide a basis for design of improved interfaces between aircraft guidance and control systems and the human crew, enabling the crew to limit their attention to

higher-level system elements while retaining confidence that lower-level details of aircraft and

system operation are being properly managed. By this means, the mental workload associated with

system monitoring and supervision might be reduced.

Regarding the pilot's mode selection as a command given to the system enabled analysis of the same

accidents and incidents from the human-factors perspective, which suggested that cockpit interface

design should be treated as an integral part of the system design process. Several heuristic guidelines

for system and interface design were presented.

147
The need for future work related to human-automation integration was discussed, and it was suggested that modeling the human crew's role in tactical supervision might enable complete integration of the human-automation system to be achieved on the tactical level.

The potential for generalization of the design method described in this report to other safety-critical

hybrid systems such as highly automated industrial plants for petrochemicals and nuclear power was

discussed briefly.

The present results may contribute by example to the development of more general theoretical

methods for synthesis of hybrid systems. They should also be of practical interest to designers of

next-generation transport aircraft avionic systems.

148
REFERENCES

Anonymous: Military Standard 1797, 1985.

Bartee, Thomas C.: Digital Computer Fundamentals, Sixth ed., McGraw-Hill (New York), 1985.

Billings, Charles E.: Human-centered Aviation Automation: Principles and Guidelines. NASA TM1 10381, 1996. See also Billings, Charles E.: Human-centered Aviation Automation: A Concept

in Guidelines. NASA TM-103885, 1991

Bray, Richard S.: A Head-Up Display Format for Application to Transport Aircraft Approach and

Landing. NASA TM-81199, 1980.

Casner, Stephen M.: Understanding the Determinants of Problem-Solving Behavior in a Complex

Environment. Human Factors, vol. 36, no. 4, Dec. 1994.

Dromey, R. G.: Program Derivation, Addison-Wesley (Menlo Park, Calif.), 1989.

Erzberger, Heinz: Automation of On-Board Flightpath Management. Tenth von Karman Memorial

Lecture, 24th Israel Annual Conference on Aviation and Astronautics, Tel Aviv and Haifa,

Israel. 1982.

Franklin, James A.; Hynes, Charles S.; Hardy, Gordon H.; Martin, James L.; and Innis, Robert C.:

Flight Evaluation of Au gmented Controls for Approach and Landing of Powered-Lift Aircraft.

J. Guidance, Control, and Dynamics, vol. 9, no.5, Sept.–Oct. 1986.

Funabiki, K.; Bando, T., Tanaka, K., Hynes, C. S.; and Hardy, G. H.: A Method of Wind Shear

Detection for Powered-Lift STOL Aircraft. AIAA-93-3667, 1993.

Geddes, N. D.: Intent Inferencing Using Scripts and Plans. Proc. of the First Annual Aerospace

Applications of Artificial Intelligence Conference, Wright-Patterson Air Force Base, Ohio:

U. S. Air Force, pp. 160-172, 1985.

Hughes, David; and Dornheim, Michael A.: Accidents Direct Focus on Cockpit Automation.

Aviation Week and Space Technology, Jan. 30, 1995, pp. 52-65.

Hynes, Charles S.; Franklin, James A.; Hardy, Gordon H.; Martin, James L.; and Innis, Robert C.:

Flight Evaluation of Pursuit Displays for Precision Approach of Powered-Lift Aircraft.

J. Guidance, Control. and Dynamics, vol. 12, no. 4, July–Au g., 1989.

Innis, Robert C.; Holzhauser, Curt A.; and Quigley, Hervey C.: Airworthiness Considerations for

STOL Aircraft. NASA TN D-5594, 1970.

Lambregts, A. A.: Vertical Flight Path and Speed Control Autopilot Design Using Total Energy

Principles. AIAA Paper 83-2239 CP, Oct. 1983.

Leveson, Nancy G.: Safeware: System Safety and Computers. Addison-Wesley (Menlo Park, Calif),

1995.

Meyer, George; and Cicolani, Luigi: Application of Nonlinear Systems Inverses to Automatic Flight

Control Design—Systems Concepts and Flight Evaluations. AGARDograph no. 251, July 1981.

149
Neumark, S.: Problems of Longitudinal Stability Below Minimum Drag Speed, and Theory of

Stability Under Constraint. Aeronautical Research Council of Great Britain R and M, no. 2983,

July 1953.

Rasmussen, J.: Outlines of a Hybrid Model of the Process Plant Operator. In Monitoring Behavior

and Supervisory Control, T. B. Sheridan and G. Johannsen, eds., Plenum. 1976. See also

Rasmussen, J. (1983). Skills, rules, and knowledge: Signals, signs and symbols and other

distinctions in human performance models. IEEE Transactions on Systems, Man, and

Cybernetics, no. 13, pp. 257-266.

Rushby, John:. Formal Methods and Their Role in Certification of Critical Syastems. NASA

Contractor Report CR-4673, 1995 (also issued as part of the FAA Digital Systems Validation

Handbook).

Sherry, Lance; Youssefi, David; and Hynes, Charles S.: A Formalism for the Specification of

Operationally Embedded Reactive Avionic Systems. Honeywell Publication C69-5370-001,

Honeywell Air Transport System Division (System Engineering Technology), Phoenix, Ariz.,

1995.

Sherry, Lance; and McCrobie, Daniel: Behavioral Characteristics of Modem Avionics Software:

Implications for Design of the HSCT Cockpit Displays, Pilot Training, and Software Design

Tools. Honeywell Publication No. C-69-5370-010, Honeywell, P. O. Box 21 1 11, Phoenix, AZ

85036, 1998.

Taylor, E. S.: Dimensional Analysis for Engineers. Clarendon Press (Oxford), 1974.

Title 14, Code of Federal Regulations. Published by Office of Federal Register, National Archives

and Records Administration, U. S. Government Printing Office, Washington, D.C., Jan. 2001.

Wiener, Earl L.: Human Factors of Advanced Technology ("Glass Cockpit") Transport Aircraft.

NASA Contractor Report CR-177528, 1989.

150
151
REPORT DOCUMENTATION PAGE Form Approved

OMB No. 0704-0188

The public reporting burden for this collection of Information Is estimated to average 1 hour per response, including the time for reviewing Instructions, searching existing

data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or

any other aspect of this collection of Information, Including suggestions for reducing this burden, to Department of Defense. Washington Headquarters Services,

Directorate for information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington. VA 22202-4302. Respondents should be aware

that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of Information if it does not display a

currently valid OMB control number.

PLEASE DO NOI RETURN YOUR FORM T THE AB VE ADDRESS.

1. REPORT DATE (DD-MM-YYYY) 2. REPORT TYPE 3. DATES COVERED (From - To)

21-12-2007 Technical Publication

4. TITLE AND SUBTITLE 5a. CONTRACT NUMBER

Synthesis from Design Requirements of a Hybrid System for

Transport Aircraft Longitudinal Control 5b. GRANT NUMBER

Volumes I and II

5c. PROGRAM ELEMENT NUMBER

6. AUTHOR(S) 5d. PROJECT NUMBER

Charles S. Hynes', Gordon H. Hardy', and Lance Sherry'

5e. TASK NUMBER

5f. WORK UNIT NUMBER

41 1031

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION

'Ames Research Center, Moffett Field, CA 94035

REPORT NUMBER

= Honeywell International Inc., Flight Control Systems Design,

Phoenix, AZ A-070007

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING/MONITOR'S ACRONYM(S)

National Aeronautics and Space Administration NASA

Washington, D.C. 20546-0001 11. SPONSORING/MONITORING

REPORT NUMBER

NASA/TP-2007-213474

12. DISTRIBUTION/AVAILABILITY STATEMENT

Unclassified — Unlimited Distribution: Standard

Subject Category: 03, 06, 08, 54, 66

Availahility: NASA CASI (301) 62 1-0390

13. SUPPLEMENTARY NOTES

Point of Contact: Jeffery A. Schroeder, Ames Research Center, MS 210-4. Moffett Field. CA 94035-0001

(650)604-4037

14. ABSTRACT

Volume I of this report presents a new method for synthesizing hybrid systems directly from design requirements, and

applies the method to design of a hybrid system for longitudinal control of transport aircraft. The resulting system satisfies

general requirement for safety and effectiveness specified a priori, enabling formal validation to be achieved. Volume II contains

seven appendices intended to make the report accessible to readers with backgrounds in human factors, fli g ht dynamics and

control. and formal logic.

Major design goals are (1) system desi g n integrity based on proof of correctness at the design level, (2) , significant simplification and cost reduction in system development and certification, and (3) improved operational efficiency, with significant

alleviation of human-factors problems encountered by pilots in current transport aircraft.

This report provides for the first time a firm technical basis for criteria governing design and certification of avionic systems

for transport aircraft. It should be of' primary interest to designers of next-generation avionic systems.

15. SUBJECT TERMS

Air transportation and safety, Avionics, Aircraft stability and control, Flight controls and autopilots. Man/machine

systems, Systems analysis

16. SECURITY CLASSIFICATION OF: 17. LIMITATION OF 18. NUMBER 19a. NAME OF RESPONSIBLE PERSON ABSTRACT OF

PAGES Jeffery A. Schroeder a. REPORT b. ABSTRACT c. THIS PAGE

19b. TELEPHONE (Include area code)

Unclassified Unclassified

I

h nclaSsifted Unclassified 164

(650)604-4037

Standard Form 298 (Rev. 8-98)

Prescribed by ANSI Std. Z39-18