## 2 Materials and Methods
### Flighting Task  
Participants were required to simultaneously perform regular flight tasks and failure recovery tasks (detailed as follows). At the beginning of the experiment, the aircraft was in a cruising state at an altitude of 6000 m. The participants needed to control the aircraft to descend smoothly by 1000 m. If any failures were detected during the descent, the participants were required to resolve the failures and try to maintain the aircraft's heading, lateral motion (yaw and roll), and airspeed stability during the descent. Finally, the participants needed to level the aircraft: starting from the altitude of 5100 m during the descent and continuing until reaching the altitude of 5000 m.  
For the failure recovery task, participants were required to identify the type of failure when they perceive a potential failure occurrence in the aircraft, and to press the corresponding button on the control stick to resolve the failure.  
The following failure types were set:  
1. System-limit failure: this included an error in the elevator sensor signal (pitch direction) and an error in the upper rudder sensor signal (yaw and roll directions).  
When there was an error in the elevator sensor signal (pitch direction), the aircraft would immediately experience a pitch-down tendency. The elevator command signal would abruptly change to a non-zero constant value, causing the aircraft to descend in altitude and the pitch angle to decrease abruptly before gradually descending. The corresponding button to resolve this failure was button 1.  
When there was an error in the upper rudder sensor signal (yaw and roll directions), the aircraft would immediately exhibit a side-slip tendency. The rudder command signal would abruptly change to a non-zero constant value. Due to the coupled effects of the aircraft's lateral and longitudinal dynamics, the aircraft would exhibit a yawing and rolling motion. The corresponding button to resolve this failure was button 2.  
2. System-malfunction failure: Thus involved a failure in the horizontal stabilizer sensor signal (pitch direction). When this failure occurred, the horizontal stabilizer sensor signal transitioned from a normal signal to a non-zero value, causing the aircraft to pitch down. The corresponding button to resolve this failure was button 3.  
The key difference between the system-limit and system-malfunction failures lies in whether the pilot can anticipate the failure in advance. Therefore, during pre-training, the participants were informed about the type of failure that would occur in the case of system-limit failure, including the possible timing, underlying principles, and resolve  
Figure 2: Tobii Glasses-2 eye-tracking instrument.  
methods of the failure. On the other hand, for system-malfunction failures, the participants were only informed that an unknown type of failure would occur, without knowledge of the possible scenarios, timing, and underlying principles of the failure, but they were aware of the resolve method. It should be noted that during the experiment, when facing a system-malfunction failure, although the participants lack self-knowledge and accurate cues about the failure, they could still perceive the failure through factors such as the visual environment, important parameter indicators, and the pilot's proprioception.