Design of Cockpit displays to explicitly support flight crew intervention tasks

In a class of accidents, known as Controlled Flight into Stall (CFIS), a structurally, mechanically, and electronically sound aircraft decelerated through the minimum safe operating speed (1.3 V
_Stall
) to the stick-shaker stall speed. These accidents followed a pattern in which a triggering event (e.g., sensor failure, flight crew entry) resulted in an automation mode change, which led to an inappropriate flight control command, which in turn resulted in a trajectory that violated the speed envelope. In all of these cases, the flight crew, who are required to “mind the gap” between the 10
^-5
automation design standard and the 10
^-9
operational hazard reliability standard, were not able to intervene in a timely manner. To address this phenomenon, researchers have proposed “low speed alerting” solutions, but this alerting takes place after the speed deviation has occurred. What would it take to detect the speed violation scenario before it occurs? An analysis of the accidents, described in this paper, identified a subcategory of CFIS scenarios in which the automation was no longer actively controlling to the airspeed target. This situation was caused by: (1) the automation no longer being coupled to the control surfaces or (2) the automation being coupled but transitioning to a mode that intentionally does not control to the airspeed target (e.g. Flare, or dormant). The analysis shows that flight deck displays do not provide the explicit information that would enable the flight crew to detect and recognize the inactive speed control or the two contributing factors. The implications of these results for design and certification of flight deck automation are discussed.