Mitigating functional complexity failures: Designing the operator inside the vehicle OODA-Loop

A class of aircraft accidents and incidents, known as Controlled Flight into Stall (CFIS), are characterized by a structurally, mechanically, electronically sound aircraft that is commanded by the automation to fly into the onset of an aerodynamic stall. These accidents are not the results of failed components; instead, they occur as a result of the complexity of the behavior and architecture of the automation that under rare circumstances results in an inappropriate command. This type of “failure,” is known as a Functional Complexity Failure (FCF). One of the most pernicious characteristics of FCFs is that they are difficult for operators to detect and intervene (i.e. they “start a fire and simultaneously turn off the fire alarm”). Researchers studying the CFIS accidents have proposed specific point-fixes to the automation to assist in preventing a specific FCF or by alerting the flight crew in these scenarios (e.g. energy-situation awareness, low speed alerting, etc). Without a holistic view for combating FCF's, these solutions are simply fighting battles in the last war. This paper describes a holistic approach to analyzing the manner in which FCFs occur and how to mitigate them. The novel approach described in this paper is to conduct a thought experiment in which the flight crew and automation are treated as adversaries in an Observe-Orient-Decide-Act (OODA) Loop. This analysis shows how in an FCF, the automation deploys techniques (e.g. creating complacency, uncertainty and disorder, hidden intentions, deception, and distraction) to get “inside” the flight crew OODA-loop. A holistic mitigation approach is described to design the automation to ensure that the operator is always inside the vehicle's OODA loop.