Aviation Safety and Pilot Control: Understanding and Preventing Unfavorable Pilot-Vehicle Interactions (1997)

''Aircraft-pilot coupling (APC) events" are inadvertent, unwanted aircraft attitude and flight path motions that originate in anomalous interactions between the aircraft and the pilot. The concept of the pilot and aircraft as constituents of a "pilot-vehicle system" (PVS) is central to understanding APC events. Historically, the most common APC events have been sustained, oscillatory motions of the PVS. These motions include changes in the aircraft attitude and flight path caused by the flight control system (FCS) and generally associated with pilot inputs. Oscillatory APC events have historically been referred to as "pilot-induced oscillations" (PIOs).

The committee has adopted APC phraseology for two reasons. The first is to remove the presumption of blame implicit in the term "pilot-induced"; although it is often difficult to pinpoint the cause of specific APC events, a majority of severe APC events result from deficiencies in the design of the aircraft (especially with regard to the FCS) that result in adverse coupling of the pilot with the aircraft. The second reason for referring to APC events instead of PIOs is to expand the focus of the term to include other extreme, unwanted PVS motions that, although not necessarily oscillatory, still derive from inadvertent pilot-vehicle interactions. An excellent, well documented example of a non-oscillatory APC event is the second JAS 39 accident, which is listed in Table 1-2 and described in Chapter 2 (at the end of the Non-Oscillatory Aircraft-Pilot Coupling section).

Both oscillatory and non-oscillatory APC events represent a fundamental discord between the pilot's intentions and the aircraft's response. Properties of

the aircraft are contributing factors to the adverse motions. APC events are collaborations between the pilot and the aircraft in that they occur only when the pilot attempts to control what the aircraft does. Indeed, the effective aircraft, left to the control of the FCS, will ordinarily remain dynamically stable in flight. For this reason, pilot error is often listed as the cause of accidents and incidents that include an APC event. However, the committee believes that most severe APC events attributed to pilot error are the result of adverse APC that misleads the pilot into taking actions that contribute to the severity of the event. In these situations, it is often possible, after the fact, to analyze the event carefully and identify a sequence of actions that the pilot could have taken to overcome the aircraft design deficiencies and avoid the event. However, it is typically not feasible for the pilot to identify and execute the required actions in real time.

Because the pilot's actions depend, in part, on the motions of the aircraft in response to pilot commands, the aircraft and pilot dynamics form a closed-loop feedback control system.* The pilot is said to be "operating closed-loop" or to be "in the loop." Adverse APC characteristics can therefore be identified as instabilities in a closed-loop feedback control system. Oscillatory APC events have been the easiest to identify and comprehend and have therefore received the most attention in this study (as they have in the past). These PVS oscillations will be referred to hereafter as "pilot-involved oscillations'' (PIOs) without thereby ascribing blame.

Non-oscillatory APC events, such as divergences,* are less well defined because the aircraft motions can be far more diverse and the cause-effect relationships more difficult to comprehend. Nonetheless, new possibilities for APC have arisen with the use of multifunction, special purpose control surfaces and subsystems intended to enhance performance and stability and control, and with the advent of fly-by-wire (FBW)* FCS technology that makes many new system concepts and improvements feasible. Foremost, but not alone, among these new possibilities is the spatial (mechanical) disconnect—with consequent temporal separations (typically tenths of a second)—between the pilot's command actions and the aircraft control effectors' reflection of the pilot's intent. With FBW controls, the pilot does not receive a direct indication through the cockpit control device when a control-surface actuator is rate limited,* whereas with some older direct hydraulic controls, mechanical resistance to further command movement indicates that the actuator is rate limited. Similarly, FBW controls do not give direct indications of rate limitations included in the software.

When stability augmentation systems (SASs)* and other FCS-associated subsystems share control effectors with direct pilot inputs, the pilot's authority over the control surfaces can also be substantially reduced. The pilot, unaware

that the systems are operating at their limits, may call for a greater response from the control surface than is allowed by the system's rate or position limits* for that effector. The resulting "disharmony" between the pilot's intentions and the aircraft's response can significantly affect the pilot's comprehension of the overall status of the PVS. All of these effects may be present and quantifiable in oscillatory PVS behavior, but for non-oscillatory interactions they are more of a potential problem because they may not be positively identified or exemplified. Consequently, this report focuses more on system oscillations than on potential, non-oscillatory interactions.

PIOs have been around since the time of the Wright brothers, giving them an unambiguous seniority among flying qualities* problems.⁴² In terms of severity and consequences, pilot-vehicle oscillatory phenomena comprise a complete spectrum. The oscillations may be of the temporary, easily corrected, low-amplitude variety often encountered by pilots when getting the feel of a new configuration—basically a learning experience. These oscillations can happen on any aircraft and have been experienced by most pilots at one time or another. On the other hand, a fully developed, large-amplitude oscillation with near or actual catastrophic consequences is a terrifying event that jeopardizes the safety of the aircraft, passengers, and crew. Severe PIOs are either difficult or impossible for the pilot to arrest.

The in-flight recording of Figure 1-1 illustrates a severe PIO and should motivate interest in this phenomenon. This event occurred with an early version of the T-38 trainer, and it remains a historical landmark for several reasons: the aircraft was equipped with instruments to collect detailed flight data; the incident was about as severe as one can get without an actual breakup of the aircraft; and the event has been extensively studied. As a result, this event has provided valuable insight into severe PIOs.

The time traces shown in Figure 1-1 indicate that the event was preceded by a low-amplitude, high-frequency oscillation involving only the pitch axis of the aircraft and the SAS; note that the force the pilot applied to the stick was zero during this pre-PIO phase. In other words, the initial oscillation was an instability of the SAS-aircraft combination with no pilot involvement. To eliminate the oscillation, the pilot disengaged the pitch SAS and entered the control loop in an attempt to counter the resulting upset.* Triggered by these events, at the pilot's intervention, a 1.2 Hz (7.4 rad/sec) oscillation developed very rapidly. In just a cycle or so, the oscillation had achieved an amplitude of ±5 g, increasing gradually to ±8 g, perilously near aircraft design limits. Recovery occurred when the pilot removed himself from the control loop. This

example is given here to capture the reader's attention and to show that such events, although extremely unusual, can be very serious.

Although severe APC events are rare, they continue to occur, and, what is of more concern, they seem to be increasing in variety and complexity as aircraft systems advance. Large amplitude, potentially catastrophic, severe APCs can appear in many guises and can involve many factors. To understand these factors and their interactions, the PVS must be dissected in detail. Understanding the possibilities as well as the past examples involves a process of identifying, describing, and examining the constituents of severe APC problems and how they interact. This process begins with a description of the PVS, followed by a brief historical perspective.

The general physical structure of a PVS subject to one command input from the pilot is summarized in Figure 1-2. From the pilot's perspective, this is a "single-axis" situation in that the pilot's command is expressed by a single manipulation of a control inceptor. "Inceptor" is a catchall term for the pilot's control devices, such as the control stick or wheel for lateral control, the stick or column for longitudinal control, handles for controlling throttles and flaps, and pedals for controlling rudders. An inceptor may affect several vehicle control effectors (e.g., control surfaces)—for example, coordinated motions of aileron and rudder originated by a lateral stick deflection. This single-axis structure may encompass various inputs to the pilot. (The dynamics of the human pilot as an element within the closed-loop PVS can take several forms depending on the details of the specific system. A short description of these forms appears in Chapter 5 [see the section, Different Modes of Pilot Behavior]. A more extensive explanation is provided by McRuer.⁴²) Examples of input to the pilot are: simple visual cues, such as pitch attitude; motion cues, such as normal acceleration at the pilot's location; composite signals, such as flight director error displays; or combinations of these inputs.

As shown in Figure 1-2, the inanimate elements of the system comprise the aircraft, FCS, and "displays." In principle, "displays" include all sources of sensory information the pilot uses to understand aircraft motion, especially those that derive from visual, motion-related, and aural modalities. The displays therefore include outside visual cues as well as cockpit instruments, proprioceptive* (e.g., perceived limb force and movement) inputs from inceptors, etc. In Figure 1-2, accelerations and angular velocities are shown as direct feedbacks to the pilot and as inputs to the display complex. Even aural signals from warning devices can contribute to the grand overall "display" that provides cues to the pilot. Because severe PIOs are almost always relatively high-frequency oscillations (0.2 to 3 Hz), only the "displayed'' inputs that

provide cues for the higher-frequency PVS loops are of practical consequence. This simplifies the analysis considerably and emphasizes as key cues the aircraft attitudes and accelerations and the pilot-perceived control forces and displacements (proprioceptive variables) at the inceptor level.

To represent the cues relevant to PIO, Figure 1-2 defines two slightly different entities that interact with the pilot. The first is the "effective aircraft dynamics," which consists of the aircraft as modified by the FCS. The second is the total dynamic entity with which the pilot interacts, the "controlled element," which includes certain elements of the display complex that contribute to the cue dynamics and are associated with the effective aircraft dynamics. In most APC events, the display complex quantities of interest include pitch or roll attitudes, which are visually perceived from the pilot's external field of view. In these cases, no distinction between the effective aircraft dynamics and the controlled element is necessary.

Figure 1-1 Flight recording of T-38 PIO. Adapted from: Ashkenas et al.³

The pilot, controlled element, task, and goal elements shown in Figure 1-2 are the principal constituents that can interact to cause a PIO when the PVS is a tightly-coupled closed-loop. Figure 1-3 shows the sufficient conditions for a continuous oscillation of the pilot-controlled-element system. These conditions can be satisfied only when the closed-loop PVS is operated with high pilot gain.*

Most flying tasks are accomplished with highly skilled discrete commands that are tailored for specific maneuvers and applied as open-loop inputs. Very few tracking-like operations demand full attention, continuous, closed-loop, pilot-controlled actions. Figure 1-3 lists some of the flight control tasks in which a high pilot gain is required to achieve necessary levels of closed-loop system dynamic performance and precision of control. Although they are a small subset of flight control tasks, most of them are well defined, ordinary, light operations.

By contrast, severe PIOs are extraordinary passages across stability boundaries. Although PIOs may, on occasion, appear to result from overly aggressive actions, they are more often associated with anomalous changes either in the pilot's behavior, the effective aircraft dynamics, or the display complex. These anomalies (the last item in Figure 1-3, Demanding or Unexpected Transitions) include conditions that induce or require one of the following responses:

• sudden major overall changes in the PVS configuration, such as wave off, target maneuvering, shift in goals, manual takeover, etc.
• modifications of the effective vehicle configuration (e.g., sudden changes in effective aircraft dynamics, such as FCS mode switching, autopilot disconnects when the aircraft is out of trim, or reconfigurations of control or power during go-arounds and aborts; low-altitude cargo extractions; afterburner light-offs; engine unstart; asymmetric stores release; SAS failures; maneuvering into Mach buffet;* or any changes in effective aircraft dynamics that are sensitive to pilot gain or driven by a shift in pilot action from small to large amplitude inputs)
• changes in the pilot's dynamics and/or the pilot-defined system architecture (e.g., shifts of dominant cues or pilot behavioral mode)

The unexpected and unusual nature of most severe oscillatory APC events implies an unusual precursor or "trigger" event. The fundamental characteristic of a trigger event is a mismatch between the pilot's control strategy and the effective aircraft dynamics that are being controlled. Triggers can arise either from external or internal sources. They may be major upsets,

Figure 1-3 Conditions associated with oscillatory APCs. Source: Adapted from McRuer.⁴²

which can be caused by wind gusts, turbulence, or other unexpected events (e.g., runway incursions) in the external environment. Triggers may also derive from transitional changes in the pilot or the effective aircraft. That is, transitions in the system or system elements may trigger APC events as well as change the effective aircraft or controlled element dynamics.

The essential elements that interact unfavorably to create a severe APC event (see Figure 1-4) are listed below:

• a pilot using one of several possible dynamic behavioral modes (see Chapter 5) to satisfy highly demanding tasks and goals
• less than optimum controlled-element dynamic characteristics
• triggering event(s)

The committee assessed the historical record of aircraft accidénts and incidents from publicly available records and detailed discussions with a representative set of aircraft manufacturers, airlines, and accident investigation authorities in the United States and Europe. This assessment revealed a remarkably diverse set of severe PIOs and other APC events. Tables 1-1a through 1-1d show a cross section of PIOs for aircraft that are considered classical and traditional from the standpoint of FCSs. Although these include some very current aircraft, with few exceptions the FCSs comprise conventional mechanical primary controls that connect the pilot to hydraulically-actuated control surface effectors. These primary control systems are usually supplemented with relatively simple, restricted authority SASs that were added to improve the effective aircraft dynamics.

Figure 1-4 Interacting constituents of oscillatory APCs.

PIOs in Tables 1-1a through 1-1d are divided by two distinguishing features into four groups, each exemplified by well-known incidents (some of them catastrophic). The two primary features are: (1) the number of aircraft control axes involved in the PIOs; and (2) the frequency of oscillation of the closed-loop PIOs. The number of aircraft control axes is defined as the number of vehicle command variables the pilot was using to control the aircraft at the time of the PIO. For example, control of pitch motions using the elevator would correspond to one control axis, whereas pitch control effected by the elevator, ailerons, and rudder would correspond to three axes. The frequency range over which control is exerted can vary from about 0.2 to 3 Hz. At the higher frequencies the flexible modes of the aircraft play an important role in the PIO. In the lower frequency regime, say 0.2 to 1 Hz, the effective aircraft dynamics are basically the dynamics of the aircraft as a rigid body modified by the low-frequency effects of higher-frequency FCS components, including actuation elements; these are referred to as "extended rigid body dynamics."

Many APC events in Tables 1-1a through 1-1d are not well documented. Several occurred on research aircraft that presented state-of-the-art stability

and control challenges; these PIOs have helped to define the limits of piloted control and have underscored the need for sophisticated FCSs to redress imbalances in certain configurations. For those aircraft that were already operational or that became operational, the specific problems leading to PIOs were identified, and the aircraft were modified to reduce PIO tendencies. This was accomplished largely on an ad hoc basis and usually required extensive flight testing. Solutions and fixes have been guided by flying qualities research aimed at developing requirements for military aircraft, by major developments in pilot-vehicle analysis that improved understanding, and by after-the-fact simulation.

Table 1-2 shows some PIO and non-oscillatory APC events associated with FBW aircraft. The entries in this table differ in several ways from those in Table 1-1. First, not all of the incidents are as well known as those in Table 1-1. Second, all the aircraft in Table 1-2 are modern. Third, and finally, incidents in the development phase of new commercial transports are included. The common attribute of the aircraft in Table 1-2 is that they are all equipped with modern FBW FCSs. As a matter of historical fact, almost every aircraft with a partial or total FBW FCS (including the Shuttle orbiter, F-16, F-18, YF-22, B-2, C-17, A-320, Boeing 777, and JAS-39) has, at one time or another in the development process, experienced one or more APC events. The new FBW era may be a historical watershed in that, although many FBW aircraft have been enormously successful in the production phase by virtue of the advantages conferred by FBW technology, all of them have passed through a period of APC difficulties.

It is now generally accepted that FBW technology, which in this report includes fly-by-light* technology, offers many opportunities for new solutions to aircraft stability and control problems of all kinds. The introduction of FBW systems technology has also created systems with enormous advantages in terms of performance, weight reductions, stability and control, operational flexibility, and maintenance requirements. At the same time, almost as a corollary, the flexibility inherent in FBW technology introduces more opportunities for new side effects and unanticipated problems. The counterpoint, however, is that FBW technology also offers a great many possibilities for correcting problems. This benefit has been amply demonstrated by experience in correcting the problems documented in Table 1-2. The flurry of APCs encountered in modern aircraft development programs suggests that, although FBW systems are not inherently more or less susceptible to severe APC events, the technology is new, and some side effects have not been fully explored.

The National Aeronautics and Space Administration (NASA) asked the National Research Council (NRC) to conduct a study to determine the current status of APC problems as a potential safety issue. This study, under the

auspices of the Aeronautics and Space Engineering Board, focuses attention on key steps that could be taken to minimize the kind of problems seen recently and that could counter new types of APC events.

To fulfill this assignment the Aeronautics and Space Engineering Board assembled the Committee on the Effects of Aircraft-Pilot Coupling on Flight Safety. Committee members have expertise in the technical, operational, and safety disciplines associated with PVSs (see Appendix A for biographical sketches). The NRC charged the committee to evaluate the current state of knowledge about APC events and to recommend processes that may help eliminate adverse APC tendencies from military and commercial aircraft. The statement of task asked the committee to do the following:

• Review and assess recent incidents and accidents in which adverse APC is known or suspected.
• Review current and projected FBW and fly-by-light applications with emphasis on potential APC issues.
• Evaluate current processes for ensuring that APC characteristics of current and future aircraft do not constitute undue safety risks and, if appropriate, recommend improvements in these processes.
• Assess the current scope, depth, and balance of national and international efforts devoted to the resolution of problems involving APC and define key areas and issues of concern.

The committee received significant help from technical liaisons from NASA, the U.S. Navy, the U.S. Army, and the Federal Aviation Administration (FAA), as well as many national and international experts who expanded and augmented the committee's expertise (see Appendix B).

As described above, adverse APC is a systems problem that occurs when human behavior and effective aircraft dynamics interact in peculiar ways. Human pilot dynamic behavior and aircraft/FCS dynamics are highly complex technical disciplines that are ordinarily treated by a three-pronged approach—analysis, computer simulation, and experiment. Like other problems of overall systems engineering, this one requires systems-level thinking and intimate knowledge of the system details.

The committee was also challenged with finding understandable and straightforward language (in fields replete with jargon) to communicate with a community that has diverse interests, needs, and time horizons. The anticipated audience for this report includes technical, government, and administrative decision makers and their technical and administrative support staffs; key technical managers in the aircraft manufacturing and operational industries; stability and control engineers; aircraft FCS designers; research specialists in flight control, flying qualities, and human factors; and technically knowledgeable lay readers. On the face of it, persuasive communications with such a diverse audience is extremely difficult.

The problem of technical jargon is partly handled with a glossary. Finding an appropriate level of technical discourse was more difficult. For instance, verbal explanations of complex phenomena can only go so far without resorting to mathematically expressed analyses; credible comparisons of approaches are best expressed in graphical depictions and tabulations of data, and so on. But such techniques in a report intended to persuade technical and administrative managers and even technically knowledgeable lay readers may obscure rather than illuminate the intended message. Accordingly, the committee has attempted to produce a report that can satisfy the needs of most readers, as they were perceived by the committee. The approach adopted to achieve this end was to prepare a multifaceted, multilevel report that incorporates material of varying complexity.

The committee engaged in an international information-gathering effort that included interactions with aviation industry experts from France, Germany, Russia, Sweden, and the United Kingdom (in addition to the United States). Based on these discussions, the committee determined that the findings and recommendations contained herein are generally applicable nationally and internationally.

The executive summary is self-contained and provides a general explanation of APC problems and a summary of the committee's findings and recommendations.

Chapters 1 through 4 focus on new systems; APC phenomena, status, and trends; and recommended processes. Chapter 1 sets the stage with an explanation of how APC is rooted in the PVS, definitions, and historical antecedents. Chapter 2 describes the wide spectrum of APC phenomena and the underlying constituents, PIO categories, and case studies of APC-related incidents and accidents. Chapter 3 summarizes trends of adverse APC from a review of accidents and incidents, points out difficulties in the identification and analysis of operational situations, and describes the associated need to

better identify APC possibilities in operational situations. Chapter 4 lists lessons learned and recommends management and design policies, procedures, and processes to avoid adverse APC events.

Chapters 5 and 6 focus on tools. Chapter 5 examines experimental and analytical techniques that can be used to discover and understand APC events and to study alternative systems. Chapter 6 compares available analytical procedures for assessing APC potential and describes the committee's conclusions related to criteria. Chapter 7 lists the committee's major findings and recommendations.

The appendices provide amplifying information in support of the main body of the report. Appendix A contains biographical sketches of committee members. Appendix B lists participants in committee meetings. Appendix C provides a detailed technical description of essentially linear oscillatory APC events and some nonlinear characteristics that lead to flying qualities ''cliffs."* Appendix D describes ongoing research to mitigate APC tendencies and improve the capabilities of piloted simulations for evaluating APC problems.