High Assurance Life and Death

Today’s airspace environment is congested and complex. The enroute environment is a tangled web of victor airways and jet routes connecting the multitude of radio navigation aids sprinkled all over the world and especially the US. The terminal area environments are highly congested with air traffic and requires precise aircraft control by pilots and ground controllers. This situation is even more critical in adverse weather conditions. The cockpit environment is also complex and unforgiving. There are four fundamental functions that must be executed by aircrews to safely fly an aircraft. The primary function is to aviate. Someone or something (like an autopilot) must constantly maintain aircraft control to at least keep the shiny side up and the greasy side down. The second function is to operate the aircraft systems. Someone or something (like onboard computers) must constantly monitor and operate the electrics, hydraulics, pneumatics, engines, flight controls, and fuel system along with all their related subsystems. Third is navigation. Someone or something (like navigation computers) must always have a finger on the map to know where the aircraft is and where it is going. An airplane can’t stop on the side of an airway to pull out a map or to ask directions. Finally, the aircrew must be able to communicate with the outside world to ensure safe aircraft separation, receive weather updates, and coordinate for other activities after landing. The basic tools aircrews use to execute these functions are fairly standard. They have a stick and rudder for aircraft control, radios for communication and navigation, and switches and dials for systems operations. But the details of the human interface vary widely in complexity and usability. High assurance in the systems engineering of these tools is absolutely critical for the long term safety of flight operations. In general, high assurance systems should be reliable, convenient, and provide proper feedback to the operator. To illustrate these concepts I will describe a flight director (FD) system and explain what a pilot expects a good FD to do. A flight director is a cockpit system that allows a pilot to input a flight profile to include route and altitudes. Using this information, the FD interfaces with navigation systems, attitude reference gyros, and other flight instruments to provide visual steering commands back to the pilot in order to execute the programmed flight profile. Once programmed, the pilot merely follows the FD steering commands almost like a video game. Of course, the pilot must occasionally update the programmed flight profile as changes occur. A good FD provides some relief to the pilot from the urgent details of the aviating and navigating functions. He can focus his concentration on more effectively managing cockpit resources, anticipating changes, reacting to new information, and handling malfunctions. The Flight Director should be able to provide appropriate guidance for each and every phase of flight and not be cluttered with information that may only be important for another phase of flight. For takeoff, the FD should direct an efficient, repeatable, wings level, initial climbout. Thereafter, the pilot should be able to program his choice of rate of climb, angle of climb, constant airspeed climb, or constant Mach climb. A heading