Control

1. Control • 16.422 Information & Signal • Detection Theory • Prof. R. John Hansman • Acknowledgements to Profs Tom Sheridan and Jim Kuchar whose notes are the core of this lecture

2. Outline Control • Information Theory • Signal Detection Theory • Alerting Introduction

3. Information Theory Control • What is information? • Control Theoretic View • □Lines in Control Block Diagram Direct Observation • Supervisory Control Computer Display Control System Interface Sensors • Bayesian View • □Information is something which reduces uncertainty in a world model

4. Bayes Theory Control H = Hypothesis, D = Data p(H | D) = p(D | H) p(H)/p(D) With new data p(H | D1,D2) = p(D2 | H) [p(D1 | H) p(H)/p(D1) /p(D2) With 2 hypotheses p(H1 | D1,D2) = p(D2 | H1) p(D1 | H1) p(H1) p(H2 | D1,D2) p(D2 | H2) p(D1 | H2) p(H2) Posterier odds ratio prior odds ratio

5. Control • Shannon Information Theory • □Bell Labs • □Telephony • Tom Sheridan Notes (Courtesy of Thomas Sheridan. Used with permission.)

6. Control • Bit view of Information • □ # of bits to disambiguate • □Bit = binary discrimination • □Drive uncertainty to zero (Courtesy of Thomas Sheridan. Used with permission.)

7. Info Transmission H = information, D = Data Control (Courtesy of Thomas Sheridan. Used with permission.)

8. Control (Courtesy of Thomas Sheridan. Used with permission.)

9. Control (Courtesy of Thomas Sheridan. Used with permission.)

10. (Courtesy of Thomas Sheridan. Used with permission.)

11. Information Value Control Assessing the Benefit of Providing Information Average benefit from having perfect information (indicative of true state x), where one can select u to optimize for each x, is vp=Σi p(xi)maxj [v(xiuj)]. The best one can ever do from just knowing the a priori statistics is vo=maxj [Σi p(xi) v(xiuj)]. The difference (vp-vo) is the net benefit of having the inform- action if it were free. As a first approximation, the cost (in complexity of hardware/ software) of providing and/or of accessing the information (in computer or human time/distraction) is C=Σi p(xi)c(xi)log2[1/p(xi)] Then should provide the information IFF (vp-vo) < C Information may become imperfect, e.g., state x changes with probability q to each other state before u takes effect. then vl=Σi p(xi)｛(1-q)maxj [v(xiuj)]+ q Σk≠i[v(x k≠i uj selected for i)]｝ Then should provide information IFF (vl-vo) < C

12. Control

13. Information Bandwidth Control • Information Rate • □Bits/Sec • Information Density • Raster Example • □(# Pixels) ( # Bits/Pixel) (Update Rate)

14. Task Performance & Bandwidth Control Frame Rate • Color • Depth • Constant Task • Performance • Constant • Bitrate Resolution Diagram from Sheridan, Teleoperation

15. Signal Detection Theory Control • Originally Developed for Radar Threshold Detection • Becomes the Basis for Alerting Theory • Signal versus Noise • A-Scope Example

16. (Courtesy of Thomas Sheridan. Used with permission.)

17. (Courtesy of Thomas Sheridan. Used with permission.)

18. (Courtesy of Thomas Sheridan. Used with permission.)

19. Control (Courtesy of Thomas Sheridan. Used with permission.)

20. Consider Sensor System Control • Display Or • Alert Threshold Sensor System • Radar • Engine Fire Detection • Other

21. Threshold Placement Control Ideal Alerting System Probability of Successful Alert P(SA) • Example Alerting • Threshold Locations Probability of False Alarm P(FA) (Courtesy of James Kuchar. Used with permission.)

22. Threshold Placement • Use specified P(FA) or P(MD) • Alerting Cost Function: Define CFA CMD as alert decision costs J = P(FA) CFA + P(MD) CMD = P(FA) CFA + (1 - P(CD)) CMD Minimize Cost: dJ = dP(FA) CFA - dP(CD) CMD = 0 dP(CD) CFA dP(FA) CMD = P(CD) Optimal Threshold Location Slope of SOC curve = cost ratio P(FA) (Courtesy of James Kuchar. Used with permission.)

23. Engine Fire Alerting Control • C(FA) high on takeoff • Alerts suppressed during TO Now let’s take a quick look at non-normal checklists. The 777 EICAS message list is similar to other Boeing EICAS airplanes. [For 747-400 operators: It doesn’t use the “caret” symbol to indicate a checklist with no QRH items, like the 747-400s do.] But it has an additional feature, called the “checklist icon”. The icon is displayed next to an EICAS message whenever there is an ECL checklist that needs to be completed. Once the checklist is fully complete, the icon is removed from display next to the message. This helps the crew keep track of which checklists remain to be completed.

24. Crew Alerting Levels Control Non-Normal Procedures Time Critical Operational condition that requires immediate crew awareness and immediate action • Warning Operational or system condition that requires immediate crew awareness and definite • corrective or compensatory action • Caution Operational or system condition that requires immediate crew awareness and possible • corrective or compensatory action • Advisory Operational or system condition that requires crew awareness and possible corrective or • compensatory action Alternate Normal Procedures Comm Alerts crew to incoming datalink communication Memo Crew reminders of the current state of certain manually selected normal conditions Source: Brian Kelly Boeing Don’t have time to discuss these levels. Important thing to know is that we rigorously define and defend these levels We apply them across all the systems. The indications are consistent for all alerts at each level. Thus the pilots instantly know the criticality and nature of an alert even before they know what the problem is

25. Boeing Color Use Guides Control Red Warnings, warning level limitations Amber Cautions, caution level limitations White Current status information Green Pilot selected data, mode annunciations Magenta Target information Cyan Background data Again, we don’t have time to describe these definitions in detail. The important thing to note is that our philosophy is definite, and as simple as practical. It fits on one page, in big font no less.

26. Direct Observation Access To Non-Normal Checklists Control • Prevents choosing wrong • checklist FIRE ENG R When an alert message is displayed, the pilot simply pushes the CHKL button and the correct non-normal checklist is displayed. This prevents the crew from accidentally choosing the wrong checklist. The non-normal checklists have priority over the normal checklists.

27. Non-Normal Checklists Control • NORMAL MENU RESETS NON-NORMAL MENU • FIRE ENG R • Fire is detected in the right engine. • Checklist specific to left • or right side • Exact switch specified • Memory items already • complete • Closed-loop conditional item • Page bar 1 2 3 • RIGHT AUTOTHROTTLE ARM SWITCH . . . . . . . . . . . OFF • RIGHT THRUST LEVER . . . . . . . . . . . . . . . . . . . . . .CLOSE • RIGHT FUEL CONTROL SWITCH . . . . . . . . . . . . .CUTOFF • RIGHT ENGINE FIRE SWITCH . . . . . . . . . . . . . . . . . . PULL • If FIRE ENG R message remains displayed: • RIGHT ENGINE FIRE SWITCH . . . . . . . . . . . . . ROTATE • Rotate to the stop and hold for 1 second. ITEM OVRD CHKL OVRD CHKL RESET NOTES NORMAL This iswhat a typical normal checklist looks like.This is thePreflight checkist. There are two kinds of line items, which we call open-loop and closed-loop items. The open-loop items have a gray check-box in front of them. These are items that the airplane systems cannot sense. The pilot determines whether the items have been completed and clicks the CCD thumbswitch when each item is complete. Closed-loop items are for switches and selectors that are sensed by the airplane systems. They automatically turn green when the switch has been positioned correctly. If the crew actuates the wrong switch, the closed-loop item will not turn green and the crew will catch their error. In this example, the procedure was already complete, so the last two items are shown in green as soon as the checklist is displayed. The white current line item box leads the pilot through the checklist and prevents accidentally skipping a line item. Color is used to indicate line item status. Incomplete items are displayed white and complete items are displayed green. Cyan (or blue) indicates an inapplicable item, or an item that has been intentionally overridden by the crew using the ITEM OVRD button. In this example, the flight is dispatching with autobrakes inoperative, so the crew has overridden the AUTOBRAKE item. Overriding the item allows the checklist to be completed.

28. Internal vs External Threat Systems Control • Internal • □ System normally well defined • □ Logic relatively static • □ Simple ROC approach valid • □ Examples (Oil Pressure, Fire, Fuel, ...) • External • □External environment may not be well defined • ♦Stochastic elements • □Controlled system trajectory may be important • ♦Human response • □Need ROC like approach which considers entire system • □System Operating Characteristic (SOC) approach of • Kuchar • □Examples (Traffic, Terrain, Weather, …)

29. Decision-Aiding / Alerting Control System Architecture Environment Automation Sensors Actuator Process Interface Sensors Displays Actuator Human Control / Actuation Information Transduction Decision Making (Courtesy of James Kuchar. Used with permission.)

30. Fundamental Tradeoff in Control Alerting Decisions x 2 Uncertain current state Hazard Uncertain Future Trajectory • When to alert? • □Too early Unnecessary Alert x 1 • ♦Operator would have avoided hazard without alert • ♦Leads to distrust of system, delayed response • □Too late Missed Detection • ♦Incident occurs even with the alerting system • Must balance Unnecessary Alerts and Missed Detections (Courtesy of James Kuchar. Used with permission.)

31. The Alerting Decision Control • Examine consequences of alerting / not alerting • □ Alert is not issued: Nominal Trajectory (N) • □ Alert is issued: Avoidance Trajectory (A) Hazard A Hazard N Current State Compute probability of Incident along each trajectory (Courtesy of James Kuchar. Used with permission.)

32. System Operating Control Characteristic Curve Ideal Alerting System Probability of Successful Alert P(SA) • Example Alerting • Threshold Locations Probability of False Alarm P(FA) (Courtesy of James Kuchar. Used with permission.)

33. Trajectory Modeling Methods Control Nominal Worst-case Probabilistic (Courtesy of James Kuchar. Used with permission.)

34. Nominal Trajectory Prediction- Control Based Alerting • Alert when projected trajectory encounters hazard predicted nominal trajectory system state hazard hazard • Look ahead time and trajectory model are design parameters • Examples: TCAS, GPWS, AILS (Courtesy of James Kuchar. Used with permission.)

35. Airborne Information for Lateral Spacing (AILS) Control (nominal trajectory prediction-based) • Alert occurs with prediction • of near miss in given time interval • Endangered aircraft vectored away (Courtesy of James Kuchar. Used with permission.)

36. Alert Trajectory Prediction- Control Based Alerting • Alert is issued as soon as safe escape path is threatened • predicted escape path • (alert trajectory) hazard hazard system state nominal trajectory • Attempt to ensure minimum level of safety • Some loss of control over false alarms • Example: Probabilistic parallel approach logic (Carpenter & Kuchar) (Courtesy of James Kuchar. Used with permission.)

37. Example State Uncertainty Control Propagation Computed via Monte Carlo Nautical Miles along-track σ= 15 kt cross-track σ= 1 nmi (from NASA Ames) Nautical Miles (Courtesy of James Kuchar. Used with permission.)

38. Monte Carlo Simulation Control Structure • Current state information • (position, velocity) Protected Zone size Intent information: Waypoints (2D, 3D, 4D) Target heading Target speed Target altitude Target altitude rate Maneuvering limitations • Monte Carlo • Simulation Engine Probability of conflict • Uncertainties • (probability density functions) • Current states • Along- and cross-track error • Maneuvering characteristics • Confidence in intent information Implemented in real-time simulation studies at NASA Ames Computational time on the order of 1 sec (Courtesy of James Kuchar. Used with permission.)

39. System Operating Control Characteristic Curve Ideal Alerting System Probability of Successful Alert P(SA) • Example Alerting • Threshold Locations Probability of False Alarm P(FA) (Courtesy of James Kuchar. Used with permission.)

40. Aircraft Collision Avoidance Control human • experience, • training automation aircraft controls caution: "terrain" GPWS alert and decision aid • diagnosis and control warning: "pull up" terrain data human senses displays • other info. • (e.g. window view) other sensor information altitude and altitude rate sensors

41. Fatal Accident Causes Control Fatalities by Accident Categories Fatal Accidents-Worldwide Commercial Jet Fleet - 1988 Through 1997 Note: Accidents involving multiple non-onboard fatalities are included. Accidents involving single, non-onboard fatalities are excluded. †CFIT Controlled flight into terrain † †RTO Refused takeoff Adapted from the Boeing Company

42. Prototype MIT Terrain Control Alerting Displays

43. Enhanced GPWS Improves Terrain/Situational Awareness Control EFIS map display color legend + 2,000-ft high density (50%) red + 1,000-ft high density (50%) yellow Reference altitude - 250/-500-ft medium density (25%) yellow - 1,000-ft medium density (25%) green - 2,000-ft medium density (12.5%) green

44. Control Terrain Alerting • TAWS Look-Ahead Alerts • (Terrain Database) • “Terrain, Terrain, Pull Up...” • approx 22 sec. Basic GPWS modes (radar altitude) • “Caution Terrain” • approx 45 sec

45. TAWS Look-ahead Warning Control • Threat terrain is shown in solid red • “Pull up” light or PFD message • Colored terrain on navigation display

46. Conflict Detection and Resolution Framework Control Human Operator Conflict Resolution Intent Environment Dynamic Model Projected States • Metric • Definition Metrics Conflict Detection State Estimation Current States (Courtesy of James Kuchar. Used with permission.)

47. Multiple Alerting System Control Conflicts • Developing formal methods for system analysis • Identification of conflicts and methods to mitigate • Drivers / implications for human interaction (Courtesy of James Kuchar. Used with permission.)

48. Control • Design Principles for • Alerting and Decision-Aiding Systems for Automobiles James K. Kuchar Department of Aeronautics and Astronautics Massachusetts Institute of Technology (Courtesy of James Kuchar. Used with permission.)

49. Kinematics Control Alert Issued Vehicle Hazard Total Braking Distance • Response • Latency Braking Distance • Alert time: talert = (r - d)/v • talert= 0Jbraking must begin immediately • talert=W J alert is issuedW seconds before braking is required • Determine P(UA) and P(SA) as function of talert (Courtesy of James Kuchar. Used with permission.)

50. Example Human Response Time Control Distribution Probability Density Time(s) Lognormal distribution (mode = 1.07 s, dispersion = 0.49) [Najm et al.] (Courtesy of James Kuchar. Used with permission.)