Reachability-based abstraction for an aircraft landing under shared control

We extend techniques for a reachability-based abstraction to hybrid systems under shared control with application to pilot-autopilot interaction during an aircraft landing. A simple hybrid model of longitudinal aircraft dynamics and mode-logic is developed based on publicly available data. As the pilot and autopilot share control over some of the same inputs, it is possible for the pilot to "light" the autopilot. New types of safety are proposed to identify regions in the state-space in which pilot-autopilot conflict can occur, and then computed using level set methods. The results partition the state-space into different levels of safety. Cells of this partition form discrete modes in an abstraction of the reachability result, which can inform the design of a pilot display. Our results show how shared control contributed to violations of "safe" pilot interaction with the automation in the Nagoya 1994 A300 accident.