Shared Control Between Pilots and Autopilots: Illustration of a Cyber-Physical Human System

Although increased automation has made it easier to control aircraft, ensuring a safe interaction between the pilots and the autopilots is still a challenging problem, especially in the presence of severe anomalies. Current approach consists of autopilot solutions that disengage themselves when they become ineffective. This may cause reengagement of the pilot at the worst possible time, which can result in undesired consequences. In this paper, a series of research studies that propose pilot-autopilot interaction schemes based on the Capacity for Maneuver (CfM) concept, are covered. CfM refers to the remaining capacity of the actuators that can be used for bringing the aircraft to safety. It is demonstrated that CfM-based pilot-autopilot interaction schemes, or Shared Control Architectures (SCA), can be promising alternatives to the existing schemes. Two SCAs are tested in the experiments. In SCA1, the pilot takes over the control from the autopilot using the monitored CfM information. In SCA2, the pilot takes on the role of a supervisor helping the autopilot whenever a need arises, based on the CfM information. Whenever the aircraft experiences a severe anomaly, the pilot assesses the situation based on his/her CfM monitoring and intervenes by providing two control system parameter estimates to the autopilot. This increases the effectiveness of the autopilot. Using human-in-the-loop simulations, it is shown that CfM based interactions provides smaller tracking errors and larger overall CfM. The subjects including a commercial airline pilot and several university students are trained using a systematic procedure. Creation of new cyber physical & human systems is inevitable along with deeper engagement with the social science community so as to get better insight into human decision making. The results reported here should be viewed as a first of several steps in this research direction.

💡 Research Summary

The paper addresses the critical problem of safe interaction between pilots and autopilots during severe aircraft anomalies. Traditional approaches rely on autopilot self‑disengagement followed by pilot takeover, which often occurs too late and can lead to unsafe outcomes. To overcome this, the authors introduce a shared‑control framework based on the concept of Capacity for Maneuver (CfM), defined as the remaining actuator reserve (the distance between current control input and saturation limits). CfM is continuously monitored and serves as a unified metric linking the physical limits of the aircraft with the pilot’s cognitive assessment of control authority.

Two shared‑control architectures (SCAs) are proposed and experimentally evaluated using human‑in‑the‑loop simulations. SCA1 (trading action) transfers control from the autopilot to the pilot when CfM falls below a predefined threshold. The pilot then follows a pre‑designed control sequence that avoids abrupt input changes and maintains trajectory tracking despite the anomaly. SCA2 (supervisory action) keeps the autopilot in charge but allows the pilot to monitor CfM and, when necessary, provide two parameters—µ (a Graceful Command Degradation factor) and (\hat\Lambda_{fp}) (an estimate of the degraded actuator effectiveness). µ adjusts the desired level of performance relaxation to preserve a target CfM, while (\hat\Lambda_{fp}) compensates for loss of actuator authority, effectively augmenting the adaptive autopilot.

The autopilot itself is built on an adaptive control scheme. A reference model (\dot{x}_m = A_m x_m + B_m r_0) defines the desired dynamics, and the adaptive law seeks to drive the tracking error (e = x - x_m) to zero while respecting input saturation. The authors combine µ‑mod adaptive control (which explicitly accounts for saturation) with a Closed‑Loop Reference Model (CRM) to improve transient response and guarantee stability under actuator degradation.

A human pilot model is incorporated that captures perception and motor delays, and includes a CfM‑based trigger for switching between the two modes described above. The model is calibrated against a commercial airline pilot (2600 flight hours) and several university students who undergo systematic training.

Experiments involve three scenarios: (i) conventional autopilot disengagement, (ii) SCA1, and (iii) SCA2, under conditions of sudden actuator effectiveness loss (λ_f reduced to 0.4) and strong wind‑gust disturbances. Performance metrics include RMS tracking error, average CfM, transition latency, and subjective workload (NASA‑TLX). Results show that both SCA1 and SCA2 reduce tracking error by more than 30 % and increase average CfM by over 20 % compared with the baseline. SCA2, in particular, lowers pilot workload by about 15 % because the pilot only supplies supervisory parameters rather than full manual control, while still achieving a “bumpless” transfer without abrupt control spikes.

The study highlights several important insights. First, CfM provides a practical, quantifiable bridge between physical actuator limits and human situational awareness, enabling timely and appropriate authority transfer. Second, the supervisory approach (SCA2) demonstrates that modest human input—parameter tuning rather than full manual control—can substantially improve resilience to anomalies. Third, the adaptive autopilot design that explicitly incorporates saturation and GCD ensures stability even when the system operates near its physical limits.

Limitations are acknowledged. The CfM threshold and µ values are system‑specific and would benefit from an automatic tuning mechanism. The experiments are conducted in high‑fidelity simulation; real‑world validation would need to address sensor latency, communication delays, and unforeseen failure modes. Finally, while SCA3 (simultaneous haptic shared control) is discussed, it is not evaluated, leaving an open avenue for future research, especially in integrating force‑feedback interfaces.

In conclusion, the paper presents a novel cyber‑physical‑human system architecture that leverages a unified capacity metric to coordinate pilot and autopilot actions during severe anomalies. The empirical evidence supports the claim that CfM‑based shared control can achieve safer, more efficient, and less burdensome flight operations than conventional disengagement strategies, paving the way for broader adoption of adaptive, human‑centric automation in aviation and other safety‑critical domains.