Dario Compagno

Identifying Intended Effects with Causal Models

HAL is

Motivation: causes and their intended effects

Causal inference is about learning relationships among events [START_REF] Pearl | Causality[END_REF]. If I put a coin into a coffee machine, as a result I will obtain a cup of espresso. This is the kind of explanation offered by causal models: the coin-event works as a cause of the coffee-event.

But what if I wanted to understand the reasons why somebody puts a coin into the machine, that is, for what ends some action is realized? To know the effects of some event is not enough to characterize it as action. In fact, an indefinite number of effects follow from any event, and not all of them are intended. If I put a coin in the coffee-machine, I get coffee, but I also become one coin poorer, and I waste some resources (water, electricity). It would be a mistake to see all those effects as reasons for action: I do not intentionally aim at becoming poorer, nor at wasting resources. Explaining actions needs to answer a particular kind of counterfactual question about their reasons: if the machine did not waste resources, would the agent keep putting coins into it? (probably yes); if the machine did not produce coffee, would the agent keep putting coins into it? (definitely no). There is a need to learn how to differentiate intended and unintended effects from empirical data, starting from a causal model and hypotheses of intentional behavior. Identifying intended effects can then be done by controlling for some of the action's effects-and not for its causes, as it is done in causal inference.

Causal and teleological inferences

We perform causal inference whenever we try to understand whether or not A is the cause of B, for example, whether the pins fall down because of the ball hitting them. Teleological inference is performed instead whenever we try to understand whether or not B is the end of A, for example, whether the ball is thrown in order to make the pins fall down. This distinction has been most clearly expressed by G.E.M. Anscombe in her book Intention (1957)1 .

Both causal and teleological inferences demand to go beyond observation and data. It is not possible to observe causation: only correlations among events can be observed and registered, while causality is a category that the viewer has to add to the data in order to produce explanations of what happens. I can see that whenever the sun is high in the sky the temperature is higher, but the causal connection transcends what can be measured. The formulation of an hypothesis is needed to turn observations into evidence for or against it. This is the main idea of contemporary causal research, which developed a probabilistic and counterfactual conception of causality, discovering ways to validate causal statements with models and data (McElreath 2020, Hernan and[START_REF] Hernan | Causal Inference[END_REF]. The ends of actions cannot be observed either. One can see somebody launching a ball, and the fact that the ball hits the pins, but to conclude that the agent aimed at hitting the pins one must add two main assumptions: first, that there is a causal connection between the ball and the pins, and second, that hitting the pin was among the effects intended by the agent. Instead of conceiving intentions as something detached from causes, we suggest modeling action by grounding it into the causal world. This is why both causal and teleological inferences require the use of causal models. However, intentions are not causes, and cannot be modeled as such. A further layer has to be built on top of causal models to use them as tools for teleological inference. A causal model is a set of assumptions about how the value of a variable depends on the value of other variables (its causes). A causal model can be represented as a non-cyclic graph in which nodes are variables and arcs are causal links between them. A causal model formalizes causal hypotheses and sometimes even permits to validate them with observational data (i.e., without performing randomized experiments): if my model assumes that when the pins are hit by a ball they should fall, and I observe a ball hitting some pins, but they stay up, this works as evidence of the fact that my model is incorrect. Thanks to causal models, observational data become evidence for or against hypotheses, producing causal knowledge. Causal inference is about events, while teleological inference is about actions. Both concepts of event and action can be defined with reference to causal models. An event is the assignment of a value to a variable A which "listens" to all other variables linked to it in a causal model. The listening metaphor has been coined by [START_REF] Pearl | Causality[END_REF] as a way to express the primitive notion of causation. With reference to a causal graph, the value of A depends on the values of all the variables having arcs going into A. If our causal graph had two variables C and A, one for the ball and one for the pins, an arrow could connect the first to the second and so express the causal connection between the two, and more precisely that the status of the pins depends on that of the ball. So if we observe "ball thrown" (C = c), we expect to also observe "pins down" (A = a). Figure 1 shows this very simple causal graph. Events are however not enough to ground teleological explanations. Even if I knew that every time the ball is thrown the pins go down, I still do not know whether the aim of the launch was to make a strike, or some other of the effects following the launch (making noise, for example, or winning a prize). We need to define actions, and we want to do it by building a further layer on top of causal models. The reason is that representing actions as a further description of observable events anchors them to the physical world, and allows to validate teleological inference with experimental or observational data. An action can be defined in this fashion as the assignment of a value do(C = c) to a variable C which "listens" to some of the variables to which it is linked to. With reference to a causal graph including C as a variable, the value of do(C) depends on the values of some of the variables having arcs coming from do(C). In order to perform teleological inference, we need to tag one variable with do() in a causal graph: this is the variable that we consider an action and whose intended effects we want to study. Any variable A to which do(C) "listens to" is tagged in the graph as intend(A). Describing the fact of throwing a ball as an action means to see it as an intervention, "pulled by" some effects identified in the model itself, such as the event of making pins fall down. Figure 2 shows a causal graph whose nodes have been tagged to express a teleological hypothesis.

Figure 2: A very simple causal graph with nodes tagged as an action and its intended effect The concept of intervention has been developed by Pearl as a way to validate causal hypotheses, and lays at the core of causal inference. If I want to test whether it is the ball that makes the pins fall, I should artificially isolate the ball launch from all its causes: throw it at random times and then observe whether all the times that the ball is thrown, the pins go down. In order to validate causal inferences, one needs to study the potential cause X independently of what made it happen, that is of its own causes. Interventions do(X) are a formal way to assume the free assignment of values to a variable X, and are needed to study its effects in an unbiased fashion. Pearl expresses well the idea that actions are not events: observing that a ball is in motion is not the same thing as throwing the ball. Similarly, [START_REF] Anscombe | Intention[END_REF] wrote that raising my arm is not the same thing as watching my arm rise, and the difference between the two English verbs "raise" and "rise" captures the distinction between describing something as an action or instead as an event. Actions require that the agent has control over the causes of his or her behavior; an action can be seen as oriented towards an end only if we isolate it momentarily from its causes. There are an indefinite number of causes at work for me to throw a ball here and now, but what is most interesting is that if there are no pins in front of me, I do not throw.

A counterfactual definition of intentions

Causes and ends are both concepts which need counterfactual definition, in the fashion initiated by David [START_REF] Lewis | [END_REF]. Limiting ourselves to facts, to what actually has or hasn't happened, doesn't give us access to their causes and reasons. Contemporary causal research has shown that causal explanations require to go beyond facts and data, and to make assumptions about what didn't happen, but could (or could not) have happened. That C is a cause of A can be formulated by saying "Had C = c not happened, then A = a would not have happened." Had the ball not been thrown, the pins would not have fallen down. This counterfactual statement expresses causality as a relationship necessarily going beyond mere observation of the actual world. A counterfactual definition of intentions can shed new light on this concept too and ground its operationalisation. "Was A = a not an intended effect of do(C = c), then do(C = c) would not have happened" expresses the idea that the observable event A is an action "listening" to at least one among its effects, namely a, which means that the action was done in order to produce this effect. Had the falling of the pins not been the end of the throw, the ball would not have been thrown. To appreciate the difference between causal and teleological explanations, it is crucial to grasp that not all the effects of an action are intended. Causal inference could ideally manage to identify all the effects of an event C = c, and still give absolutely no information about which of these effects was the reason for an agent to make this event happen. It is also important to understand that the "listening" metaphor coined by Pearl has to be interpreted differently with reference to causal or instead teleological explanation. Let us imagine a stove and a pot of water on it. The aim of causal inference is to identify a causal model (i.e., to put it to the test with respect to empirical data). For example, the model expressing the idea that "Water is boiling because the stove is hot" formalizes that the variable for water listens to the variable for stove, and so that if stove = hot, then water = boiling. This is as far as causal inference goes. The aim of teleological inference is instead to identify a means-ends relationship within a causal model, that is, an association between an action and some intended effects. The aim is therefore to formalize and put to the test an assertion like "The stove is hot in order to make water boil." It would be a mistake to think that actions operate under some sort of backwards causation (see Faye 2001). The stove does not "listen" to the water (hot water does not turn the stove on by itself), causation goes in one direction and cannot be reversed. However, the observation stove = hot and the action do(stove = hot), turning the stove on and so assigning the value hot to the variable stove, are not the same thing and have to be treated differently, as Pearl has shown. It is exactly the difference between a variable X and an intervention do(X) over it, which we use here to model actions on top of causal assumptions. In fact, an intervention do(X) cannot be represented within a causal model, as it does not stand for a variable X but for an operation on the causal model including the variable X, arbitrarily assigning a value to it. If I turn the stove on arbitrarily, at random times, I am isolating the stove from its causes, i.e. from the other events determining its on or off status within a causal system (such as the times of lunch and dinner, the day of the week, etc.). This is why it is correct to write that do(stove) "listens" to water. The action affecting the stove is done in order to have a causal impact on the water, respecting the direction going from cause (the stove) to effect (water). We are suggesting therefore to give two different interpretations to the "listening" metaphor, the first causal (proposed by Pearl), and the second teleological (inspired by Anscombe). Events "listen" to their causes, while actions "listen" to some of their effects. This "listening" relationship is anyway the aim of modeling and explanation. We clarified that do(stove) "listens" to water is not the same thing as stove "listens" to water. It is important to notice that interpreting actions depends on the correct recognition of a grounding causal relationship, in this case that water listens to stove. It is thanks to the causal assumptions grounding action that intention can be identified from causal models and data. Starting with a causal model which describes the relationships of cause and effect among variables, then observable correlation can become evidence for or against teleological hypotheses. The agent turns on the stove only if she believes that her action will have the effect of making the water boil. And her intention can be understood by us only if we refer to the same causal model, in which the stove is the cause and water the effect. In fact, if the agent didn't want to boil water, she would not have turned the stove on, independently from the other effects of her behavior. This last sentence is what needs to be operationalized to validate teleological inferences.

Confounding effects and the "fundamental problem" of teleological inference

Confounding causes are what has to be excluded by causal inference in order to identify causal models. In fact, some observable correlation between two variables A and B may not be due to a causal relationship between the two, but to a third variable C which is a common cause of both (Reichenbach 1956). For example, I may observe that education and salary are positively correlated, and guess that the first is a cause of the second, but actually there is a third variable (let's say family status) which causes both education and salary, leaving little variation still to be explained. If I artificially cancel out the impact of family status on education, I am assigning values to education independently of its causes, as if I was performing the action do(education) and observing whether or not my value assignments are correlated with the observable values of the variable salary. In fact, in order to explain the correlation of education and salary causally, I need to make sure it is not due to any common cause and so, specifically to this model, that the values of education do not depend on family status. Were I to perform an imaginary randomized experiment, I could take subjects at random from different family backgrounds and force them to diverse educational paths, observing how much they end up earning years later. This kind of action is what is called intervention by Pearl, and in certain conditions it can be simulated with purely observational data, without the need to perform randomized experiments. Figure 3 shows this causal graph with one variable tagged so to express that its value is assigned by an intervention. Several strategies have been developed to control for confounding causes in observational data. For example, in order to test whether education has an effect on salary, I may isolate the impact of family by stratifying families according to their status and check in each stratum whether I keep observing a correlation between education and salary. If the correlation is still there, I can conclude that my causal hypothesis linking education to salary resists a tentative falsification made by taking into account family status. The fact that my hypothesis has endured falsification makes it more probably true (McElreath 2020); as a matter of fact, causal models are a way to make potential confounding variables explicit, in order to find ways to control for them, resulting in causal knowledge based on explicit assumptions. Let us imagine a slightly more complex causal model, and let's assume that this model represents well (to the best of our knowledge) the cause-effect relationships among its variables. The variables in the model are sport practice, which causes one to lose weight, which in turn causes one to be fit, which finally causes one to live longer; there is also a fifth variable win medals which is directly caused by sport practice. On the basis of this causal model, we can formulate several teleological hypotheses, among which the one asserting that sport practice is done in order to be fit. Let us show our teleological hypothesis on a causal graph by tagging sport practice with the do() tag, and be fit with the intend() tag. This latter operator is used to highlight those effects that we believe are intended by the agent when performing the action tagged with do(). The tagged causal graph is shown in Figure 4. Inferring intentions is somehow harder than inferring causes because of something that may be called the "fundamental problem" of teleological inference: among all the effects caused by the event A, only some are intended by the action do(A). So even if we knew all the correct causal relationships involving the variable A, it would still not be possible to guess which effects of do(A) are intended, given that all the effects of A co-occur. Practicing sport makes you lose weight, and at the same time makes you fit, and at the same time makes you live longer, and at the same time makes you win medals. Given that all these effects follow from the same cause, how is it possible to discern the ones which were intended by the agent? Whenever one makes a teleological inference about somebody else's intention, there is the risk of missing the intended effects, or of mistaking other effects for intended. The effects which co-occur with the intended ones, but are not intended, could be called confounding effects, as they are the reason why teleological inference may fail. For example, I may make the hypothesis that agents practice sport in order to be fit, but instead they actually do it in order to win medals. The aim of model based teleological inference is to exclude confounding effects and identify a means-ends relationship, for example that the intended effect of practicing sport is to be fit, despite the fact that sport makes you also win medals. If we go back to Figure 4 and our model about the effects of sport practice, we can observe that there are three kinds of potential confounding effects. Let us remember that our hypothesis is that sport is done in order to be fit, so the variable be fit is the intended effect we are aiming to identify. First, there are further effects that may be the actually intended ones: people may practice sport in order to live longer, and not really in order to be fit. Our teleological hypothesis would be "too short," so to speak, and it should have aimed further in the causal chain of effects produced by action, as the true intended effect is a descendent in the causal graph of the one we initially guessed. Second, we should check for mediating effects: one may practice sport in order to lose weight, and not really to become fit. Our hypothesis about the agent's intention would therefore go "too far," and miss the real end, that lays between the action and our guessed intended effect. Third, we need to exclude parallel effects: sport could be done in order to win medals, independently of the fact that athletes also lose weight, are fit and live longer. The effect be fit that we thought was the intended one, would lay in a different branch of the causal graph with respect to the real one.

Interfering with confounding effects

How can we control for confounding effects, and become more confident of our teleological hypothesis? What we need is a special kind of intervention, which could be called interference. In causal inference, intervention is about controlling for potential confounding causes; interference is instead a way to control for potential confounding effects. How can I be sure that sport is not practiced in order to win medals? For example, I can forbid athletes to enroll in competitions, and then observe whether they keep practicing sport anyway. If they do, with the same frequency as before my interference, this is evidence that winning medals wasn't one of the reasons for sport practice; otherwise, this shows that the action do(practice sport) was actually listening to its effect winning medals, and so that winning medals should be accounted among the reasons for action. Interference is a sort of intervention based on the assumption that one variable in the causal model is an action "listening to" some of its effects; the effects of such action are interfered with, and then the values of the action are observed. If I prevent athletes from winning medals, I expect to observe a significant reduction in their sport practice only if I assume that practicing sport (cause) is an action oriented towards the end of winning medals (effect). This clearly goes beyond causal inference. In fact, an ordinary intervention would prevent people from practicing sport (cause) and observe whether they win less medals (effect). This would provide evidence for the causal relationship between sport and medals, but would say nothing about the ends of sport practice. Interference can be realized via a randomized experiment. I could separate athletes in two groups and forbid the first to enroll in competitions. Any significant change in sport practice between the two groups can then be interpreted as evidence for the teleological hypothesis that sport is done in order to win medals. Is this a causal experiment? It cannot be: as a matter of fact, practicing sport makes you win medals, and not the other way around. An honest causal experiment would discover very quickly that people who do not practice sport never win medals. Instead, we aim at controlling experimentally for one of the effects of practicing sport, which is definitely not how causal research should be conducted. One may think that somehow the relationship going from winning medals to practicing sport, if real, must be causal, but this is bad reasoning. Such fallacy becomes immediately evident if we go back to our simpler causal model in which hot stoves cause the pots of water on them to boil: there is no way that boiling water turns the stoves on by itself; and still, if I prevent people from obtaining cold water to cook with (or if I isolate thermally the pot from the stove), they will not turn the stoves on for no reason, and I will observe that the stoves remain off. So I can experimentally produce a significant impact in a cause (stoves) by interfering with some of its effects (water), as long as the interfered effect was really among the ones intended by the agent when intervening on the cause. This is how teleological inference can be identified starting from a causal model and data. Can we control for the effects of an action without realizing randomized experiments? Observational data can become evidence for teleological inference under certain conditions. In our example, we need data about people who enroll in competitions and people who do not. We also need to understand which variables have to be balanced (see [START_REF] Hernan | Causal Inference[END_REF]) so as to simulate most exactly as possible the results of a randomized experiment.

In fact, what we need evidence for is the relationships between do(practice sport) and win medals. Therefore, we have to assume that sport practice is an action, and we should make sure that the data collected about sport practice approximate those that could be collected about do(sport practice). Practically, this means to control for all the causes of sport practice in our causal model, which are also causes of winning medals. For example, it may very well be that age is a confounding cause of practicing sport and of winning medals; any inference would therefore be biased if it didn't take this information into account and control for it. However, as long as the values of practicing sport are independent from its causes (that is, approximately assigned at random), interfering with its effects has teleological value. We stated above that there are three kinds of potential confounding effects: further effects, mediating effects and parallel effects. The model shown in Figure 5 exemplifies the three kinds and includes the variables about which we need data as evidence for or against the teleological hypothesis that sport is done in order to be fit and so that do(practice sport) "listens to" be fit. Parallel effects and further effects are controlled for in an analogous fashion: we need to interfere with them and observe if the agents keep performing the action with the same frequency. In our example, we may forbid the persons in our sample to enroll in competitions, so as to interfere with win medals, and we may force them to smoke, so as to interfere with live longer. If our hypothesis intend(be fit) is correct, we expect no significant change after our interference. Tables 1 and2 show the data that we need to observe as evidence for our hypothesis; the variables are simplified as binary variables which can only take the values 0 or 1.

Practice sport

Lose If we observe that enroll in competition = 0 co-occurs with practice sport = 1, our teleological hypothesis that the intended effect of practicing sport is to be fit grows stronger, because we can exclude that people do sport for winning medals; similarly, if we observe together smoke = 1 and practice sport = 1, we can exclude that sport is done for living longer.

Controlling for mediating effects is a little more subtle, but not more complicated. In fact, we cannot control for a mediator, as this would result in controlling also for its effects, among which lays the one we believe is intended (see [START_REF] Pearl | Causal Inference: A Primer[END_REF]. If I prevent people from losing weight, they cannot become fit either, given that losing weight is the way by which people become fit according to our simple causal model. However, we can control for the intended effect itself: if after doing it we observe any significant change in the action, we have proof that our hypothesis was correct; otherwise, we know that the supposedly intended effect wasn't the actual end of action, and we should look at effects which mediate between it and the action. We could prevent people from getting fit by imposing a strict no protein diet; this means that people who practice sport still lose weight, but they do not become fit anymore. If our hypothesis intend(be fit) is correct, we expect people to stop practicing sport under these conditions. If instead they keep practicing it, despite our interference, this means that be fit and all of its descendents in the causal graph weren't the actual reason for action. Table 3 shows the data that we need not to observe if our hypothesis is correct.

Practice sport Lose weight Be fit No protein diet 1 1 0 0

Conclusion

Intentions play an important role within the human, social and psychological sciences-possibly a role which is as important as that of causes. Until now however this concept lacked operationalization. We have shown that intentions can be inferred from a causal model and data, if we define them counterfactually within a probabilistic framework. Intentions, like causes, cannot be seen or measured, but a counterfactual approach and causal models are able to turn data into causal or teleological evidence. Humans perform teleological inferences all the time: we simply know if the person next to us has a knife in his hand to spread the jam or instead to draw blood. We know this, not because we magically get into other people's minds, but because we observe the effects of their actions and understand how they control for them. Still, our intuitive teleological inferences are like our intuitive causal inferences: they may very well be biased. Causal research has opened a way to operationalize a probabilistic and counterfactual concept of causality, which permits today to express and validate precise causal statements from data. The present work aims at opening an analogous possibility for teleological inference, based on the framework and results of causal research, but going beyond them as intentions are not causes and cannot be modeled as such.

Causal research already makes use of interventions, which can be easily extended to inquiry about their intended and unintended effects. What we call the "fundamental problem" of teleological inference shows why causal and teleological inference are necessarily distinct, and the present paper aims to ground strategies to overcome this problem. Particularly, we have seen how to control for the three kinds of potential confounding effects which may make teleological inference fail.

Figure 1 :

 1 Figure 1: A very simple causal graph

Figure 4 :

 4 Figure 4: A causal graph with one intervention tagged with do()

Figure 4 :

 4 Figure 4: A more complex causal graph tagged with do() and intend()

Figure 5 :

 5 Figure 5: Variables needed to control for the three potential confounding effects in the model

Table 1 :

 1 What we need observing to exclude win medals as potential confounding effect

		weight	Be fit	Win medals	Enroll in
					competitions
	1	1	1	0	0
	Practice sport	Lose weight	Be fit	Live longer	Smoke
	1	1	1	0	1

Table 2 :

 2 What we need observing to exclude live longer as potential confounding effect

Table 3 :

 3 What we need not observing to exclude lose weight as potential confounding effect

Anscombe has opened the way for the analytical philosophy of action and intention(Davidson 1963[START_REF] Wright | Explanation and Understanding[END_REF][START_REF] Bratman | Intention, Plans, and Practical Reason[END_REF], Dennett 1989; see Setiya

2018, Glasscock and[START_REF] Glasscock | Action[END_REF].


Romane Dubus

Anke M Brock

Wendy E 2024 Mackay

Developing a Design Space for Critiquing Autopilot Interfaces Espace de Conception et Analyse Critique des Interfaces de Pilote Automatique

Keywords: CCS Concepts:, Human-centered computing → User interface design Design Space, Autopilot, Situation Awareness, Cockpit, Aviation Espace de conception, Pilote Automatique, Conscience de la Situation, Cockpit, Aviation

Autopilot interfaces are designed to help aircrews maintain awareness about the aircraft's current automation mode, the lack of which can lead to fatal accidents. However, even though researchers have identified multiple design flaws, cockpit designs remain largely unchanged. We first review the research literature on autopilot design, with a special emphasis on addressing mode awareness in order to create a design space that characterizes autopilot interfaces. We next follow a generative design approach that analyzes and critiques three existing commercial autopilot interfaces with respect to this design space so as to identify their gaps and limitations.

We then extend the design space to include additional design dimensions and conclude by suggesting directions for improving future autopilots.

Les interfaces de pilotage automatique sont conçues pour aider l'équipage à rester conscients du comportement de l'avion, car un manque de cette conscience peut entraîner des accidents graves. Malgré l'identification de défauts de conception, leurs interfaces restent largement inchangées. Nous passons d'abord en revue les travaux de la littérature sur les conceptions de pilotes automatiques afin de créer un espace de conception qui les caractérise. Notre approche de conception générative a guidé l'analyse et la critique de trois cockpits commerciaux existants, conduisant à l'identification de leurs limites. Enfin, nous avons étendu le design space avec de nouvelles dimensions, suggérant ainsi des directions futures pour la conception des interfaces d'autopilotage.

INTRODUCTION

Increasing cockpit automation has brought about a notable shift in pilots' roles, transforming them into system supervisors who monitor automated flight modes rather than operators who perform tasks manually [START_REF] Schmidt | Intervention user interfaces: a new interaction paradigm for automated systems[END_REF]. This shift in responsibilities has taken the aircrew "out of the loop" [START_REF] Endsley | Situation Awareness in Aviation Systems[END_REF], prompting concerns about pilots' situation awareness in general and mode awareness in particular. Endsley [28, p.97] defines "Situation awareness" as "the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning, and the projection of their status in the near future". Mumaw [51,p.1]" defines "mode awareness" as "the knowledge and understanding of the current and future state and behavior of the automation. " 2024. Manuscript submitted to ACM Norman [START_REF] Donald A Norman | The 'problem'with automation: inappropriate feedback and interaction, not 'over-automation[END_REF] explains that automated systems often lack feedback and argues that inappropriate design increases the risk of human error. Other researchers have identified multiple autopilot interface design flaws, such as ambiguity as to which knob to use [START_REF] Renwick | The introduction of new cockpit technology: A human factors study[END_REF]; lack of feedback about indirect mode changes; and flight deck errors such as simultaneous use of control input or selecting the wrong mode [START_REF]Advanced technology aircraft safety survey report[END_REF][START_REF] Earl | Human factors in cockpit automation: A field study of flight crew transition[END_REF]. Misinterpretation of autopilot behavior -mode confusionhas contributed to multiple fatal accidents [START_REF]Accident survenu le 20 janvier 1992 près du Mont Sainte-Odile (Bas Rhin) à l'Airbus A 320 immatriculé F-GGED exploité par la compagnie Air Inter[END_REF][START_REF] Endsley | Situation Awareness in Aviation Systems[END_REF][START_REF] Eric | Experimental study of vertical flight path mode awareness[END_REF][START_REF] Randall | Plan B for Eliminating Mode Confusion: An Interpreter Display[END_REF][START_REF] Palmer | Oops, it didn't arm-a case study of two automation surprises[END_REF][START_REF] Sathya | Divergence Between Flight Crew Mental Model and Aircraft System State in Auto-Throttle Mode Confusion Accident and Incident Cases[END_REF] and raises concerns about aviation safety. Over the past several decades, aircraft manufacturers have implemented minor revisions to address some of these issues, such as the redesign of the vertical speed target after the Air Inter Flight 148 crash [START_REF]Accident survenu le 20 janvier 1992 près du Mont Sainte-Odile (Bas Rhin) à l'Airbus A 320 immatriculé F-GGED exploité par la compagnie Air Inter[END_REF][START_REF] Eric | Experimental study of vertical flight path mode awareness[END_REF].

Despite demonstrated problems with autopilot interfaces, the aviation industry usually treats human error as a training issue rather than as a reflection of underlying design flaws [START_REF] Andrew | Certification for civil flight decks and the human-computer interface[END_REF]. This is not altogether surprising given the high cost of overhauling an established system which would not only be expensive financially, but would also require a complex certification process and extensive additional pilot training. As consequence, airlines prioritize adjustments to training and procedures [START_REF] Andrew | Certification for civil flight decks and the human-computer interface[END_REF][START_REF] Sanjay | Analysis of complexity evolution management and human performance issues in commercial aircraft automation systems[END_REF][START_REF] Wise | Human Factors Certification in Civil Aircraft[END_REF] instead of explicitly redesigning the interface to reduce pilot error, and few believe that a major cockpit redesign is likely in the near future [START_REF] Baxter | Cognitive mismatches in the cockpit: Will they ever be a thing of the past?[END_REF][START_REF] Randall | Plan B for Eliminating Mode Confusion: An Interpreter Display[END_REF][START_REF] Randall J Mumaw | Analysis of pilots' monitoring and performance on an automated flight deck[END_REF]. Instead, new technologies have been introduced gradually, where tinkering with the existing system [START_REF] Sherry | Design of a Display for Alerting Cockpit Automation Function Configuration Changes[END_REF][START_REF] Sherry | Design of Cockpit displays to explicitly support flight crew intervention tasks[END_REF] has turned the flight deck into "a tower of babel" [35, p.11].

Unfortunately, hiding the introduction of a new technology in order to adhere to an older design can lead to disaster, as evidenced by the two Boeing 737 MAX crashes where pilots were unable to respond to a faulty stall protection system [START_REF]Investigation Report On Accident to the B737-MAX8 Reg. Et-Avj Operated By Ethiopian Airlines[END_REF][START_REF] Jamieson | The B737 MAX 8 Accidents as Operational Experiences With Automation Transparency[END_REF][START_REF]Aircraft Accident Investigation Report[END_REF].

This paper argues that we need to explore new ways of interacting with autopilot systems to improve the safety of commercial aircraft. We first provide background about autopilot interfaces in current flight decks and describe three strategies for increasing situation awareness. We next summarize the literature on autopilot interfaces into a design space with proposed solutions for increasing mode awareness, with three key dimensions: Touch, Vision and Space.

We use a generative approach to analyze and critique three existing commercial autopilot interfaces and identify five gaps where technology suggested by the literature is not available in current commercial flight decks. We also identify two additional elements -pictorial information and co-location of control and feedback -that would benefit these interfaces. We extend the design space so that it includes Audition and Time dimensions and identify directions for future flight decks.

BACKGROUND AND RELATED WORK

Existing autopilot interfaces

An autoflight system consists of multiple subsystems that help to automatically manage the flight path. This paper focuses on the autopilot, a short-term mode management system composed of a mode controller and a mode annunciator.

The FCU (Flight Control Unit) 1 allows pilots to control or delegate flight path management. The pilot uses FCU buttons and knobs to choose the desired flight control mode. Basic modes simply follow a target, such as speed, heading, altitude and vertical speed. Advanced modes follow lateral and vertical flight path constraints, thus providing the highest level of automatic control. A separate system, the FMA (Flight Mode Annunciator), displays the autopilot's current state, e.g., the authority, as well as altitude, heading, and airspeed targets. The FCU and FMA are located in separate areas in current cockpits (Fig. 1).

Three major solutions for improving mode awareness

The research literature proposes three major solutions for improving awareness and reducing pilots' misunderstandings of aircraft behavior: improved procedures [START_REF] Sanjay | Analysis of complexity evolution management and human performance issues in commercial aircraft automation systems[END_REF][START_REF] Sanjay | Approaches to mitigating complexity-driven issues in commercial autoflight systems[END_REF], enhanced training [START_REF] Eric | Experimental study of vertical flight path mode awareness[END_REF][START_REF] David | Human Error in Aviation Operations[END_REF][START_REF] Earl | Human factors of advanced technology (glass cockpit) transport aircraft[END_REF] and better interface design [START_REF] Donald A Norman | The 'problem'with automation: inappropriate feedback and interaction, not 'over-automation[END_REF].

Improved procedures.

Pilots learn a set of procedures that encourage their active engagement during flight, not necessarily by manually manipulating the controls, but rather by "mentally flying" the aircraft whenever an automated system or co-pilot is in control. This lets the pilot anticipate FMA changes before they occur, rather than simply reacting to changes as they happen [START_REF] Sumwalt | Examining how breakdowns in pilot monitoring of the aircraft flight path[END_REF]. These clear, consistent procedures reduce the likelihood of confusion and offer pilots standardized sets of steps that help them avoid dangerous action sequences [START_REF] Donald A Norman | The 'problem'with automation: inappropriate feedback and interaction, not 'over-automation[END_REF][START_REF] Sathya | Divergence Between Flight Crew Mental Model and Aircraft System State in Auto-Throttle Mode Confusion Accident and Incident Cases[END_REF][START_REF] Sanjay | Analysis of complexity evolution management and human performance issues in commercial aircraft automation systems[END_REF].

Unfortunately, reducing pilots' active involvement in flying the aircraft sometimes reduces their ability to identify and react in abnormal situations. Studies have shown that pilots sometimes deviate from established procedures and develop diverse personal strategies for understanding what the automation is doing [START_REF] Björklund | Mode monitoring and call-outs: An eye-tracking study of two-crew automated flight deck operations[END_REF], especially when procedures are illogical or inconsistent [START_REF] Degani | On the design of flight-deck procedures[END_REF]. Roessingh et al. [START_REF] Jjm Roessingh | Training for the'glass cockpit'-Trends, problems and solutions[END_REF] found that airlines use aircraft differently from how they were originally designed, both when they prescribe using automation and when they leave these choices to the discretion of the crew. A survey by Mitchell et al. [START_REF] Mitchell | Flying glass: A qualitative analysis of pilot perceptions of automated flight-decks after 20 years[END_REF] reported that pilots basically favor using Standard Operating Procedures (SOPs) but do not agree with some aspects of the airlines' and the aircraft manufacturers' strategies. This suggests that establishing new mode control procedures may not fully solve the lack of mode awareness in the FMA and FCU. Even if the procedures are very well designed, pilots may still omit, misinterpret or forget steps, especially in high-stress situations. Procedures are only effective when pilots follow them, which requires extensive training and regular practice. and behavior [START_REF] Billings | Aviation automation : the search for a human-centered approach[END_REF][START_REF] Endsley | Situation Awareness in Aviation Systems[END_REF][START_REF] Randall J Mumaw | Analysis of pilots' monitoring and performance on an automated flight deck[END_REF][START_REF] Naidoo | Airline pilots' perceptions of advanced flight deck automation[END_REF][START_REF] Nadine | Pilot interaction with cockpit automation: Operational experiences with the flight management system[END_REF][START_REF] Sherry | What's it doing now? Taking the covers off autopilot behavior[END_REF][START_REF] Sathya | Divergence Between Flight Crew Mental Model and Aircraft System State in Auto-Throttle Mode Confusion Accident and Incident Cases[END_REF]. Soo et al [START_REF] Kim | Mastering Automation: New Airline Pilots' Perspective[END_REF]'s study of pilot learning revealed gaps in their knowledge of automation functionality due to lack of practice and inadequate understanding of how the automated systems work, made worse with long breaks between learning and practice. Pilots need better representations of the underlying functionality of automated systems to allow them to cope with non-standard situations [START_REF] Sarter | The flight management system-pilots' interaction with cockpit automation[END_REF]. Several studies suggest that letting pilots practice nonstandard tasks and explore more diverse scenarios will increase their ability to handle unexpected situations [START_REF] Katherine | Why did the pilots shut down the wrong engine? Explaining errors in context using Schema Theory and the Perceptual Cycle Model[END_REF][START_REF] Nadine | Pilot interaction with cockpit automation: Operational experiences with the flight management system[END_REF][START_REF] Nadine | Team play with a powerful and independent agent: A full-mission simulation study[END_REF][START_REF] Christopher | Designing for situation awareness and trust in automation[END_REF]. For example, Sarter and Woods [START_REF] Nadine | Pilot interaction with cockpit automation: Operational experiences with the flight management system[END_REF] encourage pilots to explicitly learn from surprises experienced by themselves or other pilots.

However, while high-quality training is essential, it cannot address all problems. First, pilot training is already extremely time-consuming and expensive and small airlines that lack the resources and finances of major airlines cannot easily extend their training programs. This poses a challenge for implementing solutions that do not penalize airlines with more limited training resources.

Better interface design.

Pilots sometimes lack sufficient information to accurately track the state of the automation [START_REF] Donald A Norman | The 'problem'with automation: inappropriate feedback and interaction, not 'over-automation[END_REF] and do not always have the resources to resolve technological failures. Wickens argues that poor situation awareness may "result from deficient display design that fails to provide effective feedback regarding how automation is carrying out its tasks [100, p.368]".

Some researchers suggest that co-locating information and feedback will increase the pilots' situation and mode awareness [START_REF] Horn | Human-Centered Design of Flight Mode Annunciation for Instantaneous Mode Awareness[END_REF][START_REF] Edwin | The Integrated Mode Management Interface[END_REF][START_REF] Li | The Evaluation of Pilot's Situational Awareness During Mode Changes on Flight Mode Annunciators[END_REF][START_REF] Rouwhorst | Use of touch screen display applications for aircraft flight control[END_REF][START_REF] Christopher | Designing for situation awareness and trust in automation[END_REF]. Boorman et al. [START_REF] Daniel J Boorman | A new autoflight/FMS interface: Guiding design principles[END_REF] suggest that presenting automation more simply and clearly will not only improve understanding but also make it easier for pilots to select the optimal automation options [START_REF] Christopher | Designing for situation awareness and trust in automation[END_REF]. Interfaces should also present more useful feedback about the state of the aircraft [START_REF] Sanjay | Development and evaluation of an electronic vertical situation display[END_REF], including better interpretation of the modes [START_REF] Feary | Aiding vertical guidance understanding[END_REF][START_REF] Edwin | The Integrated Mode Management Interface[END_REF][START_REF] Steven P Miller | A methodology for improving mode awareness in flight guidance design[END_REF][START_REF] Randall | Plan B for Eliminating Mode Confusion: An Interpreter Display[END_REF][START_REF] Joseph | Improving situational awareness through the use of intuitive pictorial displays[END_REF][START_REF] Riley | The cockpit control language: A pilot-centered avionics interface[END_REF][START_REF] Sherry | What's it doing now? Taking the covers off autopilot behavior[END_REF][START_REF] Sherry | Design of Cockpit displays to explicitly support flight crew intervention tasks[END_REF][START_REF] Stokes | Chapter 12 -Aviation Displays[END_REF][START_REF] Jaap Jan Van Den | An experimental comparison of alphanumeric and iconic formats of the Flight Mode Annunciator[END_REF] and more salient indicators of the aircraft behavior [START_REF] Mark | Peripheral visual feedback: A powerful means of supporting effective attention allocation in event-driven, data-rich environments[END_REF][START_REF] Palmer | Oops, it didn't arm-a case study of two automation surprises[END_REF].

Other researchers recommend distributing information across multiple modalities. Both auditory and tactile stimuli can capture the pilot's attention without necessarily interfering with their visual focus on primary tasks [START_REF] Sarter | The need for multisensory interfaces in support of effective attention allocation in highly dynamic event-driven domains: the case of cockpit automation[END_REF][START_REF] Sathya | Divergence Between Flight Crew Mental Model and Aircraft System State in Auto-Throttle Mode Confusion Accident and Incident Cases[END_REF]. For example, Sarter et al. [START_REF] Sarter | Modern flight deck automation: Pilots' mental model and monitoring patterns and performance[END_REF] suggest using vibrotactile feedback [START_REF] Vo | Tactilient: Turbulence Resilient Tactile Icons for Pilot Feedback[END_REF] to convey additional information.

However, incorporating additional feedback risks increasing the complexity of the cockpit display, transforming it into yet another element to monitor. The problems increase when the pilot must interpret multiple, poorly integrated automated systems that address different subtasks. Although adding feedback can be beneficial, implementation details matter. The challenge is to avoid introducing new sources of confusion or higher cognitive workload [START_REF] Mcbride | Understanding human management of automation errors[END_REF].

Although the goal of adding automation is to reduce the pilots' workload, cognitive load actually increases when the pilot's mental model does not match the aircrafts' current behavior, or when information does not appear in an obvious and timely manner [START_REF] Baxter | The Ironies of Automation: Still Going Strong at 30?[END_REF]. Suggestions for improving cockpit designs include reducing automation complexity [START_REF] Pritchett | Aviation automation: General perspectives and specific guidance for the design of modes and alerts[END_REF], limiting the number of options, and reducing interaction to a small set of behaviors [START_REF] Sanjay | Analysis of complexity evolution management and human performance issues in commercial aircraft automation systems[END_REF]. Lintern et al. [START_REF] Lintern | Functional interface design for the modern aircraft cockpit[END_REF] argue that human performance problems created by Glass Cockpits -modern cockpits in which analog mechanical instruments are replaced by electronic displays -are not an inevitable consequence of increased hardware complexity or of automation but, rather, are the result of nonfunctional design that increases complexity in the cockpit interface. This research suggests that reassessing the design of cockpit instruments has the potential to significantly improve aviation safety.

In summary, we argue that the time has come to re-evaluate the entire flight ecosystem. Most cockpit interfaces were designed before the introduction of automation and, despite major changes in functionality, few have been upgraded to support the newly created monitoring tasks [START_REF] Sherry | Design of Cockpit displays to explicitly support flight crew intervention tasks[END_REF]. Aircraft manufacturers have even explicitly hidden new automation functionality from pilots because they did not want to incur additional training costs associated with learning a new interface [START_REF] Jamieson | The B737 MAX 8 Accidents as Operational Experiences With Automation Transparency[END_REF]. In the long term, aircraft are likely to undergo further waves of new automation, with corresponding opportunities for redesigning cockpit interfaces to match. Although a radical overhaul of the cockpit is unlikely in the short term [START_REF] Baxter | Cognitive mismatches in the cockpit: Will they ever be a thing of the past?[END_REF][START_REF] Randall | Plan B for Eliminating Mode Confusion: An Interpreter Display[END_REF][START_REF] Randall J Mumaw | Analysis of pilots' monitoring and performance on an automated flight deck[END_REF], the transition from analog cockpits to Glass Cockpits demonstrates the feasibility of modifying cockpit designs, provided that the changes offer measurable improvements in safety.

A DESIGN SPACE FOR AUTOPILOT INTERFACES

The main goal of the autopilot interfaces is to control autopilot modes (input) and provide information about the aircraft's behavior (output). We thus introduce a design space that encompasses both input and output to serve as a framework for exploring new cockpit designs (see Fig. 2). We began by selecting research papers about cockpit mode awareness, especially those that address concepts and approaches related to autopilot interfaces. We used an inductive approach [START_REF] Braun | Thematic analysis[END_REF] to identify three key design dimensions: Touch , Vision and Space .

Fig. 2. The Autopilot Interface Design Space is grounded on the literature and existing cockpits along three principal dimensions, Touch, Vision, Space, that are divided into categories. Some categories may contain multiple elements, such as a tangible interface that uses a touchscreen.

Touch. The first dimension relates to

Tactile Input with Mode Control Philosophy and Haptic Feedback .

Tactile Input approaches include tangible, touchscreen, or hybrid combination of both.

Modern "Glass Cockpits" provide physical tangible controllers -knobs, switches and buttons [START_REF] Vinot | Could Tangibility Improve the Safety of Touch-Based Interaction? Exploring a New Physical Design Space for Pilot-System Interfaces[END_REF] -for interacting with flight data. For example, Boorman et al. [START_REF] Daniel J Boorman | A new autoflight/FMS interface: Guiding design principles[END_REF] developed a novel autopilot design that lets pilots select targets by turning and pushing knobs. Schutte et al.'s [START_REF] Schutte | Towards an improved pilot-vehicle interface for highly automated aircraft: evaluation of the haptic flight control system[END_REF] Haptic-Multimodal Flight Control uses sticks and throttles as physical controllers to point and "shoot" at various targets.

Emerging avionics concepts are replacing traditional cockpit devices with touchscreens. This transition offers several advantages such as direct manipulation, control performance that could be superior to physical instruments [START_REF] Alapetite | Direct tactile manipulation of the flight plan in a modern aircraft cockpit[END_REF][START_REF] Avsar | Designing touch screen user interfaces for future flight deck operations[END_REF], and the flexibility in the positioning of instruments and controls [START_REF] Albinsson | High Precision Touch Screen Interaction[END_REF][START_REF] Kaminani | Human computer interaction issues with touch screen interfaces in the flight deck[END_REF]. While touchscreen technology has potential, some studies have shown mixed results regarding its impact. For example, a study by Rouwhorst et al. [START_REF] Rouwhorst | Use of touch screen display applications for aircraft flight control[END_REF] introduced a touchscreen control panel for mode selection, but the system did not reduce workload or enhance situation awareness in a statistically significant manner and this worsening effect was aggravated under severe turbulence. In fact, touchscreens are being introduced relatively slowly into the cockpits of commercial aircraft, mainly because of the safety issues associated with use in adverse turbulent conditions [START_REF] Cantu | Does Folding Improve the Usability of Interactive Surfaces in Future Airliner Cockpits An Evaluation under Turbulent Conditions and Varying Cognitive Load[END_REF] that impact the accurate interaction with touch-based interfaces, potentially leading to unintended inputs or errors [START_REF] Cantu | Does Folding Improve the Usability of Interactive Surfaces in Future Airliner Cockpits An Evaluation under Turbulent Conditions and Varying Cognitive Load[END_REF][START_REF] Cockburn | Turbulent Touch: Touchscreen Input for Cockpit Flight Displays[END_REF][START_REF] Dodd | Touch Screens on the Flight Deck: The Impact of Touch Target Size, Spacing, Touch Technology and Turbulence on Pilot Performance[END_REF].

By combining tangible and touch features, interfaces can counteract the negative effects of turbulence by offering appropriate solutions [START_REF] Edwin | The Integrated Mode Management Interface[END_REF][START_REF] Pauchet | GazeForm: Dynamic Gaze-Adaptive Touch Surface for Eyes-Free Interaction in Airliner Cockpits[END_REF][START_REF] Pauchet | Multi-Plié: A Linear Foldable and Flattenable Interactive Display to Support Efficiency, Safety and Collaboration[END_REF]. Hutchins [START_REF] Edwin | The Integrated Mode Management Interface[END_REF] presented a graphical interface for autopilot mode management systems.

Targets values are set by manipulating physical knobs and modes are selected by touching icons that represent the desired mode. Pauchet et al. [START_REF] Pauchet | GazeForm: Dynamic Gaze-Adaptive Touch Surface for Eyes-Free Interaction in Airliner Cockpits[END_REF] introduced GazeForm, a system that acts as a touchscreen when users' eyes are focused on interaction, but which dynamically transforms into a physical control that emerges when the user's gaze shifts away from the touch interaction area. The results of their user study demonstrated that GazeForm generated a lower subjective mental workload and led to a higher efficiency of execution. In another study, Pauchet et al. [START_REF] Pauchet | Multi-Plié: A Linear Foldable and Flattenable Interactive Display to Support Efficiency, Safety and Collaboration[END_REF] explored a foldable interactive surface with the goal to make touch interaction in the cockpit more efficient and reliable.

Results showed that the folds helped to reduce physical effort by stabilizing the arm and hand. This physicality was also associated with better performance in the piloting task in a turbulent environment [START_REF] Cantu | Does Folding Improve the Usability of Interactive Surfaces in Future Airliner Cockpits An Evaluation under Turbulent Conditions and Varying Cognitive Load[END_REF].

Mode Control Philosophy highlights two different approaches to mode control, where each button can have a

Single mode or Multiple mode attached. Those approaches are different in terms of their operational philosophy and the level of complexity they introduce to the interface.

In the Single-mode-per-button approach, each button on the interface corresponds to a specific mode, and pressing a button directly activates the associated mode. This approach is straightforward and easy to understand, providing a clear one-to-one mapping between buttons and modes. However, it may require a larger number of buttons when numerous modes are used. Boeing's mode controller uses push buttons-or "switches"-for specific mode engagement.

A green light within the switch indicates that the buttons is activated. Likewise, IMMI's modes [START_REF] Edwin | The Integrated Mode Management Interface[END_REF] are engaged by pressing icons, and each icon represents a mode.

On the other hand, the multiple-mode-per-button approach corresponds to one input button with several possible outcomes. A first case corresponds to moded input buttons where a single action leads to different results, as the output depends on the initial state of the system [START_REF] Sherry | Alert! The Appearance of Moded Input Devices in the Modern Airliner Cockpit[END_REF]. This design has a high potential for causing confusion of pilots [START_REF] Randall | Addressing mode confusion using an interpreter display[END_REF].

The second case corresponds to a multifunction button that has several available interactions. For example, Airbus uses buttons that can be pushed or pulled [START_REF] Abbott | The interfaces between flightcrews and modern flight deck systems[END_REF]. This approach conserves space and reduces clutter, but it introduces an additional layer of complexity in mode management. Since there are different ways of interacting with the button, pilots have to remember what to do to activate the desired modes, which can lead to inadvertent entries or errors [START_REF] Abbott | The interfaces between flightcrews and modern flight deck systems[END_REF][START_REF] Ferris | Cockpit automation: Still struggling to catch up[END_REF][START_REF] Earl | Intervention strategies for the management of human error[END_REF].

Haptic Feedback presents the significant advantage of providing eye-free information and catching pilot's attention without impacting the current visual focus which could be on the instruments or exterior of the plane. Haptic

Feedback can be grounded or wearable.

Grounded haptic feedback involves system that is integrated into the aircraft's structure or controls. Some aircraft, such as the ATR 72-500, have their yoke moving when the autopilot is activated. Although this feedback can also be characterized as aural or visual, the pilot can feel the aircraft's steering actions by grabbing the yoke. The same applies to Boeing's moving auto throttles, which provide important information on thrust management. Even if the information is minimal, at least it lets the pilot know the aircraft's current behavior. Similarly, Schutte et al. proposed a flight control system that provide haptic feedback through a back-driven stick and throttle. These moving controllers allow the pilot to physically feel the aircraft's dynamic actions and understand what the automation is doing [START_REF] Schutte | Towards an improved pilot-vehicle interface for highly automated aircraft: evaluation of the haptic flight control system[END_REF].

Haptic feedback can also serve as a wearable cockpit instrument that provide information on aircraft behavior [START_REF] Van Erp | A tactile cockpit instrument supports the control of self-motion during spatial disorientation[END_REF].

Vibrotactile devices convey information such as aircraft attitude, by generating vibrating feedback directly onto the pilot's skin [START_REF] Sylvain Cardin | Vibro-tactile interface for enhancing piloting abilities during long term flight[END_REF]. Sklar and Sarter [START_REF] Aaron | Good vibrations: Tactile feedback in support of attention allocation and human-automation coordination in event-driven domains[END_REF] conducted a simulator study to determinate the effectiveness of visual, tactile and combined tactile and visual feedback in detecting and identifying uncommanded mode changes. The study compared the visual feedback of the FMA, a wrist-based vibration and a combination of both visual and tactile cues. Results showed that both the tactile-only and tactile-visual conditions led to higher detection rates and faster reaction times than visual feedback alone. While tactile-only feedback resulted in a few misidentifications, the visual-only and tactile-visual conditions consistently ensured proper identification when transitions were detected. These results are in line with a previous study [START_REF] Mark I Nikolic | Multisensory feedback in support of pilot-automation coordination: the case of uncommanded mode transitions[END_REF] that compared visual feedback with tactile feedback. A series of studies have delved into the application of tactile stimulation in the torso area. Van Erp et al. [START_REF] Van Erp | A tactile cockpit instrument supports the control of self-motion during spatial disorientation[END_REF] introduced a tactile vest made of vibrating tactors that provide information about yaw rotation and demonstrated its potential in mitigating spatial disorientation. Rupert [START_REF] Angus | An instrumentation solution for reducing spatial disorientation mishaps[END_REF] developed the Tactical Situation Awareness System (TSAS), a vest that provides orientation information to the pilot through torso tactors, and investigated the impact on pilot's situation awareness of position and orientation. In an evaluation in simulated shipboard departure, pilots reported a better situation awareness with TSAS compared to departure without it.

Vision. The visual dimension has two elements that based on the literature are relevant to describe: the Mode Representation and the Field of view for Feedback .

Mode Representation highlights two different approaches that can be used to display mode information: labels (written text) or graphic symbols.

Autopilots use labels and textual displays to indicate targets, abstract modes used by the system [START_REF] Sanjay | Development and evaluation of an electronic vertical situation display[END_REF] and describe the aircraft's behavior [START_REF] Feary | Aiding vertical guidance understanding[END_REF]. Unambiguous labels that clearly distinguish between different types of signals help the pilots quickly identify the meaning and involvement of the system [START_REF] Daniel J Boorman | A new autoflight/FMS interface: Guiding design principles[END_REF][START_REF] Mumaw | Experimental evaluation of a new autoflight interface[END_REF][START_REF] Prada | Testing Boeing's Flight Deck of the Future: A Comparison Between Current and Prototype Autoflight Panels[END_REF][START_REF] Sherry | What's it doing now? Taking the covers off autopilot behavior[END_REF]. This reduces the risk of feedback ambiguity, which can otherwise lead to a lack of understanding [START_REF] Sathya | Divergence Between Flight Crew Mental Model and Aircraft System State in Auto-Throttle Mode Confusion Accident and Incident Cases[END_REF].

An alternative approach is the use of icons or graphical representations [START_REF] Edwin | The Integrated Mode Management Interface[END_REF][START_REF] Randall | Plan B for Eliminating Mode Confusion: An Interpreter Display[END_REF][START_REF] Mark | Peripheral visual feedback: A powerful means of supporting effective attention allocation in event-driven, data-rich environments[END_REF][START_REF] Sherry | Design of Cockpit displays to explicitly support flight crew intervention tasks[END_REF]. Oliver [START_REF] Joseph | Improving situational awareness through the use of intuitive pictorial displays[END_REF] claimed that the most reliable, effective and acceptable means of increasing situational awareness is the use of intuitive pictorial displays "in which the subject matter is shown in graph or picture form, in a manner which does not require a thought process for understanding [60, p.5]". Earlier, Stokes and Wickens [START_REF] Stokes | Chapter 12 -Aviation Displays[END_REF] provided an extensive discussion of pictorial display formats and discussed about the use of monochrome or color for pictures and schematics. Both the opinion and performance data indicate that the concept of color pictorial formats is better than monochrome pictorial formats in terms of performance [START_REF] Tc Way | Pictorial format display evaluation[END_REF] and especially in high workload contexts and when the pilot had to recall information from a previously viewed format display [START_REF] Newton | Information processing load of graphic versus alphanumeric weapon format displays for advanced fighter cockpits[END_REF]. Studies also compared traditional alphanumeric formats with pictorial formats and concluded that when a higher number of modes were presented, the icon-based FMA format improved mode recall over the baseline [START_REF] Jaap Jan Van Den | An experimental comparison of alphanumeric and iconic formats of the Flight Mode Annunciator[END_REF]. Moreover, pictorial display formats outperformed alphanumeric formats at short exposure durations [START_REF] Newton | Information processing load of graphic versus alphanumeric weapon format displays for advanced fighter cockpits[END_REF]. This advantage tended to diminish with longer exposure durations. Funabiki [START_REF] Funabiki | Design of tunnel-in-the-sky display and curved trajectory[END_REF] proposed a perspective display format that help the pilot to understand the autopilot behavior thank to icons and graphical representations of the current and future trajectory and autopilot modes.

Field of view for Feedback refers to the position within the cockpit of the output that can be in the peripheral vision or in the foveal vision. We define output as any component that provides the pilot with information about the currently engaged modes. In modern cockpit configurations, this role is typically fulfilled by the FMA that plays a central role in providing this output.

The location of the FMA on top of the Primary Flight Display (PFD) (Fig. 1) is in peripheral vision most of the time due to the fact that pilots look more often at the PFD [START_REF] Huettig | Mode awareness in a modern glass cockpit[END_REF][START_REF] Randall J Mumaw | Analysis of pilots' monitoring and performance on an automated flight deck[END_REF]. However, the FMA is designed for foveal vision and so it is not salient enough to compete with other visual elements in a dynamic and data-rich context such as PFD [START_REF] Nikolic | Why onsets don't always capture attention: The importance of context in display design[END_REF][START_REF] Mark I Nikolic | Why pilots miss the green box: How display context undermines attention capture[END_REF][START_REF] Mark | Peripheral visual feedback: A powerful means of supporting effective attention allocation in event-driven, data-rich environments[END_REF].

The further away pilots' attentional focus is from the FMA, the less likely they are to notice mode changes. However, Alaman et al. [START_REF] Jonay Ramón Alamán | Attentional span of aircraft pilots: did you look at the speed?[END_REF] claimed that it is incorrect to state that pilots do not see peripheral changes while gazing on the PFD.

The authors concluded that the perceptual span of pilots expands to peripheral vision. Nikolic and Sarter [START_REF] Mark | Peripheral visual feedback: A powerful means of supporting effective attention allocation in event-driven, data-rich environments[END_REF] compared the effectiveness of current foveal feedback of the FMA and two implementations of peripheral visual feedback for keeping pilots informed about uncommanded changes in the status of an automated cockpit system. The two peripheral visual feedback types signaled a transition in a more luminous way than the current FMA feedback to capture attention more effectively. Both peripheral visual displays resulted in higher detection rates of unexpected events and faster response times, without interfering with the performance of concurrent visual tasks any more than does the current FMA.

An alternative approach is to place the feedback within the pilots' foveal vision, i.e. within the PFD. Horn et al. [START_REF] Horn | Human-Centered Design of Flight Mode Annunciation for Instantaneous Mode Awareness[END_REF] proposed to merge mode information with flight data on the PFD by adding a green box next to the different flight data if the system controls it. This approach embeds the FMA within the natural scanning pattern of pilots, ensuring that the relevant information is presented in the foveal vision, as the stimulus is applied directly to the raw data field frequently viewed by the pilots. Similarly, Sherry and Mauro [START_REF] Sherry | Design of Cockpit displays to explicitly support flight crew intervention tasks[END_REF] presented a new design to show airspeed modes on the speed tape of the PFD. Funabiki [START_REF] Funabiki | Design of tunnel-in-the-sky display and curved trajectory[END_REF] integrated a set of shapes into the PFD, describing the ideal flight path, flight information and autopilot modes.

Space. The spatial dimension has three elements that are considered relevant based on the literature: the Control distribution , the Relative position between the control and feedback, and the Feedback distribution.

Control distribution refers to the position of the input within the cockpit that controls modes and targets. The control position could be either shared or independent.

In the current flight deck, both pilots share the mode control interfaces with the autopilot, located in the middle between the two pilots, in the center of the cockpit (Fig. 1). Placing the mode control panel in a shared and centralized position allows both pilots to interact on the same system, and to observe the actions of the other pilot when using the control interface [START_REF] Bardou | Collaborative Design to Support Mutual Awareness in Single-Pilot Operation and Remote Collaboration[END_REF][START_REF] Becquet | How Do Gestures Matter for Mutual Awareness in Cockpits? Disclosing Interactions through Graphical Representations[END_REF].

Independent location refers to having the control interface in at least two different positions where each pilot has its own control interface. Interfaces can be identical or different. Barbé et al. [START_REF] Barbé | Physical Ergonomics Approach for Touch Screen Interaction in an Aircraft Cockpit[END_REF] studied physical ergonomic needs to optimize the integration of touch interaction in the future cockpit concept and found that some display locations, such as in front of the pilots, should be recommended as they require no physical effort to access them. However, this arrangement can result in errors when pilots use the interface simultaneously without communicating with each other, such as the sidesick to manually control aircraft pitch and roll, that have been used simultaneously by both pilots in the AF447 crash [START_REF] Conversy | The Accident of Flight AF447 Rio-Paris: A Case Study for HCI Research[END_REF][START_REF]Rapport final-Accident survenu le 1er juin 2009 à l'Airbus A330-203 immatriculé F-GZCP exploité par Air France[END_REF]. Rouwhorst et al. [START_REF] Rouwhorst | Use of touch screen display applications for aircraft flight control[END_REF] presented a touchscreen control panel and initially proposed placing it in front of each pilot. However, prototype design sessions revealed the need to move it into a crew-centered location, since the use of the system in real operational situations required rapid information sharing among crew members.

Relative position refers to the position of the output relative to the input, either delocated or colocated.

In the current flight deck, feedback is physically separated from the control interface. The FMA, located at the top of the PFD provides information about the modes used by the system (Fig. 1). The physical separation of the FMA from the FCU requires pilots to perform actions in one location and to verify the result in another. It may make it difficult to use the FMA information to verify the correct autopilot mode, potentially affecting pilots' situational awareness because the verification can be forgotten or omitted [START_REF] Palmer | Oops, it didn't arm-a case study of two automation surprises[END_REF]. A survey investigated problems and operational experiences during flight operations [START_REF] Nadine | Team play with a powerful and independent agent: Operational experiences and automation surprises on the Airbus A-320[END_REF]. Some pilots mentioned related problems with verifying the status and behavior of the automation, attributable to the fact that information on the status and behavior of different system components is presented across the flight deck rather than in an integrated manner in a single location.

Previous work suggests that co-locating control and feedback might improve pilot's situation awareness without adversely affecting performance [START_REF] Li | The Evaluation of Pilot's Situational Awareness During Mode Changes on Flight Mode Annunciators[END_REF]. Hutchins [START_REF] Edwin | The Integrated Mode Management Interface[END_REF] introduced the Integrated Mode Management Interface (IMMI), a novel mode controller panel designed to facilitate the composition, execution, and evaluation of mode management actions in one centralized location. Hutchins argues that colocating the depiction of mode states and the mode controls, should reduce the frequency of mode selection errors resulting from the crew's failure to notice changes indicated by the flight mode annunciator. Albinsson and Zhai emphasized that the co-location of input and output, control and feedback, hand action and eye gaze, makes touchscreens highly intuitive to use [START_REF] Albinsson | High Precision Touch Screen Interaction[END_REF].

Feedback distribution refers to the position of the output that provides information about the system's behavior.

The feedback position could be either shared or independent.

In a shared feedback configuration, the output is set so that both pilots can access it simultaneously, enabling them to share the same interface and consequently hopefully have identical mode awareness. Hutchins [START_REF] Edwin | The Integrated Mode Management Interface[END_REF] installed his autopilot mode management interface in a central position which allows pilots to share the same feedback. Mumaw [START_REF] Randall | Plan B for Eliminating Mode Confusion: An Interpreter Display[END_REF] proposed a feedback-oriented display that provides information about the state of the autopilot system. The display was shared and positioned centrally for better visibility. However, both works raise questions about the ideal placement of a new design in a cockpit already overloaded with interfaces.

In an independent feedback configuration, the output is presented in at least two different positions. Feedback may be identical or different depending on position. Pilots do not use the same interface for collecting information, and hence mode awareness might differ. This is the case on commercial aircraft, where the FMA is used for system status awareness. The same information is displayed, but each pilot has an FMA in front of him. In the literature, several studies have used PFD as a support for integrating independent and duplicated feedback designs for mode awareness [START_REF] Funabiki | Design of tunnel-in-the-sky display and curved trajectory[END_REF][START_REF] Horn | Human-Centered Design of Flight Mode Annunciation for Instantaneous Mode Awareness[END_REF][START_REF] Sherry | Design of Cockpit displays to explicitly support flight crew intervention tasks[END_REF].

GENERATIVE APPROACH TO USING THE DESIGN SPACE

We follow the generative design approach suggested by Beaudouin-Lafon et al. [START_REF] Michel Beaudouin-Lafon | Generative theories of interaction[END_REF] to first analyze three existing autopilot interfaces with respect to the design space and then critique them to identify current limitations. We then generate new design dimensions that extend the design space and identify directions for future research.

Design Space Analysis of three existing commercial cockpits

We illustrate how to apply the design space by using it to analyze the autopilot systems of the three most well-known commercial cockpits: Airbus A320, Boeing B777 and ATR 72-500. Table 1 illustrates the design configuration of each of the three systems and compares them. It outlines the major and minor design choices of each dimension, details of which are provided below. Major choices are those that define the fundamental characteristics of the system, while minor choices represent aspects that have a more limited impact on the overall use of the system. Touch. All three cockpits use tangible buttons and knobs on the FCU as Tactile Input . Pilots interact with the physical interface to select targets and engage autoflight modes. However, there are notable differences in the design of the FCU (Fig. 3).

First, the organization of the buttons is different. Airbus and Boeing use a structured layout, grouping buttons and knobs in clusters for each of the three axes -longitudinal, lateral and vertical. Each knob is located below a target display window that indicates the target only when actively in use. 2 . ATR has a less structured arrangement, with knobs on either side of the push-buttons panel. Knobs are not in an individual display window, but instead on an upper display located just above the buttons panel. The altitude is always displayed, the airspeed target is contingent on mode engagement, and the heading target is absent from this display, requiring the pilot to check somewhere else, on another screen.

Second, the design of each knob differs from one manufacturer to another, which is marked by variations in knob shape or engraving. Moreover, Boeing and ATR combine a thumb wheel and conventional knobs (potentiometers) while Airbus uses only conventional knobs.

Third, knobs on Airbus and Boeing are detented, whereas the knobs on ATR are smooth.

The three manufacturers use different Mode Control Philosophies to engage modes. Airbus uses the Multiplemode-per-button approach, while ATR and Boeing use the Single-mode-per-button approach. Airbus employs a push/pull philosophy where each knob is associated with multiple modes. In broad terms, the four knobs on the FCU (Fig. 3a) are 2

The altitude target is always displayed.

of modes, even if this is not the recommended method for maintaining mode awareness. Consequently, ATR can be characterized as having a colocated Relative position .

Critical Analysis of the Design Space

Although the three commercial cockpit designs share a common overall design configuration, they differ significantly in details such as shape and button layout. More importantly, none of these cockpits include the following design space elements: Touchscreen , Wearable , and Grounded , Foveal , Independent , and Shared .

Two elements, Pictorial and Colocated are only partially used (Table 2). The literature suggests that these eight elements should be integrated or further developed in future autopilot interfaces because they offer considerable advantages for mode awareness.

Table 2. Yellow stripes identify elements partially used or omitted in each of three commercial cockpits.

Extending the Design Space

The proposed design space is based on an analysis of prior research with existing cockpits and is not exhaustive. We generate new design dimensions that extend the design space and identify directions for future research. We present an extended version of the design space with additional dimensions that suggest new cockpit design possibilities (Fig. 4). Touch refers to physical touch interaction with the autopilot. Input Interaction uses touch as input.

Specifically, we have added

Mode Control Philosophy refers to the number of modes associated to input elements.

Haptic Feedback uses touch as output.

Vision refers the visual elements of the autopilot's input controls and output displays. Mode Representation describes how modes and autopilot information are presented visually to the pilot.

Field of view for Feedback specifies location of visual feedback within the pilot's field of vision. Gaze-Based Input uses the pilot's gaze as input, including Grounded systems [START_REF] Alonso | Evaluation of head-free eye tracking as an input device for air traffic control[END_REF] and Wearable devices, e.g. eye-trackers and head-mounted displays [START_REF] Merchant | Applying eye tracking as an alternative approach for activation of controls and functions in aircraft[END_REF].

Space refers to the spatial layout of the autopilot input controls and output displays.

Control distribution refers to the spatial arrangement of mode control interfaces between the two pilots.

Relative position refers to the spatial relationship between input controls and output displays.

Feedback distribution refers to the spatial arrangement of displays with respect to the two pilots.

Time refers to the temporal aspects of input controls and output displays.

Feedback delay refers to the relationship between input location and where feedback appears. The system may present feedback immediately after the pilot completes an action to indicate that it has received the input but not necessarily that the input has been fully processed [START_REF] Scapin | Ergonomic criteria for evaluating the ergonomic quality of interactive systems[END_REF]. Alternatively, the system may present feedback after the system has processed the input to indicate that the requested action is complete, and unambiguously indicates the current state of the aircraft.

Audition provides auditory information without interfering with the pilot's primary visual focus [START_REF] Sarter | The need for multisensory interfaces in support of effective attention allocation in highly dynamic event-driven domains: the case of cockpit automation[END_REF][START_REF] Sathya | Divergence Between Flight Crew Mental Model and Aircraft System State in Auto-Throttle Mode Confusion Accident and Incident Cases[END_REF].

Audio-based Input uses verbal and non-verbal cues as an input to control the autopilot.

Although we know of no existing aircraft that lets pilots command the autopilot verbally, Jones [START_REF] Jones | Three input concepts for flight crew interaction with information presented on a large-screen electronic cockpit display[END_REF] compared a prototype voice-based interface with a trackball and touchscreen to manage a multi-window aircraft management system, and concluded that neither is optimal. However, one could imagine using

Limitations and Future work

Although we sought completeness, we clearly may have missed several relevant studies that address additional design space categories or dimensions. We thus propose this design space as a starting point for reflection which should be updated as the technology evolves.

We applied the design space to the three most prevalent commercial cockpits. However, these do not include all existing cockpit instruments, even among these three manufacturers, much less other aircraft. Future work would benefit from a more comprehensive review of cockpits from other manufacturers. This paper is also restricted to commercial autoflight systems. Future exploration of other aircraft types, such as light aviation or helicopters and paradigms such as Single Pilot Operation would expand the design space.

Since the key goal of the design space is to inspire new ideas, we do not consider implementation, technical aspects and certification. The cockpit is a complex and dynamic environment and many external conditions can complicate or hinder the integration of new technologies. For example, turbulence, smoke and brightness might affect performance of eye-tracking or touchscreen use. The noisy cockpit setting may influence the effectiveness of auditory input and output. Future work should assess the feasibility of ideas from this design space in real-world aviation and assess their potential for certification. Finally, future studies with pilots' reactions to different combinations of designs based on the design space would provide valuable insights as to the acceptability, appropriability and importance of each dimension.

CONCLUSION

This paper presents a design space for autopilot interfaces drawn from the existing research literature on autopilot.

We use a generative theory approach to systematically analyze and critique three existing commercial flight decks which resulted in the identification of eight novel or rarely used interface designs. We extend the design space with new categories and dimensions to include a total of five dimensions: Touch, Vision, Audition, Space and Time. Our goal is to provide a wider range of options for cockpit designers and researchers to create safer, more effective flight decks in the future.

1

  Airbus uses the term FCU (Flight Control Unit) whereas Boeing uses MCP (Mode Control Panel). To ensure clarity and consistency, we use the term FCU to refer to both systems.

Fig. 1 .

 1 Fig. 1. Autopilot interfaces on commercial aircraft physically separate control (FCU) and feedback (FMA).

2. 2 . 2

 22 Enhanced training. Pilots receive extensive training to develop an accurate mental model of the autopilot's goals

  Gaze-Based Input to the visual dimension and suggest two new dimensions: Audition with Audio-based Input and Audio-based Output , Time with Feedback delay . The revised dimensions include:

Fig. 4 .

 4 Fig. 4. The Generative Design Space for Autopilot Interfaces adds Gaze-Based Input to the visual dimension and introduces two new dimensions:Audition and Time. Some categories may contain multiple elements, such as a tangible interface that uses a touchscreen.

  Verbal voice-based commands to control modes or convey mode input, beyond the standard inter-pilot information exchange or communication with air traffic controllers. Audio-based Output refers to verbal and non-verbal cues as output that describes autopilot behavior. Autoflight systems use alarms and alerts to notify pilots of unexpected or irregular behavior. Although the aviation literature does not address auditory announcements, Monsaingeon et al. [47] did explore earcons to indicate modes within partially automated vehicles. Aircraft cockpits with excessive auditory alerts and warnings can interfere with the pilot's ability to hear critical messages and cause "inattentional deafness" [23, 24].

Table 1 .

 1 ATR and Boeing share a common design configurations, and differ from Airbus in the Mode Control Philosophy (Airbus = Multiple, ATR / Boeing = Single). ATR and Boeing differ slightly in the Relative Position where ATR is both Colocated (minor) and Delocated (major).

associated with speed, heading, altitude and vertical speed (left to right). The functionality of the first three buttons consists of pushing to give control to the system (managed mode) and pulling to take control and select the target (selected mode). The vertical speed knob operates differently: pushing it levels off the aircraft, and pulling it activates the vertical speed mode. By contrast, ATR and Boeing use push-buttons with each button associated with a single mode, providing a distinct mode engagement mechanism.

None of the three cockpits proposes

Haptic Feedback . Vision. All three cockpits use an FMA for conveying the state of the system, with textual Mode Representation and peripheral Field of view for Feedback .

However, there are slight variations in design across manufacturers. Airbus FMA consists of a five-column layout, with the first three columns dedicated to mode awareness. Each column represents textual information indicating speed/thrust mode, lateral mode, and vertical mode. Boeing FMA comprises three columns, while ATR adopts a twocolumn format 3 . Airbus incorporates a few pictorial elements for the Mode Representation on the target display windows located just above the four knobs (Fig. 3a). The display shows a dot and a dotted line if the mode is managed (target chosen by the system) or displays the target without dot if the mode is selected (target chosen by the pilot).

However, this is not optimal to maintain mode awareness.

Space. All three cockpits present a shared Control distribution with the FCU centrally positioned in the cockpit coupled with independent Feedback distribution with a FMA in front of each pilot (Fig. 1).

The three cockpits depict a delocated Relative position of the control and feedback elements where the FMA and FCU are separated (Fig. 1). However, the upper central display on the ATR's FCU (Fig. 3b) also displays feedback 3 ATR 72-500 has no autothrust. Hence, the speed axis is not shown on the FMA. However, it is possible to select a speed target, which the aircraft will maintain not by modifying thrust, but by varying pitch. Selecting a target is therefore an option for climbing or descending.