{"schema_version":1,"research_id":"eoa_inverse_innovation_exp06_external_evaluation_20260803","source_assessment_id":"representation_independent_interface_contract__aviation_aeronautics:P4:v0","cell_id":"representation_independent_interface_contract__aviation_aeronautics","search_queries":["site:faa.gov flight guidance system mode annunciation AC 25.1329 mode awareness","site:faa.gov flight deck automation working group mode confusion report 2013","flight guidance mode logic formal verification mode confusion aviation research","ARINC 702A flight management computer standard mode interface conformance","FAA Flight Deck Automation Working Group final report mode awareness pdf 2013 recommendations","site:ntsb.gov Asiana 214 accident report automation mode awareness flight director","site:faa.gov AC 20-115D DO-178C software considerations airborne systems pdf","site:bls.gov OEWS aerospace engineers May 2025 wage","FAA AC 25.1329-1C PDF Approval Flight Guidance Systems Change 2 2024","site:faa.gov \"Operational Use of Flight Path Management Systems\" final report pdf","site:aiaa.org \"Formal Verification for Mode Confusion\" intent-based abstraction"],"sources":[{"source_id":"S1","title":"AC 25.1329-1C, Change 2: Approval of Flight Guidance Systems","publisher":"Federal Aviation Administration","url":"https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_25.1329-1C_CHG2.pdf","source_class":"OFFICIAL_GUIDANCE","publication_date":"2026-02-13","accessed_at":"2026-08-03","claims_supported":["Current FAA guidance requires indication of active and armed modes, transitions, and reversions and requires flight-guidance interfaces to minimize crew confusion.","FAA guidance calls for documented behavior, safety assessment, and compliance evidence using analysis, laboratory tests, simulation, and flight tests.","A transport-aircraft applicant must coordinate the proposed compliance methods with FAA through the certification plan.","The guidance already distinguishes operationally relevant modes from private or irrelevant submodes, substantially overlapping the proposed abstraction boundary."]},{"source_id":"S2","title":"Crash of Asiana Airlines Flight 214, Investigation DCA13MA120","publisher":"National Transportation Safety Board","url":"https://www.ntsb.gov/investigations/pages/DCA13MA120.aspx","source_class":"GOVERNMENT_OR_REGULATOR","publication_date":"2014-06-24","accessed_at":"2026-08-03","claims_supported":["The accident killed three passengers, seriously injured 49 people, and destroyed the aircraft.","The pilot selected a mode that initiated a climb and then unintentionally deactivated automatic airspeed control; the crew did not notice the autothrottle HOLD mode.","NTSB identified system complexity and inadequate documentation and training as contributors that increased the likelihood of mode error."]},{"source_id":"S3","title":"Operational event involving Boeing 737 VH-YIR at Sydney Airport on 4 June 2013, AO-2013-095","publisher":"Australian Transport Safety Bureau","url":"https://www.atsb.gov.au/investigations/ao-2013-095","source_class":"GOVERNMENT_OR_REGULATOR","publication_date":"2015-08-07","accessed_at":"2026-08-03","claims_supported":["A crew believed approach mode had been armed, but the system was not in the intended mode and the aircraft passed through the runway centerline.","ATSB found that ineffective checking of the mode-control panel or flight-mode annunciator left the crew unaware of the mode-selection failure.","ATSB concluded that autoflight mode selection, awareness, and understanding remained common vulnerabilities despite prior mitigations."]},{"source_id":"S4","title":"NASA LaRC Formal Methods Program Research: Mode Confusion","publisher":"NASA Langley Research Center","url":"https://shemesh.larc.nasa.gov/fm/fm-collins-mode.html","source_class":"OFFICIAL_ORGANIZATION_DATA","publication_date":"2002-10-18","accessed_at":"2026-08-03","claims_supported":["NASA and Collins used formal behavioral models to examine flight-guidance mode logic and its interaction with vertical navigation.","The approach searched models for mode-confusion patterns and checked pilot scenarios against behavioral specifications.","NASA reports that several enhancements suggested by the study were incorporated into new products, demonstrating technical and organizational feasibility of model-based mode analysis."]},{"source_id":"S5","title":"Analyzing Mode Confusion via Model Checking","publisher":"NASA Technical Reports Server","url":"https://ntrs.nasa.gov/citations/19990063915","source_class":"PRIMARY_RESEARCH","publication_date":"1999-05-01","accessed_at":"2026-08-03","claims_supported":["Researchers represented a flight-guidance system as a finite-state behavioral model and analyzed it with Murphi, SMV, and Spin.","The work treated complex automation state and pilot mode awareness as an aviation-safety problem.","Multiple formal tools could generate complementary diagnostic evidence, establishing mature adjacent prior art for executable mode contracts and state exploration."]},{"source_id":"S6","title":"AC 20-115D: Airborne Software Development Assurance Using EUROCAE ED-12 and RTCA DO-178","publisher":"Federal Aviation Administration","url":"https://www.faa.gov/airports/resources/advisory_circulars/index.cfm/go/document.information/documentNumber/20-115D","source_class":"OFFICIAL_GUIDANCE","publication_date":"2017-07-21","accessed_at":"2026-08-03","claims_supported":["FAA recognizes DO-178C as an acceptable software-assurance means for airborne systems.","FAA also recognizes the DO-331 model-based development supplement and DO-333 formal-methods supplement.","Operational deployment of the proposed contract would have to fit applicable certification and software life-cycle assurance rather than treating black-box conformance as sufficient approval evidence."]},{"source_id":"S7","title":"Operational Use of Flight Path Management Systems: Final Report of the PARC/CAST Flight Deck Automation Working Group","publisher":"Performance-based Aviation Rulemaking Committee and Commercial Aviation Safety Team, hosted by FAA","url":"https://www.faa.gov/sites/faa.gov/files/aircraft/air_cert/design_approvals/human_factors/OUFPMS_Report.pdf","source_class":"OFFICIAL_ORGANIZATION_DATA","publication_date":"2013-09-08","accessed_at":"2026-08-03","claims_supported":["A joint FAA-industry working group analyzed worldwide accidents, incidents, normal operations, and interviews and produced 29 findings and 18 recommendations.","The group found continuing vulnerabilities involving automation use, mode selection, equipment complexity, interface information, and situation awareness.","It recommended near-term training and procedural measures and longer-term equipment designs that reduce autoflight-mode complexity.","The membership included FAA, manufacturers, airlines, pilot organizations, avionics suppliers, researchers, and safety organizations, identifying credible authorizers and adopters, though none requested this exact software-contract artifact."]},{"source_id":"S8","title":"Occupational Employment and Wages in Huntsville, Alabama — May 2025","publisher":"U.S. Bureau of Labor Statistics","url":"https://www.bls.gov/regions/southeast/news-release/occupationalemploymentandwages_huntsville.htm","source_class":"GOVERNMENT_OR_REGULATOR","publication_date":"2026-07-09","accessed_at":"2026-08-03","claims_supported":["BLS reports a May 2025 mean annual wage of $135,660 for aerospace engineers in Huntsville and similar values for electrical, electronics, hardware, and safety engineers.","These wages provide a public labor-cost anchor for resource-equivalent estimates but do not include benefits, overhead, certification specialists, facilities, tool licenses, or proprietary-data access."]}],"problem_evidence":{"support":"STRONG","rationale":"The problem class is visible in two independent official investigations: Asiana 214 involved unnoticed automation-mode consequences and fatal harm, while the ATSB documented an unintended mode state and ineffective mode confirmation in a separate aircraft and jurisdiction. Current FAA guidance explicitly requires coherent active, armed, transition, and reversion indications, and the FAA-industry working group found persistent mode-selection, complexity, and awareness vulnerabilities. These sources establish materiality, but they do not establish the prevalence of controller-private representation leakage across displays, recorders, simulators, and test equipment in a particular current program.","source_ids":["S1","S2","S3","S7"]},"stakeholder_evidence":{"support":"MODERATE","rationale":"FAA is an identifiable authorizer, and aircraft applicants, avionics design authorities, manufacturers, operators, and suppliers are identifiable adopters. The PARC/CAST group expressly sought improved long-term equipment design and included relevant manufacturers and suppliers. However, no source shows a named program requesting, funding, or budgeting for the exact opaque shared-state contract and cross-client conformance oracle proposed here.","source_ids":["S1","S7"]},"prior_art":{"proximity":"SUBSTANTIAL_COLLISION","closest_analogues":[{"name":"FAA AC 25.1329 flight-guidance behavior, mode-annunciation, safety-assessment, and compliance practice","similarity":"Already requires behavior descriptions, unambiguous active and armed modes, indications of transitions and reversions, separation of operationally relevant modes from irrelevant submodes, and evidence through analysis and testing.","remaining_difference":"It does not prescribe one opaque implementation-neutral state object, atomic revision semantics, or a reusable oracle shared by controllers, displays, recorders, simulators, and test equipment.","source_ids":["S1"]},{"name":"NASA/Collins formal mode-awareness modeling","similarity":"Uses executable behavioral models, state exploration, scenario checking, and mode-confusion properties on real flight-guidance and VNAV logic; reported findings entered products.","remaining_difference":"The opened evidence does not show a versioned public abstract data type or a single conformance suite serving every downstream client and replacement implementation.","source_ids":["S4","S5"]},{"name":"DO-178C with DO-331 and DO-333 supplements","similarity":"Provides established certification-facing software, model-based, and formal-method assurance routes applicable to airborne avionics changes.","remaining_difference":"It is a life-cycle assurance framework, not the proposed domain-specific crew-observable mode contract; conversely, passing the proposed oracle would not satisfy this framework by itself.","source_ids":["S6"]},{"name":"PARC/CAST flight-deck automation design recommendations","similarity":"Targets persistent autoflight-mode complexity, mode awareness, interface design, and coordinated long-term equipment improvements.","remaining_difference":"It expresses a design need but does not specify the candidate's representation-independent interface or defect-seeded conformance experiment.","source_ids":["S7"]}],"distinctive_claim_remaining":"Compared with existing certification guidance, formal analysis of a single design, typed message schemas, and incumbent golden traces, a single representation-independent public mode-state contract used by every controller and client will reject seeded semantic defects—dual command authority, mutation after rejection, missing reversion reason, stale-request replay, exposed private substates, and non-atomic replacement—while accepting private-state refactorings that preserve crew-observable behavior. The claim is falsified if existing reviewed artifacts already provide that same boundary and oracle, if the abstraction must expose private substates to preserve crew-relevant distinctions, or if it provides no defect-detection or refactoring-acceptance advantage over the comparators.","confidence":"HIGH"},"implementation_evidence":{"support":"MODERATE","rationale":"Executable flight-guidance mode models, model checking, scenario analysis, laboratory testing, simulation, and formal-method assurance are established and technically compatible with the proposal. A disconnected harness is therefore plausible. Feasibility is not yet demonstrated for the proposed state vocabulary, atomicity and timing rules, proprietary controller traces, tool qualification boundary, data-control rules, or integration with a specific applicant's DO-178C and system-safety processes. Operational use would require the applicant's design authority and certification coordination; laboratory conformance cannot establish control-law stability, handling qualities, human-factors adequacy, or airworthiness.","source_ids":["S1","S4","S5","S6"]},"scores":{"meaningful_impact":{"score":4,"rationale":"Mode misunderstanding has contributed to serious incidents and a fatal accident, and coherent public behavior could protect several assurance and crew-interface consumers. The proposal addresses only one contributing layer and does not itself improve control laws or prove safer crew performance.","source_ids":["S2","S3","S7"]},"stakeholder_pull":{"score":3,"rationale":"FAA and a broad industry working group express sustained need for clearer, less complex automation behavior and equipment design, but exact demand, budget, and ownership for this artifact are unverified.","source_ids":["S1","S7"]},"incremental_advantage":{"score":3,"rationale":"A shared semantic oracle could distinguish meaningful behavior from private trace identity better than schemas or golden traces, but no comparative results yet show fewer escaped defects or fewer false-positive redesign failures.","source_ids":["S1","S4","S5"]},"distinctiveness_plausibility":{"score":2,"rationale":"The core elements—behavioral mode descriptions, relevant-versus-private submodes, executable models, formal properties, and assurance testing—substantially collide with established guidance and research. The plausible residual is their packaging as one cross-client opaque state contract with explicit atomicity, revision, and mutant-testing rules.","source_ids":["S1","S4","S5","S6"]},"technical_implementability":{"score":4,"rationale":"Existing flight-guidance formal models and accepted laboratory, simulation, model-based, and formal-method workflows make an isolated prototype technically credible. Proprietary trace access and semantic completeness remain material uncertainties.","source_ids":["S1","S4","S5","S6"]},"adoption_authority_feasibility":{"score":3,"rationale":"The applicant's avionics design authority and FAA certification process are identifiable, and an isolated laboratory experiment is within ordinary engineering authority. Operational adoption has a demanding, program-specific assurance and approval path.","source_ids":["S1","S6","S7"]},"evidence_readiness":{"score":3,"rationale":"The experiment, comparators, seeded faults, and falsifiers can be specified now, but decisive evidence requires proprietary artifacts, domain experts, and execution against at least one real controller and its clients.","source_ids":["S1","S4","S5"]},"safety_net_benefit":{"score":4,"rationale":"A disconnected harness can expose semantic inconsistencies without changing aircraft, approved simulators, procedures, or flight software, and it adds a reusable defense against representation leakage. Its results must not be misrepresented as airworthiness evidence.","source_ids":["S1","S6"]},"scalability":{"score":3,"rationale":"The contract-test pattern could extend across modes and implementations, but each aircraft architecture needs domain-specific state mapping, timing rules, safety review, and maintained certification evidence, limiting plug-and-play scaling.","source_ids":["S1","S6","S7"]}},"score_confidence":"MODERATE","costs":{"first_evidence":{"band_2026_usd":"50K_TO_250K","scope":"A 6-10 week disconnected proof using roughly 10 bounded scenarios, an executable abstract model, one incumbent trace adapter, three comparators, 6-10 seeded faulty mappers, and a short authority review.","confidence":"MODERATE","assumptions":["Approximately 4-8 loaded person-months across avionics software, verification, and flight-guidance domain expertise.","BLS's $135,660 aerospace-engineer wage is doubled as a rough loaded labor proxy for benefits, overhead, tools, and management.","Synthetic traces and a small approved non-flight trace set are available without a separate data-acquisition contract."],"source_ids":["S8"]},"initial_deployment_startup":{"band_2026_usd":"250K_TO_1M","scope":"Program-grade contract specification, trace normalization, adapters for several laboratory clients, requirements traceability, configuration control, safety review, and CI integration for one aircraft program, excluding certification credit.","confidence":"LOW","assumptions":["Approximately 1.5-3.5 loaded FTE-years.","Existing software-in-the-loop infrastructure can be reused.","No flight hardware, approved simulator modification, or qualified-tool claim is included."],"source_ids":["S1","S6","S8"]},"operational_launch":{"band_2026_usd":"1M_TO_5M","scope":"Integrate the contract into an airborne-program baseline and affected display, recording, simulation, and verification workflows; complete change-impact analysis, system-safety and human-factors evidence, certification coordination, regression campaigns, and controlled migration.","confidence":"LOW","assumptions":["Approximately 6-15 loaded FTE-years plus specialist reviews and laboratory facilities.","This is a derivative or bounded integration, not clean-sheet flight-guidance development.","Flight-test or high-fidelity simulator work required by the agreed certification plan is included, but aircraft redesign and fleet retrofit are not."],"source_ids":["S1","S6","S8"]},"annual_recurring":{"band_2026_usd":"250K_TO_1M","scope":"Contract stewardship, change review, conformance regression, leakage audits, tool and adapter maintenance, anomaly triage, and periodic assurance updates for one active program.","confidence":"LOW","assumptions":["Approximately 1-3 loaded FTEs plus shared laboratory and configuration-management costs.","Major redesigns and new certification projects are excluded.","The public contract remains stable enough that most yearly changes are compatible additions or private implementation changes."],"source_ids":["S6","S8"]}},"verified_pipeline_gates":{"externally_supported_problem":{"status":"YES","reason":"Independent NTSB and ATSB investigations and FAA evidence establish consequential and persistent autoflight-mode awareness and behavior problems.","source_ids":["S2","S3","S7"]},"externally_credible_adopter_or_authorizer":{"status":"YES","reason":"Aircraft applicants and their avionics system design authorities are credible adopters, while FAA is an identifiable certification authorizer; the FAA-industry working group includes relevant manufacturers, operators, and suppliers. Exact-project commitment remains absent.","source_ids":["S1","S7"]},"distinct_testable_incremental_claim":{"status":"YES","reason":"The residual claim specifies observable defect-rejection and refactoring-acceptance outcomes against typed-schema, golden-trace, and existing-requirements comparators.","source_ids":["S1","S4","S5"]},"bounded_next_evidence_step":{"status":"YES","reason":"A disconnected, time-bounded software-in-the-loop study can use predeclared traces, invariants, comparators, seeded faults, and explicit falsifiers without operational changes.","source_ids":["S1","S4","S5"]},"no_unresolved_safety_or_authority_stop":{"status":"YES","reason":"The proposed first study can remain synthetic or use approved non-flight traces, with no aircraft connection or operational decision. Any later baseline or flight use remains subject to the applicant's design authority, safety process, and FAA-agreed compliance plan.","source_ids":["S1","S6"]},"credible_cost_scope_and_range":{"status":"YES","reason":"The bands are scoped by lifecycle stage and anchored to public engineering wages with explicit loaded-labor and facility assumptions. Confidence is low beyond first evidence because program assurance level, proprietary access, and certification scope are unknown.","source_ids":["S1","S6","S8"]}},"next_evidence_step":"With one avionics-program partner, run a 6-10 week disconnected study on one lateral and one vertical mode family. Before seeing results, freeze the public state vocabulary, request preconditions, rejection taxonomy, authority and target invariants, atomic-reversion rule, revision semantics, timing classes, and acceptance thresholds. Use 10 scenarios covering engagement, arming, capture, cancellation, invalid target, sensor loss, authority transfer, reversion, duplicate request, and recovery. Compare (A) the proposed opaque contract and shared property/differential suite with (B) the current typed interface and scenario regressions, (C) exact incumbent golden traces, and (D) FAA-guidance-derived requirements without the new shared state object. Test the incumbent adapter, an independently coded abstract model, one behaviorally equivalent private-state refactoring, and seeded mappers for dual active modes, post-rejection mutation, lost reversion reason, stale duplicate acceptance, exposed private substate, and split non-atomic replacement. Predeclare success as the proposed suite detecting every seeded semantic defect, accepting the equivalent refactoring, and producing no unresolved crew-relevant omission. Falsify the intervention if any valid trace cannot be represented without private-state leakage, any seeded contradiction passes, the equivalent refactoring fails for incidental trace differences, or the proposal provides no net detection or false-positive advantage over comparators. Stop before aircraft, flight hardware, approved simulator, or certification-baseline use.","blocking_evidence":["No current-program dependency audit shows whether displays, recorders, simulators, and tests actually depend on private mode numbers, timing, or event order.","No named avionics program has supplied proprietary controller traces, interface mappings, or permission for comparative execution.","No design authority has accepted the proposed abstract state vocabulary, atomicity rules, timing classes, or ownership model.","No experiment shows an advantage over existing requirements-based tests, typed interfaces, formal models, or golden traces.","Human-factors adequacy, control-law equivalence, system-safety effects, certification credit, patentability, freedom to operate, market size, and realized impact remain unmeasured."],"research_disposition":"PARTNERED_RESEARCH_PROGRAM","world_novelty_boundary":"World novelty is unmeasured. The search establishes substantial prior art in flight-guidance mode descriptions, annunciation and reversion requirements, formal behavioral models, model checking, laboratory and simulator evidence, and certification-facing software assurance. It does not establish whether the exact combination of a cross-client opaque mode-state abstraction, atomic authority/reversion semantics, monotonic public revisions, and a shared mutant-tested conformance oracle has previously been implemented, patented, standardized, or deployed.","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_version":0,"controller_recommendation":{"action":"STOP_EMPIRICAL_RESEARCH_NEEDED","repairable":false,"material_progress_observed":true,"progress_targets":["Secure a named avionics-program partner and written authority for disconnected use of approved non-flight traces.","Complete a dependency audit across at least the controller, display, recorder, simulator, and verification clients.","Freeze the contract and comparator acceptance thresholds before execution.","Execute the seeded-defect and equivalent-refactoring experiment and publish the full outcome matrix, including disagreements and invalid scenarios.","Obtain design-authority classification of every contract gap and determine whether any operational follow-on belongs in the program's DO-178C, system-safety, human-factors, and certification plans."],"reason":"Bounded web research has verified the problem, credible authorities, mature adjacent practice, a narrow incremental claim, a safe next study, and plausible costs. The decisive questions now require proprietary dependency data, domain-authority judgments, and live execution against real laboratory artifacts. More public web search cannot establish comparative defect detection, semantic completeness, adoption commitment, or certification fit; therefore the evaluation stops for empirical partnered research."},"proposal_index":4}