Uncertainty State Management (USM): A Behavioural Governance Framework for Flight Crew Decision-Making Under Epistemic Uncertainty — Version 1.4

Uncertainty State Management (USM) is a formally specified behavioural governance framework governing flight crew decision-making when operational data coherence collapses. The core doctrine is: Stability first. Truth second. Optimisation last. USM addresses the interval between coherence failure and reliable state reconstruction — the window during which the startle/surprise response renders diagnostic reasoning unreliable and procedural adherence drops significantly (Landman et al. 2017a, 2017b; Vlaskamp, Landman et al. 2025). Existing approaches attempt to train pilots through this vulnerability window. USM instead removes the requirement for any cognitively demanding decision from it entirely. Core Architecture • 2-of-3 Coherence Failure Gate — fires on cross-source disagreement, physics inconsistency, or contradictory urgency cues (any two of three) • Six Epistemic States (0–5) — from Coherent Certainty through Managed Diversity, UNK, Stability Preservation, Coherence Reconstruction, to Controlled Collapse • Timer Lock — 20–30 second mandatory protection window; prohibits diagnosis, checklist execution, and optimisation; primary grounding is AF447 pitot blockage duration (~30–40 seconds) • HOLD Corridor — phase-appropriate pitch/thrust band executable under severe startle; derived from OEM performance data • Two-Key Gate — both crew members must confirm state transitions; prevents unilateral premature action • Hard-Threat Override — TCAS, TAWS, confirmed stall, and windshear retain absolute priority at all times The manuscript includes the complete doctrinal specification, five supporting annexes (evidence base, case applications, edge cases, quantification framework, and governance/adoption pathway), and counterfactual analysis of 25 historical accident and incident cases. The framework was developed following extensive review of the AF447 accident record and the published research programme of Dr Annemarie Landman (TU Delft / TNO Netherlands). USM is not a startle management procedure and is not a checklist replacement. It is an architectural constraint — a governance layer that determines when normal procedure is suspended, what behaviour is mandated during suspension, and what criteria must be met before normal procedure is restored. Empirical simulator validation is the outstanding requirement. This manuscript is submitted to establish a permanent, citable, timestamped public record and to make the framework available to any researcher, safety organisation, or training institution with the capacity and interest to pursue validation.