Aeronautical engineering never stopped decreasing the number of technical crewmembers in commercial aircraft since the 1950s. Today, a new challenge has to be taken: single pilot operations (SPO). SPO consist of flying a commercial aircraft with only one technical crewmember in the cockpit, assisted by advanced onboard systems and ground operators providing flying support services. This next move is motivated by cost reduction, and must satisfy the same or better level of safety currently guaranteed with two-crewmen cockpit. This is a human-centered design (HCD) problem where decision-makers have to take risks. This paper presents an approach to risk taking in systems engineering. This approach is illustrated by the presentation of the difficult problem of SPO HCD, and the underlying function allocation problem.
This paper is strongly based on the experience of the author in the analysis, design
and evaluation of aeronautical systems, mainly cockpit systems, and more
specifically, the shift from three to two crewmen cockpits in commercial aircraft in the
beginning of the eighties
Today, motivated by cost reduction, the shift from two pilot operations to single
pilot operations (SPO) requires us to investigate how cognitive functions will be
redistributed among humans and systems. We put “humans” plural because even if the
objective is to have a single pilot in the cockpit, there will be other human agents on
the ground or onboard (e.g., flight planners, flight followers, and flight attendants)
who could be involved. This function allocation process is typically done using CFA
to design the first prototypes and prepare human-in-the-loop simulations (HITLS),
and after HITLS to refine the definitions of the various cognitive functions involved
and their inter-relations
CFA can be used to both analyze current multi-agent interactions, and future
possible scenarios and configurations in two orthogonal spaces: the resource space and
the context space. The resource space includes logical networks of human and system
functions. The context space includes relevant situations embedded in progressively
generic context patterns. For example, when we want to represent a function of
responsibility delegation from a human to a system, we represent the various resources
that both human and system require to support it, and the various context levels in
which its resources can be used. There may also be embedded cognitive functions
(i.e., cognitive functions of cognitive functions). As a whole, this approach enables us
to study the intrinsic complexity of the generated resulting cognitive function
network. Use of CFA methodology acknowledges the intrinsic complexity involved in
multi-agent socio-technical systems and offers a path to systematically analyze
component interactions that give rise to unanticipated emergent behaviors, attributes, and
properties. We have used this approach to study and incrementally redesign
automation in commercial aircraft cockpits
At the moment, commercial aircraft cockpits include two crewmembers, a pilot
flying (PF) and a pilot not flying (PNF) – also called pilot monitoring (PM).
Typically, the PF is in charge of the control of the aircraft, and the PNF is in charge of system
monitoring, communication with the ground, and safety monitoring of flight progress.
When agent roles and number change within an organization (i.e., when the cognitive
function network changes), there is a re-distribution of the various authorities.
Authority is about control (i.e., being in charge of something) and accountability (i.e.,
you need to report to someone else). CFA enables us to study authority re-distribution
by making explicit the various roles, contexts and resources, and the links among
them. When we moved from three to two crewmembers in cockpits, we needed to
study the re-distribution of cognitive functions between the two crewmembers and the
new systems (highly automated) that were executing tasks that the previous third
crewmember was executing in the past. The main problem was to identify the
emerging cognitive functions induced by the new human-system-integration
The major advantage of two crewmen cockpits is redundancy (i.e., it is better to have two pairs of eyes and two brains, than only one of each). Safety deals with stability, resilience and therefore cognitive redundancy. This is something that will need to be challenged and tested in the SPO framework. In particular, a comparison of the current two crewmen cockpit operations with SPO should also be conducted. When we shifted from three to two crewmen cockpits, we first developed a time line analysis (TLA), which consists in developing scenarios of events as well as interactions among the various agents involved (e.g., captain, first officer, ATC, aircraft). Since then we made lots of progress in usability engineering and TLA could be combined with cognitive function analyses. We also ran simulations that enabled to play these scenarios and observe activities of the various agents.
As a general standpoint, commercial airline pilots are typically involved as
subject matter experts (SMEs). The various variables and processes that we typically
study are the followings: pilot’s goals, workload (or task-load during the TLA),
human errors (i.e., possible error commissions and recovery processes), situation
awareness, decision-making process, and action taking. Scenario data are chronologically
displayed on a classical spreadsheet, which can be upgraded as needed when the
analysis progresses. An example of such an approach is provided in
The number of aircrew in cockpits was reduced over the years during the last 60
years or so going from 5 until the 1950s when the Radio Navigator was removed (the
radio navigator was dedicated to voice communication equipment), to 4 until the
1970s when the Navigator was removed (when inertial navigation systems were
introduced), to 3 until the 1980s when the Flight Engineer was removed (new
monitoring equipment for engines and aircraft systems were introduced), to 2 until now.
Twoaircrew cockpits have been the standard for three decades. This progressive
elimination of technical crewmembers in commercial aircraft cockpits results from the
replacement of human functions by systems functions. These functions are both
cognitive and physical. The reason we only talk about cognitive functions is because
electronics and software progressively dominated the development of systems. Today, it
is clear that many onboard systems have their own cognitive functions in terms of
role, context of validity and resources used
Current technology indicates that we can move to single pilot operations (SPO). Two institutions support this new shift: NASA in the US and ACROSS2 in Europe. It is clear that the main goal of moving from two-crewmen cockpit operations to single pilot operations (SPO) is the reduction of costs. We now need to investigate how safety would be impacted by this shift. It is true that SPO is already well experienced in general aviation (GA); in this case, we know its advantages and drawbacks. In particular, ATC is already familiar with interaction with single pilots. In addition, military fighters are operated with only one pilot in the cockpit.
We foresee two main approaches to SPO. The former is an evolutionary approach that continues the move from 5 to 4 to 3 to 2 to 1 where automation is incrementally added as the aircrew number is reduced. The main issue is pilot incapacitation. We always certify an aircraft entirely safe for (n-1) capacitated flying pilot(s). When n=1, there is a discontinuity, and the piloted aircraft becomes a drone. We then need to define ground support and/or flight attendant support. The latter is a revolutionary approach that breaks automation continuity and goes to the design of a fully automatic flying machine (commonly called a drone or a flying robot). The problem becomes defining human operator’s role. Consequently, human-robot interaction activity needs to be entirely defined from the start within a multi-agent environment, and not only when the pilot is incapacitated, having a single agent approach in mind.
In both approaches, function allocation is a major mandatory endeavor. In the evolutionary aircrew-reduction approach, it is purposeful to compare the differences and commonalities between general aviation (GA) single-pilot resource management (SRM) and commercial aviation SPO SRM (to be defined). The FAA has identified 6 tenets of SRM in GA3: task management; risk management; automation management; aeronautical decision-making; control flight into terrain awareness; and situation awareness. Another important question is the definition of the role (job) of the single pilot in SPO and related operations support (i.e., procedures, automation, and problem solving skills). It is also crucial to find out risks involved in SPO as early as possible
3 FAA Order 8900.2, General Aviation http://fsims.faa.gov/wdocs/orders/8900_2.htm Airman
Designee
Handbook before delivery. This is why fast-time simulations and human-in-the-loop simulations are planned and carried out from the beginning of the design process. Finally, it is important to identify and design a new cockpit configuration for SPO integrated into a global infrastructure covering the entire air traffic management (ATM).
In the revolutionary approach, instead of looking for what we loose when we remove the first officer (a negative approach where “overload” is studied and cumulative assistance is searched), it is urgent to understand what function allocation should be developed between the SPO aircrew and systems that will need to be developed (a positive approach where situation awareness, decision making and human-machine cooperation are studied and developed from the start). What will be the role of an aircrew flying a drone? There is a major difference between controlling and managing a transport drone from the ground and inside it. The latter is likely to be more socially accepted by passengers. Therefore, the primary question is the definition the role/job of this new type of aircrew; use of socio-cognitive models and complexity analyses will be necessary. In addition, we need to find out emerging human factors issues such as situation awareness, decision-making (who is in charge and when), fatigue, and incapacitation. This should be studied in nominal and off-nominal situations. The major distinction between RPAS (Remotely Piloted Aircraft Systems4) and SPO of drones is crucial. When the person responsible for safety, success and wealth of a mission (a flight) is himself/herself directly involved (life-critical embodiment instead of remote control), he/she will have totally different relationships with the machine being controlled and managed. This approach does not remove the need for ground assistance. There will be decision to make whether or not we want to make pilot’s manual reversion possible, and/or have RPAS as an emergency/recovery possibility. In any case, board and ground personnel, organizations and technology roles should be defined in concert (i.e., consider complex and non-linear systems and design/test global solutions) and not in isolation as it is done today (i.e., simplify problems, linearize and find local solutions). Tests will be performed using various human factors metrics and methods including workload, skills, knowledge and performance assessments. Other metrics can be used such as simplicity, observability, controllability, redundancy, (socio-)cognitive stability, and cognitive support.
Using CFA to define SPO leads to the identification of cognitive functions for the various agents including the pilot (or another qualifier in the SPO context), ground operators and systems. Each of these agents has a set of cognitive functions providing him, her or it with some degree of authority. Authority can be viewed as control (i.e., the agent is in charge of doing something and control the situation) and accountability (i.e., the agent is accountable to someone else). Control can be either handled directly or delegated to other agents who have authority to execute well-defined tasks. In this latter case, these other agents (should) have appropriate and effective cognitive func
tions and are accountable to the agent delegating. CFA enables to rationalize the allocation of cognitive functions among agents.
Technical crews (or pilots) have the role and authority of bringing a set of passengers from a location A to another location B. They have the primary responsibility for safety, efficiency and comfort of the passengers. In SPO, cognitive functions of current PF and PNF are distributed among technical crews, ground operators and new systems. In particular, technical crew cognitive functions have a set of resources distributed among ground operators and aircraft/ground systems. Ground operators have different cognitive functions that can be named dispatching, ATC coordination, crew scheduling, maintenance triggering, customer service, and weather forecast. All these cognitive functions can be supported by systems when they are well-understood and mature. Dispatching and piloting are currently associated to develop a flight plan, find out what fuel quantity pilots should take, meet weight and balance requirements, ensure compliance with the minimum equipment list (MEL), de-conflict with other aircraft, help in case of equipment failure and, more generally, guide the flight from gate to gate.
Normal piloting cognitive functions consist in reading checklists, cross-checking life-critical information, trouble-shooting and recovering from failures, fuel monitoring, and so on. Abnormal and emergency cognitive functions are triggered by specific conditions such as engine failure, cabin depressurization, fuel imbalance and so on. Current air traffic controllers have specific dispatch cognitive functions. Their job will change with SPO and will need piloting cognitive functions in the case of malfunctions in the airspace, including pilot incapacitation and its duality, total system failure. Consequently, they will need tools such as in aircraft cockpits. The whole ATC workstation will evolve toward an ATM/piloting workstation for SPO. In addition, they will not have to control only one aircraft but, in some cases, several.
A first cognitive function analysis shows that there are functions that can be allocated to systems such as checklists-based verifications and crosschecking of lifecritical information. As always, allocating functions to systems requires maturity verification. Whenever technology maturity is not guaranteed, people should be in charge and have capabilities guarantying good situation awareness. In any case, tests are mandatory. In the above-defined revolutionary approach to SPO, we typically think about lower levels of control being entirely automated (i.e., trajectory control and management); human agents only act on set-points for example. We need to be careful however that the SPO pilot will be aware of the crucial internal and external states of his/her aircraft environment. He/she will also need to be knowledgeable and skilled in aviation to perceive and understand what is going on during the flight as well as act on the right controls if necessary. Full automation does not remove domain knowledge and skills in life-critical systems.
Symmetrically, some aircraft systems (or artificial agents) should be able to monitor pilot’s activity and health. This induces the definition, implementation and test of new kinds of system cognitive functions based on physiological and psychological variables. Obviously, this will require sensors that could be physiologically invasive (e.g., electro-encephalograms) or non-invasive (e.g., cameras). In any case, pilots will have to accept to be monitored. Pilot’s activity and health monitoring can be done by aircraft systems and also by ground operators.
Other processes and technology that need to be human-centered designed and developed are related to collaborative work. In this new multi-agent world, agents have to collaborate and be supported for this collaboration. Computer-supported cooperative work (CSCW) technology and techniques need to be developed to this end. When an agent fails for example, whether a human or a system, recovery means and strategies should be in place to continue the flight safely. It is also important, in this increasingly automated multi-agent world, to keep enough flexibility. HITLS could be used to find out the effectivity of possible solutions. 5
This paper showed a major distinction between a classical evolutionary approach and a revolutionary approach for SPO. A first high-level cognitive function analysis (CFA) was carried out showing the contribution of experience and creativity leading to innovation.
Studying function allocation among people and systems from the beginning
enables the development of socio-cognitive models, which further support
human-in-theloop simulations, and incrementally design systems, organizational setups and job
descriptions in order to innovate in a human-centered way (e.g., define SPO). The
TOP (Technology, Organization and People) model should always support the HCD
process leading to technological, organizational and jobs/functions solutions.
This first high-level CFA needs to be further developed as SPO TOP solutions are
incrementally developed. We need to discover human and technological weaknesses,
and design appropriate redundancy in the form of technology, onboard personnel
support and ground support. Studying multi-agent collaborative work (humans and
systems), it is important to improve our understanding of authority and context
sharing (distributed cognition), improve mutual feedback (cross-checking,
crosscommunication, intent recognition), as well as responsibility and accountability. We
found that the Orchestra model