The Human and the concepts of Extended Minimum Crew Operations and Single Pilot Operations
KEY MESSAGES
- With the changing aircraft generations, and the evolution from early jets to the fly by wire technology, the automation on the flight deck has evolved over the years as well. It has however still not reached a point of maturity enabling operations with only one pilot in the cockpit without compromising flight safety.
- For this reason, ECA currently does not support reduced or single pilot operations in CAT during any phase of flight.
- Future further development and increased use of automation in commercial aircraft, and eventually certification of Artificial Intelligence (AI) for the use in this environment, should have as a goal enhancement of human capacity, and not its replacement. This in return would increase efficiency and most importantly enhance Flight Safety.
- Two specific concepts, eMCO and SiPO are currently being prepared for implementation in the near and mid-term future and raise great concern. It is crucial that all the safety risks stemming from both concepts are fully analysed, understood, and solved before any change to the standards is considered.
- The concepts are driven by the industry seeking reduction of pilots in the cockpit and increase of maximum flight duty time at zero cost. History has shown that putting economic gains, and even innovation, as primary goal – tends to have a detrimental influence on flight safety.
Introduction
Aviation is the safest transportation system in history by learning from its mistakes and a constant process of improving flight safety standards.
Building on the knowledge and experience of over a century of commercial flights – the ultimate goal of technological and regulatory developments must not only be maintaining but enhancing aviation safety. This even more so given the expected post-crisis growth in air traffic which requires a constant improvement in safety levels.
The draft EASA concepts of eMCO and SiPO assume reduction of the number of highly qualified safety professionals – the pilots – from the flight deck and raise serious concern about the negative impact on flight safety.
The Extended Minimum Crew Operations concept (eMCO) aims to stretch the maximum flight time limitations by prolonging in flight rest for pilots. To achieve this, only one pilot would be required to remain at the controls for extended periods of the cruise phase while the other pilot would be resting most likely in an area out of the flight deck.
The next intended step for the industry is Single Pilot Operations (SiPO) - in which there will only be one pilot onboard at any given time during flight, also during critical phases of flight such as takeoff and landing. This would require an even higher degree of technical advancements and operating procedures.
Although these two concepts, eMCO and SiPO, can appear similar in nature and operation – they pose in fact both different and similar challenges. They should be treated as two separate types of operations as the defining difference is the on-board availability of a full 2-pilot crew in the eMCO concept - which is not the case in SiPO.
Augmenting and not replacing human capacity
The developments on AI are expected to play an important role in the future of air transport. While ECA supports the development and integration of AI in large commercial transport aircraft, it cannot be done at the cost of eliminating one pilot from the cockpit. The equation “2-pilots in the cockpit + AI” enhances safety. On the contrary, the equation “1 pilot in the cockpit + AI” poses important threats to safety. In the last 10 to 15 years we have seen many cases where technology has compromised safety and only the coordinated work of a crew (two pilots or more) saved the day.
Aircraft manufacturers and certain regulators claim the technology is ready for eMCO and will lead to enhanced safety. But this raises the question as to why is this technology not made available to be implemented within the 2-pilot cockpit and thereby to enhance safety even more?
Until automation technology can achieve a higher level of safety (at least in terms of situational awareness, communication, and judgement) compared to the current level of safety with two professional pilots in the cockpit - the reduction of pilots in a cockpit should not be considered.
Computers can do certain things better than humans, but they are only as good as their system design. Taking the human pilot out of the loop removes a significant safety resource. While humans may introduce some failure-scenarios, they at the same time eliminate system-failure scenarios and act as a critical onboard backup for failed systems, bridge technology-gaps and adapt in real-time and in the real environment to non-anticipated situations. Whether an automated system can adequately compensate for this is highly questionable. Additionally, with the reduction of input by human pilots, the risk of system associated threats increases.
Commercial pressure and transparency of the development and certification process
Commercial pressure from aircraft manufacturers and their customers must not play a role in the development of reduced crew operations. The B737 MAX has demonstrated that such pressure leads to wrong – and possibly fatal – decisions in the aircraft design and certification process. The relationship between the regulator and the aircraft manufacturer must be carefully managed, preventing ‘regulatory capture’ (where a regulatory agency is de facto ‘co-opted’ to serve the commercial interest of a commercial constituency). In the process of eMCO and SiPO concept development, firm scrutiny from the independent aviation regulators is therefore essential for safeguarding the highest level of safety.
Strong Gap and Risk analysis is required in the development process. These gaps and risks need to be identified in a transparent manner and with non-EASA experts involved, including commercial airline pilot experts.
ECA and other pilot organizations bring substantial operational expertise, that can contribute to the discussion on eMCO and SiPO developments, with the aim of safeguarding safety.
Flight Safety and technical aspects
Any type of reduced crew concepts, such as eMCO and SiPO, could generate high risks to operating an aircraft from a flight safety perspective. The below list describes a selection of the risks involved.
Selected Flight Safety and technical aspects
| Safety & Operations | Airline aircraft are designed for more than one pilot on the flight deck because safety and operations require it. The benefit sought in reducing crew composition – versus the associated costs, risks, and reduction in redundancy, problem solving capacity and resilience – is questionable and so far has not been demonstrated. |
| Safety II | While a lot of accident and incident statistics document how often things go wrong, there is almost no data on when things go right, and pilots save the day. Understanding how and when human adaptivity meets day-to-day, unexpected, and undocumented challenges is key before replacing the flexible human by technology. |
| Creative solutions | Problems arising in a complex and fast-changing environment rarely ever have a simple solution. It is the strength of the human being to come up with creative solutions whereas an automated system will be limited to digital, pre-programmed solutions. While highly advanced AI applications are showing first signs of creativity, this creativity differs from human creativity and is therefore not able to replace it. |
| Pro-active measurements | Automated systems are reactive, whereas the human can recognise trends and act proactively. |
| Incapacitation & Redundancy | The single pilot concept does not protect against the potential incapacitation of one pilot. There have been several incidents documented where one pilot has become incapacitated and the other pilot on board has been able to recover the situation and bring the flight to a safe conclusion. A pilot at a ground station does not provide the same level of safety as an additional pilot in the cockpit. To date, EASA has not demonstrated that the same incapacitation-related fatal accident risk of 2-pilots can be maintained with only one pilot in the cockpit, given that the 2nd pilot reduces this risk by a factor of 1.000 (‘1% rule’). |
| Redundancy II | Humans make mistakes, but they are also able to identify them and take corrective action, providing a safety net for the error of others. This element of redundancy would be eliminated in both eMCO and SiPO concepts. |
| Cyber Security | The current cyber-infrastructure of the aviation sector is already prone to attack. Further introduction of automation and remote control can only increase this risk. Even today, operators and manufacturers are unable to mitigate all attack vectors or keep up with ever emerging new attack methodologies. Furthermore, flight crew currently form the last line of defense against the potentially fatal consequences of a cyber-attack on the aircraft or airspace infrastructure. Reduced crew with associated loss of awareness (see Fatigue topic below) will significantly reduce the effectiveness of this vital safety net. |
| Insider threat/SEC | Crews working in an eMCO/SiPO environment potentially will have only limited social interaction with colleagues before, during and after flight duty. Any tendency towards mentally unhealthy, criminal or radicalized attitude could remain unnoticed and would be almost impossible to detect, thus taking away a vital means of protection of the flight deck from insider threats. In a ground aided cockpit environment this threat could come from the ground or from the crewmember themselves. |
| Workload/role of two pilots | The increased use of automation has also affected the administrative support structure surrounding flight operations, by replacing support staff with a growing number of (more or less) automated systems. The result of this is that operations now heavily rely on a qualified and experienced cockpit-crew to deal with most of the dispatch and inflight administrative tasks. Especially in short-medium haul operations the time spent dealing with a multitude of documentation and calculations, as well as some of the legal aspects of carrying out commercial flights, has grown significantly. The automated systems have not alleviated the workload enough to justify reducing the pilot numbers to one in these types of operations. |
| CRM | Placing a second crewmember in a remote location would jeopardize the quality of crew resource management and crew coordination. Current CRM requirements and standards would need to be redesigned and retrained. |
| Pilot at ground station | A “remote crew member“ can be of additional support. He/she however will always have a limited “picture” based on transferred data (data which could also be corrupted). Communication and exchange with a remote crew member are uncertain (continuous or only in emergency?), and it is very likely that it will take – potentially life-saving – time to obtain situational awareness, especially for ground pilots following multiple aircraft at the same time. |
| Procedures | Operating commercial flights with a single pilot (during cruise or the full flight) would require an extensive change in procedures. The current procedures are designed to be fulfilled by 2-pilots cross checking each other’s situation recognition, procedure confirmation and then subsequent action. |
| Training | Current training is based on a 2-pilot operation. New training would have to be developed and then delivered to secure safe operations in reduced crew configuration. |
| Physiological Limitations and workload | A minimum 2-pilot flight crew is necessary to manage the flight deck workload (e.g. flying, radio, systems, and crew management). Many physiological limitations for the pilot in control may adversely impact the safety of a single pilot mission. |
| Fatigue | There is extensive research showing that the removal of social and professional interaction has a significant impact on both the vulnerability to fatigue (including involuntary sleep), and the fatigue accumulated over a given time, for the remaining pilot. Reduction in crew through eMCO or SiPO would require a significant protective revision of FTL rules, including reduction in FDPs, minimising the economic benefit of both reduced and single pilot operations. Additionally, any rest location other than a well-designed crew bunk - would lead to a significant reduction in rest quality, due to the presence of external stimuli (e.g. light, noise, movement etc). |
| Wake-up time | Problem solving must start quickly, decisions might have to be taken without delay. Depending on sleep phase of the second crewmember when called back it might take up to 20 minutes until the full cognitive capabilities are re-established, and the aircraft cannot simply pull over and stop in the meantime. |
| Competency path for command | At present the skills and experience required for command of an aircraft are gained through time spent as a first officer with exposure to existing commanders. It is difficult to see how this experience level can be achieved while reducing crew composition. |
| Interaction with Air Traffic Management, technology, and UAS development | The significant changes in interaction, technology and procedures with eMCO and SiPO will likely enable changes in the role and balance of authority between ATM and pilots. This may also overlap with or reinforce changes coming from the development of the UAS industry. |