The Human and the concepts of Reduced Crew Operations (RCO): Extended Minimum Crew Operations & Single Pilot Operations
KEY MESSAGES
- With the changing aircraft generations, and the evolution from early jets to the fly by wire technology, the automation on the flight deck has evolved over the years as well. The pilot community embraces any advancements in technology that enhance flight safety. For this reason, ECA does not support Reduced Crew Operations (RCO), i.e. reduced or single pilot operations, in Commercial Air Transport during any phase of flight.
- Future further development and increased use of automation in commercial aircraft, and eventually certification of Artificial Intelligence (AI) for the use in this environment, should have as a goal enhancement of human capacity, and not its replacement. This in return would increase efficiency and – most importantly – enhance Flight Safety.
- Two specific RCO concepts – extended Minimum Crew Operations (eMCO) and Single Pilot Operations (SiPO) – are currently being prepared for implementation in the near and mid-term future and raise great concern. It is crucial that all the safety risks stemming from both concepts are fully analyzed, understood, and solved before any change to the standards is considered.
- These concepts are driven by the industry seeking economic advantages by reducing the number of pilots in the cockpit. History has shown that putting economic gains as primary goal tends to have a detrimental influence on flight safety.
Introduction
Aviation is the safest transportation system in history by learning from its mistakes and a constant process of improving flight safety standards.
Building on the knowledge and experience of over a century of commercial flights – the ultimate goal of technological and regulatory developments must not only be maintaining but enhancing aviation safety. This even more so given the growth in air traffic which requires a constant improvement in safety levels.
Both eMCO and SiPO assume a reduction of the number of highly qualified safety professionals – the pilots – from the flight deck and raise serious concerns about the negative impact on flight safety.
The eMCO concept aims to stretch the maximum flight time limitations by prolonging in-flight rest for pilots. To achieve this, only one pilot would be required to remain at the controls for extended periods of the cruise phase while the other pilot would be resting away from the controls.
The next intended step for the industry is SiPO – in which there will only be one pilot onboard at any given time during flight, also during critical phases of flight such as takeoff and landing. Although these two RCO concepts can appear similar in nature and operation – they pose in fact both different and similar challenges. They should be treated as two separate types of operations as the defining difference is the (potential) on-board availability of a full 2-pilot crew in the eMCO concept – which is not the case in SiPO.
Augmenting and not replacing human capacity
The developments in technology/automation (including Artificial Intelligence, AI) are expected to play an important role in the future of air transport. While ECA supports the development and integration of those in commercial air transport, it cannot be done at the cost of removing one pilot from the cockpit. The equation “2-pilots in the cockpit + Automation” enhances safety. On the contrary, the equation “1 pilot in the cockpit + Automation” poses important threats to safety. In the last 10 to 15 years, we have seen many cases where technology’s failure has compromised safety and only the coordinated work of a crew (two pilots or more) saved the day. 1
Aircraft manufacturers and certain regulators claim the technology is ready for eMCO 2 and will lead to enhanced safety. This raises the question as to why is this technology not made available to implement it within a 2-pilot cockpit and hence to enhance safety even more?
Until automation technology can achieve a demonstrably higher level of safety (at least in terms of situational awareness, communication, and judgement) compared to the current level of safety with two professional pilots in the cockpit – the reduction of pilots in a cockpit should not be considered.
Computers can do certain things better than humans, but they are only as good as their system design. Taking the human pilot out of the loop removes a significant safety resource. They act as a critical onboard backup for failed systems, bridge technology gaps and adapt in real-time and in the real environment to non-anticipated situations. Whether an automated system can adequately compensate for this is highly questionable. Additionally, with the reduction of input by human pilots, the adaptive capacity of the entire system is significantly reduced.
Commercial pressure and transparency of the development and certification process
Commercial pressure from aircraft manufacturers and their customers must not play a role in the development of reduced crew operations. The relationship between the regulator and the aircraft manufacturer must be carefully managed, preventing ‘regulatory capture’ (where a regulatory agency is de facto ‘co-opted’ to serve the commercial interest of a commercial constituency). In the process of the RCO concepts development, firm scrutiny from the independent aviation regulators is therefore essential for safeguarding the highest level of safety.
Strong Gap and Risk analysis is required in the development process. These gaps and risks need to be identified in a transparent manner and with independent experts involved, including commercial airline pilot experts.
ECA and other pilot organisations bring substantial operational expertise, that can contribute to the discussion on eMCO and SiPO developments, with the aim of safeguarding safety. 3
Flight Safety and technical aspects
Any type of Reduced Crew Operation concepts could generate high risks to operating an aircraft from a flight safety perspective. In fact, eMCO brings new hazards that have not been properly analysed, with EASA having already identified almost 50 types of such hazards.
The below list compiled by ECA safety experts describes some of the risks that need to be addressed and researched. Further hazards and related risks will most likely be identified as work continues.
Selected Flight Safety and technical aspects
| Safety & Operations | Airline aircraft are designed for more than one pilot on the flight deck because safety and operations require it. The benefit sought in reducing crew composition – versus the associated costs, risks, and reduction in redundancy, problem solving capacity and resilience – is questionable and so far has not been demonstrated. |
| Safety II | While accident and incident statistics document how often things go wrong, there is almost no data on when things go right, and pilots save the day. Understanding how and when human adaptivity meets day-to-day, unexpected, and undocumented challenges is key before replacing the flexible human by technology. |
| Creative solutions | Problems arising in a complex and fast-changing environment rarely ever have a simple solution. It is the strength of the human being to come up with creative solutions whereas an automated system will be limited to digital, pre-pro-grammed solutions. While highly advanced AI applications are showing first signs of creativity, it differs from human creativity and is therefore not able to replace it. |
| Pro-active measurements | Automated systems are reactive, whereas the human can recognise trends and act proactively. |
| Incapacitation & Redundancy | SiPO does not protect against the potential incapacitation of one pilot. There have been numerous documented incidents where one pilot has become incapacitated and the other pilot on the flight deck has been able to recover the situation and bring the flight to a safe conclusion. One pilot alone in the flight deck increases exponentially the safety risk in case of incapacitation. To date, it has not been demonstrated that the same incapacitation-related fatal accident risk of 2-pilots can be maintained with only one pilot in the cockpit, given that the 2nd pilot reduces this risk by a factor of 1.000 (‘1% rule’). |
| Redundancy II 5 | Humans make mistakes, but they are also able to identify them and take corrective action, providing a safety net for the error of others. This element of redundancy would be eliminated in both eMCO and SiPO concepts. |
| Cyber Security | The current cyber-infrastructure of the aviation sector is already prone to attack. Further introduction of automation and remote control (i.e.: a remote pilot at a ground station) can only increase this risk. Even today, operators and manufacturers are unable to mitigate all attack vectors or keep up with ever emerging new attack methodologies. Furthermore, flight crew currently form the last line of defense against the potentially fatal consequences of a cyber-attack on the aircraft or airspace infrastructure. Reduced crew with associated loss of awareness (see Fatigue topic below) will significantly reduce the effectiveness of this vital safety net. |
| Insider threat/SEC | Currently a two pilot flightdeck is ensuring enhanced vigilance and maintaining dual oversight in the flight deck to mitigate any potential risks posed by internal vulnerabilities. |
| Mental wellbeing | Crews working in an eMCO/SiPO environment potentially will have only limited social interactions with colleagues before, during and after flight duty which are detrimental to the mental wellbeing. |
| Workload/role of two pilots | The increased use of automation has also affected the administrative support structure surrounding flight operations, by replacing support staff with a growing number of (more or less) automated systems. The result of this is that operations now heavily rely on a qualified and experienced cockpit crew to deal with most of the dispatch and in-flight administrative tasks. Especially in short-medium haul operations, the time spent dealing with a multitude of documentation and calculations, as well as some of the legal aspects of carrying out commercial flights, has grown significantly. The automated systems have not alleviated the workload enough to justify reducing the pilot numbers to one. |
| Crew Resource Management (CRM) | Placing a second crew member in a remote location would jeopardise the quality of crew resource management and crew coordination. Current CRM requirements and standards would need to be redesigned and retrained. |
| Pilot at ground station | A “remote crew member" can be of additional support but should never replace a pilot in the flight deck because he/she will always have a limited “picture” based on transferred data (data which could also be corrupted or interfered with). Communication and exchange with a remote crew member are uncertain (continuous or only in emergency?), and it is very likely that it will take – potentially life-saving – time to obtain situational awareness, especially for ground pilots following multiple aircraft at the same time. |
| Procedures | Operating commercial flights with a single pilot (during cruise or the full flight) would require an extensive change in procedures. The current procedures are designed to be fulfilled by 2-pilots cross checking each other’s mental model, procedure confirmation and then subsequent action. |
| Training | Current training is based on a 2-pilot operation. New training would have to be developed and then delivered to secure safe operations in reduced crew configuration. |
| Physiological Limitations and workload | A minimum of 2-pilot flight crew is necessary to manage the flight deck workload (e.g. flying, radio, systems, and crew management). Humans are subject to certain physiological limitations, such as sensory perception, receptivity, or the number of physical activities that can be performed simultaneously, as well as the need for restroom breaks. Single-pilot operations over longer periods of time may adversely affect safety, as the remaining pilot can face sensory-overload, sensory illusions, task-saturation, or be distracted by the urge to use the restroom. |
| Fatigue | There is extensive research showing that the removal of social and professional interaction has a significant impact on both the vulnerability to fatigue (including involuntary sleep), and the fatigue accumulated over a given time, for the remaining pilot. To ensure safety, a reduction in crew through eMCO or SiPO would require a significant protective revision of FTL rules, incl. a reduction in FDPs (minimizing also the economic benefit of such reduced crew operations). Additionally, any rest location other than a well-designed crew bunk - would lead to a significant reduction in rest quality, due to the presence of external stimuli (e.g. light, noise, movement etc.). |
| Wake-up time | Problem solving must start quickly, decisions might have to be taken without delay. Depending on sleep phase of the second crewmember when called back it might take up to 30-35 minutes until the full cognitive capabilities are re-established, and the aircraft cannot simply pull over and stop in the meantime. 6 |
| Competency path for command | At present the skills and experience required for command of an aircraft are gained through time spent as a first officer with exposure to existing commanders. It is difficult to see how this experience level and knowledge transfer can be achieved while reducing crew composition. |
| Interaction with Air Traffic Management, technology, and UAS development | The significant changes in interaction, technology and procedures with eMCO and SiPO will likely enable changes in the role and balance of authority between ATM and pilots. This may also overlap with or reinforce changes coming from the development of the UAS industry. |
1 Examples include: QF32 (A380), QF72 (A330), CPA380 (A330), US Airways 1549 (A320).
2 Source: Business Insider
3 Valuable publications relevant for the eMCO and SiPO project have been published in the recent years by ALPA-I (The dangers of Single-Pilot Operations), ECA (UAS and the concepts of automation and autonomy) and IFALPA (The dangers of reduced crew operations), describing well the technical challenges of these initiatives.
4 This list has been compiled by EASA’s ‘expert group’ on eMCO (2022/23). It is part of this group’s final (unpublished) report.
5 Term derived from Safety II
6 See e.g. final accident investigation report AF447 (Rio-Paris).