D1.1 Scope and State of the Art

Advanced Cockpit for Reduction Of Stress and Workload

Document author(s) alphabetical Keyvan Bayram, Eriza Fazli, Jelena Dokic, Clive Goodchild, Paul Kou, Ana Paz Gonçalves Martins, Nicholas McDonald, Sara Peces Pascual, Nicholas Senequier, Nils Stark, Steven Sweeney, Uwe Teegen, Ronald Verhoeven, Florence Zambetti

Responsible Partner DLR

Dissemination Level

PU Public X

PP Restricted to other programme participants (including the Commission Services)

RE Restricted to a group specified by the consortium (including the Commission Services)

CO Confidential, only for members of the consortium (including the Commission Services)

Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Document information table

Contract number: ACP2-GA-2012-3141501 Project acronym: ACROSS Project Co-ordinator: THALES AVIONICS Document Responsible Partner: DLR [email protected] Document Type: Report Document number: ACROSS/WP1/DLR/TECH/DEL/002 Document Title : Scope and State of the Art Document ID: D1.1-1 Version: 1 Contractual Date of Delivery: 30.06.2013 Actual Date of Delivery: 01.07.2013 Filename: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docx Status: Released

Approval status

Document Manager Verification Authority Project Approval Thomas Dautermann Thomas Dautermann Thomas Dautermann Nicholas McDonald Nicholas McDonald Oliver Lücke Oliver Lücke Pascal Traverse Pascal Traverse Paul Kou Paul Kou Clive Goodchild Clive Goodchild Bryce Billiere Bryce Billiere Linda Napoletano Linda Napoletano Wilfred Rouwhorst Wilfred Rouwhorst Daniel Mosquera Cristina Martinez

Preface

This publication only reflects the view of the ACROSS Consortium or selected participants thereof. Whilst the ACROSS Consortium has taken steps to ensure that this information is accurate, it may be out of date or incomplete, therefore, neither the ACROSS Consortium participants nor the European Community are liable for any use that may be made of the information contained herein. This document is published in the interest of the exchange of information and it may be copied in whole or in part providing that this disclaimer is included in every reproduction or part thereof as some of the technologies and concepts predicted in this document may be subject to protection by patent, design right or other application for protection, and all the rights of the owners are reserved. The information contained in this document may not be modified or used for any commercial purpose without prior written permission of the owners and any request for such additional permissions should be addressed to the ACROSS co-ordinator (Thales Avionics S.A., 105 Av. du General Eisenhower, BP 63647, 31036 Toulouse, FRANCE, for the attention of the ACROSS Project Manager) in the first instance.

This document is produced under the EC contract ACP2-GA-2012-314501. It is the property of the ACROSS consortium and shall not be distributed or reproduced without the formal approval of the ACROSS Steering Committee. Unrestricted PUBLIC Access – EU Project

2 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

The D1.1 contributions were gathered thanks to the partners’ expertise in various fields:

• Airbus at System Level, • Boeing RTE as a System Integrator, • BAE with regard to incapacitated crew, • Deep Blue as a transversal linker between the work packages, • DLR as work package leader and provider of scientific background on basic cognitive concepts, • Trinity College Dublin as expert on human, organizational and operational aspects of monitoring technologies, • ISDEFE with respect to regulation, certification and safety, Jeppesen for navigate and mission management, • NLR for aviate aspects, • Triagnosys for communicate, • TU Braunschweig for supervision, • Thales Avionics for manage systems. • Dassault Aviation as business aircraft manufacturer and associated operations expert.

3 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Revision table

Version Date Modified Author Comments Page/Sections 1 28.06.2013 Version submitted to the EC

Circulation list

Name Company/Institution

European Commission

ACROSS consortium

4 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Executive summary

This document is the Deliverable D1.1-1 Scope and State of the Art of ACROSS, a European 7 th Framework EC funded project. The main purposes of ACROSS are:

• To develop, integrate and test new cockpit solutions that facilitate the management of the peak workload situations that can occur during a flight, in order to improve safety and ensure the reduction of accident risks through the reduction of stress;

• To develop, integrate and test new cockpit solutions that will allow reduced crew operations in a limited number of well-defined conditions;

• To identify the remaining open issues for the implementation of single pilot operations, taking into account first learning about evaluations done on workload reduction and reduced crew operations.

This document details the goals of the ACROSS project and collects the state of the art in technology, procedures and regulations, as well as human aspects related to workload for basic operations (two pilots in the cockpit), reduced crew operations (single-pilot situation for long haul flights) and incapacitated crew situations.

It starts out with a chapter on the scope of the project, which includes the operational context of today’s civil aviation environment (introducing basic and reduced crew operations), with different situations: nominal and abnormal, including incapacitated crew. Reduced crew and incapacitated crew are defined based on literature and state of the art research results.

A review of basic cognitive concepts relevant for ACROSS is done in chapter 2. Workload, stress, situation awareness, automation, human error, and other relevant constructs, are described.

Chapter 3 describes human, organizational and operational aspects of monitoring technology. This section focuses on risk in aviation and potential challenges with respect to detecting stress fatigue and incapacitation with respect to ergonomic factors.

In Chapter 4, causes for high workload are identified in normal conditions as well as in reduced crew situations. Contributions of technology to high workload are pointed out and collected.

Chapter 5 then collects the state of the art in technology that is used for the abolishment and reduction of workload at the time of the start of the ACROSS project.

The incapacitated crew perspective is inherently different from reduced and nominal crew. In an incapacitated crew situation, there will not be any workload on the human and therefore, the incapacitated crew part is structurally separated from the rest and presented in Chapter 6.

Chapter 7 identifies areas for improvement that can be envisioned with respect to the state-of-the art in workload reduction.

Chapter 8 provides an overview of the relevant rules and regulations pertaining to workload, reduced crew and incapacitated situation.

5 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Partners involved in the document

Nb Member name Short Check if name involved Thales-Avionics S.A (Coordinator) THAV 1 X Airbus Operations SAS A-F 2 X Dassault Aviation S.A. DAV 3 X BAE Systems (Operations) Ltd BAE 4 X National Aerospace Laboratory NLR 5 X DeepBlue DBL 6 X Jeppesen GmbH JEPP 7 X CertiFlyer CFLY 8 Continental CONTI 9 DLR 10 Deutsches Zentrum für Luft- und Raumfahrt e.V. X EADS G 11 EADS Innovation Works Germany ACE 12 Airbus SAS GMV 13 GMVIS Skysoft, S.A. HAI 14 Hellenic Aerospace Industry S.A. Ingeniería de Sistemas para la Defensa de España, S. A. (ISDEFE) ISD 15 X Stirling-Dynamics STIRL 16 Turkish Aerospace Industry TAI 17 Trinity College Dublin TCD 18 X Thales Training & Simulation TTS 19 TriaGnoSys GmbH TGS 20 X Thales Nederland BV TRT 21 Technische. Universität Braunschweig TUBS 22 X Technical University of Delft TUD 23 University of Malta UOM 24 USE2ACES b.v. U2A 25

6 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Zodiac Aerospace - ECE ZDC 26 Diehl Aerospace GmbH DAS 27 GTD Sistemas de Información GTD 28 EADS Innovation Works France EADS F 29 Tony Henley Consulting THL 30 Boeing RTE BRTE 31 X SELEX Galileo SEL 32 Warsaw University of Technology WUT 33 Airbus Operations Ltd A-UK 34 Airbus Operations GmbH A-D 35

7 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Table of contents

LIST OF FIGURES ...... 12

LIST OF TABLES ...... 12

LIST OF ABBREVIATIONS ...... 13

1 SCOPE ...... 20

1.1 Project Aim 20

1.1.1 Across Objectives ...... 23 1.1.2 ACROSS Approach ...... 23

1.2 Operational Context 24

2 A REVIEW OF BASIC COGNITIVE CONCEPTS ...... 28

2.1 Workload 28

2.1.1 Measuring Mental Workload ...... 32

2.2 Stress 35

2.2.1 Measuring Stress ...... 37

2.3 Situation Awareness (SA) 37

2.3.1 Measuring Situation Awareness ...... 41 2.3.2 Display-design principles ...... 42

2.4 Automation 44

2.4.1 Alarms ...... 46

2.5 Human Error 47

3 HUMAN, ORGANISATIONAL AND OPERATIONAL ASPECTS OF MONITORING TECHNOLOGIES ...... 51

3.1 Evolution of risk in aviation 51

3.2 Managing workload, stress and fatigue in the operational situation 52

3.3 Challenges in the detection and monitoring of stress, fatigue and incapacity 53

3.4 The role and philosophy of automation 54

3.5 Managing risk in human resources 55

3.6 Stakeholders, interests and trust 57

8 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

3.7 The emerging role of the manufacturing sector 57

3.8 Systemic Human Factors 59

4 CAUSES OF HIGH WORKLOAD ...... 61

4.1 System Level 62

4.2 Systems Integrator’s Point of View 64

4.3 Navigate and Mission Management 65

4.3.1 Workload Development in Nominal Situations ...... 65 4.3.2 Workload Development in Reduced Crew Situations ...... 66

4.4 Communicate 67

4.4.1 Workload Development in Nominal Situations ...... 67 4.4.2 Workload Development in Reduced Crew Situations ...... 69

4.5 Manage Systems 70

4.5.1 Workload Development in Nominal Situations ...... 70 4.5.2 Workload Development in Reduced Crew Situations ...... 74

4.6 Aviate Aspects 74

4.6.1 Workload Development in Nominal Situations ...... 74 4.6.1.1 Normal situation ...... 74 4.6.1.2 Abnormal anticipated causes ...... 79 4.6.1.3 Abnormal unexpected causes ...... 80 4.6.2 Workload Development in Reduced Crew Situations ...... 81

4.7 Real Cases 82

5 CURRENT MECHANISMS FOR WORKLOAD REDUCTION ...... 89

5.1 System Level 89

5.2 Systems Integrator’s Point of View 99

5.3 Navigate and Mission Management 100

5.3.1 Workload Reduction in Nominal Situations ...... 100 5.3.2 Workload Reduction in Reduced Crew Situations ...... 100

5.4 Communicate 100

5.4.1 Workload Reduction in Nominal Situations ...... 100 5.4.2 Workload Reduction in Reduced Crew Situations ...... 103

5.5 Manage Systems 103

5.5.1 Workload Reduction in Nominal Situations ...... 103 5.5.2 Workload Reduction in Reduced Crew Situations ...... 105

9 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

5.6 Aviate Aspects 105

5.6.1 Workload Reduction in Nominal Situations ...... 105 5.6.1.1 Systems ...... 105 5.6.1.2 Workload management ...... 109 5.6.2 Workload Reduction in Reduced Crew Situations ...... 111 5.6.2.1 Unintentionally reduced crew ...... 111 5.6.2.2 Single crew operation ...... 112

5.7 Supervision 112

5.7.1 Workload Development in Nominal Situations ...... 112 5.7.1.1 Auto-flight System...... 112 5.7.1.2 Flight Controls ...... 117 5.7.1.3 Fuel ...... 118 5.7.1.4 Ice and Rain Protection ...... 118 5.7.1.5 Central Warning & Display Systems...... 118 5.7.1.6 Navigation ...... 120 5.7.1.7 Engine Indicating ...... 122 5.7.2 Workload Development in Reduced Crew Situations ...... 122

6 FULL INCAPACITATED CREW SITUATIONS ...... 123

6.1 Effects 123

6.2 Statistics 123

6.3 Current Prevention Strategies 124

6.4 Technology 125

6.5 Real Cases 127

7 AREAS FOR IMPROVEMENT ...... 132

7.1 Workload in Nominal and Reduced Crew Situations 132

7.1.1 System Level...... 132 7.1.2 Systems Integrator’s Point of View ...... 132 7.1.3 Navigate and Mission Management ...... 133 7.1.3.1 Nominal Situations ...... 133 7.1.4 Communicate ...... 133 7.1.4.1 Nominal Situations ...... 133 7.1.4.2 Reduced Crew Situations ...... 135 7.1.5 Manage systems ...... 135 7.1.5.1 Nominal Situations ...... 135 7.1.5.2 Reduced Crew Situations ...... 136 7.1.6 Aviate Aspects ...... 136 7.1.6.1 Nominal Situations ...... 137 7.1.6.2 Reduced Crew Situations ...... 145 7.1.7 Supervision ...... 146 7.1.7.1 Nominal Situations ...... 146 7.1.7.2 Reduced Crew Situations ...... 147

7.2 Incapacitated Crew Situations 147

10 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

8 REGULATION, CERTIFICATION AND SAFETY ASPECTS ...... 149

8.1 Aviation Regulatory Framework 149

8.2 Analysis of the current regulation 153

8.2.1 Current Regulation ...... 154 8.2.1.1 ICAO Regulation ...... 154 8.2.1.2 EASA Regulation ...... 155 8.2.1.3 FAA Regulation...... 156 8.2.2 Workload Aspects ...... 156 8.2.2.1 Individual Factors...... 157 8.2.2.2 System Factors ...... 164 8.2.2.3 Corporate Factors ...... 169

8.3 Regulation Summary 170

9 REFERENCES ...... 175

11 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

List of Figures

Figure 1 - Percentage of fatal accidents and onboard fatalities by phase of flight from 2002 through 2011 (from Boeing, 2011)...... 21 Figure 2 - The three objectives for ACROSS...... 23 Figure 3 - Different situations to be explored in ACROSS...... 23 Figure 4 - The classic information processing framework...... 29 Figure 5 - The four dimensions of the Multiple Resource Model (from Wickens, 2002)...... 30 Figure 6 - Graphic representation of the Yerkes-Dodson law (adapted from Diamond et al., 2007)...... 31 Figure 7 - Model of Situation Awareness (adapted from Endsley, 1995)...... 38 Figure 8 - The Swiss-cheese model of accident causation (from Martinussen & Hunter, 2010)...... 48 Figure 9 - Categories of errors committed by pilots (adapted from Wiegmann and Shappell, 2003)...... 49 Figure 10 - Categories of preconditions for safe acts (adapted from Wiegmann and Shappell, 2003)...... 50 Figure 11 - Pilot-Controller Communication Loop [from Flight Safety Foundation (FSF), 2010]...... 67 Figure 12 - Example of A380 cockpit...... 71 Figure 13 - Example of an Overhead Panel (A380)...... 72 Figure 14 - Example of System Synoptics page (A380)...... 72 Figure 15 - Example of Alerts & Procedures (ATR)...... 73 Figure 16 - Take-off runway excursion risk factors (from FSF, 2009a)...... 79 Figure 17 - Damage to the No. 2 engine (from Australian Transport Safety Bureau, 2010)...... 85 Figure 18 - Damage to electrical wiring located in the leading edge of the left wing (punctured by debris) (from Australian Transport Safety Bureau, 2010)...... 86 Figure 19 - Qantas A380 cockpit. During the emergency, pilots were alerted by 54 error messages generated by aircraft systems (taken from “Qantas Flight 32”, n.d.)...... 87 Figure 20 - B767 FMA indication (automatic landing)...... 113 Figure 21 - Boeing 777 PFD TCAS RA indication (vertical guidance)...... 114 Figure 22 - Airbus A380 PFD trim zone indication...... 116 Figure 23 - B777 EICAS indication (left engine fire)...... 119 Figure 24 - A380 ECAM indication (bleed abnormal)...... 119 Figure 25 - A380 MFD (flight plan page)...... 121 Figure 26 - NG-ISS...... 141

List of Tables

Table 1 - Abbreviations and Acronyms...... 19 Table 2 - Contrast between the intended benefits and actual consequences of new technology (adapted from Sarter, Woods and Billings, 1997)...... 45 Table 3 - Levels of Automation...... 45 Table 4 - Tasks and actions before, during, and after take-off...... 77 Table 5 -Tasks and actions during descent, approach, and landing...... 78 Table 6 - ICAO Annexes...... 150 Table 7 - Structure of EASA Regulations...... 152 Table 8 - Structure of FAA Regulations...... 153 Table 9 - Regulatory Summary...... 157 Table 10 - Classification of ICAO Regulations...... 173 Table 11 - Classification of EASA Regulations...... 173 Table 12 - Classification of FAA Regulations...... 174

12 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

List of abbreviations

ACRONYM MEANING A/C AirCraft ACARS Aircraft Communication Addressing and Reporting System ACAS Airborne Collision Avoidance Systems ACMS AirCraft Monitoring System ACROSS Advanced Cockpit for Reduction Of StresS and workload ADS-A Automatic Dependent Surveillance – Addressed ADS-B Automatic Dependent Surveillance – Broadcast ADS-C Automatic Dependent Surveillance – Contract AeroMACS Aeronautical Mobile Airport Communication System AFEPS ARINC Front End Processor Systems AFN ATS Facilities Notification AIC Aeronautical Information Circulars AIP Aeronautical Information Publication AIRAC Aeronautical Information Regulation And Control ALICIA ALl conditions operations and Innovative Cockpit Infrastructure ALT Alternate AM Amplitude Modulation AMC Acceptable Means of Compliance Aircraft Maintenance Manual AMM Airport Moving Map ANSP Air Navigation Service Provider AOA ACARS Over AVLC AOC Airline Operations Centre AP Autopilot AP/FD AutoPilot / Flight Director APU Auxiliary Power Unit

ARINC Aeronautical Radio INCorporated ASAS Airborne Separation Assistance System ASCII American Standard Coded for Information Interchange ASHTAM ASH warning TO AirMan (NOTAM for volcanic activity) ASPA-C&P Airborne SPAcing – enhanced Crossing and Passing operations ASPA-ITP Airborne SPAcing – enhanced In-Trail Procedures ASPA-S&M Airborne SPAcing – enhanced Sequencing and Merging operations

13 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

ASRS Aviation Safety Reporting System ATC Air Traffic Control

A/THR Auto THRottle ATIS Automatic Terminal Information Service ATM Air Traffic Management ATN Aeronautical Telecommunications Network ATN/IPS Aeronautical Telecommunications Network using the Internet Protocol Suite Aeronautical Telecommunications Network based on Open Systems ATN/OSI Interconnection ATS Air Traffic Services AVLC Aviation VHF Link Control Bps Bits per second BTV Break-To-Vacate CAA Civil Aviation Authority Category CAT Commercial Air Transport CB Circuit Breaker CDTI Cockpit Display of Traffic Information CDU informationControl Display Unit CDS Cockpit Display System CEAS Council of European Aeroespace Societies CFIT Controlled Flight Into Terrain CFR Code of Federal Regulations CG Center of Gravity CLB CLimB CLEANSKY Not an acronym CMS Crew Management System COTS Commercial Off The Shelf CPDLC Controller Pilot Data Link Communications CRM Cockpit / Crew Resource Management CS Certification Specification CVS Combined Vision System CVR Cockpit Voice Recorder DASC Digital Avionics Systems Conference D-ATIS Data link Air Traffic Information Service DCDU Data link Control and Display Unit D-FIS Digital Flight Information Services

14 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

DLH Deutsche LuftHansa DLS IR Data Link Services Implementing Rule DOT Department of Transportation DPSK Differential Phase Shift Keying DRAWS Defence Research Agency Workload Scale DVI Detailed Visual Inspection EAS Emergency Avoidance System EASA European Aviation Safety Agency EATCHIP European Air Traffic Control Harmonisation and Integration Programme EC European Council ECAM Electronic Centralized Aircraft Monitor ECP ECAM Control Panel ECG ElectroCardioGram EEAG External Experts Advisory Group EEG ElectroEncephaloGraphy

EFB Electronic Flight Bag EFIS Electronic Flight Instrument System EGPWS Enhanced Ground Proximity Warning Systems EICAS Engine Indication and Crew Alerting System EPR Engine Pressure Ratio ERP Event-Related Potentials ESA European Space Agency ETA Estimated Time of Arrival ETOPS Extended-range Twin-engine Operation Performance Standards

EVS Enhanced Vision System EU European Union FAA Federal Aviation Administration FADEC Full Authority Digital Engine Control FANS Future Air Navigation System FAR Federal Aviation Rules FAS Final Approach Segment FBW Fly-by-wire FCOM Flight Crew Operating Manual Future Communications Systems FCS Flight Control System FCU Flight Control Unit

15 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

FDAMS Flight Data Acquisition and Management System FL Flight Level FLYSAFE Not an acronym FMA Flight Mode Annunciator FMC Flight Management Computer FMP Flight Mode Panel FMS Flight Management System FO First Officer FP Framework Programme (of the European Commission) FRF Flight Reconfiguration Function FRM Fatigue Risk Management FSF Flight Safety Foundation FTC Fault Tolerant aircraft Control FTL Flight Time Limitations FWC Flight Warning Computer FWS Flight Warning System GA Go-Around GALILEO Not an acronym GIM Global Implicit Measure GM Guidance Material GNSS Global Navigation Satellite System GPS Global Positioning System GPWS Ground Proximity Warning System GW Gross Weight GWCG Gross Weight Centre of Gravity HCI Human-Computer-Interaction HDD Head Down Display Human Factors HF High Frequency HILAS Human Integration into the Lifecycle of Aviation Systems HMD Helmet or Head Mounted Display HMI Human Machine Interface HOTAS Hands On Throttle And Stick HUD Head Up Display ICAO International Civil Aviation Organisation ICS Intelligent Crew Support

16 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

IEEE Institute of Electrical and Electronics Engineers IFR Instrument Flight Rules INOP SYST Inoperative Systems IP(v4, v6) Internet Protocol (version 4, version 6) IR Implementing Rules IRS Inertial Reference System ISAS Integrated Situation Awareness System ISAWARE Increasing Safety through collision Avoidance WARning intEgration ISO International Organization for Standardization ISS Integrated Surveillance System KCCU Keyboard Cursor Control Unit L-DACS L-band Digital Aeronautical Communications System LIDAR Not an Acronym LNAV Lateral NAVigation LoA Levels of Automation LOSA Line Oriented Safety Audit MCDU Multipurpose Control Display Unit MDA/DH Minimum Descent Altitude / Decision Height MEL Minimum Equipment List METAR Meteorological Terminal Air Report MFD MultiFunction Display MIDU Multi-input Interactive Display Unit MRQ Multiple Resource Questionnaire MTOW Maximum Take-Off Weight MU Management Unit NASA National Aeronautics and Space Administration NASA-TLX NASA-Task Load Index NAV/COM Navigation/Communication ND Navigation Display NEWSKY NetWorking the SKY for aeronautical communications NG-ISS Next Generation Intergrated Surveillance System nm nautical mile NOTAM NOTice to Air Men NOTOC Notice TO the pilot in Command NPA Notice of Proposed Amendment NTSB National Transportation Safety Board

17 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

NVG Night Vision Goggles OOOI Out of the gate, Off the ground, On the ground, Into the gate OSI Open Standard Interconnection PANS Procedures for Air Navigation Services PF Pilot Flying PFD Primary Flight Display PIC Pilot In Charge PIO Pilot Induced Oscillation PMS Pressurization Mode Selector PNF Pilot Not Flying PROSPERO PROactive Safety PERformance for Operations QNH Not an acronym. Refers to one of several Q-signals QoS Quality of Service RA Resolution Advisory RCAF Runway Collision Avoidance Function RF Radio Frequency ROP Runway Overrun Prevention ROW Runway Overrun Warning RSME Rating Scale for Mental Effort R/T Radiotelephony SA Situation Awareness SAE formerly the Society of Automotive Engineers, now SAE International SAFEE Security of Aircraft in the Future European Environment SAFESOUND Not an acronym SAGAT Situation Awareness Global Assessment Technique SANDRA Seamless Aeronautical Networking through integration of Data links, Radios and Antennas SARPs Standards And Recommended Practices SARS Situation Awareness Rating Scale SART Situation Awareness Rating Technique SA-SWORD Situation Awareness - Subjective Workload Dominance SATCOM SATellite COMmunication SCC Supervising Check Captain SDAC Systems Data Acquisition Concentrator SDC Strategic Data Consolidation SELCAL SELective CALling SESAR Single European Sky ATM Research

18 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

SID Standard Instrument Departure SMAAS Surface Movement Awareness & Alerting System SNOWTAM SNOW warning to AirMan SOFIA Smart Objects For Intelligent Applications SOP Standard Operating Procedures SPAM Situation Present Assessment Method SSR Secondary Surveillance Radar SUPRA Simulation of Upset Recovery in Aviation SVS Synthetic Vision System SWAT Subjective Workload Assessment Technique TAF Terminal Aerodrome Forecast TATEM Technologies And TEchniques for new Maintenance concepts TAWS Terrain Awareness and Warning System TCAP Traffic Collision avoidance system Alert Prevention TCAS Traffic Collision Avoidance System TMA TerMinal control Areas TOD Top Of Descent TO/GA or TOGA Take-Off / Go-Around TRL Technology Readiness Level UAS Unmanned Aerial/Aircraft System UERF Uncontained Engine Rotor Failure VACP Visual, Auditory, Cognitive, Psychomotor method VDEV Vertical DEViation VDL VHF Data Link VFR Visual Flight Rules VHF Very High Frequency VNAV Vertical NAVigation VOR/DME VHF Omnidirectional Radio / Distance Measuring Equipment VR Take-off rotation speed VSD Vertical Situation profile Display WiMAX Worldwide Interoperability for Microwave Access WIMS Weather Information Management System W/Index Workload Index WP Work Package ZFW Zero Fuel Weight

Table 1 - Abbreviations and Acronyms.

19 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

1 SCOPE

This document was produced within the framework of WP1.1, whose objectives are:

• To identify and detail the scope, context, problems and challenges under crew peak workload, in reduced crew and in incapacitated crew situations to be addressed and solved within ACROSS;

• To identify technologies and describe current state-of-the-art in both research and current operations;

• To identify needs and areas for improvement with respect to overall project objectives.

1.1 Project Aim Tremendous and continuous combined efforts by the aviation community have resulted in the achievement of a safety record in air transport that is unequalled by other modes of transport. However, the reduction in the accident rate has reached a plateau, stabilizing at a rate of about 2 accidents for every million departures for flights involving certified jet aircraft greater than 60,000 pounds gross weight (excluding airplanes manufactured in the former Soviet Union). For the 10-year period between 2002 and 2011 this translated to around 400 accidents (Boeing, 2011). In this report an accident is defined as an incident resulting in substantial aircraft damage, hull loss, serious injury or death.

In 2011 alone there were over 23 million departures with one accident occurring, on average, every 10 days worldwide. During that year four accidents resulted in fatal injuries within 30 days (Boeing, 2011). This accident rate, while relatively low, can in the future still translate into several major incidents and accidents per week as the number of airplanes flying every day increases. In fact, air travel is expected to grow around 5 percent per year over the next 20 years, resulting in an increase in the number of airplanes in service from around twenty to forty thousand (estimated by Boeing, 2011) or from sixteen to thirty-two thousand (according to Airbus, 2012) in 2031. This means that the overall frequency of accidents will also increase, as well as the number of fatalities, a trend that is unacceptable to the general public.

In Figure 1 we can see that between 2002 and 2011 approximately half of all fatal accidents (51%) occurred during the approach and landing stages (initial approach / final approach / landing), with another 16% taking place during departure (take-off / initial climb). These correspond to the phases when the crew is dealing with the highest workload, but also when the airplane is in closer proximity to the ground which reduces manoeuver margins in case of an emergency.

20 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Figure 1 - Percentage of fatal accidents and onboard fatalities by phase of flight from 2002 through 2011 (from Boeing, 2011).

As aircraft equipment becomes progressively more reliable, the percentage of accidents attributed to human error is expected to increase. According to a 2006 Boeing study, 55% of 134 major crashes that occurred between 1996-2005 could be directly linked to human error (Darby, 2006). Although mistakes and inappropriate reactions to events can be made in all phases of flight, they are more likely to occur when the workload in the cockpit is high, i.e. when the cockpit crew is required to perform very demanding or a large number of actions in a limited period of time. As such, the reduction in the overall number of accidents may require advances in technology, including higher levels of automation and improved cockpit displays to help the cockpit crew manage peak workload situations. This would ensure that pilots have the opportunity to address all relevant issues in a timely and appropriate manner.

There are several ways in which a reduction in workload can be achieved:

• Improved human machine interaction. With the levels of automation in the cockpit constantly on the rise, the crew’s tasks are likewise increasingly focusing on managing and supervising the aircraft and its systems. This puts increasing pressure on the need for good synergy between the human pilot and the machine, where they will effectively need to operate as a single entity, thus requiring sound human-machine interface and interaction concepts;

• Increased automation, alleviating the human from tasks that can be equally or more reliably conducted by automation;

• Improved support in case of abnormal conditions (failures, emergencies, etc.) to facilitate correct and timely action by the crew without overloading them, thus mitigating the risk of pilot error;

• Improved situational awareness tools, which help the crew in building a correct and timely mental picture of the situation with minimal effort. This is achieved by new avionics functionality and cockpit displays.

Increased automation, seen as a solution to excessive workload can, however, introduce new problems (Hollnagel, 2012). Bainbridge (1983) addressed this issue, describing what he called the ironies of automation , which may be more time consuming and incomprehensible than the manual operation of a system. Parasuraman & Riley (1997)

21 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

went even further, allocating causes of human error to particular automation conditions and the operators' attitude towards automation.

Even though it is a rare event, the British Civil Aviation Authority (CAA) reported 32 occasions in 2009 when pilots were incapacitated during a flight, due to illness or psychological issues. In cases like these, the remaining pilot(s) needs to manage the situation, probably under significant stress, highlighting the need to handle and manage unplanned reduced crew situations.

Another key driver in aircraft design and the operational framework is the economic pressure to decrease operating costs. One possibility is to reduce the crew complement on a flight to only one pilot in the cockpit. Cockpit crew reduction already happened in the 1980s with the elimination of the flight engineer. However, even though a single pilot is technically capable of safely flying a large transport aircraft from take-off to landing, a single pilot cannot cope with flying the aircraft in the operational context and expected safety margins of today, let alone those foreseen in the medium-term future.

Indeed, the actual safety levels can only be assured through mature crew resource management that, broadly, focus on the concept of two pilots sharing information, complementing and cross-checking each other. In today’s operational environment typically one pilot flies the aircraft (pilot flying or PF), while the other manages systems or provides support, such as radio communications and trouble-shooting in the event of failures (pilot not flying or PNF). The PNF is expected to assess not only the aircraft, but also what the PF is trying to do and the toll that is being placed on him or her. If needed, the PNF can suggest that some tasks be off-loaded from the PF or point out if something is not right (Vidulich, 2002). Therefore, current regulations require that commercial airlines have at least two pilots aboard an airplane, including two in the cockpit. One of the pilots is allowed to leave the cockpit, but only for a short period of time and under certain conditions. Additionally, in long-haul flights one or more extra pilots are available to allow the other pilots to take an in-flight rest and to comply with the rules on flight time limitations. Changing this paradigm requires the introduction of new technologies, the definition of new automatisms, but also changes in the cockpit design philosophy and in the crew role. Ultimately, it is imperative that adopted solutions do not reduce safety.

Once that is achieved, it would be possible to adopt a reduced crew operation (i.e., single- pilot) in some specific cases:

• Part of the cruise phase of long haul flights, with the possibility to reduce crew from three pilots to two (one active and one relief pilot);

• Cargo flights, especially for night missions where traffic is at a minimum;

• Business jets in convoy operations.

This configuration will introduce significant challenges and the need for advances in avionics technology to enable a single crew member to safely handle all the matters that are currently handled by a two-pilot crew. It also requires the development of a system that would be able to handle an incapacitation of the single pilot. This highlights the need for pilot monitoring and for an automatic system that can take over control and safely land the aircraft. Such a system can also be used to mitigate the risk of multiple crew incapacitation in a standard crew configuration, thereby extending safety.

22 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

1.1.1 Across Objectives In summary, there are three main objectives for ACROSS (Figure 2):

•To develop, integrate and test new cockpit solutions that facilitate the management of the peak workload situations , in order to improve safety and ensure the reduction of accident risks (up to Technology 1 Readiness Level 5, or TRL5).

•To develop, integrate and test new cockpit solutions that will allow reduced crew operations in a limited number of well-defined conditions (up to Technology Readiness Level 3, or TRL3). 2 •To define strategies and devices to manage full incapacitated crew.

•To identify the remaining open issues for the implementation of single pilot operations , taking into account evaluations done on workload 3 reduction (objective 1) and reduced crew operations (objective 2).

Figure 2 - The three objectives for ACROSS.

1.1.2 ACROSS Approach Figure 3 shows the four different situations (also called configurations or conf.) to be explored in ACROSS. The first one is the high workload condition ( Conf. 1 ), the second the intentionally reduced case ( Conf. 2 ), the third the unintentional crew reduction ( Conf. 3) and, finally, full incapacitation ( Conf. 4 ).

High Workload Workload (Full Crew) Conf.1 under Reduced Crew

Normal Non-normal Intentionally Reduced Unintentionally operations operations (1 pilot) Conf. 2 Reduced

Normal Non-normal Full Incapacitation Conf. 3 operations operations Conf. 4 (1 pilot)

Normal Non-normal operations operations

Figure 3 - Different situations to be explored in ACROSS.

23 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Under normal flying conditions (that is, normal aircraft status), a full cockpit crew (at least two pilots) will routinely experience different workload levels, mostly depending on the flight stage ( Conf. 1 ). Pilots’ workload is usually highest on take-off, approach and landing. During these stages, any last minute change can overload the pilots, who are left with less time to complete all required tasks. Other sources of high workload could be an approach in very low visibility, an air traffic management (ATM) blunder, or inclement weather.

In some cases, however, high workload can be caused or aggravated by non-normal events, like equipment malfunction, which can trigger abnormal or emergency procedures. For some of those events the crew is trained on a regular basis (e.g., engine shutdown), or operation procedures exist that describe what the crew should do in such situations (e.g., single system failure). In some cases, however, no operational procedures exist to describe what the crew tasks are, to respond to the situation (e.g., all engines shutdown, multiple cascading system failures, etc.).

In an intentionally reduced crew situation there is only one pilot in the cockpit during parts of the flight ( Conf. 2 ). This single pilot would need to be able to handle not only the normal procedures, but also the non-normal operational events. In this configuration, a second (relief) pilot is aboard the plane but not in the cockpit. It should be anticipated that the second pilot can be called to help whenever necessary.

Crew reduction can also be unintentional or unplanned when, for example, all but one of the pilots aboard fall ill or are in any other way incapacitated ( Conf. 3 ). Incapacitation is a term used to describe the inability of a member of the crew to carry out his/her normal duties because of the onset during flight of the effects of physiological factors. Incapacitation may occur as the result of the effects of hypoxia, smoke and fumes, food poisoning, falling asleep, a medical condition such as a heart attack, stroke, seizure or transient mental illness, a malicious or hostile act, but also because of accidental injuries caused by turbulence, abrupt aircraft movement, or received while using aircraft systems and equipment (“Crew Incapacitation”, n.d.). Consequently, all tasks that would normally be performed by two pilots in the cockpit have instead to be done by one. In particular, the single remaining pilot will have to be able to perform under normal and non-normal events.

The last scenario to be addressed in ACROSS corresponds to full pilot incapacitation (Conf. 4 ), that is, all pilots in the cockpit are incapacitated.

1.2 Operational Context The operational context of the project ACROSS may be seen from an airline/business operation point of view, from the air transport and air traffic environment view (which includes the SESAR approach to future aircraft operation), or from the direct cockpit viewpoint representing the normal working environment of the flight crew. These individual viewpoints highlight different aspects of the operational context of the project, each of them individually representing no increase of risks, but together potentially leading to hazardous aircraft conditions caused by the resulting peak workload for the cockpit crew.

Business/Airline Operation

The fast pace at which aircrafts are being operated is dictated by economic and financial considerations, by which any saved time is valuable for the profit of the end user (the customer). As such, aircraft operational usage profile is optimized to minimize "down time" and offer maximum efficiency, while required to maintain high standards of safety. Such

24 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

considerations are valid for the commercial air transport industry in general, but in the context of Business Aircraft operations, the most visible impacts in terms of operational context are:

• The fact that "the mission" is no longer just a one leg flight from A to B, but can be a multiple-flights mission within a timeframe (for example one week) where the same crew will need to operate the aircraft as autonomously as possible, including flight preparation tasks;

• Amount of time and information on the said mission are often short. Destination(s) may not be very familiar to the crew and may change upon short notice, according to the changes in the customer's agenda.

Avionics progress has of course eased the crew's jobs in such situations, and flight time limitations prevent overworked crew, but indubitably time pressure is growing and in addition to effects of changing time zones, the overall operational context contributes to the buildup of situations where workload, stress and fatigue may become key concerns.

General aviation aspects may be covered individually by the ACROSS goals and operational context. However, given the variety of aircraft sizes, the inherent purpose of the various aircraft types and, last but not least, the differences with regard to equipment, the general aviation view is out of scope of the project ACROSS.

Air Transport and Air Traffic Control/Management

The air traffic control (ATC) or air traffic management (ATM) context will change considerably within the next decade. Joint research and development effort is provided by the SESAR development programme (SESAR consortium, 2007) involving the main ATM stakeholders in Europe. Key features of the future development are:

• 4D-trajectory management for airborne and ground use (business trajectory);

• aircraft separation modes based on airborne equipment;

• global information management including airborne and ground agents.

The ATM-based features business trajectory and aircraft separation will directly impact airborne communication and navigation equipment and procedures, airborne systems management, and, moreover, will provide a time horizon of airborne planning and interaction functionality. Anyway, the target goals mentioned above demand a change for the communication channels from R/T to system-to-system data link connections, which may directly impact the cockpit crew's situation awareness regarding the surrounding traffic (Funabiki & Tenoort, 1999).

With regard to global information management air carriers operate under a system of prioritized objectives including safety, customer service (on-time departure and arrivals), and optimized economics. The major components needing to be coordinated for any given flight include the aircraft and support equipment, cockpit and cabin crews, maintenance, ground service personnel and air traffic control, as addressed above.

Commercial Air Transport is defined as being the carriage by air of passengers, mail and/or cargo for remuneration and/or hire. It has a very wide scope and the operations mainly differ depending on airline business models listed below:

25 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

• Network airlines: These are mainly former flag airlines that maintain hub and spoke networks, consolidating traffic at key hub airports. The Hub and Spoke system allows the airlines to maximize aircraft capacity on each flight by offering connections to both regional and international destinations. This more complicated route system provides customers with a much larger number of route options, which in turn maximizes revenue opportunities. The downside to this is the increase in aircraft wait time and lower aircraft utilization time, which increases the airlines' unit cost;

• Charter airlines: Traditionally these airlines have carried passengers at low unit costs, targeting holiday travellers. Most European charter airlines now form part of vertically integrated organisations incorporating a tour operator, travel agency chain, airline and often hotels and providers of ground transportation;

• Low cost airlines: This business model has evolved in different directions, some airlines keeping to a more solid model involving low frequency services to secondary airports, others adapting to the higher-yielding business market serving higher frequencies;

• Regional airlines: These airlines (often associated commercially to former flag carriers operating the major hubs) tend to operate shorter sectors both point to point and to feed network airline hubs, usually with aircrafts of less than 100 seats.

Work Environment: Cockpit

The cockpit crew status represents an essential aspect of ACROSS through the allocation of tasks to available crew members. The pilots’ condition is covered by the project in the assessment of the crew alertness status, e.g. to identify attention-based operational errors or incapacitation of cockpit crew members. In case of full incapacitation, internal or external activation of aircraft automation functionality needs to occur.

Aircraft automation , however, is not only part of the solution of operational problems, but may be related directly to their cause (see chapter 2.4). Nowadays, the operation and control of commercial transport aircraft are characterized to a large extent by automation functionality. The use of flight management, autopilot and autothrottle, as well as system monitoring functionality from departure to final approach represent an operational standard in airline and business aircraft operations (Chidester, 1999). Such operating conditions simultaneously ensure minimal environmental impact, support precise routing and fuel-efficiency and reduce workload of the cockpit crew. Nevertheless, the highest priority goal is still to guarantee the safety standards of air traffic.

Flight management corresponds to the planning functionality, which may be done in periods of low workload. There is, however, the risk of a loss of situation awareness, or of an error being made, if the task is interrupted, which might not be detected until it is later executed. This obvious increase of complexity of the sub-system operation may be combined with automation mode limitations for aircraft operation leading to unexpected events (Dekker & Hollnagel, 1999), the so-called automation surprises (Wickens, 2001, 2009). Then, the cockpit crew is forced to identify a 'way out' of the problem, which will increase the risk for subsequent operation errors. Similarly, a warning device collecting all incoming warning messages, or a future negotiation manager bound to negotiate the trajectory proposals between aircraft and ATM, may reach a degree of complexity leading to high workload conditions. In this case, operational errors of the crew due to stress and high workload may occur.

26 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Airlines handle safety-critical issues like the ones described above by means of training and cockpit procedures . Whereas training, training devices, and training material are out of scope for this project, cockpit procedures with regard to automation, crew resource management, and operation conditions remain part of the project objectives. Checklist design, the selection of corresponding devices in the future cockpit, as well as the demand for briefing sessions for the cockpit crew, e.g. “approach briefing”, may considerably reduce the risk of high workload or operational errors of the crew. However, cockpit procedures represent a challenge regarding the experimental design of simulation scenarios, as they require a simulation setup in conformity with the hardware reality of the cockpit environment.

27 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

2 A REVIEW OF BASIC COGNITIVE CONCEPTS

Even though the physical requirements of most jobs have decreased in the last 100 years, the cognitive or mental demands have dramatically increased (Johnson & Proctor, 2004), and pilots are not an exception. Associated with that complexity is the need to multitask, or perform several tasks simultaneously, which has become a common occurrence in our daily life. Given its characteristics and public visibility, the flight deck of commercial jets is one of the most common arenas for the study of complex and skilled human performance. In this chapter we will report some of the studies done on pilots and air traffic controllers, and define workload, stress and other relevant psychological constructs related to ACROSS.

It is not the goal of this project to provide formal definitions of theoretical constructs that experts are still struggling to define, as is the case with workload and situation awareness. We will therefore adopt working definitions, that are not necessarily ideal, but quite acceptable as starting points for the research to be done within ACROSS.

2.1 Workload Scientists working in attention, one of the earliest research topics of psychology, have also focused on applied issues. One major applied area is ergonomics, or human factors, defined by the International Ergonomics Association as "the scientific discipline concerned with the understanding of interactions among humans and other elements of a system (...) in order to optimize human well-being and overall system performance" (International Ergonomics Association, 2010). In particular, cognitive ergonomics is a specialised field concerned with the mental processes (such as perception, memory, reasoning, motor response) that affect the above mentioned interactions. Examples of research topics in this area are mental workload, decision-making and situation awareness.

Studies in workload started as early as 1930, but assessed tasks had mostly a physical component that required the manipulation of machines (Sheridan & Simpson, 1979). With increased automation in workplaces as a result of the introduction of computers, it became harder to define workload, especially when its demands are transient: A monitoring situation may, suddenly, require the processing of several error messages before a single response can be made, after which the operator reverts back to monitoring.

There is no universally accepted definition of mental workload (Cain, 2007) but, in its simpler form, it refers to the measurement of the mental processing demands placed on a person during the performance of a task (Gopher & Donchin, 1986). In other words, mental resources or capacities are needed in order to complete an assignment, and those available to the human operator may not always match those required to satisfactorily perform the task. In fact, Gopher and Braune (1984) suggested that the workload concept was developed in order to explain the inability of humans to meet the requirements of a task.

Mental resources or capacities refer to the human information processing system. Stimuli arriving at the sensory receptors need to be perceived and translated to a response. The classic psychological model identifies three main stages (see Figure 4): perception (what kind of stimulus was presented?), decision making/response selection and response programming/execution (Johnson & Proctor, 2004). Attentional and memory systems are assumed to affect these stages and each will be briefly discussed later in the chapter.

28 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Figure 4 - The classic information processing framework.

One of the earliest theories of mental workload was developed by Kahneman in 1973. His was a unitary-resource model of attention , which viewed resources as an undifferentiated, limited pool, to be shared by concurrent tasks (Wickens, 2008). According to this model, whenever demand for those attentional resources exceeds availability, performance should suffer.

However, several findings, such as the difficulty insensitivity effects, structural alteration effects and perfect-time sharing effects , suggested that in some cases two tasks appear to demand separate resources. This led to the development of the concept of multiple resources (Kantowitz & Knight, 1976; Navon & Gopher, 1979; Wickens, 1980, 1984). Difficulty insensitivity effects refer to the finding that performance is not always degraded on one task when difficulty levels increase on the concurrent one. Structural alteration effects correspond to changes in performance on one of two tasks caused by a shift on the response format, on the other (for example, a change from manual to verbal response). Finally, perfect-time sharing effects occur when two tasks that interfere with other tasks do not affect each other when performed together (Johnson & Proctor, 2004). None of these effects can be explained by a unitary-resource model, which predicts that any task should always demand the same resources and, consequently, two tasks should consistently interfere with each other in the same way.

One of the most influential theories to address these particular issues, and performance in high workload dual-task situations, is the Multiple Resource Theory developed by Wickens (1980, 1988). The theory’s success lies on its neurophysiological plausibility (the separate dimensions of human information processing have some parallel in specific brain structures), at the same time that it provides some guidelines to human factors designers regarding the configuration of a task or system (Wickens, 2008). Wickens (1980, 1984) identified four dimensions, each with two discrete levels (see Figure 5).

The first dimension corresponds to the information processing stages . That is, resources involved with perceptual-cognitive activity are functionally different from those related to response processes (Wickens, 1991). For example, a task that requires display reading or voice comprehension (both perceptual-cognitive activities) can be time-shared efficiently with another task that involves activating a switch or giving a voice command (both being response processes) (Wickens & Liu, 1988).

The second dimension refers to the resources used in processing spatial and verbal codes , which are not shared and are, in fact, associated with the different cerebral hemispheres. This dichotomy is seen at the levels of perception (graphics vs. speech), cognition (spatial working memory vs. memory for linguistic information) and response (manual responses vs. speech). An example of the latter is the reduced interference between a task that uses a joystick (manual responses usually involve spatial codes) and another that requires giving a vocal response (verbal code).

29 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Figure 5 - The four dimensions of the Multiple Resource Model (from Wickens, 2002).

The third dimension consists of the different perceptual (visual or auditory) modalities . It is a well-known fact that it is easier to attend to both a visual and an auditory sources than to two simultaneous auditory or visual messages. Some studies, however, have called into question the strength of the modality dimension (Wickens, 1991). Wickens and Liu (1988) found that performance on a continuous visual task suffered more in the presence of a discrete auditory task than if the concurrent task was presented visually (the pre-emption effect). In another study, Morris and Leung (2006) reported that it is very common for pilots to interrupt their actions to answer instructions from ATC. This may lead to errors, such as when a checklist item is skipped when resuming. One of the reasons is that pilots are highly predisposed to attend to auditory stimuli given the limited capacity (7±2 digits) of short-term memory (the type of memory retained for only a very brief period). As such, when presented with auditory stimuli which will be easily and quickly forgotten, humans tend to pay attention to them, at the expense of other concurrently presented visual stimuli. Latorella (1999) in a simulated flight deck, argued that during visual tasks, auditory interruptions were more disruptive than visual interruptions. A second issue with the modalities dimension was raised by Gladstone, Regan and Lee (1989) who showed that when two discrete tasks were being performed at their maximum speed, it did not matter whether they used the same or different perceptual modalities.

Finally, the most recent addition to the model, the fourth dimension, corresponds to the focal and ambient visual channels . Focal vision is required for pattern/object recognition and high acuity perception, whereas ambient vision is involved in orientation and movement perception of oneself. An example of using both resources is walking down a corridor while reading a book.

Despite some criticisms (see Wickens, 1991, 2008), the Multiple Resources model has received some support from experiments that examined dual-task performance employing new cockpit technology, as for instance the cockpit display of traffic information (CDTI) and the data link communications system (Wickens et al., 2003; Wickens & Colcombe, 2007).

Several methods developed to measure workload are essentially measures of arousal. Arousal can be generally defined as a physiological sense of readiness to act. The relationship between performance and arousal levels was first described by Yerkes and

30 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Dodson (1908), in what is now called the Yerkes-Dodson law . The law states that a high level of arousal can enhance performance on an easy task but, on a difficult task, performance is an inverted U-shaped function of arousal (see Figure 6). Additionally, the more difficult the task is, the lower the arousal level at which performance peaks. According to the cue-utilization theory (Easterbrook, 1959), high arousal leads to a decrease in the number of monitored cues, and is thus beneficial only when few cues are presented.

Figure 6 - Graphic representation of the Yerkes-Dodson law (adapted from Diamond et al., 2007).

In situations of high workload, performance levels can sometimes be maintained at the expense of extra mental effort, which may lead to feelings of fatigue, stress or strain. One way to manage high workload is to make a strategy adjustment or strategy shift . That is, the operator might change his or her behavior to a less effortful strategy to perform the task. In general, the chosen strategy depends on three factors: the individual characteristics (training, motivation, age, health, etc.), task characteristics (i.e., its requirements, including work conditions) and workload levels (Sperandio, 1971).

A change in strategy, by itself, might indicate a change in workload. For example, Sperandio (1971) described a study done with air traffic controllers which showed that as workload increased, their operative methods changed. More specifically, with low workload levels the controllers had each airplane follow the shortest way between the ATC sector entrance-point and the runway threshold. As workload increased, they adopted a less efficient, more time consuming strategy of sending the aircraft to a standard route (which included the use of holding patterns followed by standard procedures to land).

The phenomenon of attentional narrowing is another example of strategy shift. It refers to the finding that under a stressful situation humans sometimes restrict their attention to some cues or information sources, ignoring others. Even only telling people that they will experience a stressful situation, without actually experiencing it, is enough to cause a significant reduction in the number of attended stimuli (see Weltman, Smith, & Egstrom, 1971). Another compensatory mechanism are the fatigue after-effects . In this case, after a particularly stressful task the operator may switch to low cost strategies in subsequent tasks (Schellekens et al., 2000). High mental workload demands can also produce speed- accuracy trade-offs . Reaction time and accuracy are known to be inversely related, that is, as speed increases there usually is a decrease in task accuracy. The trade-off is said to

31 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

occur when fast reaction times are accompanied by high error rates. This corresponds to a risky strategy by the operator, as opposed to a more conservative approach, which leads to less errors, but also an increase in response times (Sperandio, 1971).

2.1.1 Measuring Mental Workload As Casali and Wierwille (1983) noted, mental workload must be inferred as it cannot be directly observed. Thus, three broad categories of measures have been developed: physiological, performance-based, and subjective.

According to Meister and Gawron (2010), physiological measures in aviation are mostly used in experiments that study the effects of acceleration, hypoxia, noise level, fatigue, alcohol, drugs, or workload. High workload levels are usually associated with cardiovascular and respiratory changes, as well as with specific patterns in brain electrical activity. Changes in heart rate within brief time intervals (measured as heart-rate variability), as well as changes in pupil diameter, are two of the most common body responses measured - high workload leads to large pupil size and a decrease in heart- rate variability (Beatty, 1982; Van Orden et al., 2001; Van Roon et al., 2004; Vicente, Thornton, & Moray, 1987). Moreover, event-related potentials (ERPs) computed by averaging the electroencephalography (EEG) response to an external stimulus, reflect perceptual or cognitive demands. Other physiological measures include blood pressure variability (which is related to heart-rate variability) and electrodermal activity (see the reviews by Wilson and Eggemeier, 1991; de Waard, 1996; Cain, 2007).

A special case of physiological measures is the recording of eye-movements (Sheridan & Simpson, 1979). Changes in eye movement patterns can be associated with attentional demands. May et al. (1990) reported that as task difficulty increased, the extent of spontaneous saccades (fast involuntary movements of the eye) decreased, whether the subjects were monitoring auditory or visual information. In a different experiment, done with pilots inside the cockpit, frequency of instrument fixation indicated its importance, while length of fixation was related to difficulty in interpreting the information (see Wilson & Eggemeier, 1991). Additional eye function measures are blink rate, duration and latency.

One of the biggest advantages of using physiological measures is that they can be collected in real time. In some cases, however, they require specialized equipment and technicians which may not be available (de Waard, 1996). Also, several researchers have criticized the fact that they are sensitive not only to stress caused by high workload, but to stress in general (Cain, 2007).

Performance-based measures , as the name implies, consist in assessing mental workload through task performance. It is assumed that as workload increases, so do response times and errors. In addition, accuracy and number of completed tasks decrease (Huey & Wickens, 1993). Therefore, it is possible to track performance in a task with different difficulty levels. As mentioned earlier, however, findings like strategy adjustment, fatigue after-effects and speed-accuracy trade-offs have shown that it is possible for performance not to be affected, even though workload levels are high. For this reason, a secondary-task methodology is often used. In this situation, a second task is performed at the same time and the effect of time-sharing on one of the tasks is measured. The goal of the second task is to use up the resources “left over” by the primary task, so that changes in performance are detected. If the emphasis is placed on the primary task and degradation measured on the secondary task, the technique is called subsidiary-task paradigm . On the other hand, in the loading-task technique , the emphasis is on the secondary task, with the degradation in performance of the primary task being measured.

32 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

According to Eggemeier and Wilson (1991), the most commonly used secondary tasks are:

• choice-reaction-time, where the subjects are presented with two or more stimuli (usually lights or tones) each of them requiring a different response;

• time estimation and time-interval production, which require that the subjects estimate the passage of a specified time interval or regularly produce a response (e.g., finger tapping every 2 seconds), respectively;

• memory search, a detection task where a probe is presented after a set of items and the subject indicates whether the probe was part of the initial set;

• mental arithmetic (e.g., subject perform sums) .

Several of these paradigms have been successfully applied in aviation research to assess workload. However, some researchers have criticized the use of such standard laboratory tasks, pointing out that they are strange to the operation environment under study (Lysaght et al., 1989; Shingledecker, 1980). One alternative is to use embedded secondary tasks, that is, tasks that are usually performed during normal operations, but experimentally separable from the primary tasks. Examples of such tasks are aircraft radio communication activities, which were successfully used by Shingledecker (1980).

The final, and most common, type of methods are the subjective methods , which are based on the assumption that operators can reliably rate several aspects of the tasks. The advantages of these methods are that they are direct, easy to use, nonintrusive and inexpensive. Two of the most popular ones are the NASA Task Load Index or NASA-TLX (Hart & Staveland, 1988) and the Subjective Workload Assessment Technique or SWAT (Reid, Shingledecker, & Eggemeier, 1981). The first method requires people to rate the task from low to high on each of six scales: mental demand, physical demand, temporal demand, performance, effort and frustration level. The latter is divided into two phases: scale development and event scoring. In the scale development phase the individual is asked to rank-order 27 cards corresponding to 3 levels of 3 dimensions (time, mental effort and stress), which are then used to create an individual workload scale. The event scoring consists on the rating of the actual task situation using this scale.

A third subjective method, the Rating Scale for Mental Effort, or RSME scale (Zijlstra, 1993), consists of a line with a length of 150 mm marked with nine anchor points, each accompanied by a descriptive label indicating a degree of effort. The RSME has been widely used in Western countries (e.g., in Europe and North America), but recently it was reported that the use of the scale is sensitive to cultural differences: a comparison between Indonesian and Dutch participants who performed the same task suggested that culture, and not only the properties of the scale, influences the measurement of subjective mental workload.

Some disadvantages of the NASA-TLX, SWAT and RSME methods are their reliance on memory (usually these tests are performed after the tasks have been completed), their susceptibility to operators’ bias and the task variability effect (people tend to use the whole rating scale, independently of the stimulus range). Finally, some authors criticize the use of emotional components in the NASA-TLX and SWAT tests, seeing that the feelings of “frustration” and “anxiety” are not easily related to the notion of allocated resources (Johnson & Proctor, 2004). For this reason, some defend the use of

33 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

unidimensional methods. One example of such method is magnitude estimation (Gopher & Braune, 1984), in which the operators are asked to compare versions of a task and rate them according to the perceived workload.

Other subjective methods are: the Visual, Auditory, Cognitive, Psychomotor (VACP) method, the Workload Index (W/Index) method, the Multiple Resource Questionnaire (MRQ), the Defence Research Agency Workload Scale (DRAWS), the Modified Cooper- Harper scale, Bedford scale, among others (see the reviews by de Waard, 1996, and by Cain, 2007).

Choosing the right technique depends on the setting and the question of interest. Several factors should be taken in account when deciding on the best measure to use. First, the measure should be reliable in the sense that results must be replicated under similar conditions. Second, in some cases ease of use is also important, which explains why subjective measures are so commonly used. Third, the measure must be sensitive to the changes in workload being manipulated. Fourth, the chosen technique should be diagnostic, meaning that it needs to be able to identify the load imposed and on which resources. Fifth, intrusiveness level should also be considered, as the workload measure might cause a disruption in performance of the task under study. Finally, the measure needs to be accepted by the operators. If they find the whole experience boring, unpleasant or irrelevant, the data collected may not be valuable (Eggemeier & Wilson, 1991; Johnson & Proctor, 2004).

Most of the subjective measures support only a relative evaluation, i.e. the experimental results require the definition and execution of a 'baseline' scenario, against which the results can be compared. In cases with considerable changes in the operational conditions, e.g. the elimination of R/T-communication in favour of a data link connection, a direct comparison of workload levels between the two may not be possible, unless the definition of the baseline scenario covers such extraordinary conditions.

Different measures are sensitive to different aspects of workload. Part of the problem is the absence of a general definition of workload and of standardized procedures. In addition, the term workload is used to describe not only the demands imposed on the subject, but also the effort exerted to satisfy those demands and the consequences (physiological, subjective, or performance) of those actions (Huey & Wickens, 1993). Hence when selecting one measure, researchers need to consider whether the task under evaluation is predominantly psychomotor, cognitive or perceptual. Whenever possible, more than one method should be used, from different categories, and the advantages and disadvantages of each method carefully considered.

The question of how much workload is too much, is called the determination of a workload redline (Rueb, Vidulich, & Hassoun, 1994). Reid and Colle (1988), for example, attempted to find a critical SWAT score above which operators experienced performance problems and arrived at a value of 40±10. However, according to de Waard (1996), by the time performance decreases, peak workload has already been crossed. Instead, he argues, workload redline should be the point after which the operator needs to exert some effort in order for performance to remain stable. This is also the point where stress begins if the situation lasts for some time. Lastly, individual differences on the amount of resources each person is willing, or capable, of allocating makes it very difficult to calculate a critical workload level.

As reported above, high workload levels can lead to stress. The next chapter describes the causes of stress, and its physical and behavioural impacts.

34 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

2.2 Stress Stress can be defined as the response of the body to stimuli that affect the normal physiological balance of a person, causing physical, mental or emotional strain. Hence, it is not a pathology per se, but an adaptation of the organism. In some cases some stress can be positive, if it focuses attention and increases arousal and vigilance levels. In this chapter, though, we will focus on the detrimental effects of stress. Stimuli that cause stress are called stressors and they include physical factors such as noise, vibration, heat/cold, lighting, as well as social/psychological factors like anxiety, time pressure, mental load, fatigue, frustration, and anger (Wickens, Gordon, & Liu, 2004). In an aircraft, common stressors are: persistent radio communication noise, sudden alarms or warning horns, uncomfortable temperature (above 30°C or bel ow 15°C), engine and system noise, vibration, cramped workspace, air quality, lighting conditions, etc. High workload levels can also cause stress when there is too much to do in too little time. Several aviation accidents have occurred because the crew was overloaded, which caused them to neglect key tasks (Wickens et al., 2004).

Stress can be acute or chronic . As the names imply, acute stress is caused by an unexpected and sudden threat (e.g., engine failure), whereas chronic stress occurs when a stressor is present for a long time (e.g., relationship problems). In chronic stress the body first reacts by releasing hormones ( fight-or-flight response ), which gives rise to extra energy, muscular strength, and heightened hearing and vision (Alarm phase). That is followed by the Resistance phase, which corresponds to the body attempting to repair any damage caused by the stress, at the same time that it maintains the state of readiness. This long mobilisation of body resources decreases resistance to other noxious stimuli. The final phase is Exhaustion, when the defence mechanisms collapse, leading to several symptoms and severe illness (Campbell & Bagshaw, 2002). In acute stress only the Alarm phase is present.

In 1991 Frankenhaeuser developed a biopsychosocial model of stress that relates stress with health (Martinussen & Hunter, 2010). According to this model, an individual is subjected to demands, and stress ensues if those are greater than the available individual resources. Examples of high environmental demands are high workload, time constraints, conflicts and problems, whereas resources are determined by experience, personal abilities, physical and mental health, genetic factors and social support (Martinussen & Hunter, 2010).

Physiological and psychological symptoms of stress include tachycardia, perspiration, muscular tension, insomnia, loss of appetite, headache, irritability, psychological disorders, gastro-intestinal diseases, muscular diseases, sexual disorders, cardiovascular diseases, etc. (EATCHIP, 1996).

Regarding flight crews, some recommendations have been made to help them cope with stress. In short, pilots are encouraged to avoid stress whenever possible by anticipating events and adopting a prevention strategy. If stress cannot be avoided (e.g. in the case of death of a family member), the symptoms should be recognized and the emphasis should be on the management of emotional reactions. If, on the other hand, there is a solution to the stress-causing problem, pilots should focus on solving it (Campbell & Bagshaw, 2002). Some of the stress management strategies that pilots are encouraged to apply (when possible) include task delegating, handing over of aircraft control and taking a short break.

35 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

In general, stress affects how we perceive and process information, as well as what decisions we make, leading to an increase in the number of errors and mistakes. The most common behaviour effects are (Stokes & Kite, 1994; Martinussen & Hunter, 2010):

• attentional narrowing or decrease in attention levels which translates into perceptual (narrower field of vision, selective hearing) and cognitive tunnelling;

• scattered and poorly organized visual scan;

• reductive thinking and filtering (considering only a few hypotheses, thus rejecting certain tasks or ignoring some warning signs);

• premature closure (making a decision without exploring all information);

• hurried decisions, even when there is no time pressure (leading to the speed- accuracy trade-off). Not surprisingly, the best decision-makers seem to be those who take their time under stress;

• decrements in working memory capacity and retrieval.

In the particular case of pilots, during a stressful situation in the cockpit they might return to old procedures that may no longer be applicable, use non-standard phraseology when communicating, fail to understand what is being said over the radio, revert to the use of their native language if different from the one being used (usually English), or look for items in a place where they used to be, but are no longer located.

The critical role of working memory in aviation cannot be overstated. At any given time while flying a pilot needs to orient in a three-dimensional space (which requires temporary storage and manipulation of spatial and visual information), as well as keep in mind clearances, call-signs, instrument readings, advisories, briefings, and so on, some of which constantly being updated. Any impairment can have dangerous consequences (Stokes & Kite, 1994).

According to Stokes and Kite (1994), knowledge of regulations, systems and procedures (stored in long-term memory) is relatively resistant to stress, whereas more fundamental flying skills (the “stick and rudder control”) can degrade significantly. A study by Wickens et al. (1988) using a computer-based simulation, investigated the effect of stress on pilot decision-making. The authors found that stress affected performance on scenarios that required the use of spatial working memory, but not on those that depended on the retrieval of knowledge stored in long-term memory. For this reason, experienced pilots, who rely more on long-term memory and on a rule-based approach to a problem, usually make less mistakes under stress than less experienced pilots.

Another important issue is the relationship between stress and control. There is some evidence that stress reactions and changes in performance are less severe when individuals have some control over the situation. That is, when the warning signs are clear and a standard, trained solution to a problem can be applied, the situation is less stressful than if the signs are confusing and several messages need to be considered and processed at the same time. This has implications for automation, which will be discussed later (see chapter 2.4).

36 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

2.2.1 Measuring Stress As mentioned in section 2.1.1, several physiological workload measures are also sensitive to general stress levels and can thus be used to measure the latter.

Stressful situations lead to the release of hormones that can be quantified in blood, saliva and urine samples. Of interest are the catecholamines adrenaline and noradrenaline, as well as the steroid cortisol. Adrenaline levels have been associated with mental effort, whereas noradrenaline levels are determined by physical effort (Wilson & Eggemeier, 1991). Catecholamine levels were found to depend on flight duration, level of experience, degree of responsibility and aircraft characteristics (see Wilson and Eggemeier, 1991). Kakimoto et al. (1988) reported that salivary cortisol levels increased more for pilots while they were in control of the aircraft than when they were not, especially during take-off and landing.

Holmes and Rahe in 1967 developed a scale that attempts to quantify stress. It consists of 43 stressful events that require personal adjustments (Scully, Tosi, & Banning, 2000), ranging from family matters, occupation, peer relationships, health, etc. Examples of events include a spouse’s death (assigned 100 points), illness or injury (53 points) and trouble with the boss (23 points). A total score of 300 or more over a certain time period can have serious health consequences. Between 150 and 300 points leads to stress for about 50% of people. Under 150 points fewer than 30 % of people become ill (EATCHIP, 1996).

2.3 Situation Awareness (SA) Another very important concept associated with workload is situation awareness (SA). Many researchers favour Endsley’s (1995) definition that SA is "the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning, and the projection of their status in the near future" or, put simply, “knowing what is going on”. The first part of the definition, elements perception, consists mainly of stimuli processing. A pilot, for example, needs to attend to the airplane (all relevant lights, screens, indicators, etc.) and environmental cues. Cue salience and attentional narrowing, for example, can have a big impact in this phase. Jones and Endsley (1996) reported that 76% of all SA errors in pilots occurred in this phase. The second SA level is the understanding of the situation in light of the operator’s goals and objectives. The decision to abort take-off upon seeing a warning system alert is an example of this level of SA. Finally, in possession of that information the operator must predict the outcome of future events in order to make a decision regarding the best course of action. An example would be a pilot anticipating the trajectory of other airplanes. Figure 7 shows a representation of each level of SA, as well as all factors that influence it.

Situation awareness requires paying attention to the relevant information, not only in the early information processing stages, but also during decision making and response execution. Consequently, in complex situations the limited capacity of attention can be quickly reached (Endsley, 1995). It is not possible for human operators to attend to all the relevant stimuli and some are processed easier than others. Therefore, the amount of information that can be perceived at any time constitutes a bottleneck for SA (Endsley & Jones, 2011).

Memory also plays an important role in SA, given that the individual needs to keep track of present and past events in the environment. According to Wickens (1984), the three levels of SA occur in working memory , suggesting a direct link between the two. In

37 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

working memory the perceived stimuli are stored, processed and combined with previous knowledge in order to project what might happen in the future. Given its very limited capacity, it is the second bottleneck of SA (Endsley & Jones, 2011).

Figure 7 - Model of Situation Awareness (adapted from Endsley, 1995).

Long-term memory is also fundamental to achieve SA. The access to stored information guides the expert operator on what to expect, freeing up working memory resources. Two of the mechanisms which help to circumvent the limitations of working memory are mental models and schemata. Mental models correspond to a systematic understanding of how something works and are the keys to levels 2 and 3 of SA (comprehension and projection). They also allow people to fill in the blanks when needed information is missing (Endsley & Jones, 2011). Schemata are stored representations of knowledge acquired from experience or vicariously through reading or hearing from others (Jones & Endsley, 2000). They are like shortcuts that provide comprehension and projection in one step. The major difference between mental models and schemata is that only the latter are assumed to be stored and activated, whereas the former are thought to be creations of the moment arising from schemata (Wilson & Rutherford, 1989).

The model of SA developed by Endsley (1995) also identifies two stages that proceed directly, and are separated, from SA: decision making and response performance (Fig. 7). A pilot can understand what is happening (i.e., have perfect SA), and yet not know what is the correct decision to make or how to execute it. Similarly, experienced pilots can make wrong decisions if they have an inaccurate SA. Finally, appropriate responses can in some cases be executed despite low SA, as when a driver suddenly realizes he or she can’t remember having driven the preceding kilometres (Endsley, 1988a, 1995).

38 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Good decision making is usually, but not always, associated with expertise. An expert usually notices cues and patterns that might otherwise be missed by a novice (or simply be faster at that), and is able to anticipate a sequence of events (Sieck & Klein, 2007).

Another construct involved in the acquisition of SA is the operators’ specific goals for the tasks they are performing. These goals define how attention is directed and which elements in the environment are attended to. It also guides which mental models are chosen. This goal-driven process is also called top-down information processing . On the other hand, data-driven or bottom-up processing occurs when information “catches” the operator’s attention independently of the goals (Endsley & Jones, 2011). Examples are flashing lights or loud alarm noises, which might force a person to change the tasks’ priorities. As such, a pilot needs to be able to switch between data and goal-driven processing while flying an airplane.

Also related to the goals are the operator’s expectations and priorities. These are based on mental models, experience, instructions, and communications from other sources (Endsley & Jones, 2011). Preflight briefings, for example, are very important in defining a pilot’s expectations during flight. Like goals, expectations and priorities guide attention providing a shortcut in processing the information without overloading working memory. One disadvantage is that they can lead to missing important cues when these are not expected to occur. Goals, objectives, expectations and priorities affect not only SA, but decision making.

In a familiar situation, human behaviour is controlled by a set of already known and previously successful rules, whereas in a new situation, behaviour tends to be goal- controlled, as the subject accesses different mental representations, or schemas, from which the best one for the situation is chosen (Rasmussen, 1983).

One of the most well-known models of decision making is Rasmussen’s (1983). Rasmussen distinguished between skill-, rule- or knowledge-based levels of behaviour:

• Skill-based tasks are executed at an automated level. The entire motor process is executed without much conscious effort, attention or control. The actions are well trained and do not require a great deal of mental effort from the operator. Consequently, an operator is left with enough capacity to perform other tasks. An example is operating the brake if one wants to stop;

• Rule-based tasks are well trained tasks, but they still require a bit of thinking. Therefore, they can be disturbed if the operator is distracted during execution. Proficient crew follow a script in which actions and reactions are expected to occur in a specific sequence. The stored rule goes: if this event occurs, then perform these actions. The boundary between skill-based and rule-based performance is not sharp, as it depends on the level of training and attention of the operator;

• At the knowledge-based level the operators are confronted with relatively new situations, with things to choose and decide. As such they need to give mental attention to that task. The more knowledge-based tasks are, the more workload rises. Compared to machines, humans are relatively good performers at the knowledge-based level. This creates a dilemma. On the one hand this level induces most workload, but on the other hand humans are the best solution builders.

For experienced pilots, hands-on flying (aviate) is mostly an automated event (skill-based) (Gopher & Donchin, 1986). Some navigation tasks, on the other hand, are rule-based,

39 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

meaning that even though they are not automatic, they do not require high levels of mental resources, or that the pilot stop and think before acting. This is because the pilot has been trained on what to do, or has a lot of experience with such situations (Morris & Leung, 2006). Finally, in new situations for which no rules exist it is necessary to resort to the slower, effortful and highly prone to error process of thinking things through (knowledge-based conceptual level). This level of demand also occurs when the pilots must handle multiple tasks and track the status of each one.

Other individual factors that affect the acquisition of SA are automaticity, experience, training and innate abilities. Experience and training lead to a certain automaticity in mental processing, such that actions and behaviours become fast and effortless, freeing up mental resources. Through them people develop mental models, schemata and goal- directed processing, which allow a high degree of time-sharing between tasks (Eggemeier et al., 1991; Strayer & Kramer, 1990). Automaticity, however, might lead to errors because events outside the routine are not attended to, e.g., if the pilots are given a different clearance than usual, they might not notice it and carry out the habitual action (Endsley & Jones, 2011). This is one of the reasons, why pilots’ operations in the cockpit are highly scripted. There are written procedures that detail the sequence of actions the pilots must take in each flight phase. Aircraft systems are usually set by memory and a checklist is used not only to make sure the most critical procedures are executed, but to protect against errors that occur when processes become too automatic (Endsley & Jones, 2011). This approach has the advantage of allowing a large number of actions to be quickly and smoothly executed (Loukopoulos, Dismukes, & Barshi, 2003).

The amount of workload and stress also affects SA. Endsley (1995) showed that SA and workload are independent constructs, with four possible combinations:

• low SA and low workload if the operator does not know what is happening and is not actively trying to find out;

• low SA and high workload if the operator is attending to too much information or too many tasks, thus not being able to process and integrate everything;

• high SA and low workload, in which the important information is being presented and correctly perceived and integrated (the ideal situation);

• high SA and high workload, when the operator is working hard, but successfully handling the situation.

System design, such as its capabilities, interface and complexity, also affect SA (Endsley, 1995). The way the information is presented to the pilot has a large impact on SA and workload. As avionics systems, flight management systems and other technology become more complex, the amount of data available increase. Consequently, there is also a raise in the number of components which need to be monitored, all of it potentially leading to high mental workload (Endsley, 2010). The effects of system complexity can be alleviated by well-developed internal representations, which aids in directing attention and developing SA. In section 2.3.2 these topics will be further developed when discussing display-design principles to achieve higher SA.

Endsley (2010) identified several general classes of elements that a pilot requires for SA. These are:

40 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

• Geographical SA – location of own and other aircrafts, terrain features, waypoints, and navigation fixes, climb/descent points; position relative to these, path to desired locations;

• Spatial/Temporal SA – attitude, altitude, heading, velocity, vertical velocity, G’s, flight path; deviations from these and clearances;

• System SA – system status, functioning and settings; settings of radio, altimeter, and transponder equipment; air traffic control (ATC) communications; flight modes and automation entries and settings; fuel; impact of malfunctions on system performance and flight safety;

• Environmental SA — weather formations (area and altitudes affected); temperature, icing, ceilings, clouds, fog, sun, visibility, turbulence, winds, microbursts; instrument flight rules (IFR) vs. visual flight rules (VFR) conditions; areas and altitudes to avoid.

A more complete and detailed list of SA information requirements for commercial airline pilots can be found in Endsley et al. (1998).

2.3.1 Measuring Situation Awareness Endsley and Jones (2011) defined four different approaches to measure SA: process, direct, behavioural and performance measures.

Process measures include verbal protocols, communication analysis and psychophysiological metrics. Verbal protocols consist of asking the subjects to “think out loud” while performing the task. In communication analysis , mostly used in studies of team strategies, the interaction between participants is recorded and analysed. The biggest disadvantages in the use of these two groups of measures are their subjective nature and the fact that they depend on the verbal skills of the subjects under study. The last measure corresponds to the physiological methods already described in section 2.1.1 for workload. As before, the most common are eye movement recordings, EEG, and ECG (electrocardiogram). These are very useful in providing information on how attention is located, but handling the equipment and performing the data analyses can be difficult (Endsley & Jones, 2011).

The second approach to study SA consists in using behavioural and performance measures , which assess SA based on how the subjects behave or on their performance, respectively. In the former, events are inserted into a scenario, or the displayed information is manipulated, and the response measured. In the latter, realistic scenarios are run and global performance measures taken, such as the number of successful missions (Endsley & Jones, 2011).

Direct measures can be subjective or objective. Subjective measures assess SA by asking the subject (or an observer) to rate the subject’s SA on some scale(s). One disadvantage of these measures is that it assumes people can correctly evaluate their decisions and thoughts. Examples are the SA Rating Technique (SART), the SA Subjective Workload Dominance (SA-SWORD) technique and the SA Rating Scale (SARS) (Endsley & Jones, 2011).

Like NASA-TLX, SART is a self-reporting multidimensional rating procedure designed for application in the aviation environment (Selcon, Taylor, & Koritsas, 1991). However, unlike NASA-TLX, ten independent dimensions are selected and further grouped into

41 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

three domains: attentional demand, attentional supply, understanding. Both the 10- dimensional and the 3-dimensional versions can be implemented. More information about this technique can be found in Selcon et al. (1991). SA-SWORD is derived from a workload tool, SWORD. Tools for data collection and analysis are the same, only the instructions to complete the scales are different (Vidulich & Hughes, 1991). Finally, the SARS scale consists of eight dimensions, covering 31 behaviours which are rated on a six-point scale (Endsley & Jones, 2011).

On the other hand, objective measures not only query the operators about aspects of the environment, but compare their responses with reality. Memory-probes are the most common objective measurement technique in situation awareness, reflecting the understanding that SA is the ability to keep track of what is going on (Vidulich, 2002). One of the most popular is the SA Global Assessment Technique (SAGAT), formulated by Endsley (1988b). It consists of running a scenario in an aircraft simulator, which at random times is halted so that a series of questions about the situation at that exact moment in time can be asked. At the end of the trials, the answers are evaluated based on what was happening in the simulation. According to Endsley (1988b), this comparison between the real and the perceived situation provides an objective measure of pilot SA. The greatest disadvantage of using this technique is the fact that the simulation needs to be stopped to collect the data.

Another procedure is called the Global Implicit Measure (GIM) which is a real-time, performance-based measure of SA, developed by the US Air Force, that can be applied to civil aviation (Vidulich, 2002). This measure is based on the assumption that a pilots’ goals and priorities are constantly changing, and that it should be possible to look at the progress toward accomplishing these goals, using it as measure of SA. Therefore, the first step is to conduct a detailed analysis to divide the mission into phases. Then the tasks associated with each phase are identified and segmented according to the headings aviation, navigation, and communication. Subsequently, this analysis is used to create a set of rules of engagement similar to those encountered in real-life situations. For example, the rules might specify the radar mode for each mission segment or the required altitude to be maintained on each segment. Scoring is based on contribution for goal accomplishment, that is, if the pilots configure their radar correctly, they get a certain score. Tasks with low scores correspond to those that the pilots were not able to perform, or were unaware of (Vidulich, 2002).

The final method, Situation Present Assessment Method (SPAM), uses SAGAT-like queries while the operators perform the task. However, unlike SAGAT it does not require a memory component: subjects with good SA should be able to answer the questions more quickly, because they can find the information faster (Durso et al., 1998).

2.3.2 Display-design principles The concepts of situation awareness and workload are key concepts for aviation psychology and have already played a role in improving cockpit design, mostly visual displays (Vidulich, 2002). In ACROSS, new systems and cockpit solutions will be developed in order to reduce workload levels (objective 1) and allow reduced crew operations (objective 2). This can be achieved through the introduction of new instruments or systems, or the redesign of current ones. Either way, several principles of system interface design need to be considered in order to present the information as quickly as possible, and reduce the number of errors with the minimum cognitive effort.

42 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Wickens (2003) identified seven principles of display design:

• Principle of information need – Only the information needed by the pilot should be presented. Too much information leads to visual overload, as well as to performance issues in critical times. Too little and pilots might ignore or forget what is outside their focus (the out of sight, out of mind phenomenon);

• Principle of legibility – Display must be readable under the conditions found in the flight deck. Contrast and brightness levels, as well as display size must be appropriate and the effects of vibration, glare and illumination levels need to be considered;

• Principle of display integration / proximity compatibility principle – Frequently used instruments should be located directly in front of the pilot and instruments providing information which needs to be integrated and compared should be close together (display proximity leads to mind proximity). Ideally, the pilot should be able to scan these instruments without head movement;

• Principle of pictorial realism – Display should “look like” or be a very pictorial representation of the information it represents;

• Principle of the moving part – The moving element on the display should correspond to the element that moves in a pilot’s mental model of the airplane, and it should move in the same direction as in the mental representation;

• Principle of predictive aiding – Displays should assist the pilot in predicting the future state of the aircraft;

• Principle of discriminability: status versus command – Displays should be unambiguous so that information is not confused between similar looking displays. Distinction between command (what the pilot should do) and status (what the pilot is doing) information should be clear and unmistakable.

In recent years, the introduction of digital technology and the increased accuracy in identifying aircraft location and trajectory have guided the development of navigational displays. An example of such equipment is the 2-D electronic map display (or navigation display), a successful story in display automation. Another example of a system designed with the above principles in mind is the Traffic Alert and Collision Avoidance System (TCAS).

Research by Yeh and Chandra (2004) focused on the design of effective symbols in navigational electronic displays. The authors identified some characteristics that symbols should have in order to be usable and to facilitate task performance: be salient (easy to find), distinct from each other (with a consistent design across manufacturers), of an appropriate size, and all encoded attributes should be quickly and accurately decoded (e.g., filled vs. unfilled symbols for compulsory and on-request requirements, respectively). The number of items on the display, as well as their proximity to each other, affects the time it takes to find a particular symbol. Therefore, colour and intensity can be used to increase saliency, such that the symbol “pops out” of the display (Yeh & Chandra, 2004). However, these properties should be carefully manipulated as humans usually find it difficult to classify more than seven different colours and intensities at once, and more so in conditions of glare or low illumination, such as those found in cockpits.

43 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Some of the issues associated with display design are directly related to the effects of automation. In the next chapter, we will discuss some of the unintended problems raised by automation.

2.4 Automation Automation occurs when a task, action or operation is executed by a machine. In most cases, it reduces workload and stress, helping humans deal with complex systems, and improving situation awareness in general (Mouloua et al., 2010). In aviation, automation has improved efficiency, flexibility and helped decrease the number or accidents. It is therefore expected that the trend towards extensive use of advanced automation will continue in the next decades. However, maintaining an accurate SA in today’s flight deck is not an easy task and pilots report spending a lot of time working towards it (Endsley & Jones, 2011). In fact, the cause of several aircraft accidents has been attributed in part to lack of SA due to cockpit automation. One of the problems is the difficulty pilots have in forming accurate mental representations of the automated system, even after extensive use. Therefore, in critical situations they might misunderstand the information presented and miss important cues. A specific case occurs when people assume that the system is working in one mode, when it is instead working in a different one ( mode error ). For example, the system might be presenting the descent rate in degrees and the pilots mistakenly believe the values represent feet per minute. In cases like this, people tend to dismiss every conflicting information and may never realize the error they are making (Endsley & Jones, 2011). This loss of mode awareness usually occurs when there is not enough feedback from the system to the human operator (Mouloua et al., 2010). The term automation surprise was introduced to explain all those occasions in which humans are left astonished and confused by the machine’s behaviour.

Automation can also lead to a decrease in SA if the pilots are left out-of-the-loop , that is, they do not know what the system is doing or why. If an unexpected situation occurs that the system cannot handle and which requires the pilots to take over, they might not be able to properly evaluate the situation to decide on the proper action (Endsley & Jones, 2011). The out-of-the-loop syndrome has been attributed to complacency and over- reliance . When the human role is merely to monitor the system, this leads to a decline in performance, associated with a reduction in vigilance, low workload and/or boredom (Hancock & Warm, 1989; Parasuraman & Mouloua, 1987). Macworth (1948) reported that vigilance tasks that last longer than 30 minutes lead to a significant decline in reaction times and accuracy levels. Over-reliance on automation can also be an issue, if automation is used when it should not be, or when the human fails to actively monitor the machine (Parasuraman & Riley, 1997). The opposite problem is the disuse , or lack of trust of automation, when the operator underuses or ignores automation, usually caused by an excessive number of false alarms associated with periods of high workload (Parasuraman & Riley, 1997). The topic of alarms and their effects will be discussed in section 2.4.1. Finally, loss of proficiency has also been reported as a consequence of automation. Wiener and Curry (1980), for example, discuss the deficient flying skills of pilots who extensively use automatic equipment.

Table 2 summarizes another aspect associated with the development of new technology, the fact that in some cases the perceived benefits do not correspond to the actual impacts on human performance (Sarter, Woods, & Billings, 1997).

44 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Putative Benefit Real Complexity

Better results Transforms routines and human roles.

Decreases workload Creates new kinds of cognitive work, often at the wrong times. Focus user’s More systems to track, making it harder to integrate all attention on the right the information. answer Requires less Demands new knowledge, skills. knowledge Machine is Interaction with people is critical to success autonomous Provides the same New levels and types of feedback are needed to support feedback the new roles Generic flexibility Explosion of features, options and modes creates new demands and errors Reduce human error Both machine and people are fallible; introduces new problems associated with human-machine coordination breakdowns Table 2 - Contrast between the intended benefits and actual consequences of new technology (adapted from Sarter, Woods and Billings, 1997).

Two different approaches can be pursued in the development of complex systems where automation levels and human involvement are manipulated with the goal of improving overall performance: implementation of automation levels and adaptive automation.

Levels of Automation

Sheridan and Verplank (1978) were the first to characterize the levels of automation available in man-computer decision-making. These are presented in Table 3.

1 The computer offers no assistance, human must do it all – no automation

2 The computer offers a complete set of action/decisions alternatives, and ... 3 narrows the selection down to a few, or... 4 suggests one, and... 5 executes that suggestion if the human approves, or... 6 allows the human time to stop action before automatic execution, or... 7 executes automatically, then necessarily informs the human, or... 8 informs human after execution only if human asks, or... 9 informs human after execution if it, the computer, decides to. 10 The computer decides everything and acts autonomously, ignoring the human – full automation Table 3 - Levels of Automation.

45 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

When deciding which level of automation to apply to a particular system, it is important to consider the implications of each and how they will affect performance and safety. For example, Endsley and Kaber (1999) reported that performance improved when automation aided in task execution, but not when it was used to generate options. In addition, operators were faster to respond to alarms at intermediary levels of control than at full automation (Endsley & Kiris, 1995).

Adaptive automation

The optimal solution to the issues raised by automation is to have a system where tasks are assigned to humans or automated systems in a flexible, adaptive manner ( adaptive automation ). According to Rouse (1988), this implies that tasks are mostly performed by humans, and the switch to automation only occurs when they need support to meet the operational requirements. Once tasks become more manageable, automation is deactivated and the operator takes over.

Automation level selection is not decided by the machine itself, but through the interaction between pilots and systems. The human monitors the automation and sets the role allocation such that the probability of mission success is maximized. One difficulty, however, is that in situations of high workload when humans need assistance, they might not have the resources available to monitor and interact with the system (Rouse, 1988). As such, adaptive automation systems (who adjust by themselves to a measured level of crew resource availability) need to be designed with great caution. Although such automation systems revealed promising results with regard to enhanced dependability, they have not yet been considered a team player by human operators.

More recently, with the development of new methods to determine optimal allocation strategies, adaptive automation has been found to reduce workload and improve situation awareness (Bailey et al., 2003, Kaber & Riley, 1999). One approach is to use physiological methods. Prinzel et al. (2003) used EEG measurements to switch between automatic and manual task modes- when the operator’s engagement level increased above a baseline condition the task would switch to automatic mode. Otherwise the manual mode would be engaged.

Both techniques (levels of automation and adaptive automation) reinforce the notion that people seem to perform better when automation provides support at the level of collecting and presenting data, especially in routine, repetitive tasks, than at a higher cognitive level (generating and selecting the best available option) (Endsley & Jones, 2011).

2.4.1 Alarms Alarms are designed to call attention to important events, especially in occasions when the operator is distracted or attending to other tasks. In theory, when an alarm sounds the information conveyed should be quickly understood and attended to with the proper action. In reality, however, things are not so straightforward (Endsley & Jones, 2011).

First, in emergency situations it is now very common for several alerts to be activated at the same time forcing the operator to sort through them to understand what caused the emergency. For example, in the Qantas Flight 32 incident, it took three crew members 50 minutes to process 54 failure messages.

Second, many systems have a high number of false alarms. Consequently, people are slow to respond or ignore the warnings completely, because they do not trust the alarm. This is the cry wolf syndrome . Furthermore, when false alarms sound too often, they are a

46 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

source of annoyance as the operator has to interrupt an on-going task to attend to them (Endsley & Jones, 2011).

Although alarms are generally designed to be reacted to immediately, humans tend to seek for a confirmation of the problem before taking action, losing critical time. For that reason, alarm systems should provide information that helps the operator identify the issue and quickly confirm the alarm’s validity.

For every alert system a trade-off must be reached between the probability of detecting false alarms and that of actual emergencies not being acknowledged ( missed alarms ). The consequences of each can be measured against the operator’s workload to decide on where to place the criterion. In very low workload levels, performance usually decreases and threats are sometimes overlooked. Thus, missed alarms in these circumstances can be very hazardous. But false alarms can actually raise arousal levels and increase performance (Wilkinson, 1964). Therefore, Endsley and Jones (2011) advise moving the alarm detection threshold in favour of more false alarms. The same suggestion is made for peak workload levels: In order to cope with all tasks, the operator may choose to rely on automation and use his limited resources to monitor the system, instead of operating. Under these circumstances, only the issues raised by the system will be attended to, including false alarms, whereas missed alarms will probably not be detected by the operator. During normal workload levels though the situation changes completely. Here, false alarms are a source of annoyance to the operator who must attend to them, increasing workload to undesirable levels. Moreover, missed alarms may not be as hazardous since the operator is already attending to most systems and managing all tasks (Bustamante, Anderson, & Bliss, 2004).

2.5 Human Error Between 60 to 70% of all accidents involving commercial aircrafts have been attributed to human error (Dismukes, Berman, & Loukopoulos, 2007). As air traffic increases and systems become more complex, it is crucial to understand what causes those accidents and how to reduce their number. Most researchers agree, however, that usually there is no single cause for accidents. The majority are a result of a conjunction of failures, as illustrated by James Reason’s Swiss Cheese model (Figure 8). According to Reason, in every system there are barriers or layers in place to prevent accidents. As long as the barriers are intact, there are no accidents. Unfortunately layers incorporate weaknesses or even have failures, represented as holes. When events occur in such a way that each barrier of protection fails, then the holes are aligned and an accident is waiting to happen (Martinussen & Hunter, 2010).

Reason’s model was very important in accident investigation, because it forced investigators to look beyond the pilots’ active failures or unsafe actions (the system’s first layer). Three other levels of latent failures were described by Reason: preconditions for unsafe acts (for example, mental fatigue, improper crew communication and coordination), unsafe supervision (e.g., lack of training, inadequate supervision), and finally organizational influences (e.g., resource management, organizational climate). These failures are latent, because as long as the barrier ahead of them is intact, it will act as a shield. As soon as a hole develops in the first layer, the remaining holes may become unexpectedly aligned, and an accident occurs (Martinussen & Hunter, 2010).

47 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Figure 8 - The Swiss-cheese model of accident causation (from Martinussen & Hunter, 2010).

Wiegmann and Shappell (2003) defined and characterized the holes in Reason’s Swiss cheese model, and at the same time developed a system to be used as a tool to investigate aviation accidents. The system they proposed is called the Human Factors Analysis and Classification System (HFACS). Within ACROSS, only the first two levels seem to be relevant: unsafe actions and preconditions for unsafe actions.

Unsafe Actions

By far the most common cause of all aviation accidents, unsafe actions are grouped by Wiegmann and Shappell (2003) in two categories: violations and errors . The former can be considered out of scope for ACROSS, as they correspond to rule-breaking behaviours. The latter consist of failures to reach an intended goal and can be further divided in skill- based errors, decision errors and perceptual errors:

• Skill-based errors are those made while performing, or failing to perform, skill- based behaviours. As mentioned earlier in section 2.3, these automatic, effortless actions are vulnerable to forgetfulness and failures of attention;

• Decision errors occur when the wrong behaviour is chosen, even if well executed. This might occur either for lack of training or of SA. Again, this error category includes three types of errors:

48 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

o procedural errors - mistakes in rule-based behaviours, when for example, the wrong schema is applied to a particular situation;

o poor choices - related to knowledge-based behaviour. They occur when the pilot is faced with more than one option and mistakenly picks one that is inadequate;

o problem-solving errors - in the presence of a new, untrained situation, the pilots must slowly think their way through, sometimes making errors in the process.

• Finally, spatial disorientation and visual illusions may lead to perceptual errors . As the name implies, stimuli arriving in the senses are not properly processed. An example is flying into terrain at night, because the crew assumed they were cruising at a higher altitude.

In Figure 9 all the three categories of unsafe acts are displayed, including the three types of decision errors.

Figure 9 - Categories of errors committed by pilots (adapted from Wiegmann and Shappell, 2003).

Preconditions for Unsafe Actions

Included in this category are the pre-existing conditions that lead to errors while flying. These are: condition of operators, environmental factors and personnel factors (Figure 10).

• Condition of operators is further split in three possibilities. Pilots may suffer from:

o adverse mental states (arrogance, impulsivity, mental exhaustion);

o adverse physiological states (physical fatigue, sickness);

o physical/mental limitations (slow reaction times, general lack of aptitude to fly),

all of which indirectly affect performance and lead to errors.

• The next conditions are the personnel factors . Bad coordination among aircrew, and between them and the cabin crew, or ATC or maintenance may lead to bad

49 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

decision-making that cause fatal accidents (Crew Resource Management ). In addition, the pilots might not be mentally or physical prepared to fly due to insufficient rest, or lack of proper nourishment (Personal Readiness );

• Finally, the environmental conditions include the technological and physical environments:

o Technological environment refers to any issues with cockpit design, interfaces or aircraft systems that may lead to errors. This was already discussed in sections 2.3.2 (Display-design principles) and 2.4 (Automation) and will not be further developed here;

o Physical environment , particularly ambient environment, was already identified in section 2.2 as a source of stress inside the cockpit. These include vibration, heat, lighting, etc., which may lead to bad decision- making. Finally, operational environment are the weather and terrain conditions that cause disorientation and perceptual errors.

Figure 10 - Categories of preconditions for safe acts (adapted from Wiegmann and Shappell, 2003).

During validation exercises performed in a simulator environment, operational errors are rare events, playing a less prominent role than in the actual aircraft environment. Therefore, errors must sometimes be directly provoked by the experimenter, through design or procedure shortcomings.

50 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

3 HUMAN, ORGANISATIONAL AND OPERATIONAL ASPECTS OF MONITORING TECHNOLOGIES

3.1 Evolution of risk in aviation Across the industrial world, there can be few professions whose average conditions of work have changed so much in the last two or three decades as that of the airline pilot. A combination of new technologies, which have reduced the technical uncertainties that need to be managed in the flight process, together with new business models which have driven down costs and led to a massive expansion of commercial air transport, have in turn led to a major intensification of work for all flight crew. Just like aircraft are in the air longer earning more revenue, so are aircrew. The situation for flight deck crew is not so extreme as it is for some cabin crew whose conditions of work are sometimes so intensive that there is no time for a meal break during a normal daily roster. These changes were unimaginable to a previous generation. While this analysis has prioritized commercial passenger aviation, which is of course more visible to those that travel, other sectors with even more demanding conditions of work should not be ignored, for example air cargo, air ambulances, air taxi and parts of business aviation. Such conditions include long durations of duty (or ‘spreadovers’), irregular unpredictable duties, and duties that overlap the window of circadian low, operating in more extreme environments, and with less support.

The implications of these changes are that much of the accepted wisdom that has governed assumptions about safety in aviation over previous years may no longer hold. For example, initial simplistic predictions that low cost means low safety have not been borne out. But the intensification of work on short haul commercial aviation creates a dilemma – what are safe limits? Often the evidence from scientific studies has not kept pace with the speed of operational change, and this causes great problems in the reform of regulations which were initially framed in another era, with quite different patterns of work and rest. Maximum limits on flight and duty time were originally framed with a wide operating margin, which, it was assumed, would only be reached in exceptional circumstances. These maximum limits now operate more as norms, with little ‘safety margin’ to the boundaries of what is permissible.

This therefore means that operational risk needs to be managed in an entirely different way – ensuring compliance with a written regulatory standard is being, if not replaced, certainly augmented by close monitoring of the operational situation in order to anticipate, identify and manage hazards as they arise, and to ensure that the system itself adapts and learns to mitigate the risks that emerge from this close monitoring of everyday operational life. From a commercial point of view a serious safety failure has an enormous impact, which in some cases can threaten the survival of the company. Thus managing risk becomes a strategic priority for the company. This requires better monitoring of the operation, but it also requires an integrated system approach to managing and mitigating the risk.

The ACROSS project has positioned itself as a contributor to reducing risk in a changing aviation market, aiming to reduce the likelihood of incidents and accidents that are connected to flight crew workload and stress. As far as possible, the cockpit based technology solutions will take into account the increasing complexity of the operational situation as outlined before, that goes beyond the execution of flight tasks and puts a stronger emphasis on the flight crew as a manager of the process. Transversal work

51 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

packages are designed to shed light on the wider implications of changes in the operational situation and manage the realization of project requirements with the aim of ensuring maximal operational impact and pre-viewing/anticipating the capacity for their future implementation.

3.2 Managing workload, stress and fatigue in the operational situation For the pilot in the operational situation, managing workload, stress and fatigue has at least two aspects: managing the immediate demands of the task activity using available resources; and anticipating demands and managing one’s own capacity over a longer time-frame, for example a sector, a duty-day, a duty week. While ACROSS has a primary focus on the first of these, it is also important to consider the context within which the crew have situation awareness, pay attention, make decisions, communicate and execute the action. Humans are not fixed capacity devices with a linear expenditure of effort in relation to immediate demand – rather, the capacity to anticipate and plan means that a limited resource can be monitored, nurtured and sparingly allocated across a demanding situation. This, of course implies that the apparent activity at any one time may not accurately reflect underlying capacity to respond to a situation.

Thus, although there may be significant relationships between workload, stress, fatigue and performance these relationships are not simple or linear. To take the example of fatigue, the difficulty in demonstrating the relationship between fatigue and performance is not only because there are many antecedents of fatigue (e.g. duration and type of work or other activity, time awake, circadian periodicity, duration and quality of last sleep, accumulated sleep debt, etc.) but also because crew are required to manage their fitness for duty across their whole duty period. In aviation, long days of work, routinely violating the ‘window of circadian low’, sometimes combined with irregular schedules, are not unusual. For crew, the issue is managing not just this flight but the day, the week, or longer, until adequate rest can be gained. For these reasons, problems due to fatigue may be as likely to occur early as late in a shift, or early as late in a week of work. Performance may paradoxically improve towards the end of a working day or working week, and this is often attributed to the anticipation of the end of a demanding period. Conversely, unexpected demands added at the end of a demanding schedule may be disproportionately debilitating.

Threat and error management (Klinect et al., 2003) is an operational framework designed to assist the crew in anticipating and managing the range of threats that can impinge on flight operations and assist in mitigating the consequences of human error in order to restore unacceptable aircraft states to their normal status in a timely fashion. Within the HILAS project, the concept of an intelligent flight plan (Cahill et al., 2011) was developed to operationalize this concept in a tool to support preflight briefing, and, from that point on, to optimize the management of threats and errors during the operation.

For all the above reasons, the level of apparent activity at any one time may not accurately reflect underlying capacity that is available to deal with a threat, a stress, or high workload. On some occasions, an apparent low level of response may mask a capacity to respond to a newly emerging threat; on other occasions, an apparently adequate level of response to a situation may presage an unexpected breakdown in response to an unanticipated threat. The pilot is manager of the process.

52 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

3.3 Challenges in the detection and monitoring of stress, fatigue and incapacity How easy is it to detect critical levels of awareness or cognitive capacity to respond to occupational demands?

The first issue concerns the sensitivity of the metric. This issue applies whether the metric concerns a general measure of physiological arousal (e.g. cardiovascular activity, respiration), a specific measure of attentional state (e.g., EEG) or a behavioural measure of capacity (e.g., secondary task). An ideal metric differentiates all and only those occasions where there is an underlying signal (a critical degree of stress, workload, fatigue or some other incapacity). This ideal situation is difficult to achieve. Particularly in an industry like aviation where workload varies a lot and which is routinely carried out at unfavourable periods in the circadian cycle. Early starts, night flights, time zone changes mean that in the routine operational situation one would normally expect some signs of fatigue. One might normally expect such signs to be more common when workload is low and the situation is less critical. The problem is both in inferring the likely response when the demand changes in such situations, as well as measuring the quality of response in high demand situations. To take an example from road transport, it is possible to observe a professional driver at night in an apparent hypnagogic state, with physiological signs close to sleep, behaviourally with a rather loose ‘control loop’ maintaining direction down the highway, wondering how close this is to actually falling asleep; only then to see how that driver responds to a distant signal from other traffic, rousing himself to take control over that situation quite adequately. If the monitoring device is too sensitive it will detect too many weak signals that routinely occur in such typical occupational situations. This will encourage avoidance, or work-arounds, which may defeat the purpose of the monitoring. On the other hand if the device is not sensitive enough it may warn too late to intervene, or miss key signals altogether.

A key variable here is the degree of self-awareness in the operator him- or herself. This can vary quite dramatically at different stages in the progression of drowsiness (for example). One strategy is to use monitoring to enhance self-awareness, to try and support effective self-monitoring and decision-making based on an enhanced appraisal of how close one is to a putative boundary of relative incapacity. On the one hand this increases the level of control the operator has over the situation. On the other hand, if that enhanced self-monitoring encourages the operator to operate routinely closer to the boundary, due to operational and commercial pressures, perhaps, then there may not be a net safety gain.

A second set of issues concern the operational significance of the particular metric. In a very interesting study by easyJet into fatigue, flight-time limitations and performance in short haul operations (Stewart et al., 2006) it was found that towards the end of a week of rosters (including a split shift) the performance ‘error rate’ declined. The explanation for this was the increasing use of automation by the pilots, and this seemed to be related to increasing fatigue. Thus underlying this reduced error rate was something that was considered by the authors to be far more serious – tired pilots compensating for excessive fatigue by reducing their workload through use of automation. This was not seen to be a safe way to run the operation – but this required a complex judgment. Optimising the local situation by use of automation may seem to be a rational strategy, but if this relates to an increased risk of one or both crew being incapacitated by sleep or extreme drowsiness during a critical manoeuvre, then it masks a situation of far greater potential seriousness.

53 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

A third issue concerns the operational context of the monitoring activity. One of the applications of Threat and Error Management is an operational auditing procedure, based on extensive observation and interview of crew in normal operational situations (under non-jeopardy conditions). One recent case study of the application of LOSA (Line Oriented Safety Audit) in one airline was shown to come to conclusions directly contrary to subsequent fuller analysis. LOSA counts threats, errors and unacceptable aircraft states and indicated a high level of all three in this airline’s operations, surprisingly, even amongst highly experienced pilots. The real problem was the necessity for experienced pilots to be sent to difficult airports where it was often impossible to land following the prescribed procedure due to geographical and climatic factors. What was seen through the LOSA findings to be a problem of a relatively high degree of error and relatively low performance standards, was in fact a problem of procedure within a very challenging flying situation, requiring high skill and experience to manage effectively. The problem here concerns a procedure that was not adequate in a particular context.

What these three examples illustrate is that it is the risk to the operation that needs to be managed and that detecting and monitoring the state of the crew or their performance is a step towards this overall goal. Managing risk is about reducing uncertainty; there are several principles that can be applied to monitoring methodologies that may help to reduce uncertainty. A key principle is the triangulation of methods; using multiple complementary methods seeks to ensure that at least some of the weaknesses of any one method are compensated for by employing other concurrent methods. A classic way of doing this is by triangulating between physiological, behavioural and self-report measures to establish a valid overall picture. This is most feasible in an experimental or simulation situation, less so in normal operational contexts. Nevertheless, embedding both monitoring and reporting technologies in normal operational tasks and their technologies may make it possible to overcome this problem. Triangulation also can help solve problems of interpretation – for example, in the easyJet study above, only by interpolating behavioural measures of performance, aircraft states, and use of automation was it possible to come to a judgement about the significance of what appeared like an anomalous reduction in the error rate. The final example demonstrates that context is important; therefore the transparency of the monitoring process to the crew in the operational situation, and to any external parties involved in the monitoring needs to be assured, so that anomalies arising can be addressed.

3.4 The role and philosophy of automation The use of crew monitoring begs the questions: Who does the monitoring? Where are decisions made? What is the accountability for those decisions? The level of certainty about the status of crew and operation that can be achieved will dictate the possibilities of automation of the monitoring function. Within ACROSS, there are at least four levels of control envisaged in the different scenarios that address the three objectives of the project. These are:

• Support the pilot: the pilot remains fully in control and the monitoring output is an advisory information support to pilot decision making;

• Define envelope of permissible performance: control parameters of system operation are defined, so that the system resists any functional activity outside those boundaries and substitutes its own built-in control functions;

• Take over pilot functions: certain macro functions of the pilot are entirely taken over by automation under defined circumstances;

54 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

• Re-allocate functions: certain pilot functions are transferred to another agent – for example to ground control.

Each of these levels of automation progressively demand increasing level of certainty to be achieved by the monitoring functions in order to support the type of decision that needs to be made in a clear and unambiguous manner. Such decision-making needs to be accountable within the normal framework of operational control. Even more so, accountability for transferring functions needs to be clearly defined and supported.

3.5 Managing risk in human resources The role of monitoring has been defined in terms of reducing uncertainty, and some difficulties have been discussed in fully resolving the uncertainties in relation to pilot and operational status. It is therefore necessary to consider the wider context of managing the risk of high workload, fatigue, stress and incapacity; this may suggest a range of possibilities for using monitoring information in order to enhance the management of risk. Thus, it is important to stress that while the core focus of ACROSS is on the acute operational situation that needs to be managed in an optimal manner, the quality of the decision making that is supported in that situation may be enhanced by considering the wider context of operational risk management.

Once again, we can take Fatigue Risk Management (FRM) as a paradigm case, but one which can be extended and applied to other forms of potential incapacity under a general heading of “Incapacity Risk Management”. An integrated FRM concept could include the following functions, each of which could be supported by pilot monitoring:

A framework of Regulation. It is normal in Fatigue and Flight Time limitation (FTL) regulation to specify the general duties of the different parties. Thus it is the duty of crew to manage their lifestyle in a way that enables them to present fit and able for duty as required. This duty can be complemented by a general duty on the operational organization to provide the conditions under which crew can perform their functions safely and well. Methods and technologies for monitoring crew can be seen as enhancing the fulfilment of these general duties.

An envelope of permissible flight-time limitations with exceptions and derogations. This is the core of current FTL regulatory schemes. Such schemes are an uneasy compromise between different interests, such as practical considerations that underpin commercial viability and the cost of crew; the scientific evidence concerning fatigue, FTL and operational safety; geographical constraints of routes, distance and time zones. A relative lack of detailed evidence concerning the operational experience of fatigue and flight time limitations has been a major constraint in coming to an optimal arrangement of FTL schemes that provides maximum protection to crew and the public within a commercial transport system. Better crew monitoring could rectify this. The easyJet example quoted above (Stewart et al., 2006) was a successful initiative to demonstrate to the National Authority, using sophisticated multi-dimensional pilot monitoring, the safety benefits of a rostering scheme that was at variance with the national regulations. In order to get a derogation from the regulations, it was necessary to prove that the alternative scheme was safer than the current scheme that was permitted by the regulations.

A Crew Rostering System. Most commercial airlines have a software system for allocating crews to rosters, sometimes called a Crew Management System (CMS). These are designed to ensure that the roster complies with regulations on flight duty times. Some of these also have a built-in fatigue management system, allocating crew to rosters

55 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

according to optimal principles for managing sleep, work and rest. What ACROSS offers is a methodology for validating those principles with routine data from normal everyday operations. The PROSPERO project is developing a system which will allow the embedding of the most up-to-date current risk information in the normal data that feeds into flight planning (including crew). ACROSS would provide a valuable source of risk data about crew performance in relation to stress and fatigue and incapacitation.

Active Flight Management and Pilot Monitoring. As mentioned earlier, the core functions of ACROSS technologies support active flight management and pilot monitoring in real time.

Reporting and Critical Incident Stress Debriefing. Good practice following any critical incident during flight dictates both reporting that incident and following up with a crew critical incident stress debriefing. ACROSS technologies can not only improve both the identification and reporting of such incidents, but also provide a fuller picture for a more effective debriefing.

Investigating events and mishaps. In many incident investigations the role of fatigue is hidden. Because it is a subjective experience which potentially lays blame on the crew it is rarely reported in accident and incident investigations unless there is direct and independent evidence that it is a factor. At most there will be a comment on compliance with flight time limitations regulations. This means that the overall incidence of fatigue, or excessive stress and workload, is grossly underestimated in current safety data. Implementation of ACROSS technologies would go a long way to correcting this important anomaly in our understanding of safety.

System Risk Analysis. By providing normal operational data on the incidence of high workload, stress and fatigue in aviation operations, the application of ACROSS technologies in pilot monitoring could provide baseline data against which the real risk to the operation from such factors can be computed. This could provide all stakeholders in the industry, from the regulator down, with an accurate picture of exposure to risk. Due in part to the ‘low-cost revolution’, operational norms in commercial aviation have radically changed. Limitations that were once seen as being there to manage relatively rare exceptions are now seen as prescribing operational norms. What were previously seen as wide margins of safety are routine boundaries of what is operationally acceptable. For an airline, managing risk is a core commercial and operational goal. Where the airline is operating close to the boundaries, it is necessary to know precisely where those boundaries actually are. It is no longer sufficient to rely on tradition, custom and practice and a loose interpretation of disparate scientific evidence, system risk needs to be managed by smart streams of data from the operation identifying the key operational parameters that drive the analysis of risk. This could be one of the most strategic benefits of the ACROSS technologies.

If the overall goal of ACROSS is reduction in the risk of accident due to high workload, stress, fatigue or incapacity, then it is important to consider how the ACROSS technologies and methods can support an integrated approach to risk reduction. As with any other hazard there is a hierarchy of risk mitigation measures ranked according to their effectiveness. The optimal solution is to design out the hazard, for example by improving technology in order to reduce workload at key points. The next level of solution is to anticipate and prevent exposure to the hazard. Here, the knowledge given by the application of crew monitoring can sharpen up the anticipation and prevention of exposure to the risk. Anticipation also helps the third level – manage the hazard – which is normally the least effective way of dealing with a hazard. Because of the residual uncertainty in the

56 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

detection and monitoring of fatigue, stress and other unfavourable crew states, anticipation of the circumstances in which such states may arise should improve the ability to detect and manage such states effectively. Finally, if a hazard still persists despite these measures, it provides the opportunity to learn how to improve the ability to anticipate and manage in the future. Thus it is important to address the full cycle of risk management.

3.6 Stakeholders, interests and trust While the flight crew in the cockpit is at the centre of the technology development trajectory within ACROSS, the consideration of operational risk in the flight process and its management extends beyond the local situation and its actors. Taking this broad approach to the overall management of operational risk makes it plain that there are many stakeholders in this process and its outcomes. These stakeholders include at least the following, and most of these interests are represented in the External Expert Advisory Group (EEAG):

• Crew

• Flight ops management

• Safety management

• Commercial management

• Human resources management

• ATM

• National authorities

• Regulatory authorities - EASA, FAA, ICAO

• A/C design & manufacture

• Aviation medicine

By definition, the interests of stakeholders are not identical, though they will overlap considerably. Performance data and performance management always raise complex and difficult issues in relation to their purpose, availability and use. In considering the broad context of managing operational risk, that involves different functions and stakeholders, it may be possible to show that there are different ways of resolving conflicts of interest if broad system goals are shared.

3.7 The emerging role of the manufacturing sector From a manufacturing point of view, it is important to be able to see the services that can be hosted on the technologies that can deliver enhanced value to the customer. Focusing on the immediate application of new technology in a limited operational situation is very important in the design process, but it is also important to understand the ways in which new technologies can leverage the overall operational situation to improve the system outcome. The previous discussion has outlined key characteristics that constrain or facilitate the actions of flight crew and other actors that have a stake in the flight process.

57 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

New systems and new technologies do not change single jobs that individuals perform in isolation, but they can transform the whole process, including how it interfaces with related processes.

It is this process transformation potential which can deliver a step change in operability. Therefore the manufacturer has not only to engage with the Human-Machine-Interface, but also with how the technology fits into and facilitates the whole operational system. Designing a local solution in consideration of the wider system strengthens the overall value proposition to the customer as well as end-users and prepares the ground for a roadmap towards an implementation that maximizes the benefits for all stakeholders (e.g., manufacturer, regulator, end-user, airline management).

Considering the transformation capability at a system level raises new issues for the design stage of large complex operational systems:

• The commissioning and certification of the technologies to be integrated into new systems has to address how they will be operated in order to achieve the specified social goals. To take the issue of safety as an example, this means that the management of safety at the design stage has to seamlessly transition into the management of safety in the operational stage;

• Business concepts for service delivery are becoming more central to manufacturers’ design strategy, forcing them to address more directly how to design and deliver technologies which support their customer’s business model; and how to deliver value through services to support the deployment of their technology;

• System operability goals have therefore got to be integrated into the design process. This involves not only how to deliver availability and reliability of technologies in service to optimise customer’s business opportunity; but also how to integrate the manufacturer’s core technologies into smart, integrated operational systems;

• The functional requirements to meet these operability goals have to fully engage with the human role in complex operational processes, in order to understand how that human role might best be transformed through deploying new technologies in order to optimise system performance. This role involves not just ‘operators of technologies’ but also co-ordinators across complex “systems-of-systems”;

• Technology capabilities then have to meet these functional requirements to maximise the operational impacts of the new technologies, such as efficiency or safety.

These new aspects of the design process will inevitably require a much more intense and focussed process to engage with and reconcile different stakeholder interests. Delivering a technology solution that supports a more systemic agenda as outlined in the previous bullet points and is tailored to complement business and organisational changes in the aviation industry, requires the design process to be managed to ensure, amongst other requirements, the integrity of the human, social and organisational requirements which are necessary to fulfil the system goals. For example, creating a common operational picture of the new system will require quite radical “knowledge transformation” on the part of the various stakeholders to ensure common understanding.

58 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

3.8 Systemic Human Factors This whole approach requires a systemic framework for Human Factors. The crew is key to understanding the operational situation but is not the only gatekeeper, as other stakeholders have direct or indirect influence on facilitating and constraining crew decisions and actions along the process. The philosophy of WP3 addresses this explicitly in researching task in the process and their HMI requirements in a way that is firmly anchored in their operational context.

Thus the crew needs to be seen not just as elements in a human Minimum Equipment List (MEL), but as agents actively managing their whole part of the process. Within this there are decision points (and ACROSS will be identifying new parameters of decision making by crew and support), but such decision processes generally have a longer time-line than the end decision itself. Decision making in this context is about reducing uncertainty (managing risk), and that uncertainty relates partly to awareness of the situation (self- awareness, external awareness), and enhanced awareness through technical support (e.g. monitoring, detection). Thus the design and evaluation of ‘local’ solutions (specific to a closely defined situation) needs to be seen in a more ‘global’ context. For example, the goal of reducing risk through the management of peak workload and consequent reduction of stress can partially be understood in terms of workload and stress at one particular juncture; but might be better represented in a philosophy of optimizing the relationship between crew and systems in managing risk along the process.

How does this relate to the goals of ACROSS? ACROSS technologies should demonstrate that they can reduce operational risk (enhance operational safety). It needs to be shown that the local impact of a new technology-enhanced function has an impact on the overall propagation of uncertainty along the process. In order to do this, we introduce the concepts of states , gates and dependencies in the process as part of the operational framework in WP3. Fulfilling dependencies (e.g., ensuring resources, task performance and co-ordination) enables the achievement of a process state that in turn enables transition through a decision point (gate) into the next phase. There are, of course multiple intersecting processes (flight, ATM, ground support, crew management, etc.), each with overlapping and sometimes contradictory dependencies. Within ACROSS, one goal of WP3 (HF) is to show how these dependencies systematically relate between process, task and HMI levels of interaction. The fundamental objective is to be able to demonstrate how any change in the process (whether technology, procedure, information, etc.) has a potential influence on the process outcome. This requires building a functional model of the process in which all relevant influences on its operation are taken into account and incorporated into the analysis of dependencies, states and gates.

Within this, information cycles play a key role. ACROSS is all about the management of information. In an information cycle, data is sought out, transformed into information, and translated into knowledge about what the system is doing. This poses the questions – whose knowledge? How and where is it shared? How is it used in the process? These information cycles interact with other knowledge cycles in which people’s tacit understanding of how the system functions is challenged by new information, leading to a process of learning and knowledge transformation. Coping with difficult and demanding situations are the classic circumstances that give rise to a rich body of informal knowledge which is only partially shared, and almost never written down or formalized in any way. This body of informal knowledge forms one of the core components of professional culture. One of the challenges in ACROSS is to access this rich seam of informal knowledge, because it will give great insight as to how ACROSS technologies can work in the real world.

59 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Knowledge and information cycles rely on social relations – this is what makes the process actually work. For all the reasons advanced above it would be a mistake to see the flight crew in isolation from the rest of the system. The flow of both knowledge and information cycles in ACROSS needs to encompass all stakeholders who have a direct or indirect role in the operational situation. A key dimension in relationships between such stakeholders is trust. Trust is important in relation to the implementation of a new system or organizational change (Ward, 2005). It is important that all stakeholders and most particularly those who will operate the system have confidence and trust in the system. In her analysis of change initiatives, Ward (2005) identified five broad dimensions which are important in creating the conditions for trust. These are: having common goals which are not divergent; having open communication, with no topics that cannot be discussed; having clear, commonly understood ways of working; time pressure not being excessive; and not having a history of mistrust. These conditions are particularly relevant to objective three of ACROSS – the roadmap for implementation of single pilot operations. They apply both to the design, development and implementation cycle itself, as well as to the way in which these information technologies can work in the operational situation itself.

This is the essence of the approach that will be advanced in the operational framework in WP3.1. Advancing an integrated approach to HF is itself a significant advance on current HF practice. It is built out of experience in a series of EU projects (for example, TATEM, HILAS, ALICIA) but also seeks to learn from other integrated HF approaches – like the UK Defence Research framework for HF (e.g., Salmon et al., 2004). Thus ACROSS advances the State of the Art in considering how HF delivers an effective service to understanding the risks at a system level as well as the hazards at a local level (see Morrison, 2013) – including evaluating ways of managing those hazards and risks. This, of course is essential to delivering on objective 3.

60 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

4 CAUSES OF HIGH WORKLOAD

Workload assessment of the flight crew has received increasingly more attention as controls, displays and crew stations become more sophisticated. From the 1960s to 1980s there were over 100 individual components in the cockpit, each providing one single piece of information, all of which needed to be monitored by the pilots. The visual complexity in the cockpit had reached a point where there was no more space for new instruments. Fortunately, new technology allowed for the introduction of digital displays, which could show the same information in a smaller area (Curtis, Jentsch, & Wise, 2010). The new displays now resemble laptop computers and pilots need to know where the information is located, how to navigate menus and be able to interpret the information.

High workload occurs mostly at take-off and landing, in particular from the time the two pilots start preparing for departure until the end of the initial climb phase and again throughout the descent until the aircraft is on the ground. If an emergency situation or an unexpected event occurs, such as a late descent clearance or runway change, workload levels can become extremely high. On the other hand, during cruise there is usually more time to perform the tasks and to identify and fix errors. This reasoning also applies to the reduced crew configuration. Even though in theory, and under normal circumstances, a single pilot is capable of flying an airplane from take-off to landing without the need for assistance, the situation becomes more complicated if an unexpected situation occurs that requires the pilot to perform other duties besides flying.

Wigmore (2007), in an article for Hindsight magazine, summarized the routine of a short- haul flight, pointing out some of the sources of heavy workload during take-off and landing. These will now be briefly described. Once the aircraft is ready for taxi, pilots must go through the pre-take-off checks and make sure they are ready for departure as soon as they are given clearance. In bad weather the flight crew might want to take a look at the weather data again. At this time, an unplanned runway change means that the pilots have to recalculate the take-off performance data, re-brief the departure (runway data and SID can be completely different) and reprogram the FMS. Under time pressure, the probability of making an error increases. After take-off and during the initial climb the pilots must carry out several procedures, including equipment checks, while ensuring communication with air traffic controllers. Noise abatement rules over urban areas mean that climb rates are usually high and that pilots need to follow strict departure routes, making it harder for them to level off the aircraft when reaching the allocated altitude.

During the final flight phases (approach and landing), pilots need to check the ATIS, calculate landing performance data, brief the approach (including the go-around procedure) and go through the appropriate checklists, at the same time that they are monitoring several instruments and following clearances from the controllers. At this point the already high workload levels can increase even more if, for example, the weather is bad, there is a runway change, a delayed descent clearance or a requirement to maintain speed and/or altitude until late on the approach.

Independently of the flight phase, whenever unexpected events occur that require two or more tasks to be performed concurrently, it might lead to high workload levels. In those cases, the pilot must prioritize and decide which tasks to perform first (Morris & Leung, 2006). According to Loukopoulos et al. (2003), airline formal procedures and training do not provide clear guidance on how to manage concurrent demands. For example, airline procedures expect that during taxi the PNF is not only monitoring the PF’s actions, but also responding to radio calls and finishing up any performance calculations left-over from

61 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

the preflight phase. Interruptions to ongoing tasks from radio communications and the cabin crew, are also quite common, and pilots must remember to return to the interrupted task later. Deferred actions, however, are particularly vulnerable to forgetting.

4.1 System Level Thanks to the introduction of computer technology and lightweight and powerful circuits in the early 70s, the aircraft cockpit benefited from the transition of electromechanical instruments to “glass-cockpit” which progressively permitted a more functional view of aircraft status and environment to pilots. It is connected with the progressive reduction of crew members (radio operator and navigator made unnecessary by communication and navigation instruments) and the increasing demand on pilots due to increasing air traffic . LCD-like displays and satellite aids enable information displays to become operationally (or at least functionally) oriented regarding the pilots’ needs in terms of relevance, flight phase or impact on safety.

Now that the modern large commercial aircraft requires two pilots and that air traffic will significantly increase during the next decades, thus increasing the risk of incidents and accidents, the aeronautics stakeholders must pay attention to maintain the effort of safety improvement, whilst maintaining previous assets and increase performance.

Pilots’ workload is clearly one of the key levels which should be primarily addressed due to its impact in terms of safety and performance during operations. As mentioned above, the pilots’ workload significantly increases during take-off as well as approach and landing phases. This is implicitly due to the demanding constraints of the air traffic environment (e.g. margin from ground, ATC clearances, close air traffic, navigation aids, route profile, all regarding the short amount of time for the pilots to identify, analyse, decide, execute and check the appropriate procedures required during the concerned flight phase). During take-off, approach and landing an average of ~80% of accidents/incidents occur whereas they only represent about 5% of total flight time.

Air traffic is one of the main challenges to be faced in the near future of aviation. Global market forecasts 5% of traffic increase until 2030. Surveillance and navigation means within the aircraft help the pilots to survey and navigate through the traffic. But as a consequence, traffic augmentation around the aircraft force the pilots to monitor more accurately its navigation performance and listen to the information provided by either the ATC (communication link) or other independent equipment such as TCAS (Traffic Collision Avoidance System). Anyhow, the risks of collision shall be mitigated in a relative short period of time to avoid them (reactivity). A synthesis could be formulated by: “more aircraft means more alerts, more precision required on navigation and less time to manage it.” As a result, pilots’ workload depends on air traffic.

The weather (sudden or forecasted), the communication with ATC for clearances, navigation aid availability and aircraft infrastructure deeply determine the pilots’ choices in terms of route definition during nominal or abnormal cases. That’s why they should be considered as direct drivers for global navigation performance and pilots’ workload induced to assess the viability regarding the aircraft’s global status.

Commercial transport business rely evidently on fuel price but airlines have also various strategies depending on single-leg or multi-legs mission profiles, maintenance centres localisation and often on preferred routes (sometimes pre-implemented within onboard information system applications). They may variably change along the flight and hence cause route modification to be entered into the FMS. This induces workload and could be

62 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

further called “commercial context change”. Moreover, some specific event such as the diplomatic instantaneous status of the country over-flown may influence dispatch envisaged solutions or even normal operations (e.g. USA territory forbidden on 9/11/2001).

Hence the operational context is a key factor which may cause workload. Pilots are trained and aircraft systems are designed to comply with the procedures defined by the airworthiness authorities in order to handle effectively this kind of situations and to progressively ameliorate impact along time. Further, the future requires a reduction, or at least, the maintenance of the incident/accident rate alongside the increase in air traffic, which means that improvements shall be decided and developed today.

In parallel to operational context, the aircraft global status (i.e. how the aircraft flies whatever the environment is) may fluctuate during the flight. The flight performance is directly subject to aircraft attitude, altitude, speed and heading. But, more specifically, it depends on any systems status at various levels governed by their criticality and safety assessment. It may be minor and affect only profitability of the flight but it can also in rare cases seriously threaten the human beings on-board and outside the aircraft. Losing one or more aircraft system may cause degraded navigation performance, decrease situation awareness, affect aircraft “liftability” or cause re-routing or dispatch. Consequently, in each of those cases, the workload will increase. Those matters are described more precisely in the corresponding Communicate , Navigate , Aviate and Supervision chapters which will act as references for system failure models and for the impact of resolution procedures on workload.

Besides the usual Aviate, Navigate, Communicate rule, aircraft systems management has to be appropriately integrated by the pilots, especially in case of system failure (more indicators to be checked and procedures of resolutions to be applied). It demonstrates that aircraft global status constitutes also a key factor of workload, which may be combined to the operational context one.

Finally, the pilots who are most of the time the decision-makers and always the executors, act as the final uncertainty element in the global operation chain. Aptitudes, experience, and training are levers which may improve the various knowledge-based types. But, in addition to pilot skills, reduced crew situation and pilots’ coordination (cross-checks, task prioritizing, etc.) may also interfere with crew workload management.

As a result, whatever nominal or abnormal cases (anticipated or unexpected), the causes generating high workload are the following:

• Operational context

o flight phases

o traffic

o communication with ATC

o navigation aids availability

o airport infrastructures

o weather

63 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

o commercial context change

o countries security policy change

• Aircraft global status

o Aircraft attitude, altitude, speed and heading

o Aircraft systems status

• Human factors

o Reduced crew situations (pilot incapacitation, pilot physiological need, etc.)

o Pilots’ coordination

o Pilot’s skills.

All of them are addressed, independently of each other, from equipment to system, function and operations levels. However, the workload becomes higher when the complexity of the situation (mixed causes or cascading effect) increases whilst the probability of occurrence decreases. As an example, in case of uncontained engine rotor failure, the checklists resolution plus the route diversion definition and its communication to ATC combined with bad weather context (turbulence for example) are synonyms of high workload situation. Nevertheless, in real operations, it is certainly not experienced by every member of the flying pilot community.

At system level, attention is paid to anticipate at maximum all the risks and then to make matching what in reality may occur and what needs to be planned for mitigation. Complex situations are more and more previewed or anticipated, at least because of aviation history incidents/accidents which lead to continuous improvements.

The resulting main difficulty is to adjust the right balance between risk mitigation means, complexity and aircraft operability. One of the considered risks is system constant complexity evolution (which answers to the safety requirements evolution) vs. its usability: the ability of the pilot to understand and resolve a failure which is commonly a time demanding effort.

4.2 Systems Integrator’s Point of View During normal operations, the pilots can experience high workload due to the combination of multiple tasks or due to the high effort required to perform one task. These tasks can be categorised under Aviate, Navigate, Communicate, Manage systems.

The task of aviating involves monitoring flight parameters on-board, and flying the aircraft, either manually or via the autopilot. Situations in which the crew are required to take manual control of the aircraft can add significantly to their workload. In particular, conditions in which the flight control system degrades can cause high levels of workload. Further, limited availability of parameters required to perform the Aviate task can increase workload as it requires the pilot to use alternative, possibly more unfamiliar sources of information. Adverse weather can also increase workload, especially when the aircraft needs to be operated manually.

64 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

The navigate task involves planning and executing the desired flight trajectory, normally via the flight management system (FMS). Rerouting from ATC can increase crew workload as the crew are required to update the FMS with new route information or fly the aircraft without use of the FMS, especially when a swift change is required. Limited system availability causing flight deck systems such as the Navigation Display or the FMS to degrade in functionality or fail will contribute to increased workload. So will adverse weather conditions, such as thunderstorms in the area, as they may require increased interaction with navigation system interfaces as well as monitoring of the weather radar.

The communicate task involves voice communication with ATC. When in heavily used airspace this task can significantly increase crew workload, as ATC reroutes traffic as needed, and increased interaction and flight crew attention are required. In non-normal situations, the crew may need to inform ATC of an onboard incident which may require an emergency landing or rerouting. This task will add additional workload to an already high- stress environment on the flight deck.

The system management task involves preparing and monitoring the on-board systems for correct functionality. In the nominal situation, much of this task is automated, or normal checklists are followed. When non-normal situations arise, such as single or multiple system component failures, the crew may be required to run various checklists, which can greatly increase workload from the nominal situation. In particular, highly integrated aircraft can produce a multitude of flight deck effects in case of system failures. In some situations it might be required that the crew interpret the flight deck effects to prioritize the appropriate actions to be carried out. If multiple systems are affected by a failure then chances are that performing the other basic pilot tasks already requires increased effort from the flight crew. The combination of having to manage multiple flight deck effects with associated actions, while under increased workload due to degradations in the other pilot tasks, might further exacerbate the situation.

4.3 Navigate and Mission Management

4.3.1 Workload Development in Nominal Situations In airline operations today, there is still a huge amount of manual action required to collect all the information that is needed to safely and efficiently manage the overall flight mission. Flight Crews predominantly get the operational flight plan with associated operational data, like passenger and cargo load, as well as weather information and NOTAMs at the Airline Operations Centre. The information is in most cases printed out and handed over to the crew as a pack of paper, which is subsequently used by the cockpit crew to mark and brief the information deemed relevant for the forthcoming flight.

In addition to the operational data, there is supplemental aeronautical information needed about airports, airspaces, airways, navigation aids as well as rules and procedures for the respective countries along the route. This information is available within the Aeronautical Information Publication (AIP) of each country and the operator has to make sure that all current and active information is available onboard. In some cases this information has been collated by an external provider or the airline operations office. In many cases the flight crew itself needs to prepare the subset of required charts for the different flight phases like taxi-out, departure, en-route, arrival, approach and taxi-in.

The navigation during the flight is performed by flight management and guidance computers, which are programmed prior and also during the flight by the crew through

65 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

inputs to these systems via control and display units (CDU). The crew has to verify that current databases are loaded and that the information contained in the aircraft systems matches the published information. During flight execution, the crew needs to monitor on the Electronic Flight Instrument System (EFIS) that the aircraft remains within the cleared flight path and within operating limits.

While this mainly serves the safe fulfilment of the mission, the flight crew has to consider other information like wind, turbulence, icing or severe weather in order to make sure that the flight is conducted in a convenient and fuel efficient way. Changes to the originally planned route have to be coordinated with the airline’s operations centre and of course with air traffic control.

In modern airliner cockpits, the amount of paper needed to be carried onto the flight deck is already significantly reduced, because the majority of the described supplemental aeronautical information is presented on electronic displays. Besides the advantage of a smaller environmental impact due to less paper waste and the weight reduction, electronic versions of the repositories allow a much faster access to all kinds of information, provided there is a smart interface available.

However, the first generation of Electronic Flight Bags (EFB) represents a rather direct replication of the information on paper, where the user still needs to do a lot of manual search and pre-selection of the needed data. For example, charting information is still divided along the different flight phases and available on separate electronic charts. Chart subsets have to be composed for each flight and single charts have to be pulled during the respective flight phases. In order to reduce the number of single charts for one airfield, a large amount of information is grouped on a single chart. As a consequence, a preselected chart still contains non-relevant data which needs to be suppressed mentally by the crew during use. An example of this fact would be an arrival chart showing multiple arrival routes, while only one of these routes is flown, or an approach chart showing data for different airplane speed categories, while only one of them is applicable to the currently flown aircraft type.

4.3.2 Workload Development in Reduced Crew Situations A reduced crew situation in today’s cockpit means that there is only one crew member left on the flight deck to finalize the mission. Two-pilot cockpits have been designed in a way that all flight critical airplane functions can be controlled from both seats, either the left or the right seat. Critical aeronautical information like charts are available on both sides, no matter if they are displayed electronically or conventionally on paper. Each crew member also has its own CDU to access the flight management computer to fully program the remaining flight path. In summary, technically all provisions have been made to handle the aircraft by a single pilot.

As far as navigation and mission management is concerned, the remaining crew member now has to handle the same amount of information as in a non-reduced crew situation. In the airliner cockpit, there are currently no adaptive information management systems that change their behaviour to specifically support the information presented to the remaining crew member in a reduced crew event. There is no mode available that, if selected, would change the logic and structure of the flight management system or electronic flight bag to accommodate this abnormal situation. Probably the most efficient and helpful information support to the remaining pilot will be the voice connection to the ATC on ground and the provision of selected information on pilot oral request, or information deemed useful by the controller for that situation.

66 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Nevertheless, even with the most efficient support from the ground, all the tasks of the pilot flying and the pilot not flying are now combined in one person and are to be handled by the remaining crew member. This encloses programming and verifying the flight management computer, as well as performing briefings alone. A verification of the crew plans and actions in the sense of a Crew Coordination is not available anymore. The monitoring of flight parameters is now done based on a reduced safety net – there is no verification or confirmation from a second human and the technical cockpit systems are not adapted in any way to replace the missing human redundancy.

4.4 Communicate Crew workload development due to communication tasks is discussed in the following subsections. The specifically addressed issue is the workload incurred on the crew, to guarantee an error-free ATC communication in the currently predominant voice-based communication system.

4.4.1 Workload Development in Nominal Situations Pilot-controller communications typically consists of controllers initiating and presenting a transaction with the intended aircraft, and the pilot accepting the message and presenting an acknowledgement back to the controller (Figure 11).

Figure 11 - Pilot-Controller Communication Loop [from Flight Safety Foundation (FSF), 2010].

67 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

After the acknowledgement, the controller’s message is taken as mutually understood by both the pilot and the controller. Examples of such transactions are airspace report information (traffic, weather), commands to the pilot to perform some actions, and request of information about flight conditions. In voice-based communications, these routine can present some challenges as controller instructions are often complex and time-critical. Moreover, the radio link is often noisy and busy with controller communications with other aircraft in the same flying sector. Communication errors and misunderstanding often comes out as a result.

Morrow and Rodvold (1993) listed some communication problems that lead routine collaboration into non-routine transactions, which in turns cause increased workload and delays because pilots and controllers must indicate and repair the problem:

• Initiation failure: The wrong pilot responds to a message because of call-sign confusion, forcing the controller to correct the addressee and repeat the message for the intended pilot. Pilots may also fail to hear, forcing the controller to repeat the message. Repeating unacknowledged messages was also noted as a frequent problem;

• Understanding failure: Pilots may notice that a message is for them, but misunderstand all or part of the message. This may come in different forms:

o Pilots may fail to interpret all or part of the message, forcing them to request a repeat (e.g. “Say again heading”);

o Pilots may interpret the message, but be uncertain of their interpretation, forcing them to request confirmation (e.g. “Was that heading 120?”);

o Pilots may misunderstand the message, but not realize it, which is signalled by an incorrect readback.

• Memory failure: Pilots may understand a message, but forget it before they respond. For example, cockpit duties or subsequent ATC or cockpit communication may interfere with memory for the message, particularly if the second event is similar to the message;

• Information failure: A message may be understood and remembered, but the pilot disagrees with its accuracy, timing, or completeness;

Some of the causes of the failures are also presented in Morrow and Rodvold (1993):

• Message factors:

o Poor formulation: incorrect or outdated information is presented in the first place;

o Poor packaging: controllers may present too much information in one message, or the message may be too complex (e.g. “cross XYZ at one-one thousand, descend and maintain one-zero thousand, reduce speed to 250 knots...”);

68 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

o Poor delivery: controllers may present the message too rapidly, with poor enunciation or with misleading stress/intonation cues.

• Medium factors: Message factors can be compounded by noisy of overloaded radio frequencies;

• Task factors (workload): The working memory demands from message and medium factors are more likely to lead to pilot communication problems when concurrent flight tasks compete for limited capacity.

Voice communications are also known to contribute to operational errors due to miscommunication, stolen clearances (an ATC clearance for one aircraft is heard and erroneously accepted by another aircraft), and delayed message transfers due to radio frequency congestion.

Some more studies that support the problematic of voice based communication can be found from reports based on the analysis of the NASA Aviation Safety Reporting System (ASRS) database. For instance, the study in Monan (1986) analyses 417 communication related reported incidents from the ASRS database in the 29-month period from April 1981 to July 1983, emphasizing on the readback-hearback problem in ATC communications. Some identified failure modes:

• ATC message numbers transmitted correctly but heard incorrectly, and ATC hearback failures (328 cases), for example:

o Pilot mixing up 10,000 with 11,000, or FL200 with FL220;

o Inadequate acknowledgements such as “Roger”, “So long”, “Okay”, instead of full readback, with subsequent flight deviations.

• ATC message numbers transmitted, heard, and read back correctly, but followed by deviations due to cockpit mismanagement (71 cases);

• Acknowledged controller hearback failures (298 cases), for example: failure to hear error in pilot readback.

These findings show that readback/hearback mechanism, as a devised means to mitigate noisy radio links, does not provide a full safety guarantee while still adding up to pilot and controller workloads.

4.4.2 Workload Development in Reduced Crew Situations Another finding in Monan (1986) is that splitting roles into “pilot flying” and “pilot handling the radios” is a relatively common practice in certain phases of flight, e.g. in the engine startup, taxi, during any minor malfunction in early climb, etc. This kind of situation presents a loss of redundancy in two-man cockpit operations, because ATC communication tasks were accomplished without the cross-check monitoring of one crew to the other. Clearly at some phases of flight, the flying tasks require more focus and concentration of the flying pilot, hence the splitting of the roles. It is thus obvious that in a reduced crew setting, irrespective of the cause, communication task would only add up to the workload of the pilot. Moreover, the supervision function would become inexistent, i.e.

69 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

there is no second crew that verifies if the other crew has understood and readback ATC clearances correctly.

4.5 Manage Systems

4.5.1 Workload Development in Nominal Situations While the “Aircraft System Management” task may have differences from one aircraft manufacturer to another, the following paragraph describe the common state of the art regarding this task.

The “Aircraft System Management” task corresponds to a permanent task for the crew throughout the flight and covers the nominal use of the aircraft systems (External lighting, anti-Ice selection, brakes use, etc.) as well as their permanent monitoring and reconfiguration in case of failure.

Systems managed by crew in normal operation:

• Air Conditioning

• Electrical power (during flight preparation)

• Fuel (during flight preparation)

• Ice and Rain protection

• Landing Gear & Braking

• Lights

• Engines & APU (during flight preparation)

• Vehicle monitoring

• Flight Controls (slat/flaps…)

Systems only monitored and reconfigured by the crew after a failure:

• Previous list (“Systems used in normal operation by the crew”)

• Fire Protection

• Hydraulic

• Oxygen

• Pneumatic (Bleed)

70 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

• Inert Gas system

• Doors & Slides

• Flight Controls

Note: Here “Aircraft Systems” covers also avionics systems (FMS, Auto-flight, Communication systems, etc.), to be reconfigured in case of failure (for example, usually, the pilot and co-pilot use their own FMS, but in case of failure of one FMS, both pilots use the same FMS after a manual reconfiguration). Nevertheless, the main part of “Aircraft System Management” corresponds to systems today managed via the overhead panel. These systems may also be called “Utilities”.

Man-Machine work sharing

Taking into account a modern aircraft, tasks are shared between the crew and the aircraft systems depending on the type of operations: normal or abnormal.

During normal operations, the crew perform manual controls and monitor the aircraft status through synoptics from a display and data from the overhead panel (see Figures 12, 13 and 14). The avionic system possibly provides normal checklists to the crew as well as aircraft system status and monitor the aircraft system failures.

Figure 12 - Example of A380 cockpit.

71 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Figure 13 - Example of an Overhead Panel (A380).

Figure 14 - Example of System Synoptics page (A380).

72 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

During abnormal operations, the crew first need to acknowledge the alerts through master warning/caution usually located in the glareshield. The crew has then to select and apply the appropriate procedure, perform manual reconfiguration actions and check the aircraft status. This needs to be done taking into account the operational limitations. In case of abnormal operations, tasks are shared by the crew between PF and PNF. The captain may decide to change pilot flying.

In parallel, the avionic system provides to the crew “attention getters” (master warning/master caution), the alert messages on a display, as well as the appropriate procedure to be applied at this moment (see Figure 15). The system provides the system status as well as the operational limitations on display.

Figure 15 - Example of Alerts & Procedures (ATR).

Failure detection and alert

In case of multiple failures, the flight crew may be drastically stressed. Multiple alerts and procedures need to be performed. The situation may become more delicate; one of the crew members is dedicated to the pure task of piloting while the other one has to manage the new technical situation, sometimes difficult to understand. Multiple failures are managed and prioritized during aircraft design, but not all cases can be identified. Thus crew may be lost with a list of procedures with multiple actions to be performed.

With a happy ending, during the A380 Qantas F32, it took the flight crew 50 minutes to manage 54 alerts and procedures after aircraft damage due to one engine explosion.

Moreover, aural alert in a context of multiple failures or cascaded failures is a major source of stress. The management of alerts by the crew could appear more stressing than the real aircraft situation.

73 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Failure Resolution:

Pilots are not supposed to know all details about system functioning but the question of what is the minimal knowledge of system design and behaviour that the crew must have, is a difficult topic linked with the global position of crew against automatism and procedures, especially for a non-anticipated event related to the aircraft system or the avionics design.

During procedure execution, the crew perform many slight changes between down head displays (to check the status) and the overhead panel (to reconfigure). This man machine interface configuration appears as not being operationally efficient, source of workload and errors.

4.5.2 Workload Development in Reduced Crew Situations Fail-safe designs are designs that incorporate various techniques to mitigate losses due to system or component failures. The design assumption is that failure will eventually occur but when it does the device, system or process will fail in a safe manner.

“Safe life” refers to the philosophy that the component or system is designed to not fail within a certain defined period. It is assumed that testing and analysis can provide an adequate estimate for the expected lifetime of the component or system. At the end of this expected life, the part is removed from service. Techniques like redundancies, back-up systems or multiple load path, early detection are used for safe life design.

Automation in aircraft increased safety and efficiency both significantly relieve the crew from workload and thus decreases psychological tension and stress. Flight management system makes the flight safer relieving the crew from calculation burdens and by providing an excellent situational awareness to the crew.

Furthermore, as written earlier, the two-pilot cockpits have been designed in a way that all flight critical airplane functions can be controlled from both seats, either the left seat or right seat only. Nevertheless, the workload, which is normally being shared by the two- pilot crew , will definitively increase for the single pilot in the case of a reduced crew situation.

4.6 Aviate Aspects

4.6.1 Workload Development in Nominal Situations

In this section we will discuss contributing factors to pilot workload during aviate in a nominal crew situation.

4.6.1.1 Normal situation In a normal situation, the pilot flying (PF) must concentrate on flying the aircraft (aviate). This includes:

• controlling and/or monitoring the current aircraft state:

o pitch attitude

o bank angle

74 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

o airspeed

o thrust

o sideslip

o heading

o altitude

o aircraft configuration

o vertical speed

o flight mode annunciation

o etc...

• capture and maintain the desired targets, vertical flight path and lateral flight path.

The pilot not flying (PNF) must backup the PF by monitoring flight parameters and by calling any excessive deviation. The main display unit supporting the aviate task is the primary flight display (PFD). In his scanning task the PF will generally follow the so-called “basic-T” scanning rule (90% of time): attitude, speed, attitude, altitude, attitude, heading. In the remaining scanning time (10%) the vertical speed and slip are also scanned.

Flight crew workload varies during the flight from low to high. During high workload, flight crews are especially vulnerable to making errors if their strategies for effective multi- tasking break down.

Typical flight phases causing high workload relevant for ACROSS are:

• Take-off, initial climb and standard instrument departure

• Descent, approach, landing and go-around

Although not directly forming part of ACROSS, the taxi-in and taxi-out flight phases may also be considered a high workload flight phase, especially for crews not familiar with the airport and under low visibility and/or adverse weather situations.

Most of the tasks executed during these flight phases are executed at skill-based level (Reason, 1990) or have standard operational procedures, thus they are fairly effortless for the flight crew. Workload increases, however, if tasks require rule-based or knowledge- based 1 activities (Reason, 1990) (for example in unexpected non-nominal situations). Similar, multiple concurrent tasks intensify the need for mental resources. Often these tasks do no directly relate to controlling the flight path but to navigation, communication, and system management. In such situations the flight crew has to prioritize tasks (Morris & Leung, 2006). The competency associated with task prioritization is called cockpit task management or strategic workload management.

In the following sections we will discuss flight phases relevant for ACROSS, which are associated with high workload, in more detail.

1 The difference between skill-, rule-, and knowledge-based activities is further outlined in section 2.3.

75 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Take-off, initial climb and standard instrument departure

This section describes the tasks needed to be performed for take-off, initial climb and standard instrument departure. It is a shared responsibility of the flight crew to carry out these tasks. Clearly, all these tasks will contribute to flight crew workload and most of them are related to the aviate task. Note that dependent on aircraft type and airline policy, differences between the tasks list / procedure may occur.

Typically, the captain will call for the “Before take-off” checklist when cleared for line-up. At this point, it is assumed that flight crew briefing has been done, flight controls and instruments are checked, and flap setting, v-speeds, and flex temp are confirmed. Table 4 lists the tasks and actions belonging to the procedures before, during and after take-off.

Procedure Tasks and actions Before take-off: • Advise cabin crew to take seats Line-up • Check t/o configuration clearance • Check temperature of brakes received • Select appropriate engine ignition mode • Select appropriate weather radar mode • Select appropriate TCAS mode • Select appropriate APU bleeding and AIRCO PACKS mode, if applicable • Set appropriate exterior lights • Crew briefing update o PF reviews any late changes in clearance or routing o PF briefs first turning point and direction, together with the first cleared altitude or flight level o Both pilots check that the first cleared altitude or flight level is inserted and indicated on the PFD • When lined up, check compass heading and aircraft position for positive runway identification Take-off: • Start elapsed timing take-off • Release brakes clearance • Advance thrust levers to get the aircraft rolling received • Advance thrust levers further to take-off thrust and push TO/GA switch • Adjust take-off thrust prior to 80 kt, if required • Keep pitch control forward of neutral • Notify 80 kt event • Rotate at VR and establish a positive rate of climb • Monitor vertical speed and radio altitude to verify positive rate of climb • Retract gear • Engage AP as required • Set heading if required • Verify climb thrust at thrust reduction altitude • Verify acceleration at acceleration altitude • Set flaps according flap retraction schedule and check reaching commanded position After take-off: • Set altimeter to standard and cross-check settings and after passing

76 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

transition indications altitude Table 4 - Tasks and actions before, during, and after take-off.

A number of those tasks require constant monitoring. For example the fact that the PF needs to be head-up during take-off implies that the PNF at the same time often needs to monitor certain displays intensively (e.g., for calling out V1, V2 and rotate). In such situations it is simply not possible for a pilot to give visual attention to any other task and one can conclude that the pilot is saturated unless information is provided in another format or using a different display device (e.g. HUD vs. HDD). It is feasible to increase the pilot’s capacity to process more information either by combining information in a clever, more intuitive, way, or by providing information via different channels (e.g., audio).

The combination of tasks and the way the interface between pilot and cockpit is designed assure that a commercial flight crew of two is constantly occupied with primarily aviate related tasks during these flight phases. Workload of flight crew may decrease by developing a new distribution of tasks (the taskload) over automation and crew and / or by creating interfaces that make better use of the pilots abilities, thereby freeing pilot capacities for other tasks (for example from the other crew member).

Descent, approach, landing and go-around

Table 5 describes the tasks and actions that contributed to flight crew workload during the descent, approach, landing and go-around phase:

Procedure Tasks and actions Descent • Check (ATIS) weather report, terrain and FMS position preparation: o Check possible altitude restrictions imposed by terrain prior to TOD clearance o Compare FMS position with raw data • Select appropriate weather radar mode • Manage pressurization • Approach preparation o Check fuel status o Check landing weight o Check applicable descend, arrival and expected approach procedures o Check applicable descend/arrival and approach speeds o Insert arrival procedure in FMS as soon as known o Prepare as far as possible NAV/COM systems for intended type of approach o Give landing crew briefing as soon as practicable o Set descent limit if already determined o Set destination QNH on altimeter settings panels Descent: • Initiate descent at and after • Select appropriate pages on long term interface FMS to TOD o Monitor VDEV information o Allow carrying out any ATC long term lateral or vertical revisions • Perform descent adjustments if desired • At FL 100: o Set appropriate exterior lights

77 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

o Switch seat belts sign on o Arm appropriate approach mode o Ensure that the appropriate radio navaids are tuned and identified o Cross check nav accuracy using FMS interface and the VOR/DME raw data on the ND o State descent limit, FAS and approach aids identified o Check if FMS is in correct mode Approach and • Notify the cabin crew to prepare for landing landing: • Check approach clearance when cleared • Perform flight crew briefing below transition o Review the approach, including any additional items or level or when changes appropriate • Set altimeters o Check correct airfield QNH on altimeter settings o Select QNH on EFIS control panels o Cross-check altimeter indication on PFDs • Activate approach phase • Set GA altitude • Set flaps according flap extraction schedule and check reaching commanded position • Advise cabin crew to take their seat • Extract gear • Check approaching minimum (typically 100ft above MDA/DH) • Check visual reference and decide for landing or GA • Monitor altitude and speed frequently Go-around • Increase thrust to TOGA level • Select appropriate flap position • Verify rotation to go-around attitude and thrust increase • Verify positive rate of climb • Retract gear • Select appropriate heading • Set flaps according flap retraction schedule and check reaching commanded position • Manage speed • Verify missed approach route being tracked and missed approach altitude captured • Accomplish after take-off checklist Table 5 -Tasks and actions during descent, approach, and landing.

In this situation, exactly as with the take-off and climb, there are a number of aviation related tasks that can be prepared in advance. However, in the last moments of the flight they all need to be aligned, monitored and require attention simultaneously. In addition there will be heavy interaction with the Communication task, at least for the PNF.

Similar as described above, the task combination and interface design assures that the flight crew can primarily concentrate on the aviate task. The flight crews workload may decrease by changing the task allocation between crew and automation and / or by creating interfaces that make better use of the pilots abilities.

78 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

4.6.1.2 Abnormal anticipated causes In general pilots are well prepared, or trained, to manage a number of abnormal situations that may occur. In other words, the pilots anticipate for anomalies. The examples described below all have a set of rules attached to them that the pilot need to execute (either from memory or a checklist). Most of those procedures are trained, which is why they are called ‘anticipated’.

Reason (1990) described that tasks can be executed at different levels. Those levels are skill-, rule- or knowledge based (see section 2.3).

The level on which operators execute a task depends on their level of experience. For example, a student pilot still needs to develop the ability to steer aircraft in flight by manipulating panels on the aircraft wings and tail. S/he needs to understand that the input devices are different from for example the steering wheel of a car. The student pilot also needs to learn what the approach procedure at an airport is. After a while a number of these abilities will migrate from knowledge via rule- to skill-based and the pilot can just fly the aircraft and talk at the same time.

For example, Figure 16 lists the high-risks areas during take-off of runway excursions for the accident cases between 1996 and March 2008. More than one area may apply per case. These risks may have led to situations with increased workload, in which immediate corrective actions were required.

Figure 16 - Take-off runway excursion risk factors (from FSF, 2009a).

79 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Specific contributing factors increasing workload in descent, approach, landing and go- around are:

• Faulty information of A/C systems (e.g. inconsistent airspeed indications)

• Late runway change (time pressure)

• Fatigue

• Unplanned change of level of automation due to hardware system failure

• ATC instructions

Other causes, which will significantly increase workload to operate the aircraft, are events for which the crew has been trained on a regular basis, such as:

• Adverse weather, e.g. windshear

• System degradation, e.g. engine failure during take-off

• Dense traffic (VFR)

• Bird strike

4.6.1.3 Abnormal unexpected causes The major difference between anticipated and unanticipated, when talking about the impact on workload, is that unanticipated situations always start at the knowledge-based level. If it is unanticipated there probably is no well-trained rule for it and therefore it will result in more workload. After all the solution has often a substantial knowledge-based component and on top of that it is unclear how much work there will eventually be involved.

After identification of the whole situation there is, of course, the opportunity to break the solution in pieces and some of those pieces may be chunks at rule-, or even skill based, level. In general, solving abnormal unanticipated situations increases workload significantly. Striving to have as little abnormal unanticipated situations as possible is, amongst others, for reasons of workload management a good intention.

Abnormal unexpected events for which the crew was not trained on a regular basis, such as: • all engines shutdown

• multiple cascading system failures lead to increased workload situations.

Besides the technical aspects, like understanding the situation and finding a solution, unexpected situations may also be affected by additional strains, such as a shift of roles. Often the captain will act as PF whereas the co-pilot will be working on finding solutions in a handbooks, checklist, etc.

Note that complex situations like abnormal unanticipated ones often are not solely a matter of increased workload. Also factors like stress or reduced situational awareness contribute and reinforce each other.

80 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

4.6.2 Workload Development in Reduced Crew Situations Part 25 of the Certification Specification regulates that “the minimum flight crew must be established so that it is sufficient for safe operation, considering the workload on individual crew member” (EASA, 2008, CS 25.1523). Furthermore, in Part 25 ten workload factors from an aircraft design perspective are specified, which are considered important when the determinants for minimum flight crew are determined. The following list is an extract of Part 25, Appendix D-1:

(1) The accessibility, ease and simplicity of operation of all necessary flight, power, and equipment controls, including emergency fuel shutoff valves, electrical controls, electronic controls, pressurisation system controls, and engine controls.

(2) The accessibility and conspicuity of all necessary instruments and failure warning devices such as fire warning, electrical system malfunction, and other failure or caution indicators. The extent to which such instruments or devices direct the proper corrective action is also considered.

(3) The number, urgency, and complexity of operating procedures with particular consideration given to the specific fuel management schedule imposed by centre of gravity, structural or other considerations of an airworthiness nature, and to the ability of each engine to operate at all times from a single tank or source which is automatically replenished if fuel is also stored in other tanks.

(4) The degree and duration of concentrated mental and physical effort involved in normal operation and in diagnosing and coping with malfunctions and emergencies.

(5) The extent of required monitoring of the fuel, hydraulic, pressurisation, electrical, electronic, de-icing, and other systems while en-route.

(6) The actions requiring a crew member to be unavailable at his assigned duty station, including: observation of systems, emergency operation of any control, and emergencies in any compartment.

(7) The degree of automation provided in the aircraft systems to afford (after failures or malfunctions) automatic crossover or isolation of difficulties to minimise the need for flight crew action to guard against loss of hydraulic or electrical power to flight controls or other essential systems.

(8) The communications and navigation workload.

(9) The possibility of increased workload associated with any emergency that may lead to other emergencies.

(10) Incapacitation of a flight-crew member whenever the applicable operating rule requires a minimum flight crew of at least two pilots.

The Air Operations Commission Regulation EU No 965/2012 (European Commission, 2012) states that a flight crew member may use a controlled rest procedures if unexpected fatigue is experienced and if workload permits. However, it is not regulated what the procedures are if workload does not permit to have a reduced crew.

Airlines usually require flight crew to apply standard operation procedures (SOP) if the crew is reduced below the minimum for the aircraft due to unplanned events such as incapacitation of a crew member. The remaining pilot is confronted with an abnormal

81 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

situation, in which workload is high and no back-up is provided by a second pair of eyes. Such situations are subject to errors and are safety vulnerable, and SOPs increase the probability that important tasks are performed. In general, a PAN call (i.e. an emergency call indicating no immediate danger) should be made. A possible SOP in sudden reduction of crew is CHASE, which is an abbreviation for:

• Control the aircraft

• Help! Declare an emergency and alert other crew

• Assess the situation

• Secure the victim and cockpit

• Explain your plan to ATC and other crew members

The SOPs vary per airline but in essence the procedures are in line with CHASE. In more detailed SOPs, which include a description of possible situations for reduced crew, it becomes obvious how easily workload may increase in reduced crew situations for the remaining pilot. For example, an incapacitated crew member may adversely affect the controls of the aircraft, for example by slumping forward. The pilot in control then is responsible to take actions that reduce the likelihood of such actions, while remaining in control of the aircraft and focusing on the primary aviate task.

4.7 Real Cases In order to illustrate the state of the art and the impacts and causes of the workload increment, a set of real cases were selected and classified by the project objectives. They are considered as a basis for the definition of the reference scenarios and the elicitation of the requirements to be addressed within the project. Namely, the requirements and reference scenarios represent the key elements for project harmonisation as they are common to the different technological and transversal WPs. They are also closely interconnected and interdependent.

Two examples of the real cases are provided here (the Northwest Airlines Flight 188 and the Qantas flight 32). Two other examples corresponding to Full Incapacitated Crew Situations (the Learjet 35 and the Helios Airways Flight 552) are presented in section 6.5.

The Northwest Airlines Flight 188

1. Keywords: Crew distraction: pilots error.

2. Phase of flight: It occurred during the en-route phase of flight (ENR).

3. Date: October 21, 2009 at 5:56 pm mountain daylight time.

4. Location: The aircraft flew over the Minneapolis airport and continued to fly off course by 150 miles.

5. Type of aircraft: An Airbus A320, registration number N03274, flying from San Diego International Airport to Minneapolis-St Paul International Airport.

6. Narrative

82 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

On Wednesday, October 21, 2009, at 5:56 pm mountain daylight time, an Airbus A320, N03274, operating as Northwest Airlines (NWA) flight 188, became a NORDO (no radio communications) flight at 37,000 feet, leaving air traffic control to think the flight had been hijacked (“Northwest Airlines”, n.d.). The flight was operating as a Part 121 flight from San Diego International Airport, San Diego, California (SAN) to MSP with 147 passengers and unknown number of crew.

At 7:58 pm central daylight time (CDT), the aircraft flew over the destination airport and continued northeast for approximately 150 miles. The MSP centre controller re- established communications with the crew at 8:14 pm and reportedly stated that the crew had become distracted and had over flown MSP, and requested to return to MSP.

According to the Federal Administration (FAA) the crew was interviewed by the FBI and airport police. The pilots originally stated they were in an argument regarding airline policy (CNN, 2009) and did not notice that they had flown off course (National Transportation Safety Board Advisory, 2009), but later admitted to having been using their personal laptop computers at the time (Maynard, 2009). The pilots contacted air traffic control after they realized their mistake and arrived in safely Minneapolis about one hour late. The pilots' commercial flying licenses were subsequently revoked by the FAA (Wald & Maynard, 2009).

7. Causes

• Technological (automation)

No technological issue was detected.

• Human factors

Pilots’ error due to distraction and failure to comply with the rules/procedures.

8. Additional supporting materials

It is possible to listen to the radio transmissions on YouTube website (accessible via http://www.youtube.com/watch?v=i7l50n6JRO0 )

The Qantas flight 32

1. Keywords: Technological failures (engine and system feedback); appropriate flight crew response

2. Phase of flight: The accident occurred during the en-route phase of flight over Batam Island, Indonesia.

3. Date: November 4, 2010, at 10:01 am Singapore Standard Time (02:01 UTC).

4. Location: The failure occurred over Batam Island, Indonesia on Flight 32 from London Heathrow Airport to Sydney Airport, four minutes after taking off from Changi for the second leg of the flight. After holding to determine aircraft status, the aircraft returned to Changi nearly two hours after take-off (“Qantas Flight 32”, n.d.).

5. Type of aircraft: The aircraft involved was an Airbus A380-842. Delivered in September 2008, the aircraft had four Trent 972 engines manufactured by Rolls- Royce. The aircraft, named Nancy Bird Walton in honour of the Australian aviation pioneer, was the first A380 delivered to Qantas.

83 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

6. Narrative

An Airbus A380-842 passenger jet, registered VH-OQA, incurred substantial damage in an accident near Batam Island, Indonesia. There were no fatalities. The airplane operated on Qantas flight QFA32 from Singapore-Changi International Airport (SIN) to Sydney- Kingsford Smith International Airport, NSW (SYD).

The airplane took off from runway 20C at 09.56. Following a normal take-off, the crew retracted the landing gear and flaps. The crew reported that, while maintaining 250 kts in the climb and passing 7,000 ft above mean sea level, they heard two almost coincident “loud bangs”, followed shortly after by indications of a failure of the No. 2 engine (Aviation Safety Network, 2012).

The aircraft levelled off and because of an overheat warning of engine No. 2, thrust for this engine was moved to 'idle'. Meanwhile, at 10:02, when the airplane was flying over Batam Landmass, the crew radioed a PAN call to the Approach Controller citing a possible engine failure. At that time, the pilot of QFA 32 maintained height on 7,500 feet and requested to be on heading 150 degrees to investigate the problem, but did not request to return to Singapore immediately. Later on at 10.21, the crew reported that they had been gone through an extensive checklist and found that there was a hole in the side of engine number 2 and it had damaged a part of the wing. The pilot then requested to hold for half an hour before making an approach to Changi Airport.

A moment later, an air traffic controller from Batam Tower, who had received a report stating that parts of an aircraft had been found on Batam Center-Batam Island made a report to Singapore ATC Approach Sector about the finding.

The pilot informed Singapore ATC that other engines apart from engine number 2 appeared to be functioning normal; thus required an approach on Runway 20C at Changi Airport and a towing assistance when the aircraft stopped at the end of the runway.

While the aircraft was stopping abeam taxiway E10, Changi’s Airport Emergency Service (AES) found that engine number 2 was damaged near the rear of the engine and fuel had leaked from the port side (left wing). Moreover, there was smoke from tyre number 7, 4 tyres were deflated, and the pilot was not able to shut off engine number 1. Nevertheless, it was safe to disembark passengers. Exactly at 13:54, all passengers had been disembarked, and finally at 14:53, engine number 1 was finally able to be shutdown (Flightstory Aviation Blog, 2010).

There were no injuries reported among the 440 passengers and 29 crew on board the plane. Debris also fell on a school and houses, causing structural damage, and on a car.

Analysis of the preliminary elements from the incident investigation shows that an oil fire in the HP/IP structure cavity may have caused the failure of the Intermediate Pressure Turbine (IPT) Disc.

After completing repairs in Singapore, estimated at $139 million, the aircraft returned to Sydney, New South Wales on 22 April 2012. The failure was the first of its kind for the four-engine Airbus A380, the world's largest passenger aircraft.

7. Causes

• Technological (automation)

84 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

The flight sustained an uncontained failure of the Intermediate Pressure (IP) turbine disc on engine No. 2. On inspection (Australian Transport Safety Bureau, 2010), it was found that the aircraft's No. 2 engine (on the port side nearest the fuselage), a Rolls-Royce Trent 900, had a missing turbine disc (Figure 17). The aircraft had also suffered damage to the nacelle, wing, fuel system, landing gear, flight controls, and to the controls for engine No. 1. Shrapnel from the exploding engine punctured part of the wing and damaged the fuel system causing leaks, disabled one hydraulic system and the anti-lock brakes, caused engines number 1 and 4 to go into a “degraded mode” (Robinson, 2010), damaged landing flaps and the controls for the outer left No. 1 engine (see Figure 18).

• Human factors

No HF cause was identified. On the contrary, the flight crew succeeded in dealing with the engine and automation failures.

• Procedures

No erroneous procedures were detected.

Figure 17 - Damage to the No. 2 engine (from Australian Transport Safety Bureau, 2010).

85 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Figure 18 - Damage to electrical wiring located in the leading edge of the left wing (punctured by debris) (from Australian Transport Safety Bureau, 2010).

8. Emergency operations/management

The crew, after finding the plane controllable, decided to fly a racetrack holding pattern close to Changi airport while assessing the status of the aircraft. It took 50 minutes to complete this initial assessment. The First Officer (FO) and Supervising Check Captain (SCC) then input the plane's status to the landing distance performance application (LDPA) for a landing 50 tonnes over maximum landing weight at Changi (Robinson, 2010). Based on these inputs the LDPA could not calculate a landing distance. After discussion the crew elected to remove inputs related to a wet runway, in the knowledge that the runway was dry. The LDPA then returned the information that the landing was feasible with 100 metres of runway remaining (Australian Transport Safety Bureau, 2010). The flight then returned to Singapore Changi Airport, landing safely after the crew extended the landing gear by a gravity drop emergency extension system, at 11:45 am Singapore time (O’Sullivan, 2010). As a result of the aircraft landing 35 knots faster than normal, four tyres were blown.

Upon landing, the crew were unable to shut down the No. 1 engine, which had to be doused by emergency crews 3 hours after landing until flameout (Australian Transport Safety Bureau, 2010). The pilots considered whether to evacuate the plane immediately after landing as fuel was leaking from the left wing onto the brakes, which were extremely hot from maximum braking. The SCC pilot, David Evans, noted in an interview, "We’ve got a situation where there is fuel, hot brakes and an engine that we can’t shut down. And really the safest place was on board the aircraft until such time as things changed. So we

86 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

had the cabin crew with an alert phase the whole time through ready to evacuate, open doors, inflate slides at any moment. As time went by, that danger abated and, thankfully, we were lucky enough to get everybody off very calmly and very methodically through one set of stairs” (Robinson, 2010). The plane was on battery power and had to contend with only one VHF radio to coordinate emergency procedure with the local fire crew (Creedy, 2010).

The flight crew reported that they discussed the available options for the recovery of the aircraft, including an immediate return to Singapore, climbing or holding and decided that the best approach would be to hold at the present altitude while they processed the 54 ECAM messages and associated procedures (Figure 19).

Figure 19 - Qantas A380 cockpit. During the emergency, pilots were alerted by 54 error messages generated by aircraft systems (taken from “Qantas Flight 32”, n.d.).

It took about 50 minutes for the flight crew to complete all of the initial procedures associated with the ECAM messages. During that time, the aircraft’s autopilot was engaged. They then assessed the aircraft systems to determine those that had been damaged, or that were operating in a degraded mode. They considered that the status of each system had the potential to affect the calculation of the required parameters for the approach and landing. The crew also believed that the failure may have damaged the No. 1 engine, and they discussed a number of concerns in relation to the lateral and longitudinal fuel imbalances that had been indicated by the ECAM.

The crew applied the required procedures to cope with the failures but they did not receive any proper feedback from the system:

87 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

The aircraft’s engine failure procedure required the crew to determine whether serious damage had occurred to the affected engine. The crew reported assessing that there was serious damage and discharged one of the engine’s two fire extinguisher bottles into the engine in accordance with the relevant procedure. Contrary to their expectation, the flight crew did not receive confirmation that the fire extinguisher bottle had discharged. They repeated the procedure for discharging the fire extinguisher and again did not receive confirmation that it had discharged.

The flight crew recalled that, after a brief discussion, they followed the procedure for discharging the second fire extinguisher bottle into the No. 2 engine. After completing that procedure twice, they did not receive confirmation that the second bottle had discharged. The crew reported that they then elected to continue the engine failure procedure, which included initiating an automated process of fuel transfer from the aircraft’s outer wing tanks to the inner tanks.

The crew also noticed that the engine display for the No. 2 engine had changed to a failed mode, and that the engine display for No. 1 and 4 engines had reverted to a degraded mode 2. The display for the No. 3 engine indicated that the engine was operating in an alternate mode as a result of the crew actioning an ECAM procedure. During this time, the ECAM continued to display numerous other warnings and alerts to the crew.

9. Additional supporting materials

It is possible to watch the associated video named “A380 Engine Explodes On Qantas Flight 32” on YouTube website (accessible via http://www.youtube.com/ watch?v=iWi_Ilg_fEY )

2 Degraded or alternate engine mode indicates that some air data or engine parameters are not available.

88 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

5 CURRENT MECHANISMS FOR WORKLOAD REDUCTION

5.1 System Level Prior to any technical considerations, safety is the first objective of large aircraft manufacturers regarding crew regulation aspects spread mainly over Doc 7300 9 th Edition (ICAO), Part CS25 (EASA) and Part 25 (FAA).

In particular, attention shall be put on minimum flight crew topic to establish a link between crew members composition and operational workload:

• 25.1523 Minimum Flight Crew: The minimum flight crew must be established so that it is sufficient for safe operation, considering:

o the workload on individual crew members;

o the accessibility and ease of operation of necessary controls by the appropriate crew member;

o the kind of operation authorized under Sec 25.1525.

Please refer to chapter 8 which provides an exhaustive analysis of applicable regulations to be considered when dealing with cockpit crew workload.

Diminishing cockpit crew workload is a key enabler to globally improve flight safety during nominal or abnormal situations. A permanent concern is to analyse airlines’ needs and safety requirements in order to propose the best achievable aircraft system design (from equipment to operations levels) which will comply with the certification requirements and propose safety gains by reducing cockpit crew workload.

Next we present a non-exhaustive list of transversal systems that are drivers of workload reduction at aircraft level (other items can be found within the Navigate and Mission Management, Communication, Manage Systems, Aviate Aspects and Supervision chapters):

• Cockpit organization o Coherence/consistency - ergonomics:

This transversal attribute is built by the design specifications. It eases crew actions and as such reduces workload by improving cognitive processing. More specifically, mental computations can be improved by installing associated flight parameters close together, readability can be enhanced by avoiding the use of the same characters and colours from one display to the other, and displays and checklists can be adapted to the pilots’ operational needs at the time (e.g., depending on flight phase). The cockpit ergonomics are also designed taking into account human-machine interface issues, pilots’ comfort and ease of handling. Modern aircrafts also require less physiological effort to manoeuvre compared to the past, hence reducing workload;

89 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

o Alerting philosophy:

The Flight Warning System (FWS) monitors the various systems of the aircraft, detects failures and dangerous flight conditions and generates the corresponding warnings. It provides the crew with operational assistance for both the normal and abnormal aircraft system configurations. It does this through visual and aural attention-getting devices and through the two Electronic Centralized Aircraft Monitoring (ECAM) display units by means of warning messages and system synoptic diagrams. The FWS comprises two captain lighted pushbuttons (Master Caution and Master Warning), two First Officer lighted pushbuttons (Master Caution and Master Warning) and ECAM Control Panel (ECP) enabling the crew to perform actions such as:

energizing and adjusting brightness of the ECAM displays units;

manually presenting system pages;

recalling cleared warnings;

clearing displayed messages and synoptic diagrams;

testing take-off configuration;

calling status pages.

Two computers, named Flight Warning Computers (FWC), send discrete data to lighted pushbuttons, audio data to the loudspeakers and warning messages to the warning and system displays. These data are categorized and, when multiple, prioritized:

Warning : An emergency situation requiring immediate crew action. For example, the aircraft is in a dangerous configuration or in a limiting flight condition (e.g. slat/flap retraction blocked), or there is a system failure that impacts the safety of the flight (e.g. engine fire).

Caution : An abnormal situation requiring awareness but not immediate action or even not a crew action. For instance, a system failure that does not impact the safety of the flight, but to prevent any further degradation, a crew action is required whenever possible. Or a situation that requires the crew to be informed (crew awareness), but does not require an action (e.g. redundancy loss or system degradation).

Advisory: For a monitored parameter that is still in the normal operating range, but is drifting away.

This alerting philosophy reduces the need to permanently control the systems, allowing more time to monitor the aircraft environment or perform mission tasks. Furthermore, it enables the crew to get the contextualized relevant data and indicates the required responses in order to solve the issue. As a result, it enables the crew to gain time on nominal operations and abnormal situations, globally reducing their workload.

90 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

o “Dark Cockpit” principle:

To achieve aircraft systems monitoring, the information of any failure or abnormal/emergency situation has to be clearly notified to the crew. To reach this goal, the Dark Cockpit principle occurs in nominal operations where all lights, except for blue or green lights for transient phases, are extinguished.

In case of a system failure, the relevant information is provided to the crew, standing out of the rest in order to draw the pilots’ attention to it. A colour code is established on pushbutton switches to level the criticality or contextualize the information provided:

Red: indicates a failure which may require immediate corrective action;

Amber: indicates a failure which needs future corrective actions, but failure must immediately be reported to the crew;

Green: indicates normal system operation;

Blue: indicates normal operation of temporarily used systems;

White: indicates that the position of the illuminated pushbutton switch is not conform with the aircraft normal configuration, or test result, or maintenance indications.

It is easier to notice one switched-on light on a dark panel than one switch changing colours on a panel with several other lights. As a result, in a dark cockpit the pilots’ attention is caught faster and to the appropriate information (system status). Therefore, it improves reaction times and decreases the probability of missing relevant information for flight performance, reducing workload and mitigating safety risks.

• Flight envelope protection o Flight Control Laws (Fly-by-wire):

The general objective of the flight control laws integrated in a fly-by-wire system is to improve the natural flying qualities of the aircraft, in particular in the fields of stability, control, and flight domain protection. In a fly-by-wire system, the computers can easily process the anemometric and inertial information, as well as any information describing the aircraft state. Consequently, control laws corresponding to simple control objectives could be designed. The stick inputs are transformed by the computers into pilot control objectives which are compared to the aircraft actual state measured by the inertial and anemometric sensors. Thus, as far as longitudinal control is concerned, the side stick position is translated into vertical load factor demands, while lateral control is achieved through roll rate, sideslip, and bank angle objectives. The increase in stability provided by the flight control laws improves the aircraft flying qualities and contributes to aircraft safety. Unlike conventional aircraft, aircrafts with flight-by-wire system remain stable in case of perturbations such as gusts or engine failure, due to a very strong spin stability. Aircraft control through objectives significantly reduces the crew workload, with the system acting

91 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

as the inner loop of an autopilot system, while the pilot represents the outer loop in charge of objective management. Finally, protections forbidding potentially dangerous excursions out of the normal flight domain can be integrated in the system. The main advantage of such protections is to allow the pilot to react rapidly without hesitation, since he knows that this action will not result in a critical situation.

• Continuous improvement. Some examples o Brake-to-Vacate – Runway Overrun Protection & Warning:

The Brake-To-Vacate (BTV) is an Airbus innovation in pilot aid to ease airport congestion and improve runway turnaround time. The BTV system, which is available on the A380 as an option and on A350XWB as a basic feature since 2009, helps reducing taxiing time at busy airports by optimizing the runway occupancy time and lowering braking energy while maximizing passenger comfort. The BTV system allows pilots to select the appropriate runway exit during descent or approach preparation. The system uses the GPS (Global Positioning System), Airport Navigation, Auto-Flight and Auto-Brake Systems to regulate deceleration, enabling the aircraft to reach any chosen exit at the correct speed in optimum conditions. The use of the auto-brake system is recommended when the pilot’s workload is high, and since the year 2000 has become an Airbus recommended Standard Operating Procedures (SOP) at landing. Brake-to- Vacate system design objectives can be expressed as follows:

Ensure the best possible braking management at landing from main landing gear impact to runway exit vacation;

Develop a crew intuitive selection, monitoring and termination of the BTV system;

Propose a seamless and natural integration with: In-flight landing distances assessment during descent/approach preparation and execution, Runway Overrun Prevention and Warning Systems (ROP and ROW) below 500ft until aircraft vacates runway, and airport navigation during taxi;

Ensure increase in safety by increasing crew situation awareness with the in-flight landing distance computation through final approach and ground roll, even with low visibility operations;

Ensure increase in safety with the implementation of a runway overrun prevention device covering most frequent cases on non-contaminated runways; feature which is also generalized to all other classical auto- brake modes.

The “best possible braking management at landing”, targeted by the BTV system, considers the most robust and simple compromise which guarantees the exit at the assigned location, optimizes the brake energy regarding the current operational constraints, minimizes the runway occupancy time and improves the passenger comfort. Obviously, if the BTV system ensures the robustness of the braking function, then it leads to less cognitive computation work for the pilots to prepare the aircraft’s landing-

92 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

taxi phase during descent and approach, letting them carry out other critical tasks during these demanding flight phases.

o TCAP (Traffic Collision Avoidance System Alert Prevention):

“Undesired” Resolution Advisory (RA) is an RA, which occurs during 1000ft level-off manoeuvres while everything is correctly done by the crew with regards to operations and clearance. It can be encountered when one or two aircrafts level-off to an adjacent level flown or nearly reached by another aircraft situated in the TCAS’ activation range. This type of operationally “undesired” RAs represent more than 50% of all RAs triggered by TCAS in Europe, and even more than 2/3 of RAs for some major European airlines which frequently operate in very high density Terminal Control Areas (TMA) like Paris or London. Besides recommendations of airworthiness authorities, there is still a significant number of undesired Resolution Advisories observed during 1000ft level-off manoeuvres. In fact, the recommendations diverge slightly from one to the other (FAA, ICAO, FCOM, DLH) which explains why they are rarely applied.

TCAP Solution objective is twofold:

To reduce the number of undesired TCAS RAs occurring during 1000ft level-off encounters by introducing a new altitude capture law which soften aircraft arrival to an intended altitude when traffic is confirmed in the nearby vicinity;

Not to unduly degrade the aircraft performance, in particular in descent, by a premature and excessive reduction of the vertical speed before reaching the altitude target, when it is not justified.

TCAP solution will efficiently contribute to alleviate the crew workload. Pilots will not have to anticipate the recommendations of the Flight Crew Operations Manual to prevent “undesired” Resolution Advisories any longer. Knowing they are flying an aircraft equipped with the TCAP system, they will just have to monitor the Autopilot or the Flight Director, adopting the proper strategy in the event of a Traffic Advisory . Moreover, it reduces pilot stress thanks to the reduction of resolution advisory and generates fewer unnecessary traffic perturbations owing to ‘undue’ avoidance manoeuvres for ATC. This function is gradually being introduced on A380 and A350XWB.

o Operational data integration and system back-up/redundancy are also workload reduction drivers:

First, the operational data integration permits the “copy-paste” of some variables relevant for mission performance (airports data, MTOW, FMS entries...). It enables the pilot to gain time in mission preparation, particularly during last-minute changes, prevents some misprints, eases cross-checks, and facilitates mission data traceability and capitalization. Secondly, the system back-up and its redundancies (in critical systems) are the most efficient architectures built according to their safety assessment, taking into account human factors in the early design phases. Comprehension and “command-ability” by cockpit crew influence the

93 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

various engineering solutions both in nominal and abnormal situations. Nevertheless, the systems’ synoptics are mostly represented on the system display depending on flight phase and system status, which enables the flight crew to get an efficient overview of the system and probable locations of failures when occurring. Then transition from nominal to abnormal procedures is facilitated by the ‘intelligent’ architecture, switching from one system to comparable but distinct ones (e.g. Autopilot 1 & 2, FMS 1 & 2, Primary flight computers, Radio Management Panels, Hydraulic and electrical systems, etc.). As a concrete example, regarding airworthiness regulations, the CAT B approaches are available for aircrafts with at least 2 independent autopilot systems. In the case of a commercial route arrival threatened by bad weather where only CAT B approaches would be authorized, then the crew without CAT B capabilities will have to re-plan the flight plan which certainly generate more workload during flight. The crew workload is implicitly less when systems architecture understanding is easier and sub-systems activation/deactivation logics are operationally oriented in terms of design. Switch and time required for transition are managed by the cockpit crew without too much effort. Some operations are facilitated by the system’s redundancies and back-up availabilities, which are globally a workload reduction factor.

• Human Factors:

o Training, tasks decomposition/prioritization, pilot’s strategy dynamic projection on timeline in front of operational context:

In some abnormal events (anticipated or unexpected), the pilots have to prioritize their tasks according to the usual rule: aviate, navigate, communicate with spread over, resolution and periodic check of systems status depending on the criticality of the situation. When system(s) failure(s), single or complex, occur, the Standard Operating Procedures provide guidelines to be applied to mitigate the risks. But at that time the risks are highly time-dependent and as a consequence, the amount of time required to solve the issue may interfere with the next steps of the operations (for example the fuel assessment until airport selected by dispatch). It is all the more the case when cascading effects happen on an event (e.g. UERF) causing multiple overlapping systems errors. Through this kind of situation, the workload can be extremely high and the time short to handle the situation in order to reach a safe global status of the flight. Moreover, the pilot’s strategy (in accordance with ATC) has to be first projected in a timeline and matched with the operational context encountered (weather, traffic, ground population proximity...). The relative unusual of the situation (besides training may address more effectively this issue along time) does not help the pilot retrieve basic skill mechanisms that will ensure him complete achievement of the transition from a risky flight situations to a safe one. Hence the workload may become higher when the pilot is not experienced to this kind of situation (pilots with few flight hours, or with the last training a long time ago) as they will have difficulty remembering the right procedure, or might even perform imprecise or hesitating commands. Meanwhile the aircraft must be flown by the other pilot so that it enables the treatment of the procedure and reduce at maximum the risks on surrounding traffic and/or ground population. The crew members can often adopt various recovering strategy composed of a

94 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

combination of knowledge-based tasks which highly depends on their profile, on aircraft status and on the operational context. The perspective of success of those strategies derive from the capability of the crew to compose/decompose the situation, compute parameters, evaluate the risks, agree on the preferable solution and finally execute it. As a conclusion, pilots’ relevant training, efficient coordination and strong ability to project their strategy on timeline regarding the operational context will benefit workload reduction in nominal cases and more severely on abnormal cases.

o Crew coordination

Effective flight crew coordination is essential to manage workload. To manage workload by performing the aviate task, task sharing between pilot flying (PF) and pilot not flying (PNF) should be adapted to the current situation, for example:

task sharing for hand flying or with AP engaged;

task sharing for normal operation or for abnormal / emergency conditions.

In general, the following tasks are performed by the PF:

Flight path and airspeed control;

Airplane configuration;

Navigation.

The PNF responsibilities are:

Checklist reading;

R/T communications;

Tasks asked for by the PF;

Monitoring flight path, airspeed, airplane configuration, and navigation.

Typically, it is both pilots’ responsibility:

To mutually monitor and cross check;

To exchange information and knowledge (cross-cockpit communication). Whenever a crew member makes any adjustments or changes to any information or equipment on the flight deck, he must advise the other crew member and obtain acknowledgement. Whenever cross-cockpit communication is used, standard phraseology is essential to ensure effective communication,

To distribute the work load,

To report immediately to the other, the deviations of standard procedures or judgement mistakes.

95 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

The PNF, in moments of high workload, first accomplishes the requests of PF, and after that the requests of ATC.

o Standard calls

Standard calls are intended and designed to enhance the efficiency of crew coordination and update the flight crew situational awareness (e.g., including aircraft position, altitude, speed, status and operation of aircraft systems, etc.).

The following generic standard calls often are used to express a command or response:

Check (or Verify): a command for the other pilot to check an item;

Checked: a confirmation that an item has been checked;

Cross-check(ed): a call (response) confirming that an information has been checked at both pilot stations;

Set: a command for the other pilot to set a target value or a configuration;

Arm: a command for the other pilot to arm an AP/FD mode (or to arm a system);

Engage: a command for the other pilot to engage an AP/FD mode (or to engage a system).

Use of standard calls and acknowledgements reduces the risk of tactical (short-term) decision making errors (e.g., in selecting modes, setting targets or selecting aircraft configurations). The importance of using standard calls increases with increasing workload or flight phase criticality (e.g. take-off, approach + landing).

Standard calls convey the required information with a minimum of words that have the exact same meaning for all crew members.

Standard calls are also practical, concise, unambiguous and consistent with the aircraft design and operating philosophy. Standard calls may be generated automatically by aircraft systems (i.e., auto callouts) using synthetic voice messages (e.g., radio-altimeter callouts, GPWS/TAWS alert messages, reactive or predictive windshear alert messages, etc.). The absence of a standard call at the appropriate time or the absence of acknowledgement may:

Result in a loss of situational awareness for the other crew member;

Be an indication of a system or indication malfunction;

Indicate a possible incapacitation of the other crew member.

Standard calls are used to:

Give a command (i.e., task delegation) or transfer an information;

96 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Acknowledge a command or an information transfer;

Give a response or ask a question (i.e., feedback);

Callout a change of indication (e.g., a mode transition or reversion);

Identify a specific event (e.g., crossing an altitude or a flight level).

o Standard Operating Procedures (SOPs)

The use of SOPs is an important method to manage workload. SOPs describe standard tasks and duties of a flight crew for each flight phase, including what to do and when to do. SOPs provide a basis for efficient crew coordination and communication. Generally, SOPs address a variety of operational topics (”SOP-Standard Operating procedures”, 2012):

Task sharing (who should do);

Optimum use of automation (how to use);

Operations golden rules;

Standards calls (what to expect, what to observe);

Use of normal checklists;

Approach and go-around briefings;

Altimeter setting and cross-check procedures;

Use of the radio altimeter;

Descent profile management;

Energy management;

Terrain awareness;

Threat and hazard awareness;

Elements of a stabilized approach and approach gates;

Approach procedures and techniques for various types of approaches;

Landing and braking techniques for various types of runway and wind conditions;

Readiness and commitment to go around (e.g., ground-proximity warning system [GPWS] warning, unstabilized approach, bounce recovery).

In general SOPs can be accomplished without an aid to recall, such as checklists. For critical tasks (e.g. selections of systems, changes of aircraft configurations), normal checklists may be used to cross-check for errors. The normal checklist developed by Airbus, takes advantage of the ECAM system and only includes the items that may directly impact safety and

97 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

efficiency if done incorrectly. Note that the checklist is not a TODO list: all actions should have been completed from memory prior the checklist being called for.

Pilots normally do not deviate from SOPs. In most cases if pilots deviate from SOPs, the following factors and conditions are cited (Airbus, 2004a) among others:

Task saturation;

Lack of vigilance (e.g. fatigue);

Distractions (e.g. cockpit activities);

Interruptions (e.g. due to pilot/controller communications);

Reduced attention (tunnel vision) in abnormal or high-workload conditions.

o Emergency/Abnormal checklists

“Fly the aircraft” is always an unwritten immediate action for any emergency or abnormal procedure. Both pilots will first give their attention to continued safe flight of the aircraft, with particular attention to flight path and communications.

When the ECAM displays a warning or a caution, the first priority is to ensure that a safe flight path is maintained. The successful outcome of any ECAM procedure depends on: correct reading and application of the procedure, effective task sharing, and conscious monitoring and cross- checking. In an emergency or abnormal situation it is important to remember that:

The PF’s task is to fly the aircraft (aviate), navigate, and communicate;

The PNF’s task is to manage the failure, on PF command.

The PNF has a considerable workload: the PNF reads the ECAM and checklist, performs ECAM actions on PF command, requests PF confirmation to clear actions, and performs actions required by the PF. The PNF never touches the thrust levers, even if requested by the ECAM.

Note that some selectors or pushbuttons (e.g. as a general rule, all guarded switches) must be completely cross-checked by both the PF and PNF, before they are moved or selected, to prevent the flight crew from inadvertently performing irreversible actions.

As a conclusion, at system design level regarding workload reduction opportunities, they could be carried out at equipment and/or system level but they shall be also in line with a transverse integration at cockpit and even aircraft level, taking into account the operations issues and constraints in order to make them viable and useful. They shall also incorporate the human factors dimension during the early design phase by a first statement: “ Would the application be understood and used by flight crews?”

98 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

The workload reduction is still an improvement area where it might generate also safety gains and navigation performance. The operations, nominal and abnormal, shall be the reference use cases to evaluate the best solutions. Where automation can be implemented thanks to the pre-deterministic context and/or when pilots do not represent sufficient added-value for the task performance, then opportunity shall be seized and pilots’ work shall be ease by the support from automation: reduce human factors uncertainties. Whereas, when automation may induce riskier effects on the flight safety, then pilots shall be the key deciders: “pilot in-the-loop” of how to manage the function, from system design phase to operations included, finding the best way to integrate accurately (which means precisely to not overload him) the pilot in the decision-command chain.

5.2 Systems Integrator’s Point of View In modern commercial aircraft the automation of many systems alleviates much of the workload on the crew.

In normal operation, during a significant part of a flight the aviate task can be performed by the autopilot system. While engaged, the autopilot greatly reduces crew workload and frees up the crew to perform other tasks. In many non-normal situations the autopilot system can alleviate workload in the flight deck, allowing the crew to work the problem situation while reducing the aviate workload to one of monitoring.

The navigate task is largely automated by the flight management system (FMS). Once initial programming of the route is performed, the system will only need to be reprogrammed if rerouting is required.

The aircraft has many systems which communicate with other aircraft and ATC. Transponders allow ATC to identify an aircraft and its altitude without the need for crew voice communication. TCAS systems monitor proximity of aircraft in the vicinity by using automated communication between aircraft. ADS-B transmits aircraft parameters which can be received and interpreted by various airborne and ground systems to determine information about aircraft state and flight path. All these systems alleviate the need for the flight crew to perform voice communication, having the effect of reducing the overall workload on the crew.

The system management task is largely automated, reducing the crew workload for this task to a monitoring role. When non-normal situations arise, such as single or multi system component failure, checklists are performed to solve the issue. In many aircraft an electronic indication and centralized crew alerting system can detect system faults and perform a limited prioritization of the checklists to be performed. This centralized, text- based alerting and prioritization reduces the workload on crew, who may otherwise have to integrate multiple failure indications to come to a coherent explanation and work through checklists less relevant to the problem.

On some airplanes the checklists are provided in an electronic format and with some degree of automatically checking whether the pertinent actions have been performed. Again, this pertains to workload reduction as less manual activity is required to locate and work through the checklist.

99 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

5.3 Navigate and Mission Management

5.3.1 Workload Reduction in Nominal Situations Workload reduction in the context of navigation and mission management can mainly be achieved by pursuing the goal to reduce the information available to only the information that is relevant for the flight or the particular flight phase.

Before the flight, this is already done when the dispatchers collect the weather and NOTAM information for the specific flight and the route to be flown. But still this information bundle contains all information that possibly could be relevant, and the final filtering is done by the flight crew by highlighting single pieces of information they really need to keep in mind for the forthcoming flight. During cockpit preparation, there are several support systems that allow for workload reduction such as performance calculation systems on mobile devices or the EFB, or pre-programmed company routes that can be selected in the CDU in order to reduce the amount of information that needs to be entered manually into the FMC.

During flight, the aircraft’s navigation systems monitor adherence to the programmed flight path, but the crew still has to verify periodically that the systems are working properly. A specific page within the FMC allows the crew to monitor the flight progress and to read out time and fuel predictions. The systems permanently calculate the expected remaining fuel on board when arriving at the destination. These algorithms are based on past and actual flight performance. The crew still has to combine different sets of static information by using their knowledge and experience to make this information intelligible. An example of this would be to combine the FMS predictions with weather reports and forecasts along the route to anticipate any upcoming deviations from the current predictions while the flight progresses. There is the possibility to enter for example wind forecasts along the remaining route to enhance the prediction with expected conditions, but this is a manual process.

Nowadays, information support systems allow workload reduction during information pre- selection, for example by connecting Electronic Flight Bags to aircraft data buses to read out departure, destination and alternate airports from the FMC, which eliminates some manual steps for information preparation. In many installations, EFBs are interconnected in the cockpit, so that information that has been pre-configured by one crew member can be transferred to the opposite side with a few clicks.

5.3.2 Workload Reduction in Reduced Crew Situations Technical provisions in the cockpit for workload reductions in the context of Navigation and Mission Management are nowadays all designed to support the crew in nominal situations. They definitely still support a reduced crew in the same way, but they are not tailored to change their information support in the specific event that all information has to be selected, checked, interpreted and followed by just one crew member.

5.4 Communicate

5.4.1 Workload Reduction in Nominal Situations The introduction of data link communication presents a major reduction in terms of pilot/crew and ATC controller workload, due to:

100 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

• fewer communication misunderstandings;

• higher link capacity, which allow more automation services (e.g. ADS-C, trajectory loading to FMS).

The evolution from voice to data link has been underway since the introduction of ACARS and the more recent VDL Mode 2 mandate in the Eurocontrol LINK 2000+ programme. These technologies are shortly summarised in the following paragraphs:

ACARS

Aircraft Communications Addressing and Reporting System (ACARS) is introduced by ARINC in an effort to reduce crew workload and improve data integrity. Its protocol is based on telex formats to exchange basic text messages between controller and pilot. The ACARS signal uses 2400 bps message data bit stream to differentially AM modulate the transmitter carrier using 1200 and 2400 Hz tones.

The term ACARS encompasses a complete air and ground communication system, which consists of:

• Radio links: ACARS uses VHF, HF, and Satcom (Inmarsat / Iridium)

• Equipment:

o On aircraft:

ACARS Management Unit (MU), which is used to send and receive digital messages from the ground using VHF radios;

Control Display Unit (CDU), often also referred to as MCDU or MIDU, provides the flight crew with the ability to send and receive messages.

o On ground:

Network of radio transceivers;

ARINC Front End Processor System (AFEPS), which receives/transmits messages from/to aircraft, and route messages to various airlines on the network.

• Early applications:

o OOOI (Out of the gate, Off the ground, On the ground, and Into the gate) was one of the initial ACARS services. OOOI events are determined by algorithms that use aircraft sensors as inputs. These messages are used to track the status of aircraft and crew;

o Flight management; since the introduction of interface between ACARS MUs and Flight Management Systems (FMS), ACARS have also been used by airlines to update FMSs while in flight, allowing flight crew to evaluate weather conditions, or alternative flight plans;

o Maintenance data; airlines have also used ACARS to transmit data on aircraft engine and operational performance conditions to ground in real- time. This is made possible by the interface between the Flight Data

101 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Acquisition and Management System (FDAMS) / Aircraft Condition Monitoring System (ACMS) and ACARS MU;

o Interactive crew interface; this is achieved using the CDU, with which flight crew could request various types of information such as weather condition.

Within the Future Air Navigation System (FANS) program, with FANS-1 being Boeing standard and FANS-A by Airbus, some series of upgrades to the FMS software have been introduced that allow additional services to use ACARS data links. These include ATC services:

• AFN (ATS Facilities Notification);

• Automatic Dependent Surveillance-Addressed (ADS-A) or –Contract (ADS-C);

• Controller / Pilot Data Link Communication (CPDLC);

• Flight Plan Updates, based on ATC clearances.

There are however several limitation of ACARS that constraint its applications:

• Low air interface data rates (2.4 kbps in VHF and Satcom, 1.8 kbps in HF);

• It uses character-oriented data (ASCII based), which means it can only transfer text messages, and certain characters cannot be used as they are reserved for data link control.

VHF Data Link (VDL) Mode 2

VDL Mode 2 (or VDL2) is in many ways different from and offer better performance compared to ACARS. VDL2 implements bit-oriented protocol and higher-order modulation (8 DPSK), and consequently supports higher data rate for the same RF channel bandwidth as ACARS.

VDL2 has been implemented in Eurocontrol LINK 2000+ program and is specified as the primary link in the EU Single European Sky rule adopted in January 2009, requiring all new aircraft flying in Europe after January 1, 2014 to be equipped with CPDLC. The LINK 2000+ programme started in 2001 and is now in the full scale implementation phase governed by the Data Link Services Implementing Rule (DLS IR), which requires (Eurocontrol, n.d.):

• All newly delivered aircraft operating above FL285 to be equipped as of 2011;

• Core European ANSPs to be operational by 7 February 2013;

• The rest of European ANSPs to be operational by 5 February 2015;

• All existing aircraft operating above FL295 to be retrofitted by 5 February 2015 (unless exempt).

VDL2 can be considered as an intermediate step towards a fully ICAO standard ATN (Aeronautical Telecommunication Network) system, as it is backward compatible with the ACARS service via the so-called ACARS over AVLC (Aviation VHF Link Control) or “AOA” service (ARINC, 2013). Existing aircraft can still use already installed ACARS host

102 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

systems and data link applications; only the data link avionics needs to be changed in order to use VDL2 infrastructure (replace ACARS MU by a CMU/ATSU).

Apart from classical ACARS messages, VDL2 transports also CPDLC (which includes over 200 uplink and 100 downlink ATC messages) and Digital Flight Information Services/Automatic Terminal Information Service (D-FIS/ATIS). However ADS-B and voice are not supported (which in a way can be an advantage, because there is no single point of failure for both data and voice services). Another drawback of VDL2 is that there is no support of traffic prioritization.

Other variants of VHF data links are VDL Mode 3 (VDL3, used in the USA, supports prioritization, voice and data on one radio), and VDL Mode 4 (VDL4, supports air-air communications and ADS-B).

Effort to reduce communication workload outside the introduction of data link also exists, e.g. through Selective Calling (SELCAL) system. SELCAL is an alerting system that notifies an aircraft’s crew that a ground station wishes to communicate with the aircraft. It is particularly useful in noisy High Frequency (HF) radio environment. HF radio’s high level of background noise can be difficult or distracting to listen to for long periods of time. It is a common practice for crews to keep the radio volume low unless the radio is immediately needed. A SELCAL notification activates a signal to the crew that they are about to receive a voice transmission, so that the crew has time to raise the volume. SELCAL reduces crew workload in the sense that it limits the amount of attention required by the crews to monitor radio communication broadcast only to those that are relevant to the aircraft.

5.4.2 Workload Reduction in Reduced Crew Situations The state of the art workload reduction in terms of communication tasks goes along the same line as the data link evolution. The study in Comerford et al. (2012) argues that, historically, one factor in crew reductions in the past, i.e. from three-pilot flight deck to two- pilot flight deck, has been the increased availability of ground personnel. The availability of ACARS meant that pilots could offload high workload strategic tasks to an Airline Operations Centre (AOC) without clogging the radio party-line communications. In fact, it was reported that the FAA would not certify Piedmont Airlines for two-man operations in 1978 unless the airline demonstrated continuous “reliable and rapid communications” in FAR 121.99, that is, ACARS (Comerford et al., 2012). The study continues to suggest that the increased communication bandwidth available with current technologies will enable ground personnel to play an even greater role in reducing pilot workload.

5.5 Manage Systems

5.5.1 Workload Reduction in Nominal Situations Normal system operation

On modern aircraft, the system automatically provides the flight crew with normal checklists according to the current flight phase, or on crew request.

On ground, the flight crew initializes the aircraft systems mainly via the overhead panel (power generation, air conditioning, engines power up, IRS initialization, etc.).

103 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Further to crew actions, the aircraft performs local automatic system configurations that can be complex, as for example fuel tank transfer to ensure correct position of the centre of gravity.

The system also provides system’s synoptics to indicate the status of the aircraft systems; either automatically according to the current flight phase or upon manual crew request. In addition, the system provides “memos” to help the crew during normal operations (SEAT BELTS, ENG ANTI-ICE, etc.).

The flight crew permanently monitors the aircraft systems directly via the system itself, that is, via the aircraft system’s synoptics shown on displays and overhead panel; or indirectly via the system (for example, suspicious aircraft behaviour via sensitive feedback, direct smoke detection in cockpit, engine fire alert coming from attendant).

The system monitors many parameters (including internal ones not displayed to the crew) to alert in case of failure detection.

Abnormal operation

Failure Detection and Alert:

When a failure is detected by the system, it alerts the crew via visual attention getters (two Master Warning Annunciators located in the glareshield, one for each pilot), and also via an aural warning (the sound profile, for example single chime or repetitive chime, depending on the concerned failure).

These attention getters are de-activated when the crew acknowledges the alert.

The corresponding alert message is displayed. Every message is categorized according to its criticality level, depending on its safety impact (see section 5.1). Alerts are prioritized by the system according to these categories when several failures co-exist.

On some aircraft, the System Page concerned with the failure is automatically displayed. Such system’s synoptics provide refined information allowing the crew to confirm an alert.

Alerts may be inhibited to avoid crew disturbing during critical phases, as take-off or landing for example.

Failure Resolution:

In case of a warning failure, the flight crew instinctively executes essential actions related to survival. The crew confirms the system's auto setting in safe configuration. And then follow the procedure proposed by the system. Some major, non-reversible actions are confirmed between the pilot flying and the pilot not-flying (e.g. one engine shut down because on fire).

For each failure, the system helps the flight crew define the right actions in order to secure the flight, providing a procedure to follow ("to do-list ") to resolve the failure. This procedure is based on a safety analysis process, including a human factor demonstration. In some cases, the system displays automatically the aircraft system page related to the actions to be performed. Then, the crew performs the prescribed actions through the overhead panel and acknowledges the corresponding “procedure item” (action in procedure). In some aircraft, items are automatically acknowledged by the system itself that detects the realization of the action (or detects the new aircraft system state consecutive to the action). These items are usually called “sensed Items”.

104 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Post Failure Resolution:

The system updates the aircraft system’s synoptics and provides indications on the list of inoperative systems, as well as operational limits (via "memos") to support the flight crew in performing the assessment of the failure consequences on the aircraft's capability. The decision the Captain has to take is predefined. His latitude of decision will be to choose either the flight level which matches with the procedure recommendation or to choose his new destination according to new landing performance constraints and remaining flight time (in case of engine failure for example). This is done via the communication task with the ATC, and the AOC. Moreover, the flight crew will inform the Airline Maintenance centre, so that they can anticipate the actions to take before the next flight (could be done via an electronic technical logbook sent via data link).

5.5.2 Workload Reduction in Reduced Crew Situations While auto-flight capability eases the pilot's active monitoring and physical action of flying the aircraft, the technology also increases the pilot workload and requires sound task- management strategies and practices.

Pilots are reliant upon effective display avionics, particularly in low-visibility and high-traffic environments. Cutting-edge technologies exist both to increase the pilot’s situational awareness and to reduce pilot workload and fatigue.

In a two-pilot cockpit, if there is only one fit crew member left on the flight deck to finalize the mission, given the redundancy of the systems and functions, the pilot will continue to monitor and manage the systems. If other tasks are added, the workload may become higher depending on the flight phase and on the complexity of the situation i.e. cascading effects or “black swan”.

5.6 Aviate Aspects

5.6.1 Workload Reduction in Nominal Situations

To manage flight crew workload various means and methods are used today:

• Use of systems which (partially) automate tasks and/or assist in tasks;

• Use of SOPs in normal situations and emergency procedures in case of abnormal situations;

• Effective crew coordination/task sharing (CRM);

• Effective crew communication (standard calls).

In this section we will address these solutions with a focus on ‘aviate’ aspects.

5.6.1.1 Systems Systems currently operational reducing workload of the aviate task are described in this section. Funk et al. (1999) identified a list of automation issues that is also available on

105 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

the web (http://www.flightdeckautomation.com) and continuously growing. From that list a number of workload reducing systems were selected:

• flight directors

• autopilots

• autothrottles

• flight management systems

• centralized warning and alerting systems

Autopilot and Flight director The design objective of the autopilot and flight director is to provide assistance to the crew in the aviate task throughout the flight:

• By freeing up the PF from routine handling tasks, and thus providing time and resources to assess the overall operational situation;

• By providing the PF with adequate attitude or flight path orders, with the flight director symbol on the Primary Flight Display, so as to facilitate accurate handling of the aircraft.

The AP/FD guides the aircraft along the intended flight path, or at the intended speed, according to the guidance modes engaged by the pilot. In general the pilot uses a short- term interface to select guidance targets and arm/engage guidance modes. Generally, there are two types of modes and associated targets:

• Managed modes and targets: The aircraft is guided along the FMS lateral and vertical flight plan and speed profile;

• Selected modes and targets: The aircraft is guided by selected targets according to the modes selected on the FCU/ FMP.

The PF's task is to set the desired modes and targets to fly the aircraft to the desired direction.

In general, the autopilot may be used from after take-off down to a late stage of the approach (including autoland when permitted) and the autopilot may be used in most failure case, when available:

• In case of engine failure, including CATII/CATIII ILS approaches and fail-passive automatic landings;

• In case of abnormal configuration (e.g. slats/flaps failure), down to a predefined altitude.

When the PF hand flies the aircraft using the flight director, he must obey the flight director orders; in other words, the crossbars must be cantered, or the flight path vector must be on the flight path director symbol so as to fly according to the selected modes and targets.

Note that the autopilot allows the pilot to guide the aircraft automatically by the selected mode and targets. As such it reduces the pilot’s workload. However the pilot needs to

106 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

remain aware about other aspects of the flight. For example the autopilot will not prevent the aircraft from a Controlled Flight Into Terrain (CFIT). As such the workload of the pilot is changed from a task that requires constantly monitoring and giving inputs to a task where the pilot needs to make sure that despite all kinds of other tasks s/he also monitors the flight.

Fly-by-wire (FBW) systems In the early days of flying the pilot controlled an aircraft directly via a yoke and cables connected to the aircraft control surfaces. With increasing operational speeds attained by new aircraft designs the aerodynamic hinge moments could no longer be directly compensated by the pilot’s manual control power and some form of boosted control was introduced where simple actuators took over that role. With the advent of commercial airplane development, the pilot was further separated from the direct influence of the aerodynamic hinge moments by the introduction of hydraulic power actuation. Subsequently more sophisticated actuators improved aircraft flight control and handling qualities, for instance due to pure lag dynamics between the yoke deflection and the control surface positions, thereby reducing the pilot effort required to control the aircraft.

The introduction of fly-by-wire (FBW) technology on civil aircraft replaced the mechanical pilot-yoke inputs by electrical-signalling of the pilot inputs e.g. from a side stick. Also, the irreversible hydraulic power control actuators used to control the aircraft’s control surfaces were replaced by electrically signalled servo-actuators. A computer with flight control system (FCS) logic between the side stick and the servo-actuators allowed for the design of improved aircraft handling qualities at all flight conditions, but especially in demanding flight phases, like approach and landing. By using similar flight control laws per aircraft type, common flying qualities could be achieved that resulted into a common cockpit layout concept.

The advantages of a FBW system are a reduction in the piloting effort required to control the aircraft, a better precision in flying and a more efficient (meaning less time consuming) aircraft type conversion training due to the cockpit and aircraft flying commonality aspects. Carefree manoeuvring is another capability that is provided due to an implicit flight envelope protection function, thereby avoiding the need for the pilot to continuously monitor aircraft operating limits. Also asymmetrical yawing moments (for instance due to an engine failure) can be compensated for automatically. Other FBW applications relate to automatically trim the aircraft or to provide gust load alleviation. These FBW functions all add to improve the safety of aircraft operation considerably and to reduce crew workload.

Future FBW technology developments will be devoted to flight-control computer advances, new means of electrical signalling (e.g. fly-by-optics, wireless means) and more advanced actuator control electronics. Apart from the hardware matters, the cockpit crew will be further assisted in its aviating tasks with/via:

• more advanced pilot controls (like active inceptors with less technical complexity) providing feedback to the aircraft automation on pilot grip sensing matters and aircraft state aspects;

• enhanced flight envelope protection to earlier and better derive the impact of reaching an operational safety limit, and supporting the crew when possible;

• novel fault tolerant aircraft control (FTC) logic to allow the aircraft to be automatically stabilized and controlled under more critical situations, like wing

107 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

damage, aircraft configurations problems (like hard-overs of control surfaces or runaways), etc.;

• recovery assistance modes in more critical flight situations.

All these novelties should further reduce piloting effort and provide a smart feedback to the aircraft automation to further assist the cockpit crew when needed.

Autothrottle The A/THR's design objective is to provide assistance to the crew for thrust management as part of the aviate task throughout the flight. In general, the A/THR may be engaged in one of the following modes, which automatically depend on the AP/FD vertical modes:

• THRUST mode: The A/THR maintains a fixed thrust level when the AP/FD guides the aircraft in climb or descent at a constant speed;

• SPEED/MACH mode: The A/THR varies the thrust, so as to maintain a target speed, when the AP/FD guides the aircraft on a given trajectory.

When the A/THR is active, the thrust levers are set to detents; they remain in this fixed position, while the A/THR varies or sets the thrust according to the active mode. In an Airbus type of aircraft when the A/THR is active, the thrust lever position defines the maximum thrust available for the A/THR.

The crew must monitor the A/THR to ensure correct operation:

• On the PFD, by checking the active mode on the FMA, the current speed versus the target speed and, most importantly, the speed trend vector on the speed scale;

• On the engine display, by checking the thrust command symbols on the engine thrust indication.

In case the PF is not satisfied with the A/THR operation, he must disengage it and command the thrust manually, which is totally conventional.

In general the A/THR may be used from thrust reduction, after take-off, down to flare, at landing and the A/THR may be used in most failure cases, when available, in case of :

• One engine failure, without any restrictions;

• Abnormal configuration, with selected target speed for the approach.

Flight Management System The FMS is designed to provide assistance to the crew for:

• Position computation

• Speed management

• Lateral and vertical navigation

• Flight planning

• Aircraft performance prediction (optimum speeds/altitudes)

108 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

The FMS is an important long-term planning and management tool, linked to the AP/FD. When the AP/FD is engaged in managed modes, the aircraft is guided along the FMS flight plan, using the FMS target speeds. As such, the Flight Management System (FMS) is at a higher level of automation than the autopilot and autothrottle.

Typically, a long-term interface (e.g. Multipurpose Control and Display Unit (MCDU)) is used to insert and retrieve data to/from the FMS. Note that the various FMS entries required at successive flight phases should not distract the crew from the general flight conduct and duties.

The prime concern for the flight crew should be:

• Is the aircraft flying as expected now?

• What is the aircraft expected to fly next?

If any doubt is raised about the aircraft current trajectory, or proposed target speed, the PF must immediately select the appropriate modes and targets on the short-term interface (e.g. FCU). Subsequently and if time permits, the PNF will analyse and correct whatever might have gone wrong in programming the FMS.

Electronic Centralized Aircraft Monitor An electronic centralised aircraft monitor (ECAM) is a system that monitors aircraft functions and relays them to the pilots (“Electronic Centralized Aircraft Monitor”, n.d.). It also produces messages detailing failures and in certain cases, lists procedures to undertake to correct the problem. ECAM is similar to another system, known as Engine Indicating and Crew Alerting System (EICAS), used by Boeing and others, which displays data concerning aircraft systems and also failures. Airbus developed ECAM, such that it not only provided the features of EICAS, but also displayed corrective action to be taken by the pilot, as well as system limitations after the failures. Using a colour-coded scheme the pilots can instantly assess the situation and decide on the actions to be taken. It is designed to ease pilot stress in abnormal and emergency situations. The system does reduce pilot workload and it also allows the pilot (human operator) to do those things that humans are good at, solving problems rather than monitoring a system that most of the time operates fine.

5.6.1.2 Workload management As described above a number of systems exist in each commercial aircraft that automate the pilots task and to a certain extend reduce the pilots workload. To manage workload of the aviate task the pilot can switch these systems on and off dependent on what else is going on during the flight. They allow the pilot to switch priorities and leave some tasks under the control of the automation when another task requires all of his attention. Since none of the systems described above has a level of automation (LoA) that can function for 100% on their own the pilot always has to make sure that he monitors the automation frequently. Some general guidelines are to reduce workload are:

• Adhere to the defined task sharing for abnormal / emergency conditions to reduce workload and optimize flight crew resources;

• Use AP-A/THR, if available, to alleviate the PF workload,

• Use the correct level of automation for the task and circumstances.

109 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Generally these systems are primarily workload management tools rather than workload reduction tools.

Level of Automation In 1978 Sheridan and Verplank developed a taxonomy for levels of Automation (LoA). After them other researchers (Parasuraman, Wickens) have described comparable LoA taxonomies. The main structure, comprising 10 levels ranging from low to high LoAs, remained (see section 2.4). Further Sheridan and Verplank (1978) stated: “This taxonomy incorporates issues of feedback (what the human should be told by the system), as well as relative sharing of functions determining options, selecting options and implementing. While this taxonomy can be applied in more general terms, it is instantiated in terms of which agent (the human or the computer) gets or requests options, selects actions, requests or approves selection of actions, starts actions, approves start of actions, or reports actions and has been framed in terms of the teleoperation environment.”

What is described above does not yet explain the relationship between LoA and workload. It is just a taxonomy. However the reader should bear in mind that higher levels of automation, not by definition result in lower workload. Below is described that there is more to workload increase or decrease than the level of automation.

As mentioned earlier, Funk et al. (1999) identified a list of automation issues:

• Pilots are required to monitor automation for long periods of time, a task for which they are perceptually and cognitively ill-suited, and monitoring errors are likely;

• Cultural differences are not adequately considered in automation design, training, certification, and operations. Because they are not considered, they have resulting effects on performance and how automation is used;

• Transitioning back and forth between advanced-technology aircraft and conventional aircraft increases pilot training requirements;

• Although automation may do what it is designed to do, design specifications may not take into account certain unlikely but very possible conditions, leading to unsafe automation behaviour;

• When two pilots with little automation experience are assigned to an advanced- technology aircraft, errors related to automation use are more likely;

• Side sticks are not coupled with each other or the autopilot, reducing awareness of the other pilot's or the autopilot's inputs, resulting in reduced situation awareness, improper control actions, or both.

Funk et al. (1999) also found that slightly more specialists disagree then agree with the statement that “Automation may increase overall pilot workload, or increase pilot workload at high workload times and reduce pilot workload at low workload times, possibly resulting in excess workload, boredom, or both.”

On top of specific tools or displays there are also different flight modes that are supposed to relieve taskload from the pilots. They reduce workload and provide economic benefits, however also human machine problems and automation surprises follow from these improvements (Degani, Shafto, & Kirlk, 1996).

110 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

A recent study (Casner, 2009) investigated the effects of advanced cockpit systems on pilot’s workload. In this experiment traditional equipment was compared with modern systems related to aviate and navigate activities. With regard to aviate, manual steering was compared to the autopilot, and round-dial instruments were compared to electronic instruments. Results revealed that automation did not substantially decrease pilot’s workload (measured by the NASA-TLX rating scale). However, when pilots were asked explicitly in post-experiment surveys they reported that their workload was lower when using advanced automation and that they clearly preferred working with these systems compared to traditional equipment. These results confirm the (mis-)belief that supervising a system creates less workload than performing the tasks oneself. In other words, people believe in the positive effects of automation, but evidence by direct workload measures fail to appear. Note that others have remarked that monitoring is a cognitive effortful activity, which should not be underestimated but is often neglected (Morris & Leung, 2006).

A common strategy for workload management is prioritizing tasks according to the aviate- navigate-communicate-system approach. In practice, this prioritization strategy can be disturbed by more salient tasks, which draw more attention. Usually communication often interrupts aviate tasks. Such interruptions increase the workload and require more flexible strategies, like perceived importance strategy. It has been found that flight crews have difficulties in adopting different strategies as workload increases (Wickens, 2003).

Advanced automation may support flight crews in strategic workload management by monitoring their activities, remind them if specific activities are missed, present relevant task information and advice to shift to other activities (Wickens, 2003).

A flight crew can either aviate the aircraft through using automation or through manual flight using flight management systems and flight guidance. In both situations the flight crew has the responsibility to monitor the aircraft’s state, manage and maintain the flight path, detect deviations from the desired trajectory, and take appropriate actions. In order to do so the flight crew must select an appropriate level and mode of automation or flight guidance systems in a timely manner considering phase of flight and workload (ICAO, 2012).

5.6.2 Workload Reduction in Reduced Crew Situations When a crew is reduced either because one of the pilots is incapacitated or in a single crew cockpit the tasks as described above (in section 4.6) still need to be performed. Especially for the take-off-until-cruise and the approach-until-landing it goes that the aviation work requires a great deal of attention from the crew and bring a lot of mental workload for the crew members.

5.6.2.1 Unintentionally reduced crew If, during those high workload phases, one pilot is, for any reason, not able to perform as planned, the other pilot will have to take over responsibilities. Given the fact that a number of aviate related tasks were identified, that require full time attention from one pilot and that some of those tasks need to be executed in parallel, it will not be possible for just one pilot to perform at the same workload level as a complete crew would. When no solutions are invented to, either leave some of those tasks to automation, or new interfaces that would allow the pilot to execute several aviate related tasks at the same time, an incapacitated crew will by definition lead to a higher workload in just the aviation tasks.

111 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

5.6.2.2 Single crew operation The difference between the operation of an incapacitated crew and a crew of one is that the cockpit is designed either to be flown by one or by two persons. When designing a cockpit for one effort may be spent on solving some of the above mentioned problems. However, if the cockpit is truly designed for one there still needs to be some kind of safety net. Because also a crew of one pilot may become incapacitated. For those situations the aircraft must either be able to perform a landing by itself or it must be possible to control it from the ground or by a “cabin crew member-like-person”. This again raises the question how to redesign a number of the current aviate related flight instruments in such a way that a less skilled person is able to perform the tasks with highest workload for a normal pilot: the approach and landing.

5.7 Supervision In order to reduce the workload in the cockpit and to improve the situational awareness of the pilots, aircraft systems are generally equipped with specific assistance functionalities in terms of crew monitoring functions, operational data evaluation logics and notification rules.

Future cockpit developments should target on improving and integrating these functionalities in a holistic supervision system concept. Such a supervision system should be capable of the following:

• Autonomous cross-checking of system inputs performed by the crew members and/or external operators through avionics interfaces including all operational parameters related to the corresponding aircraft subsystems;

• Provision of cockpit crew notification respecting validity checks, failure monitoring and detection of inconsistent system setup;

• Kind and time of any specific notification should be based on the actual flight phase and the level of severity evaluated through an alerting algorithm;

• Supervision includes flight phase related monitoring of procedures and decision making support. In the event of special or abnormal situations, recommendations for optimum solutions should be presented to the flight crew considering the correlation of all data bases available to the system.

5.7.1 Workload Development in Nominal Situations In the following chapters, prevalent supervision functionalities will be presented that are already implemented in today’s aircraft systems.

5.7.1.1 Auto-flight System

5.7.1.1.1 Autopilot and Flight Director

Flight Mode Annunciator (FMA)

112 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

The conventional FMA design is limited to the display of selected and activated modes for lateral and vertical flight guidance, thrust and speed setting and the degree of support through the Fight Director and the Autopilot (see Figure 20). Several innovations have been added in recent aircraft generations to improve the pilots’ ability to interpret the respective level of automation and to monitor the handling of the Auto-flight System.

Figure 20 - B767 FMA indication (automatic landing).

Automatic mode reversions have been designed to ensure coherent Autopilot, Flight Director and Auto Thrust operations. Whenever the vertical and/or lateral axis modes are not consistent (e.g. a flight plan discontinuity, navigation failure, manual mode selection), a fallback to a basic mode on the constrained axis is automatically initiated. In order to notify the pilots about this particular condition an attention getter is implemented, e.g. the Flight Director bar flashes for 10 seconds (Airbus).

Compared to older aircraft generations that only provide low level flight guidance (basic modes such as “Heading Select” or “Selected Heading”, “Vertical Speed” etc.) current aircraft types are equipped with a highly automated flight guidance system. LNAV and VNAV (Boeing) or managed modes (Airbus) respectively are capable of providing the flight crew with lateral and vertical flight path management. In Airbus aircraft types for instance, lateral and vertical guidance can be established by the flight crew independently and either selected (individual programming) or managed (referenced to pre-programmed flight plan parameters). The system restricts the programming of the flight crews in such a way, that managed vertical guidance is not possible whenever selected lateral guidance is already used. In addition, the FMA system notifies the flight crew whenever mode setup inconsistencies exist (e.g. lateral condition does not meet the requirements for the activation of the vertical mode).

Flight mode faults are also indicated to the flight crew. For example, Boeing uses a horizontal amber line which is drawn through the appropriate roll or pitch mode if a flight mode fault is detected. In this case, the selection of the faulty mode is no longer possible.

113 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

TCAS (Traffic Alert and Collision Avoidance System)

TCAS Resolution Advisory (RA) manoeuvres are generally controlled by the pilot. The TCAS system monitors the flight path convergence of the affected aircrafts. In order to avoid a collision, it verifies the effect of the evasive manoeuvres and gives coordinated commands to the pilots to prevent an unacceptable approximation. However, aircraft types currently being developed are capable of performing automatic TCAS RA manoeuvres (see Figure 21). This improves the situation awareness of the flight crew as the pilot flying is no longer charged with controlling the aircraft. He is able to divide his attention between monitoring of the evasive manoeuvre, airspace observation and additional piloting tasks.

Figure 21 - Boeing 777 PFD TCAS RA indication (vertical guidance).

5.7.1.1.2 Speed-Attitude Correction In today’s aircraft systems the flight conditions are continuously monitored by sensing, computing and internal monitoring of the flight envelope. “Auto Trim”, “Mach Trim” as well as “Speed Stability” and “Mach Feel” are means to automatically correct for effects of speed and out-of-trim conditions. They are indicated via specific warning devices and support the pilots in order to maintain a safe flight profile.

In the following, supervision functionalities referring to the aircraft speed and attitude are listed:

• Ground Speed Mini function (Airbus)

o Approach speed correction considering actual wind condition.

• Short term managed speed (Airbus);

o Speed target to prevent over or underspeed (actual configuration).

• Alpha floor protection, low energy protection (Airbus & Boeing);

114 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

• Highspeed protection (Airbus & Boeing);

• High bank angle protection (Airbus & Boeing);

• High angle of attack protection, pitch attitude protection (Airbus & Boeing) ;

o Limitation of excessive angle of attack.

• Load factor protection (Airbus);

• Flap placard speed limit (Airbus & Boeing);

o Automatic retraction avoids structural overload of flaps.

• Reactive windshear protection (Airbus);

• Corrections for cross wind during take-off and landing (Airbus);

o Rudder input during landing flare is supported by automatic reverse roll moment to compensate for drift.

5.7.1.1.3 Automatic Trim The automatic trim system establishes a constant g-load and therefore maintains a preset aircraft attitude. Manual trim control is no longer required, which results in a reduction of workload. However, in case of a flight control law downgrade (e.g. a fallback to “Direct Law” due to a technical malfunction) the controllability of the aircraft is reduced and the pilots’ workload will rise significantly.

The pitch trim for take-off is set automatically based on the centre of gravity (CG) for the respective aircraft gross weight (GW). The GWCG is computed by means of the zero fuel weight (ZFW) and the ZFW CG provided by the flight crew. Whenever the pitch trim setting is not within predefined limits, e.g. out of target (optimum pitch) or out of green band (flight envelope), a notification on the pitch trim display (at the bottom of the PFD) will be presented to the flight crew along with an associated ECAM (refer to chapter 5.7.1.5.2) alert. The Flight Warning System (FWS) also triggers an ECAM alert if the pitch trim setting for take-off is not in line with the take-off CG entered in the Flight Management System (FMS) and/or with the actual CG computed by the “Fuel Quantity and Management System”.

The rudder trim indication system also provides a supervision functionality. On ground, whenever the position of the rudder trim is not in the neutral range, the rudder trim indication turns amber. Prior to take-off it turns red if the position of the rudder trim is not in take-off range (see Figure 22).

115 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Figure 22 - Airbus A380 PFD trim zone indication.

5.7.1.1.4 Autothrottle (Boeing) and Autothrust (Airbus) Both Autothrottle and Autothrust are capable of automatically adjusting the engine thrust in order to maintain target airspeed, or of setting any preselected or calculated thrust value after initiation of the flight crew (refer to chapter 5.6.1.1).

The automatic thrust lever movement of the Autothrottle system makes power changes obvious and/or recognizable to the pilots. Manual intervention is possible at any time without disconnecting the Autothrottle. There are no specific supervision functionalities in terms of thrust lever operation monitoring

As stated in chapter 5.6.1.1, the Autothrust system requires the pilots to manually select a notch position that defines a specific thrust limit (during normal operation the thrust lever remains in the climb (CLB) notch). However, manual intervention is possible at any time after deactivation of the system. The Autothrust automatically adjusts the amount of required thrust in order to limit the selected or managed speed. Whenever the aircraft is about to decelerate below the lowest selectable speed (includes margin against stall and buffet) or to accelerate beyond the maximum speed minus 5 knots (Vmax - maximum operating speed or maximum speed with flaps and/or landing gear extended) the Autothrust intervenes and prevents any under- or overspeed condition. In case the pilot does not follow the Flight Director commands and a speed limit violation becomes likely, the Autothrust reverts to SPEED mode and adjusts the thrust accordingly.

5.7.1.1.5 Aerodynamic Load Alleviating

Load Factor Protection

On most commercial aircraft the maximum allowed structural load is 2,5g. Load factor protection enables the pilot to immediately apply full control column or side stick pressure without the risk of overstressing the aircraft. Most protection systems also provide

116 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

assistance functions in terms of automatic correction for gust loads, upset recovery and aerodynamic augmentation, alleviation or suppression.

5.7.1.2 Flight Controls

5.7.1.2.1 Spoiler, Drag Devices and Variable Aerodynamic Fairings Various supervision functionalities are established on modern jet aircraft with respect to the use of spoilers and drag devices. For instance, immediately after recognition of a take- off run abort, the ground spoilers will be deployed automatically. The system is also capable of automatic retraction during a landing abortion as well as of automatic extension after a landing touch down. Associated indications and warnings are also implemented.

5.7.1.2.2 Lift Augmenting

Auto Slat/Flap System

Automatic lift device operation has already been developed at an early stage. The automatic slat and automatic flap system partly deploys the slats and/or flaps with respect to the actual speed, the acceleration/deceleration rate and the actual aircraft configuration. For instance, whenever the aircraft approaches a critical flight attitude or flight envelope condition, slats and/or flaps are extended to avoid the development of a stall. In specific configurations, the automatic retraction function of the flap devices avoids excessive structural loads whenever the aircraft is just about to exceed the flap placard speed limit.

5.7.1.2.3 Reconfiguration Laws (Airbus) Multiple aircraft system failures may result in a degradation of the normal flight control law. As a consequence, restrictions regarding the availability of the Auto-flight System including flight control protections and/or the controllability of the aircraft may occur. The degraded laws are

• Alternate law (ALT 1, ALT 2);

o Limited pitch and lateral control;

o Limited flight control protection functionalities.

• Direct law;

o Limited pitch and lateral control;

o No flight control protections.

• Abnormal attitude law;

o Control laws allow for inputs to immediately restore the protected envelope.

• Backup Control law;

o Electrical backup mode in case all flight control computers are lost.

117 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

5.7.1.3 Fuel

5.7.1.3.1 Distribution Intelligent fuel systems are capable of levelling the aircrafts load distribution with help of cross feeding between wing and trim tanks. The fuel distribution is monitored by the system and the respective fuel transfer pumps are activated in order to achieve structural load changes with respect to the actual flight phase. For instance, during cruise flight a significant amount of fuel remains in the outer wing tanks in order to counteract the forces induced by the lift, whereas before landing the fuel is transferred to the inner tanks to reduce the forces on the wing root in case of a potential landing impact. Furthermore, CG control is supported by the trim tank fuel transfer.

Several supervision functionalities are common, such as the notification of any abnormalities regarding the transfer process and the technical status of the fuel system components. Moreover, the dumping process is also monitored (automatic termination & notification).

5.7.1.4 Ice and Rain Protection Modern aircraft icing protection systems are able to detect ice formation early and notify the flight crew if significant ice built-up can be expected. A warning is triggered in case the pilots are not reacting adequately (use of wing and/or engine anti ice system).

5.7.1.5 Central Warning & Display Systems

5.7.1.5.1 EICAS (Engine Indication and Crew Alerting System, Boeing) Boeing’s EICAS system depicts the instrumentation of various engine parameters (EPR, N, fuel flow and quantity, oil pressure etc.), allows the monitoring of the hydraulic, pneumatic and electrical system and shows all details concerning de-icing, environmental and control surface systems (see Figure 23). Several supervision functionalities are implemented such as:

• Reminder of incomplete checklists;

• Display of warning, caution and advisory messages;

• Reminder of communication and memo messages;

• System status indication;

• Recall indication.

118 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Figure 23 - B777 EICAS indication (left engine fire).

5.7.1.5.2 ECAM (Electronic Centralized Aircraft Monitoring, Airbus) The ECAM system provides electronic supervision of essential aircraft components such as engines and APU, fuel system, lift devices, electric system, hydraulic system, cabin pressurization and air conditioning (see Figure 24). It consists of a display for engine supervision and warning indication, a display for status and system indication, a control panel, two computers to generate warning indications (Flight Warning Computer, FWC) and two computers for data acquisition (Systems Data Acquisition Concentrator, SDAC).

Figure 24 - A380 ECAM indication (bleed abnormal).

119 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Several assistance functionalities are provided by the ECAM system:

• Display of memos (e.g. seat belts, anti-ice, take-off and landing memos);

• Provision of abnormal procedures

o Either automatically sensed by the system;

o Or selected by the flight crew.

• Display of applicable system synoptic pages.

Both the EICAS and the ECAM system allow for flight phase related notification inhibitions to avoid a distraction of the pilots in critical flight conditions. Take-off configuration alerts are also implemented through the EICAS/ECAM system.

5.7.1.5.3 Electronic Flight Instrument System (EFIS, Airbus & Boeing) In today’s aircraft systems the Electronic Flight Instrument System (EFIS) controls the display of all relevant flight parameters and associated notifications. Flight envelope supervision leads to the generation of a notification whenever the flight crew is close to exceeding a parameter limit. In the following, common notifications implemented in the Primary Flight Display (PFD) are listed:

• Attitude indications and alerts;

• Airspeed indications and alerts;

• Altitude indications and alerts;

• Heading/track indications and alerts;

• Guidance indications and alerts.

Furthermore, most systems provide warnings whenever one or more of the above mentioned indications are invalid or unavailable.

5.7.1.6 Navigation

5.7.1.6.1 Flight Management Computing The Flight Management System (FMS, Airbus & Boeing) provides long-term guidance along the active flight plan. By handing over target parameters to the flight guidance system it assures that the requirements of the flight plan created by the flight crew will be met. The system is capable of managing and checking flight performance calculation and optimization tasks. It also verifies the aircraft position, the position accuracy and the radio navigation tuning. Inconsistencies will be notified via cockpit displays, such as the Primary Flight Display (PFD), the Navigation Display (ND), the Control and Display Unit (CDU) and the Multifunction Display (MFD, see Figure 25).

120 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Among others, modern flight path management systems are capable of:

• Indication of constraints (and respective warnings)

• Time management

• Fuel management

• Trajectory management (vertical and lateral)

• Cost Index optimization

• Wind uplink functionalities.

Figure 25 - A380 MFD (flight plan page).

121 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

5.7.1.6.2 Enhanced Weather Radar On modern aircraft enhanced weather radar systems assist the pilots in revising their flight path in order to avoid adverse weather areas. These areas are displayed on the Navigation Display (ND) with help of colour codes, different scanning options and additional depiction logics (e.g. use of a vertical display).

5.7.1.7 Engine Indicating Today’s engine control systems provide a number of assistance functionalities. Most common are general protecting functions as for instance overboost, stall and shaft failure protection. Airbus’ Full Authority Digital Engine Control (FADEC) allows for an automatic engine start and shutdown management including automatic handling of engine start abnormalities.

5.7.2 Workload Development in Reduced Crew Situations As stated in previous chapters, a reduced flight crew condition results in a degradation of the overall situation awareness. In particular during flight phases with high workload such as take-off, go around, approach and landing the monitoring of an additional crew member reduces the risk of human error. Whenever the redundancy of an observing crew member is no longer available, cockpit assistance systems become even more vital, especially under low visibility and adverse weather conditions. Existing supervision functionalities do not yet specifically incorporate pilots incapacitation. Nevertheless, their support is all the more important during reduced crew situations.

122 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

6 FULL INCAPACITATED CREW SITUATIONS

The previous chapters have considered high workload condition (Conf. 1), the intentionally reduced case (Conf. 2), and the unintentional crew reduction (Conf. 3). This chapter consider the full crew incapacitation (Conf. 4) situation.

6.1 Effects In a multi-crew environment, incapacitation by one of the crew may be obvious immediately and become progressively more evident. Alternatively the incapacitation could even escape notice until there is an unexplained response or action from one of the crew member. However, if all pilots of a multi / single crew aircraft become incapacitated then safety of the flight will be severely compromised and Loss of Control likely to result. It should also be noted that a subtle incapacitation of one of two pilots could also present a similar risk, especially at low level and particularly if it occurs during a precision approach in Low Visibility Procedures. Another consideration that also needs to be considered in the case of total crew incapacitation is loss of separation in the airspace as well as flight into terrain or obstacles to be considered in the case of total crew incapacitation is loss of separation in the airspace.

6.2 Statistics

Events on the SKYbrary Database which list Incapacitation as a causal factor include:

Accidents

B733, en-route, Grammatiko Greece, 2005 (HF LOC FIRE AW): On 14 August 2005, a B737-300 aircraft belonging to Helios Airways, crashed near Grammatiko, Greece following the incapacitation of the crew due to Hypoxia.

LJ35, Aberdeen SD USA, 1999 (HF): On 25 October 1999, a Learjet 35 operated by Sunjet Aviation, crashed in South Dakota following crew incapacitation.

These are further developed in section 6.5.

In addition, the following is a list of incidents where incapacitation was a causal factor:

Serious Incidents

B763, en-route, Atlantic Ocean, 2008 (HF): On 28 January 2008, the first officer on a B767, flying from Toronto to London, became incapacitated and the captain elected to divert to the nearest airport, Shannon, Ireland.

SF34, vicinity Zurich Switzerland, 2000 (HF LOC FIRE) (On 10 January 2000, two minutes and 17 seconds after departure from Zurich airport, at night in instrument meteorological conditions (IMC), a Saab 340 operated by Crossair, entered into right- hand dive and crashed.)

BE20, vicinity North Caicos British West Indies, 2007 (LOC HF) (On 6 February 2007, a Beech 200C Super King Air being operated by a small locally-based airline on a passenger flight from North Caicos to Grand Turk, Turks and Caicos Islands, British West Indies crashed into a shallow lagoon 1nm south east of the departure airport soon after a dark night take-off in VMC. The single pilot was fatally injured as a result of the accident

123 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

whilst four out of the five passengers received serious injuries and the other, seated at the back of the aircraft, received only minor injuries.)

The US Federal Aviation Administration (FAA) has also studied in flight medical incapacitation and impairments from 1993 to 1998. It found 30 incapacitation and 11 impairments aboard 47 aircraft over this period with serious impacts on flight safety in seven flights. Similarly The U.K. Civil Aviation Authority (CAA) said 49 cases of incapacitations occurred from 1992 to 1997 on public transport aircraft, with 38 of those in two-crew cockpits and 27 related to nausea and gastric troubles.

In addition there have been incidents of partial incapacitation and fatigue and these need to be taken into account for any move towards a single crew cockpit. A recent press report has also highlighted an Air New Zealand pilot that fell asleep at the controls twice during a flight in 2011 "During the cruise phase of the flight, one of the two operating pilots nodded off twice for around a minute and woke spontaneously”. Safety was not compromised during the flight as there were two other pilots on board. Concerning fatigue, there was also published in 2011 the results of a study, commissioned by the British pilots' union, Balpa in 2011 with a major British airline. This indicated that some 45% of those who responded in the survey said they were suffering from significant fatigue. And that one in five reported their abilities were compromised in flight more than once a week.

Risk

ICAO Doc 8984 "Manual of Civil Aviation Medicine" builds on the knowledge that has been learned over the decades about pilot incapacitation. The acceptable 1% level of risk of incapacitation in a multi-crew environment of commercial operations is the so-called ’1% Rule’. The rule has been devised to consider the failure of the human component, in terms of mechanical system reliability to be at par with the airworthiness requirements of airliners. Most of the regulatory medical authorities now use this broad rule as an acceptable rate of ‘one per cent per annum’ (approximately equal to one in 1 million flying hours) for pilot incapacitation due to medical reasons to assess fitness of the pilots. However it should be noted that the “1% rule” cannot apply to a solo pilot flying in public transport operations, because it is derived from two pilot operations and the availability of a second pilot to take over in the event of one pilot becoming incapacitated.

The rule however, has also been applied to the private pilot population by some States where it is considered that the acceptance of an increased risk of incapacitation in a private pilot seems reasonable since the overall level of safety demanded of private operations is less than that of commercial operations, and it would therefore be out of place to demand a professional pilot medical standard for private pilot operations.

6.3 Current Prevention Strategies There is currently no existing solution to allow the saving of the aircraft when all the flight crew are incapacitated. The existing protection strategy relies on the remaining pilot to assume and maintain control. Any new solution to cover total crew incapacitation should take into account the following current lines of defence which are summarised as follows.

• The remaining pilot must assume or maintain control

• Establish a safe flight profile and engage the autopilot; use all possible automation

• Obtain cabin crew assistance

124 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

• Obtain assistance of any person on board, familiar with the operation of large aircraft or commercial airliners.

• Inform ATC

• If on an extended-range twin-engine operations (ETOPS) flight, the remaining pilot or pilot in charge (PIC) must assess whether to continue the flight, return to the departure airport if still possible or divert. The decision is based on:

o Weather conditions at the destination or alternate

o Reduction of flight time if diverting

o Workload involved in single-pilot operation

o Familiarity with the alternate

o Condition of the incapacitated pilot

o Availability of medical assistance

o Overall safety of the flight

• Complete the approach and landing using the autopilot as much as possible

• No special landing limits or procedures apply

6.4 Technology

European co-funded research (SAFEE and SOFIA) has concentrated on the security on-board an aircraft in the event of a hostile action. For the SAFEE (Security of Aircraft in the Future European Environment) programme there are two areas of interest that are applicable to ACROSS: the Emergency Avoidance System (EAS) and the Flight Reconfiguration Function (FRF). For the EAS, the work conducted in SAFEE corresponded to the initial cycle of an incremental development process. It comprised of an analysis stage that produced an initial requirements baseline, followed by a prototyping and experimentation stage that was introduced to get further insight into requirements from end users perspective. One of the key future areas of investigation was to demonstrate that the EAS would comply with the FAA/EASA regulatory framework. For the FRF SAFEE established the foundations of a system providing the ultimate protection function able to safely re-route and land threatened aircraft on a secure airport and this provided the groundwork for SOFIA. The SOFIA project developed an FRF system that enabled the safe, automatic and autonomous return to ground of an airplane in the event of hostile actions. To carry out this action, the FRF disables the control and command of the aircraft from the cockpit, creates and executes a new flight plan towards a secure airport and lands the aircraft at it. Regarding the generation of the flight plan this could be generated in ground (ATC) or in a military airplane and be transmitted to the aircraft, or be created autonomously by own FRF system. Additionally, the SOFIA project also considered the impact of the regulatory and certification frameworks into the FRF system and vice-versa. A number of open questions remained concerning responsibility for the aircraft, new flight plan, new airport etc.

Auto-flight Systems are commonly fitted to a wide range of different aircraft types and are used to reduce the Pilot workload by providing an alternative (automatic) means by

125 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

which the flight path and speed of an aircraft can be controlled. The availability and integrity requirements for the autopilot function depend to a certain extent on the functions that are being provided. For example, an autopilot that is used to perform fully automatic landings (CAT 3b) will have more stringent requirements than one that only provides steering commands during cruise. Given that autopilots are not required for safe flight and landing, the availability requirement will normally be in the range of 1E-5 to 1E-7. The integrity requirement for any new functionality will need to be consistent with the failure effect that can occur as the result of an autopilot failure.

Autoland systems can be described as those systems that fully automate the landing phase of an aircraft's flight, with the human crew supervising the process (including configuration and energy management). The pilots assume a monitoring role during the final stages of the approach and will only intervene in the event of a system failure or emergency and, after landing, to taxi the aircraft off of the runway and to the parking location. From an avionics safety perspective, a CAT 3b/c landing is the "worst case scenario" for safety analysis because a failure of the automatic systems from flare through the roll-out could easily result in a "hard over" (where a control surface deflects fully in one direction). This would happen so fast that the flight crew may not be able to effectively respond. For this reason Autoland systems are designed to incorporate a high degree of redundancy so that a single failure of any part of the system can be tolerated (fail active) and a second failure can be detected – at which point the autoland system will turn itself off (uncouple, fail passive).

Unmanned Aircraft – state of the art activities concerning the introduction of unmanned aircraft into civil airspace are also applicable to the ACROSS programme as the aircraft could be treated as an unmanned vehicle. In the case of incapacitated crew. ICAO Circular 328, Unmanned Aircraft Systems (UAS) will provide a useful input concerning number of areas including: legal matters, regulatory/certification, operations, use of remote pilots, and security.

Patents

• Emergency flight control system – US 7,568,662- Honeywell

o A method and system for preventing the control of an aircraft from the cockpit. In an exemplary embodiment, the system could be triggered externally. For example, an air traffic control (ATC) station could determine that the aircraft has deviated from its planned flight path. If personnel at the ATC station decide that the deviation is not attributable to the actions of the authorized flight crew, the personnel can transmit a signal to the aircraft that disables all normal cockpit control of the aircraft. Once normal flight controls are disabled, the aircraft may execute a pre-programmed emergency flight plan via its autopilot system, with or without the use of a flight management system (FMS). The emergency flight plan could cause the aircraft to fly to a sparsely populated area and enter a holding pattern, or it could cause the aircraft to land in a sparsely populated area or at an airport using an autoland system.

• System and method for automatically controlling a path of travel of a vehicle, US 7,142,971 - Boeing

o The method and system for automatically controlling a path of travel of a vehicle include engaging an automatic control system when the security of

126 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

the onboard controls is jeopardized. Engagement may be automatic or manual from inside the vehicle or remotely via a communication link. Any onboard capability to supersede the automatic control system may then be disabled by disconnecting the onboard controls and/or providing uninterruptible power to the automatic control system via a path that does not include the onboard accessible power control element(s). The operation of the vehicle is then controlled via the processing element of the automatic control system. The control commands may be received from a remote location and/or from predetermined control commands that are stored onboard the vehicle

• Flight Control System with Dynamic Allocation of Functionality Between Flight Crew and Automation, US 20120215384, Emerald Sky Technologies

o A Real-time Allocation Flight Management System and method, which defines specific roles functions for crew during the implementation of the flight plan. The flight control system requires crew input during pre- programmed way points during the flight. When fully functional, the system can control all aspects of a flight, including attitude and power control as well as all ancillary systems necessary for flight from take-off to touchdown. In the event that the crew is incapacitated, the system can select the most probable approach procedure in use based on whatever information is available such as current and forecast destination weather, prevailing winds, and approach possibilities, such as available runways. Adjustment of the flight plan trajectory, allows the system to follow the adjusted trajectory. Included is a simulator software program, a free-standing flight simulator and methods of incorporating training protocols for flight crews.

6.5 Real Cases Two real cases where the crew was fully incapacitated will be presented next.

The Learjet 35

1. Keywords: Loss of cabin pressurization (for undetermined reasons); crew incapacitation

2. Phase of flight: The accident occurred during the en-route flight phase.

3. Date: October 25, 1999, about 12:13 central daylight time (CDT).

4. Location: Near Aberdeen, South Dakota.

5. Type of aircraft: The aircraft was a Learjet Model 35, registration number N47BA, operated by Sunjet Aviation, Inc., of Sanford, Florida.

6. Narrative

The airplane departed Orlando, Florida, for Dallas, Texas, about 0920 eastern daylight time (EDT). Radio contact with the flight was lost north of Gainesville, Florida, after air

127 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

traffic control (ATC) cleared the airplane to flight level (FL) 390. The airplane was intercepted by several U.S. Air Force and Air National Guard aircrafts as it proceeded northwest bound. The military pilots in a position to observe the accident airplane at close range stated (in interviews or via radio transmissions) that the forward windshields of the Learjet seemed to be frosted or covered with condensation. The military pilots could not see into the cabin. They did not observe any structural anomaly or other unusual condition. The military pilots observed the airplane depart controlled flight and spiral to the ground, impacting an open field. All occupants on board the airplane (the captain, first officer, and four passengers) were killed, and the airplane was destroyed (NTSB, 2000).

7. Causes

The plane apparently suffered a loss of cabin pressure at some point early in the flight. All on board are thought to have died of hypoxia, lack of oxygen. The plane, apparently still on autopilot, continued flying until one engine flamed out, most likely due to fuel starvation and crashed near Aberdeen, South Dakota after an uncontrolled descent. The exact cause of the pressurization failure and the reason behind the crew's failure or inability to respond to it has not been definitively determined (National Transportation Safety Board Advisory, 2000).

• Technological (automation)

There was a loss of cabin pressurization for undetermined reasons.

• Human factors

The probable cause of the accident was given as:

"The National Transportation Safety Board determines the probable cause of this accident was incapacitation of the flight crew members as a result of their failure to receive supplemental oxygen following a loss of cabin pressurization, for undetermined reasons."

But in the same report it is stated: “The continuous sounding of the cabin altitude aural warning during the final 30 minutes of cruise flight (the only portion recorded by the cockpit voice recorder, or CVR) indicates that the airplane and its occupants experienced a loss of cabin pressurization some time earlier in the flight. 3 Further, although the severity of the impact precluded extensive analysis, there was no evidence suggesting any alternative reason for incapacitation.

If the pilots had received supplemental oxygen from the airplane’s emergency oxygen system, they likely would have properly responded to the depressurization by descending the airplane to a safe altitude. Therefore, it appears that the partial pressure 4 of oxygen in the cabin after the depressurization was insufficient for the flight crew to maintain

3 The Safety Board was unable to conclusively determine whether the cabin altitude warning initiated as designed. (The warning is designed to begin at 10,000 feet cabin altitude ± 500 feet.) However, the aneroid device that initiates the warning functioned properly to terminate the warning as the airplane descended. 4 Partial pressure, which is a function of the concentration of the gas in the atmosphere, represents the amount of total pressure accounted for by a particular gas. For example, at sea level (14.7 pounds per square inch [psi]), there is a 21 percent oxygen concentration, which provides a partial pressure of about 3.1 psi. A 100 percent concentration of oxygen from supplemental oxygen would provide the same partial pressure of oxygen at about 34,000 feet.

128 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

consciousness and that the flight crew members did not receive any, or adequate, supplemental oxygen” (NTSB, 2000).

The Helios Airways Flight 552

1. Keywords: Pilot error; crew incapacitation; inadequate procedures

2. Phase of flight: The accident occurred during the en-route flight phase.

3. Date: August 14, 2005, at 12:04 Eastern European Time (EEST).

4. Location: In the area of Grammatiko, Attikis, 33 km Northwest of Athens International Airport.

5. Type of aircraft: The aircraft involved was a Boeing 737-31S, named Olympia, registration number 5B-DBY.

6. Narrative

Helios’ Boeing 737-300, 5B-DBY, underwent maintenance on the night prior to the accident. The pressurization system was checked, but after completion of the tests the Pressurization Mode Selector (PMS) was reportedly left in the "Manual" position instead of the "Auto" mode. In manual mode the crew had to manually open or close the outflow valves in order to control the cabin pressure. The outflow valves were one-third in the open position which meant that the cabin would not pressurize after take-off. The PMS mode was apparently not noted during the pre-departure checks by the crew (Aviation Safety Network, 2005).

In the morning the 737 was to operate Flight 522 from Larnaca to Prague, Czech Republic with an intermediate stop at Athens, Greece. The flight departed Larnaca at 09:07 for the leg to Athens with a planned flying time of 1 hour and 23 minutes. As the airplane climbed over the Mediterranean the cabin altitude alert horn sounded. This occurred as the 737 passed through an altitude of 10,000 feet. Cabin altitude is usually held around 8,000 feet. The crew possibly thought it was an erroneous take-off configuration warning because the sound is identical. Then, at 14,000 feet, the oxygen masks automatically deployed and a master caution light illuminated in the cockpit. Because of a lack of cooling air another alarm activated, indicating a temperature warning for the avionics bay.

The German captain and the Cypriot co-pilot tried to solve the problem but encountered some problems communicating with each other. They contacted the Helios’ maintenance base to seek advice. The engineer told that they needed to pull the circuit breaker to turn off the alarm. The radio contact ended as the aircraft climbed through 28,900 ft.

The circuit breaker was located in a cabinet behind the captain. The captain got up from his seat to look for the circuit breaker. The crew were not wearing their oxygen masks as their mind-set and actions were determined by the preconception that the problems were not related to the lack of cabin pressure.

As the airplane was still climbing the lack of oxygen seriously impaired the flight crew. The captain probably became unconscious when he was trying to find the circuit breaker. The first officer was still in his seat when he also became unconscious. Because the plane's autopilot was programmed for FL340 the Boeing continued to climb until levelling out at that altitude some 19 minutes after take-off. At 09:37 the 737 entered the Athens FIR but no contact was established with the flight. Over Rodos at about 09:52 the airplane entered the UL995 airway. At 10:21 the airplane passed the KEA VOR, which is located about 28

129 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

nm south of the Athens airport. The airplane then passed the Athens Airport and subsequently entered the KEA VOR holding pattern at 10:38. All efforts by Greek air traffic controllers to contact the pilots were futile. Around 11:00 two Greek F-16 fighter planes were scrambled from the Néa Anghialos air base. At 11:24, during the sixth holding pattern, the F-16's intercepted the airliner. The F-16 pilots reported that they were not able to observe the captain, while the first officer seemed to be unconscious and slumped over the controls.

At 11:49, the F-16's reported a person not wearing an oxygen mask entering the cockpit and occupying the captain's seat. The F-16 pilot tried to attract his attention without success. At 11:50, the left engine flamed out due to fuel depletion and the aircraft started descending. At 11:54, two Mayday messages were recorded on the CVR.

At 12:00, the right engine also flamed out at an altitude of approximately 7100 feet. The aircraft continued descending rapidly and impacted hilly terrain.

The same Boeing 737, 5B-DBY, suffered a loss of cabin pressure on December 20, 2004 during a flight from Warsaw to Larnaca. Three passengers needed medical treatment after landing in Larnaca. This incident was caused by a leaking door seal of the right hand rear door (“Helios Airways Flight 522”, n.d.).

7. Causes

In this case study direct and latent causes involving all three typologies (see below) can be identified. Additionally, it is possible to recognize several contributing factors to the accident (Aviation Safety Network, 2005). For example, the omission of returning the pressurization mode selector to AUTO after unscheduled maintenance on the aircraft; the lack of specific procedures (on an international basis) for cabin crew procedures to address the situation of loss of pressurization, passenger oxygen masks deployment, and continuation of the aircraft climb; and the ineffectiveness of international aviation authorities to enforce implementation of corrective action plans after relevant audits.

• Technological (automation)

Technological causes that can be defined as design issues is the identical sound alarm for two different warnings which has caused the “Non-identification of the warnings and the reasons for the activation of the warnings (cabin altitude warning horn, passenger oxygen masks deployment indication, Master Caution), and continuation of the climb”.

• Human factors causes

1. Non-identification of the warnings and the reasons for the activation of the warnings (cabin altitude warning horn, passenger oxygen masks deployment indication, Master Caution), and continuation of the climb.

2. Incapacitation of the flight crew due to hypoxia, resulting in continuation of the flight via the flight management computer and the autopilot, depletion of the fuel and engine flameout, and impact of the aircraft with the ground.

As reported in the official document (Air Accident Investigation & Aviation Safety Board, 2005), the cause of the accident was the uncontrolled decompression due to pilot error leading to incapacitation and fuel exhaustion. But there are latent causes imputable to several actors:

130 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

o The Operator’s deficiencies in organization, quality management and safety culture, documented diachronically as findings in numerous audits.

o The Regulatory Authority’s diachronic inadequate execution of its oversight responsibilities to ensure the safety of operations of the airlines under its supervision and its inadequate responses to findings of deficiencies documented in numerous audits.

o Inadequate application of Crew Resource Management (CRM) principles by the flight crew.

o Ineffectiveness and inadequacy of measures taken by the manufacturer in response to previous pressurization incidents in the particular type of aircraft, both with regard to modifications to aircraft systems as well as to guidance to the crews.

• Procedures

The causes that have produced those related to the technological and the HF aspects:

o Non-recognition that the cabin pressurization mode selector was in the MAN (manual) position during the performance of the:

Preflight procedure;

Before Start checklist;

After Take-off checklist.

8. Additional supporting materials

It is possible to watch the associated video named “Airplane Crashes - Helios Airways Flight 522” on YouTube website (accessible via http://www.youtube.com/watch?v=d- iePFo5QrA

131 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

7 AREAS FOR IMPROVEMENT

7.1 Workload in Nominal and Reduced Crew Situations

7.1.1 System Level The areas for improvement deal with building the most efficient balance between crew resources and the tasks to be performed. The workload will automatically reduce, thus also improving safety, when automation provides faster and robust results to the pilot. Here, this means automation when appropriate, and sufficiently deterministic such that it does not require human choice (only validation). Automation is provided at various levels depending on the criticality induced by the operational context, the aircraft status and human factors. Hence, automation shall be “adaptable”.

Practically, the aircraft status is one area where determinism is the highest and, regarding state-of-the-art technologies, where improvements can be technically developed and evaluated in terms of quality and quantity (crew monitoring). As this pilot task is spread over the whole flight, the benefits will not be null in nominal operations and will be of consequence when abnormal situations occur, especially in case of system failure. Moreover, those cases are the ones where pilots are less used to workload gains, but safety gains shall also not be underestimated.

As previously said, the take-off and approach + landing phases, which are highly demanding, generate needs for mental computation by the pilot regarding his operational solutions with respect to the operational context and aircraft system status. If one of them is degraded, then workload will significantly increase and almost reach the total working effort capacities of the two pilots. As a consequence, in case of reduced crew, this kind of event will lead to hazardous situations if workload remains the same as today. Thus, dimensioned use cases shall be taken as references through the evaluations of innovative solutions which are used during high-workload situations (abnormal procedure in landing phase for example). This finally belongs to the strong drivers for integrated system design.

7.1.2 Systems Integrator’s Point of View High levels of workload are often associated with unforeseen events. While certain surprise events are impossible to avoid, such as system malfunctions or certain operational events, flight crews that have high situation awareness, i.e. are more effective in analysing the environment, planning ahead and performing constant contingency planning are more successful in managing peak workload situations. Solutions that enhance mission planning, also in non-normal situations, as well as providing an intuitive picture of the operational environment while avoiding information overload of the crew may help the crew in coping with high workload situations.

The introduction of data-based ATC communications has the potential to greatly reduce the amount of voice communication required between aircraft flight crew and ATC, by allowing aircraft to receive ATC commands through data networks between ground and airborne systems and automatic loading into the FMS after confirmation by the crew.

A large part of the workload for crews in non-normal situations, such as single or multiple component failures, might be related to prioritizing alerts and understanding cascading

132 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

effects through the aircraft’s subsystems. Improved solutions might provide a viable way to reduce workload in critical situations.

7.1.3 Navigate and Mission Management

7.1.3.1 Nominal Situations Mission management relies heavily on human combination and interpretation of data. Areas of improvement for navigation and mission management can be classified into two sections:

• Information reduction

• Information interpretation

Information reduction can be achieved by pre-filtering information before it is loaded onto the flight deck and by offering systems to the flight crew that display only the information that is relevant for the current and actual flight situation. As an example, by using operational flight data that is normally used by the crew to manually search for a currently applicable value in a table can be automated very easily. Displaying only this relevant parameter or value reduces the workload to seek the right value out of a field of potentially valid numbers and reduces the risk of following non applicable data.

The second field for improvement, the information interpretation aims at overlaying in one place multiple single sets of information that currently is still brought together mentally by the crew. An example would be the alignment of a weather forecast with the expected estimated arrival times along the route to determine if it affects the flight. Another example would be the cross-checking of temporary flight restrictions with the ship’s ETAs at certain geographic areas. Synchronizing flight plan data, NOTAM and weather information and present this in one integrated display bears a significant potential for workload reduction and efficiency gains through more precise predictions.

7.1.4 Communicate

7.1.4.1 Nominal Situations From a communications perspective, the roadmap of data link-based communications contributes both directly and indirectly to workload reduction. Further developments can be summarised in three aspects:

• higher data link capacities (broadband communication);

• integration of various data link technologies;

• provision of data communication with high reliability, global availability, and security.

In addition to data, voice based communications will still be used for emergency situations.

Although not rigorously justified here, we believe there is sufficient indications that a higher data rate air-ground link will allow moving tasks from air to ground, possibly with a

133 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

strong impact on pilot tasks, and thus workload. Furthermore, air-ground communications concern not only ATS and AOC, but also potentially remote pilot communications, which require sufficient bit rate, availability, etc.

In terms of provision of high capacity data links, in the SESAR context, some new data link technologies have been selected, which cover different flight domains:

• Airport surface domain: AeroMACS, which is based on the IEEE 802.16e standard (WiMAX), and operates in the C-band;

• General terrestrial domain: L-DACS (L-band Digital Aeronautical Communications System, currently under study in SESAR);

• Oceanic and terrestrial: new satellite system, for example the ESA-Iris system.

Another aspect is the facilitation of the integration of the different technologies. The currently accepted consensus is that one data link alone will not be able to meet all requirements (i.e. being able to guarantee the same availability, security, and availability) across all operational flight domains, and that the future system will be a system of systems integrating existing (e.g. voice, VDL), as well as new communication systems (Fistas, 2010). To efficiently operate within the “system of systems” environment, a network layer on top of the data links is needed. The Aeronautical Telecommunication Network (ATN) facilitates the implementation of this requirement. The use of ATN is expected to give the following benefits (Crouzard et al., 2000):

• Use of existing infrastructure;

• High availability;

• Mobile communications;

• Prioritized end-to-end;

• Scalability;

• Policy based routing;

• Use of COTS products;

• Improved communication.

The ATN is an international civil aviation effort, and is standardised by the International Civil Aviation Organisation (ICAO). It is specified in the ICAO Standards and Recommended Practices (SARPs). At present the ICAO ATN SARPs is based on ISO’s OSI (Open Standard Interconnection) protocols (ICAO ATN/OSI doc 9880), with adaptations specific to aeronautical applications. At the time of developing the SARPs the Internet Protocol (IPv4) was not capable of providing the facilities for the ATN to meet its objectives and was not expected to become the protocol of the future (Crouzard et al., 2000). In the meantime the Internet has grown very rapidly and is now the de facto standard of networking technology. Many weaknesses of IPv4 have been amended in IPv6, which include:

134 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

• Larger address space, allowing for hierarchical addressing plan (e.g. region, country, networks);

• Real-time application support;

• Improved support for mobility;

• Embedded and improved security (IPsec);

• Improved quality of service (QoS).

The use of IPv6 for ATN is specified in the ICAO ATN/IPS doc 9896 (ICAO, 2011), “Manual for the ATN/IPS”. It specifies standard IPv6-based protocols for the provision of, among others, mobility, security, and QoS, whose feasibilities are supported by some research projects such as EU FP6 NEWSKY ( http://www.newsky-fp6.eu ) and FP7 SANDRA ( http://www.sandra.aero/ ).

7.1.4.2 Reduced Crew Situations The improvement in this aspect is expected to be on the same line as the nominal situation.

7.1.5 Manage systems

7.1.5.1 Nominal Situations From a general point of view, the flight crew is asking for drastic simplification of the system management so that they can focus on mission management. The main axis of improvement is therefore to reduce crew stress providing a centralized man machine interface, managing procedures in a contextual way with more support for system reconfiguration and operational impact analysis.

Failure detection and alert

• Improve filtering and alert inhibition management with a deeper usage of the operational and aircraft context (flight phases, A/C attitude, weather conditions, etc.);

• Improve audio alert management, cause of major stress in the cockpit;

• Define a set of complementary alert vectors, sensitive, visual, aural with 3D, to give a better situation awareness;

• When multi-failures are involved, provide a dynamic summary of procedures (with a synthesis of what is done, what to do) managing priorities, to allow a better overall situation awareness;

• Provide more functional and less physical references regarding aircraft status: mask the complexity of the system;

• Improve physical ergonomy centralizing information currently dispatched between head down displays (Procedures + System pages) and Overhead panel.

135 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Failure Resolution:

• Agglomerate and simplify crew actions to reduce flight crew workload and errors, meaning having a semi-automatic mode of pre-defined actions where no additional value is expected from the crew. However manual override should still be available to cover not anticipated cases during the aircraft design;

• Improve physical ergonomy providing controls more accessible and visible than today: not over the head;

• Provide controls integrated with procedures and system status, that means virtualization of aircraft systems control commands located on the overhead panel today.

Post Failure Resolution:

• Target full sensed items on procedures to reduce the crew workload, as there is no crew additional value on such actions;

• Provide an improved and contextual view of operational impact. INOP SYST list (that could represent one page), is less interesting than the associated operational impact.

All these improvements are attractive but from a global point of view, the couple crew- system is already very safe, any changes should be made carefully to avoid detracting from existing safety practices.

7.1.5.2 Reduced Crew Situations The primary mission of the flight crew is to transport passengers and freight from a point A to a point B. All means given to the crew have for objective to improve the execution of this transport in terms of safety, profitability, and comfort.

In a context of densification of the traffic and the increase of economic and environmental constraints, requirements on the global performance of the mission have been strengthened: flight crew needs to respect the 4 dimensions trajectory in a more and more reduced envelope, master the fuel consumption, ensure passengers’ comfort and satisfactions. Consequently, the aircraft systems management appears as a constraint regarding the mission.

A reduced crew situation, being one fit pilot in a two-pilot cockpit or two fit pilots instead of three generates higher workload and stress. There are still improvements to be developed as seen earlier to relieve the fit pilot(s) of a high workload and stress, being in a normal or abnormal situation.

7.1.6 Aviate Aspects Areas for improvement are further automation of flight and crew assistance, enhancement of the crew HMI by introduction of novel technologies.

136 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

7.1.6.1 Nominal Situations

7.1.6.1.1 Automation and Assistance In this section systems are discussed to automate certain aspects of the aviate task of the flight crew aiming to decrease overall pilot workload.

Take-off and Initial Climb assistance

As indicated in chapter 4, flight crew workload during the take-off and initial climb phase is relative high. By assisting the flight crew during these phases by automating tasks or assisting tasks (e.g. automatic gear retraction, take-off performance monitoring & alerting system, go-around assistance, etc.), workload can be decreased.

Approach and Landing Guidance support

During the approach and landing phase, flight crew workload is relative high. A major concern to safety is runway over-run due to hot and high approaches. Continuing an unstabilized approach is a causal factor in 40% of all approach and landing accidents (Airbus, 2006). Approximately 70% of rushed and unstable approaches involve an incorrect management of the descent-and-approach profile and/or energy level (i.e. being slow and/or low, being fast and/or high). The problems often commence at Top of Descent and get worse until touch-down. Approach and landing guidance support functions, also coupled to a progress monitor system for detection of (high-energy) unstabilized approaches and decelerating devices deployment logic. Hence fully automatic high lift devices, landing gear, speed brake deployment and control, can decrease flight crew workload and stress significantly, and help the flight in normal situations as well as situations of reduced flight crew. In addition, development of recovery functionality may further increase the level of automation to be used, if required in case of situations of incapacitated flight crew (WP10).

Fully Automated Aircraft Configuration Control

Decelerating devices deployment logic, hence fully automatic high lift devices, landing gear, speed brake deployment and control is another area of improvement. For example, the high-lift devices (i.e. flaps, slats, spoilers) and landing gear selection may be coupled to the aircraft’s auto-flight system, while retaining compatibility with the flight envelope, the working conditions for the cabin staff, the comfort of the passengers as well as the environment. During the approach and landing phase correct timing of aircraft configuration changes is becoming more and more important to accomplish 4D navigation constraints and/or aircraft spacing demands of the future 4D ATM environment. Furthermore, running SESAR- and CLEANSKY-related automation initiatives on time and trajectory based operations and optimised green approaches in order to minimise noise, fuel and emissions is also an area of improvement to be further expanded from the “aviate” perspective, and in which fully automated aircraft configuration may play an essential role.

Improved Flight Envelope Protection Logic, Fault Tolerant Flight Controls and Automatic Upset Detection and Recovery

Improved flight envelope protection, fault tolerant control (e.g. A/C configuration related, like loss of an engine, damaged control surfaces, control law reconfiguration, etc.), upset detection and automation recovery logics will form another important area of

137 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

improvement, to lower the crew’s workload in both the manual and automated flight control and flight guidance context, as well in its transitions back and forth.

7.1.6.1.2 Enhanced Crew HMI

Active inceptors

To enhance manual aircraft control, introduction of novel grip technologies are proposed like active inceptors (e.g. active sidesticks) to improve manual control and for feedback the state of the crew. These devices can provide crew feedback for example when there is force fight, when envelope restrictions are met and/or when the performance of the aircraft is degraded such as when the Flight Control System (FCS) reverts to alternate/direct modes. They can also be reconfigured to prevent Pilot Induced Oscillation (PIO) in the event of a failure such as loss of some primary or secondary actuation capability.

Active inceptors can be programmed to provide cues that give warnings to the pilot. They also provide linking across the cockpit that reproduces the older mechanical connections from column and wheel aircraft, however they do this without the weight, complexity, cost and volume of these older pilot control devices.

Many studies have shown the effectiveness of active inceptor cues and how the neuromuscular system responds much faster to haptic / tactile cues than some other types of cues such as visual or aural. Active inceptors are now in production for some military aircraft and are increasingly being specified for new platforms. The technology has recently been transferred to civil aircraft driven by the desire to utilise the benefits both of the linking between pilot stations and the active cues. Active inceptors for civil aircraft are in development now and will be certified for flight and will enter production within the timescales of ACROSS. Reflecting this fact Aerospace Recommended Practice SAE 5764, General Specification For Aerospace Active Inceptor Systems for Aircraft Flight and Engine Controls has been issued very recently specifying the attributes of these devices.

Research in this area on manual aircraft control has been conducted in a number of areas including the EU projects SUPRA and ALICIA.

Haptic Touchscreen

An interseat Haptic Touch screen is a touch screen mounted between the two cockpit seats that that provides haptic feedback, i.e. the screen moves and gives the user of the screen physical feedback that a screen interaction has taken place.

In the EU 7th framework project HILAS the Human Factors aspects of such a monitor were evaluated in a simulator experiment (HILAS, 2009a).

In the experiment, the display provided an interface to the aircraft’s communication devices. The graphical radio panel aims to overcome the draw backs of the standard radio controls. The display shows multiple radio devices at once. It also allows the pilot to view (and change) their college’s radio controls.

It is supposed to:

• Improve accuracy; • Decrease error rate;

138 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

• Improve user confidence; • Decrease workload.

Some main findings were that this type of display has relevance and also may add to workload reduction. However, this will primarily be done by intuitive and user friendly software solutions on the display while the hardware and whether the screen is haptic or not, is important but not the main factor when it comes to workload education.

HMD

In the EU 7th framework project HILAS two experiments were performed about the added value of Helmet Mounted Displays for civil aviation purposes. One of those studies (HILAS, 2009b) focused on civil helicopter pilots. For those pilots, who are sometimes flying, and landing, in unfamiliar environments, any technique that enables them to remain head up and process information about the environment at the same time can contribute to workload reduction.

This study showed that a clever use of synthetic vision indeed created a workload reduction, and situational awareness enhancement for the pilot.

In the same project also the use of a wearable spatial display (HMD variant) that was designed to assist pilots in approaching landing and reducing workload plus increasing situation awareness especially in future flights scenarios (more traffic). The design and use of this technology is described in document (HILAS, 2006).

This system was a prototype and not sufficiently mature to install in operational commercial aircraft. However, the principle was much appreciated by pilots who had participated in the flight simulator experiment. Therefore the potential of such a system is considered quite high.

Voice input

A voice input system is a system in which an operator can utter a command to a system. The system will recognize and execute the command. Sometimes the system will ask for confirmation from the operator before actually executing the command. The advantage of such a system is that during moments of the flight that a pilot does not have his hands available to make entries in the cockpit or when s/he has to look out of the window inputs to the system can still be made. As such voice inputs system have the potential to reduce workload significantly, especially if they work flawlessly.

The voice recognition technology, which underlies voice input systems, is rapidly becoming more mature. Especially since all kinds of applications for mobile phone and tablet are being developed that rely on voice input systems the quality of voice recognition is improving significantly.

In the EU 6 th Framework project SafeSound a number of applications for the use of voice input where developed.

An important starting point for that development was that pilots in commercial aviation do not were headsets during all flight phases. As such a microphone array on the glare shield is needed to allow them to give voice instructions without the headset. In the relatively noisy cockpit such a microphone array that always recognizes the voice input was a hard task.

139 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Eventually a system was created that could amongst others:

• Radio frequency change;

• Primary Flight Display (PFD) configuration layout change;

• Navigation Display (ND) configuration layout change;

• FMS configuration: runway change.

The result was a system that worked quite well but with a relatively tight, inflexible structure for giving the commands. Each command needed to be given with exactly the same words and time in between for the system to recognize each individual word.

However, the above motioned improvements in voice recognition systems in general and the potential for a DVI as a tool to relieve pilot mental workload during high demanding flight phases has increased again.

FLYSAFE and ISAWARE technologies

During the FP5 project ISAWARE (1998 – 2001), see Rouwhorst and Marsman (2006), an Integrated Situation Awareness System (ISAS) was developed to improve operational flight safety via increasing the pilot’s situation awareness and via lowering the crew’s workload along the full flight. This ISAS system consisted of grouping together particular services related to traffic, terrain, weather and ATM awareness. This led to an improved Human Machine Interface (HMI), via an enhanced PFD and an enhanced ND. One way of reducing the crew workload was the introduction of the Airport Moving Map display for ground operations onto the ND and the application of a Vertical Situation (profile) Display (VSD) for improved descend and approach (height) awareness. Furthermore, to allow the pilots more time to resolve any potential issues, thereby reducing stress and workload levels, the tactical conflict alerting logic related to potential traffic, terrain and weather conflicts was combined together and stretched into a more strategically alerting logic by using predictive elements. The PFD was enhanced with Enhanced Vision System (EVS) aspects, like 3D-terrain, and dedicated traffic and terrain alerting presentation to improve tactical (conflict) situation awareness. Strategically oriented, potential conflict issues and alerts were presented on the ND using strategic conflict icons. When closing in to these icons without any resolution performed by the crew, the safety nets (like TCAS and EGWPS like) would still be activated. ATM awareness was improved by using ADS-B, other traffic presentation and presentation of airport related on ground matters.

During the continuation FP5 project ISAWAREII (2002 - 2005), see Vernaleken et al. (2005), the above concept was further refined and enhanced by developing an Integrated Surveillance System (ISS) and cockpit displays which intuitively provide pilots with an optimum situational awareness, again during all flight phases. The project already uses parts of the interactive Cockpit Display System (CDS) developed for the Airbus A380 as a basis. Primary Flight Display (PFD) and Navigation Display (ND), the two central cockpit displays, were additionally equipped with a so-called "Synthetic Vision System" (SVS), a database-driven representation of terrain and airport features resembling the real outside world. Furthermore the display driving technology was enhanced using ARINC 661 widgets and technologies. The strategic icon technology was further developed and improved.

Subsequently the FP7 project FLYSAFE, Airborne integrated systems for safety improvement, flight hazard protection and all weather operations (2005 - 2009), see

140 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Rouwhorst, de Gelder, & Verhoogt (2011), worked on various cockpit technologies, like a Next Generation Integrated Surveillance System (NG-ISS) that should prevent the crew from making mistakes via its novel pro-active logics, and also support the crew after having made certain mistakes. Again, like in ISAWARE and ISAWAREII the basis was formed by an integration of logic of traffic, terrain and weather, in both tactical and strategic Conflict Detection (and resolution) logic to avoid more timely bad weather situations, traffic and terrain conflicts. Also the NG-ISS made use of today’s safety nets solutions, like EGPWS and TCAS, since pilots would expect those to be present, although the latter was enhanced (i.e. merged) with ADS-B functionalities The lessons learned from the previous projects were translated into better logics and even more clever conflict detection. Furthermore new logic was added to also provide the best type of resolutions in case of some types of conflict alerts. The overall improved HMI and information integration modules were named the NG-ISS, although sometimes the NG-ISS is also referred to as being only the system logic, so apart for the HMI (see Figure 26). A major step forward was the collaboration with the Meteo Services community (Meteo France, UK MET Office) to establish the introduction of WIMS (Weather Information Management System) services. Via a data uplink, these WIMS services of the Meteo providers allowed detailed weather aspects to be updated and presented onto the ND inside the cockpit, using dedicated icons for CB’s, turbulence, icing and other weather aspects. This ground- based weather information was fused onboard with data from the onboard weather radar, and used by the SDC (see next).

Figure 26 - NG-ISS.

To anticipate the future ATM related SESAR and NextGen programs, the Strategic Data Consolidation (SDC) module was coupled to the Flight Management System (FMS) for flight plan exchange to the ground (i.e. to ATC). For instance in case of weather conflict detection the SDC would provide a resolution (new flight plan) circumventing the weather problem, that could be initially accepted by the crew and further negotiated with ATC via newly developed onboard CPDLD tools, before inserting it as the new active flight plan into the FMS.

A primary safety improvement driver was the prevention of runway incursions. See Vernaleken, Urvoy and Klinghauf (2008) and Sammut et al. (2010). Various new cockpit functions were developed for that aspect:

141 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

• Surface Movement Awareness and Alerting System (SMAAS) functions, like Operational Awareness, Clearance Awareness, and Surface Movement Alerting functions, aimed to prevent runway incursions;

• Airport Moving Map (AMM) functions, to provide position awareness when navigating at an airport. It also presented various SMAAS aspects, such as open/closed/active runway presentations, FMS-selected runway indications, taxi traffic collision indications and alerting, wrong runway heading annunciation and also taxi/runway clearance awareness related aspects;

• Runway Collision Avoidance Function (RCAF), an onboard safety function for prevention of aircraft conflicts during take-off and landing.

Furthermore an Intelligent Crew Support (ICS) prototype was developed to assist the crew in some particular crew (awareness) tasks, like for example:

• Stop bar violation;

• Detection of wrong runway;

• Inadvertent take-off from a taxi way;

• Approaching/crossing taxiway edges;

• Take-off without an ATC clearance;

• Incorrect altimeter settings.

Another major functional development was performed on the Airborne Separation Assistance System (ASAS) to allow future Flight Deck Interval Management types of operations via:

• Airborne Spacing - Enhanced Crossing and Passing operations (ASPA-C&P);

• Airborne Spacing - Enhanced In-Trail Procedures (ASPA-ITP);

• Airborne Spacing - Enhanced Sequencing and Merging operations (ASPA-S&M).

These were mainly set up for the en-route and descent flight phase.

In addition to all new NG-ISS functions a novel Cockpit Display System (CDS) and HMI content was designed and evaluated, like Airport Moving Map (AMM) on the Navigation Display (ND) with detailed airport (surface/marking) information, ATC-uplinked taxi route presentation, stop bars and other traffic, uplinked and fused weather information. All functions, as well as the Primary Flight Display (PFD) adaptations, were controlled via special menu-driven controls via a KCCU (Keyboard Cursor Control Unit) and by using a software driven Data link Control and Display Unit (DCDU) to allow data link messages to be communicated between cockpit and ATC.

The ISAS, ISS and NG-ISS were all proven to contribute to an increase operational flight safety, with improved SA and no significant (subjective) workload increase, with workload decrease in particular aspects.

Finally, dedicated FLYSAFE flight test programme were executed towards WIMS products related to In-flight Icing and turbulence aspects, both for rotorcraft and fixed wing aircraft.

142 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Another flight test was executed with a novel type of weather radar to prove from a technology point of view that improved cockpit weather presentation (using data link an uplinked weather graphics) via data fusion with onboard weather radar data was feasible (Verbeek, Drouin, & Azum, 2009).

Adaptive HMI

In general flight crew information and interaction needs will depend on tasks to perform, the context in which the tasks needs to be performed and the flight crew status. It is proposed to optimize these flight crew information and interaction needs by adapting the HMI dependent on above mentioned factors. This adaption takes place automatically, in contrast with the adaptable HMI concept, in which the user explicitly changes the HMI by own initiative. It is assumed that in situations of high workload, complex cognitive demanding situations, and/or less knowledgeable and capable flight crew (e.g. fatigue) the flight crew might be helped in performing their tasks by automatically adapting the HMI tailored to the actual needs and capabilities.

There are a number of ways in which the HMI could be adapted. The HMI may adapt functionality (e.g. decision support and error correction), information presentation and/or user tasks (prioritization, change in level of automation, etc.).

The first steps towards adaptive automation were made for example in the HILAS EU project. It was found that measures that are often used for post experiment analysis can also be applied in real time but that there are also a number (technological / practical) problems to solve before these measures can be applied in real time.

• For a number of measures a reference is needed. For example, if one wants to identify whether heart rate (or any psychophysiological indicator) points towards increased workload a reference is needed. Therefore the operators physiological state in rest is needs to be known to the system;

• Psychophysiological systems in general are good indicators of an operators mental state. However most of them are sensitive to more than just the mental state. Therefore the principle of converging evidence is needed. This method recommends using multiple sources to gather information about the same underlying principle. Therefore the likelihood that the system as a whole interprets the operator state correctly increases because the interpretation is based upon more, and different, sensors;

• The same applies to calibration of systems that measure the operator state. They need to be calibrated which may cost time prior to flight;

• Accurate synchronisation between data sources is needed. In order to generate a complete description of the pilot state in the context in which he is operating, the different sources need to be combined. A prerequisite for that is that all data sources provide, in real time, an interpretation of what they are measuring. If a pilot is not monitoring vital information or when he is overloaded, this interpretation should be available immediately, and not with a delay of valuable seconds. This is not always possible. Some analysis techniques require time or a sample over a prolonged period of time to generate an interpretation;

• Many systems and tools exist to measure aspects of an operator state. What is very hard to measure is to what extend an operator truly understands what is going on and to what extend s/he is able to predict what will happen in the future.

143 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Such knowledge is crucial in order to provide the right advice or make the right decision by the system that is supposed to support the operator.

The principle of integrating data from the aircraft, data bases and operator state in order to create an adaptive HMI is not new. The principle is described in in various level of detail in a number of studies, also in the 20 th century. A good overview of these type of studies is given in Banbury et al. (2008).

The challenge of designing good adaptive HMI’s is that it will only work well if the system understands what the actual flight crew knowledge and capabilities are (e.g. by using a high quality crew monitoring system), is able to perform a good situational assessment (task context) and understand the flight crew intentions (task load).

Head Up Display

Head Up, eyes-out displays, provide information which is displayed as collimated see through imagery presented as a mix of “Conformal” (or real world stabilized) and non- conformal (platform stabilized and display fixed) information. These types of display fall into 2 sub-categories:

• Head-Up Displays (HUD), which are mechanically fixed inside the cockpit at a well-defined and precisely aligned line of sight with respect to platform axis. They therefore offer very high accuracy but have a limited field of view, horizontally and vertically (typically ≤30°) and a limited head motion box within which the imagery may be viewed;

• Head Mounted Displays (HMD), which are installed on the pilot’s head offer a much larger field of regard, limited only by the capability of the helmet tracking system (and the capability of platform mounted sensor to follow the users line of sight) . These displays present information (which may a combination of symbology and imagery) which is displayed as a collimated see-through image overlaid on the pilot’s line of sight. These systems retain the capability to see the external scene through this display (see-through capability) unlike conventional NVGs (Night Vision Goggles) which are non-see through.

A key driver for the successful application of HMD systems to display conformal information is the overall dynamic performance of the head coupled system. Overall system latency should be minimized and is typically < 30msec.

Due to their different characteristics, the symbols and cueing data presented on these displays and more traditional cockpit display are different:

• Head-down displays are mainly used to pilot and perform the mission in IFR regime, and to provide basic information for VFR regime flights;

• Head Up, eyes-out displays provide an additional feature which can make a tremendous difference compared to HDD in degrade visual environments: the capability to maintain situational awareness by the display of flight and mission parameters when eyes-out for a very wide field of regard. This is important because in degraded visual environment and particularly close to the ground, the first priority of the crew is to keep or recover lost visual references, while piloting and pursuing the mission.

144 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

When flying at low level in degrade visual environments, traditional IFR flight may not be possible, due to the different threats that surround the rotorcraft (e.g. terrain, obstacles, traffic). The introduction of symbology and cueing information optimized for such applications may be displayed to the pilot, head-down or head-up, to improve the situation awareness:

• Synthetic vision image of the terrain and the obstacles;

• Sensor image of the external scene, taken by an on-board sensor (night vision sensor, thermal sensor, radar sensor, LIDAR sensor…);

• Fused image, for example the combination of a combining a sensor image and a synthetic image (we then talk about CVS – Combined Vision System);

• Familiar and novel flight symbology (including 3D conformal symbology);

• Flight Mode Specific symbology formats;

• Navigation and Guidance symbology;

• Symbology augmentation of the users outside view or sensor images.

These different types of symbolic and cueing information are complementary and must be used in combination to provide an optimised solution for the provision of safe pilotage. For example the combination of enhanced vision combined, selected synthetic imagery and conformal symbology can enable the goals of enhanced SA, improved safety with reduced crew workload to be achieved. The addition of other technologies such as audio and tactile cueing may also be considered in this context.

7.1.6.2 Reduced Crew Situations In section 7.1.6 a number of new technologies and features are described that may have a positive impact upon the workload of pilots. Some of them are more relevant than others when managing the workload of reduced crews. An example of a technology that would really contribute to workload reduction when crews are reduced is the voice input system. An important pre-condition is of course that the voice input system needs to work as ‘flawless’ as any other input device. If a voice input device can be created that meets this requirement it will allow pilots to give aviate related inputs while remaining head up and in HOTAS (Hands On Throttle And Stick).

Further the pilot will also be able to provide not aviate-related inputs as well via this system. Examples of such inputs are changing the radio frequencies, or even comfort related inputs like changing the cabin temperature.

Another example of a new technology that could be beneficial with respect to workload management for a reduced crew is a head mounted display. Such a display would allow, just like the voice input system, that the pilot can remain head up and still perform a lot of his aviation related tasks.

Ideal would be a combination of voice input and head mounted display because the pilot can be head up in HOTAS and on the display s/he can see whether the system has interpreted the pilot’s input correctly.

145 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Even when these tasks are not strictly related to the aviate tasks, the fact that a pilot is able to quickly and effortlessly execute them offers him the opportunity to perform more tasks in general in the same time. It gives flexibility to the pilot but also to designers of cockpits and procedures. After all, the less time consuming and also less visual attention consuming tasks become, the more opportunities exist to plan the order in which tasks are executed.

7.1.7 Supervision

7.1.7.1 Nominal Situations In this chapter the potential for improvements of flight deck support systems and supervision functionalities will be determined and suggestions for implementing solutions will be stated.

7.1.7.1.1 Data Processing In the previous chapters a number of approaches to the improvement of flight deck information management have already been defined. In addition, the correlation of operationally relevant data coupled with intelligent filter logics and notification schemes provide a wide scope for optimization.

In recent years, the increasing demand for the pilots to maintain not only a safe but also efficient flight has led to an information overflow with an emerging impact on the pilots situation awareness. Endsley et al. (1998) defines situation awareness as “[…] the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning and the projection of their status in the near future”. It is the main objective of a cockpit supervision system to support the pilots in obtaining the correct mental picture of the situation. Further details concerning the definition of cockpit supervision system have been given in chapter 5.7.

The ARINC 429 and ARINC 633 standard could serve as a reference for the implementation of data processing algorithms with respect to flight execution, which would include the handling of operational data such as:

• Operational & ATC flight plan data (including ANSP restrictions);

• Fuel data (including fuel consumption monitoring and statistics);

• Load & Trim data;

• Airport & en-route weather data (e.g. METAR, TAF);

• Airport & airspace operations data (e.g. NOTAM);

• Aircraft handling data (NOTOC, de-icing, crew & pax info, catering, water etc.).

The correlation of the above mentioned operational information with static data bases such as the aircraft related performance data base (e.g. take-off, inflight, landing performance) or the environment based navigation data base (e.g. aeronautical information publication, AIP, topography) should aim at a holistic pilot notification concept. Besides, the technical status of the aircraft (e.g. minimum equipment list, MEL) or data

146 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

from the airline operations center (e.g. airport special restrictions, handling information) could be used to further improve the supervision system.

7.1.7.1.2 Indication and Warning In order to realize an enhanced flight deck notification concept that meets the demands of a holistic indication system, affiliation logics for the above mentioned data bases including all related interfaces need to be established. The following contributory factors should be considered:

• Inflight monitoring and supervision (altitude and speed control, re-routing support, 4D trajectory etc.) should include adequate indication solutions and warnings;

• Inflight diversion supervision should consider essential operational parameters as for instance aircraft technical status, weather conditions, performance factors, airport restrictions etc.;

• Relevant information should be displayed to the pilots in accordance with a classification logic to be developed within the scope of the project.

7.1.7.2 Reduced Crew Situations The suggestions for implementing solutions stated in chapter 7.1.7.1 generally apply to reduced crew situations. During phases of high workload it is even more essential to support the pilots through holistic supervision functionalities. The support system should be capable of detecting potential problematic situations and supporting the single pilot in performing operational procedures without losing the awareness for the overall picture.

Therefore, a special operating mode for reduced crew situations should be arranged, that specifically allows for a scaled down operation focusing on the avoidance of information overflow.

7.2 Incapacitated Crew Situations A requirement of ACROSS is to analyse the possibility of Single Pilot operations for future aircraft and currently there is no solution if there is total crew incapacitation in civil air transport vehicles.

Current procedures assume that another crew member can take control of the aircraft and bring the aircraft to a safe arrival and the state of the research and development in this area has also concentrated on how to take control of an aircraft during a hijack.

To recover an aircraft from a total incapacitated crew situation then capability and procedure improvements are required which are discussed as follows:

• There is a need to provide a safe and reliable means of detecting total flight crew incapacitation during all phases of flight;

• The existing and planned future aircraft functions which already provide much of the required auto-flight capability, need to be enhanced and adapted and be available for use during all phases of flight;

o Autorecovery of the aircraft and safe positioning within the airspace;

147 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

o Safe return and landing of the aircraft at a suitable airport;

o During the recover and landing phase the system will need to be capable of:

responding to changes and events as they occur during the flight phase, i.e. in much the same way that conventional Pilot (if available) would respond and will need to include the need to make decisions in the event of non-normal situations occurring e.g. as a result of an unforeseen cascade failure;

Interacting with the ground based Air Traffic Controllers (ATC) and systems.

o It should also be noted that the top level of system integrity required in systems like autoland is ONLY required over a very limited period of time not exceeding 100 to 600 seconds. If this integrity level would be required during other flight phases the periods might increase to something like 3000 – 10000 seconds. This will have a great impact for choices in candidate technologies.

• The interaction and responsibility with the ground systems/stations requires refinement, who is responsible for the revised flight plan, decision to divert to a new airport etc.;

• What is the responsibility of the ATC system and Airline operators in dealing with the aircraft?

• The system will need to be Safe and Secure and be certifiable;

• The system will need to operate in all weather conditions.

While this type of improved system(s) could be used to pave the way towards single pilot operations, it could equally be deployed on aircraft that are flown by two or more pilots to provide an additional layer of protection to what currently exists. This type of system could also be used to reduce crew numbers on long haul flights e.g. from three to two, by allowing single crew operation during the cruise phase of a flight.

148 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

8 REGULATION, CERTIFICATION AND SAFETY ASPECTS

There are no specific official regulation or certification publications related with pilot or crew workload in nominal or reduce crew situations.

Although there is not a universally accepted definition of workload (see 2.1 for ACROSS definition), it tends to be defined as the relationship between an individual's capacity to perform a task (mental and/or physical), and the level of system and situational demands associated with the performance of that task [AC23.1523 (U.S. Department of Transportation)].

Important factors related with crew workload while performing a specific task have been already deeply described in previous chapters of this document and could be broadly grouped as:

• Individual Factors: aspects directly related with the pilot and its individual capacity to perform an specific flight task • Systems Factors: technological aspects directly related with the machine (aircraft) and the system • Corporate Factors: aspects related with Air Corporation and the interaction with crew

Main regulation agencies such ICAO (International Civil Aviation Organization) and EASA (European Aviation Safety Agency) in Europe, FAA (Federal Aviation Administration) in US, establish the current minimums that any crew and aircraft must comply with to assure a safe flight and an acceptable level of workload in the cabin crew.

Any solution or improvement in the cockpit related with the reduction of crew workload should be in line with what is published by the regulatory agencies and should never be against this regulation. Because of that and in order to facilitate covering ACROSS objectives (see 1.1.1) of developing new solutions to reduce workload and reduced crew operations, an assessment of the current regulation and certification is needed.

In this chapter a description of the main regulatory agencies is done in section 8.1 and also a list of the basic regulation chosen to perform the analysis is contained in that section. In section 8.2 an analysis of the most relevant publications is done in order to identify within them any aspect related with workload in cabin crew and/or any issue that could be associated to human factors interoperating with the aircraft.

All the regulation is grouped focusing on the crew as a human being (Individual Factors) or the aircraft systems that enable the crew to performed the flight tasks (Systems Factors) or aspects concerning Airlines/ANSP policies (Corporate Factors). Section 8.3 summarizes all the regulations classified by issue and Regulator.

8.1 Aviation Regulatory Framework

Aviation regulation and policy is, as far as possible, harmonised across the world to ensure consistent levels of safety and consumer protection.

ICAO (International Civil Aviation Organization), EASA (European Aviation Safety Agency) and FAA (Federal Aviation Administration) were the Regulatory Agencies chosen to perform the assessment. These regulatory bodies (primarily EASA and ICAO) will also be

149 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

used in the analysis accomplish in WP4. Due to time efforts limitations only the regulation mentioned above and produced by the these three regulatory bodies, is analysed.

The agencies studied develop the common regulation and certification standards at a Member State level (ICAO), at an European Union level (EASA) and at a global or international level (FAA). That was the reason to select these three agencies because they represent the major bodies every country follows and are a good sample of global policy covering regulation and certification.

ICAO (International Civil Aviation Organization)

A specialized agency of the United Nations, the International Civil Aviation Organization (ICAO) was created in 1944 to promote the safe and orderly development of international civil aviation throughout the world. It sets standards and regulations necessary for aviation safety, security, efficiency and regularity, as well as for aviation environmental protection. ICAO refers to the 9th edition of the Convention on International Civil Aviation as the statute, and designates it as ICAO Doc 7300/9.

The Convention is supported by eighteen annexes containing standards and recommended practices (SARPs).

The annexes are amended regularly by ICAO and are resumed in the next table.

Annex 1 Personnel Licensing Annex 2 Rules of the Air Annex 3 Meteorological Service for International Air Navigation Annex 4 Aeronautical Charts Annex 5 Units of Measurement to be Used in Air and Ground Operations Annex 6 Operation of Aircraft Annex 7 Aircraft Nationality and Registration Marks Annex 8 Airworthiness of Aircraft Annex 9 Facilitation Annex 10 Aeronautical Telecommunications Annex 11 Air Traffic Services Annex 12 Search and Rescue Annex 13 Aircraft Accident and Incident Investigation Annex 14 Aerodromes Annex 15 Aeronautical Information Services Annex 16 Environmental Protection Annex 17 Security: Safeguarding International Civil Aviation Against Acts of Unlawful Interference Annex 18 The Safe Transport of Dangerous Goods by Air Table 6 - ICAO Annexes.

EASA (European Aviation Safety Agency)

The European Aviation Safety Agency (EASA) was established by EU Regulation 1592/2002. Since its creation in 2003, EASA has been the responsible organisation in Europe for the airworthiness, environmental protection at source and maintenance aspects. The legislation extending the EASA system to flight crew licensing, air operations and third country aircraft and operators was adopted by end of 2007 and its implementing rules entered into force on 1st January 2009.

150 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Regulation (EC) No 216/2008 (the Basic Regulation) was adopted by the European Parliament and the Council in February 2008, and entered into force on 8 April 2008. The Basic Regulation lays down the framework, criteria and objectives for EASA’s responsibilities. The Agency fills in technical detail by drafting the associated Implementing Rules (IRs), accompanied by Guidance Material (GM) and Acceptable Means of Compliance (AMC).

Each Part to each implementing regulation has its own Acceptable Means of Compliance and Guidance Material (AMC/GM). These AMC and GM are amended along with the amendments of the regulations. These AMC/GM are so-called ‘soft law’ (non-binding rules), and put down in form of EASA Decisions.

On 28 September 2003, the Agency took over responsibility for the airworthiness and environmental certification of all aeronautical products, parts, and appliances designed, manufactured, maintained or used by persons under the regulatory oversight of EU Member States, FTL Certification Specifications. In the context of the project, only CS-23 (Normal, Utility, Aerobatic and Commuter Aeroplanes) and CS-25 (Large Aeroplanes) are applicable.

The basic regulations produced and used for ACROSS purposes are presented in Table 7.

FAA (Federal Aviation Administration)

The Federal Aviation Administration (FAA) is the national aviation authority of the United States of America and regulates and oversees all aspects of civil aviation. The FAA is primarily responsible for the advancement, safety, and regulation of civil aviation, as well as overseeing the development of air traffic and facilities and also enforce regulations and minimum standards covering manufacturing, operating, and maintaining aircraft and certify airmen and airports that serve air carriers.

The Federal Aviation Regulations, or FARs, are rules prescribed by the FAA governing all aviation activities in the United States. The FARs are part of Title 14 of the Code of Federal Regulations (CFR). A wide variety of activities are regulated, such as airplane design, typical airline flights, etc. The FARs are organized into sections, called parts. Each part deals with a specific type of activity.

There are 68 regulations organized into three volumes under Title 14, Aeronautics and Space. A fourth volume deals with the Department of Transportation, and the fifth volume is focused on NASA. These 68 regulations can be separated into administrative, airworthiness certification and airworthiness Operation categories. The structure of these regulations are presented in Table 8.

151 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Table 7 - Structure of EASA Regulations.

152 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Table 8 - Structure of FAA Regulations.

8.2 Analysis of the current regulation

The aim of this section is to provide an analysis and a classification of the current regulatory and certification publications from ICAO, EASA and FAA listed in section 8.1. There are many regulation regarding air transportation but the ones mentioned in this chapter has something in common, there are the ones that regulate issues related with the crew, the cockpit of different type of aircrafts and their interaction, in terms that could impact on workload.

153 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

8.2.1 Current Regulation

One of the objectives of ACROSS is to develop new cockpit solutions to facilitate the management of the peak workload situations (as stated in 1.1.1) in order to improve safety and ensure the reduction of accident risks due a reduction of stress. Any of those future new solutions should be in accordance to what is establish in the regulation and certification publications (at least of) the European regulatory agencies. New solutions could be not in line with what is in those regulations, then a contact with the relevant agencies should be done to solve the conflict.

This chapter has the meaning to facilitate the compliance of the new solutions with the regulation and certification by establishing a preliminary analysis and classification of the information published.

Regulatory publications studied containing any relevant issues referring to cockpit configuration and flight crew potentially related with workload are extended in the following sections

8.2.1.1 ICAO Regulation

The following documentation from ICAO has been identified, containing issues related with workload, pilots and cockpit configuration:

Doc 7300 Annex 1: Personnel Licensing

Standards and Recommended Practices for the licensing of flight crew members (pilots, flight engineers and flight navigators), air traffic controllers, aeronautical station operators, maintenance technicians and flight dispatchers are provided by Annex 1. Related training manuals provide guidance to States for the scope and depth of training curricula which will ensure that the confidence in safe air navigation is maintained

Doc 7300 Annex 2: Rules of the Air

Air travel must be safe and efficient; this requires, among other things, a set of internationally agreed rules of the air. The rules developed by ICAO - which consist of general rules, visual flight rules and instrument flight rules contained in Annex 2 - apply without exception over the high seas, and over national territories to the extent that they do not conflict with the rules of the State being overflown.

Doc 7300 Annex 3: Meteorological Service for International Air Navigation

Pilots need to be informed about meteorological conditions along the routes to be flown and at their destination aerodromes. The object of the meteorological service outlined in Annex 3 is to contribute to the safety, efficiency and regularity of air navigation.

Doc 7300 Annex 6: Operation of Aircraft

The purpose of Annex 6 is to contribute to the safety of international air navigation by providing criteria for safe operating practices, and to contribute to the efficiency and regularity of international air navigation by encouraging ICAO's Contracting States to facilitate the passage over their territories of commercial aircraft belonging to other countries that operate in conformity with these criteria.

154 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

Doc 7300 Annex 8: Airworthiness of Aircraft

In the interest of safety, an aircraft must be designed, constructed and operated in compliance with the appropriate airworthiness requirements of the State of Registry of the aircraft. Consequently, the aircraft is issued with a Certificate of Airworthiness declaring that the aircraft is fit to fly.

Doc 7300 Annex 10: Aeronautical Telecommunications

The five volumes of this Annex contain Standards and Recommended Practices (SARPs), Procedures for Air Navigation Services (PANS) and guidance material on aeronautical communication, navigation and surveillance systems.

Doc 7300 Annex 15: Aeronautical Information Services

The object of the aeronautical information service is to ensure the flow of information/data necessary for the safety, regularity and efficiency of international air navigation.

8.2.1.2 EASA Regulation The following documentation from EASA has been identified, containing issues related with crew and cockpit configuration:

Regulation (EC) No 216/2008

This regulation determines the basic common rules in the field of civil aviation and establishing a European Aviation Safety Agency and repealing Council Directive 91/670/EEC, Regulation (EC) No 1592/2002 and Directive 2004/36/EC.

Regulation (EU) No 1178/2011

This regulation lay down technical requirements and administrative procedures related to civil aviation aircrew pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council.

Regulation (EU) No 290/2012

Amending Regulation (EU) No 1178/2011 laying down technical requirements and administrative procedures related to civil aviation aircrew pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council.

Regulation (EU) No 923/2012

This regulation lay down the common rules of the air and operational provisions regarding services and procedures in air navigation and amending Implementing Regulation (EU) No 1035/2011 and Regulations (EC) No 1265/2007, (EC) No 1794/2006, (EC) No 730/2006, (EC) No 1033/2006 and (EU) No 255/2010.

Regulation (EU) No 965/2012

This regulation laying down technical requirements and administrative procedures related to air operations pursuant to Regulation (EC) No 216/2008.

155 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf

NPA 2010-14

This NPA (Notice of Propose Amendment) contains the Opinion on the Implementing Rules on Flight and Duty Time Limitations and rest requirements for commercial air transport (CAT) with aeroplanes to be included as a Section VIII to Subpart OPS of Part- OR.

CS-25 Certification Specifications for Large Aeroplanes

CS-25 is the Airworthiness Code provided by EASA and comprises two parts: Book 1, providing the Airworthiness Code, and Book 2, providing the Acceptable Means of Compliance (AMC), what are amendments of the Book 1.

CS-23 Certification Specifications for Normal, Utility, Aerobatic, and Commuter Category Aeroplanes

CS-23 gathered the certification specifications, including airworthiness codes and acceptable means of compliance for normal, utility, aerobatic and commuter category aeroplanes. It consist in: Book 1, the Airworthiness Code and Book 2, providing the Acceptable Means of Compliance (AMC)

8.2.1.3 FAA Regulation The following documentation from FAA have been identified, containing issues related with workload, crew and/or cockpit:

CFR-14—Aeronautics And Space

Chapter I—Federal Aviation Administration, Department of Transportation (DOT)

Volumes I, II and III: The parts in these volumes are arranged in the following order: Parts 1–59, 60–109, 110–199. These volumes contained a codification of the general and permanent rules published regarding Aeronautics.

8.2.2 Workload Aspects

A step forward in the analysis of the regulation is made in this section attending to three main aspects affecting workload. A classification by the agency producing them is resumed in the Table 9:

A deeper classification is also made in the following subsections in order to identified within each regulation document which particular section applied to the different factors identified, individual, system and corporate, to ease future assessments when merging the emergent solutions gathered by ACROSS with current regulation.

156 | 186 Status: Released Document Number: ACROSS/WP1/DLR/TECH/DEL/002 Document Name: ACROSS-WP1-DLR-TECH-DEL-002_D1.1-1_v1.docxf