Commercial airline single-pilot operations System design and pathways to certification

Feature Article:

DOI. No. 10.1109/MAES.2017.160175

Commercial Airline Single-Pilot Operations: System Design and Pathways to Certification Yixiang Lim, RMIT University, Melbourne, Australia Vincent Bassien-Capsa, Marshall Aerospace and Defence Group, Cambridge, UK Subramanian Ramasamy, Jing Liu, Roberto Sabatini, RMIT University, Melbourne, Australia

The main challenges in implementing SPO are:

INTRODUCTION Global air transport demand is increasing steadily, with the global revenue passenger kilometers (RPK) growing at an annual rate of 4% [1] and the number of passengers rising at an average annual rate of 10.6% [2]. By the end of 2016, it is estimated that 1,420 large commercial airliners will be produced, 40.5% more than was produced five years ago [2]. A consequence of this growth is an exacerbation of the existing global shortage of qualified pilots. Airlines have to hire more than 500,000 new commercial pilots until 2034 in order to meet this unprecedented air transport demand [3]. Additionally, the high costs associated with training and remuneration of pilots has been a substantial economic burden on air carriers, prompting active research into the concept of single-pilot operations (SPO) as an option for the future evolution of commercial airliners.

SPO cockpits have already been developed for military fighters as well as general aviation (GA) aircraft, with small business jets like the Cessna Citation I obtaining approval for SPO as early as 1977 [4], however, the last decade has seen considerable interest in the implementation of SPO in commercial aviation. NASA has been conducting SPO-related studies since the mid-2000s [5], [6], while some recent research in Europe has focused on the technical [7] and operational [8] challenges of SPO. In the SPO concept of operations (Figure 1), a single pilot operates the flight deck with increased ground support from a dedicated ground human flight crew. The ground operators (GO) fulfil a role similar to that of a remotely piloted aircraft system (RPAS) operator, providing a combination of strategic and tactical support to the single pilot in collaboration with the air traffic controllers (ATCo).

Authors' addresses: Y. Lim, S. Ramasamy, J. Liu, R. Sabatini, School of Engineering – Aerospace Engineering and Aviation RMIT University, PO Box 71, Bundoora, VIC 3083, Australia. Email: (roberto.sabatini@rmit.edu.au); V. Bassien-Capsa, Marshall Aerospace and Defence Group, Cambridge CB5 8RX, UK. Manuscript received August 15, 2016, revised November 3, 2016, and ready for publication December 15, 2016.

Review handled by E. Blasch.

0885/8985/17/$26.00 Š 2017 IEEE 4

CC

CC

CC

CC

Operational: distribution of workload between pilot-incockpit and ground crew, single-pilot resource management, communication procedures and processes, as well as pilot/ crew training requirements.

Technical: high bandwidth, low latency communications (line-of-sight and beyond-line-of-sight data links for airto-air, air-to-ground as well as ground-to-ground systems), autonomous navigation (flight planning, management, negotiation and validation), autonomous surveillance (senseand-avoid, health monitoring), the development of adaptive automation and interfaces for pilot/ground crew.

Safety: increasing system integrity and performance, as well as assessing the impact of higher levels of automation on flight safety and specifying incapacitation procedures.

Human factors: assessing pilot workload, addressing singlepilot incapacitation, maintaining the situational awareness of pilot and GO, developing new crew resource management (CRM) procedures for interactions between the pilot and GO, building automation trust, as well as designing appropriate human-machine interfaces and interactions (HMI2).

To address these issues, projects such as the Advanced Cockpit for Reduction of Stress and Workload (ACROSS) [9] and Aircrew Labour In-Cockpit Automation System (ALIAS) [10] have brought together academic, industrial, and government organizations to develop solutions for workload reduction in the cockpit.

The proposed systems incorporate knowledge-based capabilities as well as cognitive and adaptive interfaces to mitigate the increased pilot workload. These are relatively new concepts in civil aviation but are essential for the introduction of SPO. Considering both the SPO concept of operations and the evolving regulatory framework for conventional, GA, and unmanned operations, the system architecture for a certifiable virtual pilot assistant (VPA) is proposed to enable the implementation of SPO for commercial airliners. The VPA is a knowledge-based system, which reduces single-pilot workload in the cockpit through increased system autonomy and closer collaboration with the ground component. In particular, this article discusses the integration of communications, navigation, and

IEEE A&E SYSTEMS MAGAZINE

JULY 2017

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

surveillance (CNS) systems with the VPA and introduces the concept of a novel cognitive human-machine interface (CHMI) [11], which provides a real-time estimation of the pilot's cognitive states for adaptive alerting and task allocation. The increased operational efficiency and safety afforded by the VPA will provide a pathway to the certification of single-pilot aircraft for commercial aviation.

CURRENT TWO-PILOT OPERATIONS In the 1950s, a five-person flight crew was required in any commercial aircraft. However, technological advancements have allowed progressive de-crewing on the flight deck [12]. At present, a two-person cabin crew comprising a pilot flying (PF) and a pilot not flying (PNF) is responsible for the tasks of aviating, navigating, communicating, and managing the aircraft from take-off to landing, with the responsibilities of radio operators, navigators, and flight engineers being replaced by on-board automated systems (Figure 2).

The PF takes responsibility of directing the aircraft in line with the approved flight plan and continuously monitors the flight path for

any deviations. The PNF primarily focuses on navigating, controlling and monitoring radio communications, cross monitoring the actions of PF, assisting the PF in high workload situations and taking over flight tasks in case of PF incapacitation. Proper CRM allows the workload to be shared effectively between the PF and PNF with adequate levels of cooperation, communication, and coordination for maintaining appropriate situational awareness.

Under current regulations, all large commercial aircraft are required to be flown by a flight crew consisting of not less than two pilots (FAR 14 CFR 121.385). However, authorities also specify that all aircraft must be capable of being operated by a single pilot from either seat, meaning that there are already SPO elements in the design of current flight decks.

SINGLE-PILOT OPERATIONS – DEFINITION AND CONSIDERATIONS

Australian Civil Aviation Safety Regulations (CASR) define SPO as the operation of an aircraft by a single pilot on board the cockpit (CASR 1998-REG 61.010). In this context, the pilot assumes a supervisory role, monitoring automated systems and coordinating the various tasks together with the ground crew. Due to the increased autonomy in the aircraft, humanmachine teaming (HMT) is identified as a critical aspect and has to be addressed through human-centred systems design.

According to Nielsen, the key ergonomic elements to be considered for system design include: facility of learning and remembering key functions; efficiency and intuitiveness of using automated functions; and avoidance/reduction of pilot-induced errors [13].

In recent years, there has been considerable interest in the implementation of SPO for small-to-medium size commercial aircraft. Comprising approxiFigure 1. mately 80% of the global fleet, these Crewing requirements and interactions in two-pilot, single-pilot, and RPAS operations.

JULY 2017

IEEE A&E SYSTEMS MAGAZINE

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

5

Commercial Airline Single-Pilot Operations: System Design and Pathways to Certification for trajectory planning, negotiation and validation [17]; as well as cognitive-adaptive interfaces [11]. The development and implementation of these systems is the key for enabling the transition of SPO from GA to commercial operations. In the long term, it is envisaged that SPO can eventually be extended from short-andmedium range commercial airliners to long-range operations.

SINGLE-PILOT OPERATIONS – TASK ANALYSIS

Figure 2.

De-crewing and transition to SPO as a result of increased levels of automation.

aircraft have a lower passenger-to-crew ratio and thus incur more significant crew costs as compared to wide-body aircraft [14]. In particular, cargo aircraft (e.g., courier companies) are feasible testbeds for the initial implementation phase due to public perception of the risks associated with travelling in single-pilot aircraft. Careful consideration must be given to the risks and challenges associated with the implementation process (Table 1) in the context of a wide variety of airport and air traffic environments.

Next-generation air traffic management (ATM) operations will require aircraft to fly 4-dimensional (4D) trajectories with high precision. To ensure required levels of safety, capacity, and efficiency, future CNS systems will provide greater capabilities to pilots in the areas of air-to-ground collaborative decision making; automated separation assurance and conflict avoidance (SA&CA) [15] and integrity augmentation [16]; intelligent decision support

The reduction of the aircrew size requires changes to the responsibilities of relevant personnel so as to accommodate a new operational mode in which the pilot is supported by ground crew.

The responsibilities of the ground crew are to assist the pilot in any adverse or high workload conditions, and to take over the responsibility of the pilot during an event of incapacitation. These responsibilities can be allocated to both strategic and tactical level tasks, requiring an evolution of the current airline operational centre operator (AOCO) role and the introduction of a new ground operator (GO) role, which is analogous to that of a RPAS GO. The AOCO assists the pilot with strategic tasks such as dispatch, optimal route planning, and coordination with ATCo while the GO assists the pilot with tactical or emergency tasks such as rerouting and conflict resolution. In case of PF incapacitation, the GO will perform duties similar to those of an RPAS operator executing an emergency mission egress (i.e., landing in minimum time) and the associated landing procedure in coordination with the ATCo (Figure 1). This can be either to destination, return-to-base, or to an alternate airport depending on the current operational flight phase.

The AOCO typically monitors multiple aircraft (up to 12 [18]) for increased operational efficiency while the GO assumes control of a limited number of aircraft to ensure the required safety levels. The SPO ground station enables the distribution of flight tasks and, in the event of pilot incapacitation, allows the GO to control the aircraft as an RPAS operator (Figure 3). A typical SPO work station comprises a cockpit situation display (CSD) to indicate the routes, positions, and hazards of aircraft and also an integrated interface

Table 1.

SPO Risk Analysis Risk

6

Transition

Risk Class

Reliability of non-mature technology

There are already solutions in business jet market (e.g., Embraer Phenom 300)

Medium

Safety issues (physical and cyber)

Automation may provide higher levels of safety (reduced human error)

Medium

Public opinion: acceptance of flying with only one pilot

Progressive implementation

High to medium

Cost and difficulty of airworthiness certification

Moderate compared to RPAS and potentially serving as a transition case

High to Medium

Overload of the pilot

Higher level of automation will contribute to decrease the pilot's workload

Medium

Cost of implementation (training and avionics)

Economic efficiency (same number of pilots can fly more aircraft) IEEE A&E SYSTEMS MAGAZINE

Low

JULY 2017

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

Lim et al.

Figure 3.

Piloting task analysis.

including the primary flight display (PFD), navigation display (ND), mode control panel (MCP), and multi-function control display unit (MCDU) [18].

To actualise this concept of operations, new system functionalities are required to assist the single pilot and ground support staff in mitigating the increased workload of the single pilot and in detecting pilot incapacitation. These functionalities must be enabled by secure and high-throughput data links connecting both airborne and ground systems. Using established certification standards, the operational, technical, human factors (HF), as well as test and evaluation aspects (T&E) are considered in the development of a VPA system. These requirements provide the framework for the design of the various VPA subsystems.

CC

CERTIFICATION CONSIDERATIONS The following section provides a review of current certifications, acceptable means of compliance (AMC), guidance materials (GM) and recommended practices applicable to SPO. The material is sourced from national/international organizations such as the International Civil Aviation Organization (ICAO), Federal Aviation Authority (FAA), European Aviation Safety Agency (EASA), Civil Aviation Authorities (CAA) from Australia, the UK and New Zealand, the US Department of Defence (DOD) and the Institute for Defense Analyses (IDA). References are also made to standards from Aeronautical Radio Incorporated (ARINC), American Society of the International Association for Testing and Materials (ASTM), Radio Technical Commission for Aeronautics (RTCA), JULY 2017

Society of Automotive Engineers (SAE), and NATO Standardization Agreements (STANAGs). The content is divided into three operational categories, namely conventional two-pilot operations, SPO, and RPAS operations. Each category provides a different aspect of certification, which is relevant to the certification of SPO for commercial airliners (Figure 4).

Two-Pilot Aircraft: The operational and technical requirements for two-pilot aircraft highlighted within this category serves as a baseline for future SPO standards, since a similar set of prerequisites ensures interoperability between SPO and conventional operations in the next-generation ATM context. However, a significant evolution of these standards is required to address the differences between SPO and conventional operations, namely:

CC

CC

Safety considerations arising in view of a sole pilot in the cockpit.

Technical and operational requirements for higher levels of ground support (in terms of communication integrity/protocols and work/authority allocation).

HF and technical requirements for the safe operation of highly autonomous systems (in terms of HMI2 and system integrity/redundancy).

SPO: The certification aspects and guidelines in this category address the requirements for SPO in GA aircraft, providing another baseline (together with the relevant requirements for two-pilot and RPAS operations) to determine the future certification and standards needs of commercial SPO. The documents here are unique to SPO for GA.

IEEE A&E SYSTEMS MAGAZINE

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

7

Commercial Airline Single-Pilot Operations: System Design and Pathways to Certification

Figure 4.

Different aspects of certification based on the three operational categories.

RPAS: Concept of operations of the SPO requires the aircraft to operate as an RPAS in case of pilot incapacitation, or in situations that require the ground pilot to assume control of the aircraft.

This imposes additional requirements for the certification process.

The material in this category is relatively new and contains references to both civil and military documents.

Table 2 provides a compilation of the certification standards, AMC, GM, and recommended practices for the three categories (twopilot aircraft, SPO, and RPAS) encompassing the operational (OP), technical (TC), safety (SA), HF, as well as T&E aspects. The design of the VPA focuses on the technical, safety, and HF aspects, while operational and T&E requirements are considered in greater detail at a more mature stage of the design process. In order to develop a certifiable SPO pilot decision support system, the following subsystems are required to meet the certification requirements identified in Table 2.

Communications Subsystem: The relevant certification requirements are TH03 (flight data integrity for ground station), TH05 (data link systems), TH09 (ICAO manual on RCP), TH14 (ICAO manual on RPAS), TH15 (required RPAS C2 performance), TH19 (data link and C2 interface).

Surveillance Subsystem: The relevant certification requirements are TH06 (minimum aviation system performance for surveillance), TH07 (flight deck interval management), TH10 (ICAO manual on PBN), TH14 (ICAO manual on RPAS), TH18 (detect and avoid).

Flight Management System: The relevant certification requirements are OP20 (operational function requirements), TH04 (RNP for RNAV), TH08 (aerospace recommended practice for flight management systems (FMS)), TH17 (functional allocation), TE02 8

(CNS/Air Traffic Management (ATM) software integrity), TE04 (automatic flight guidance and control).

Cognitive Human-Machine Interface: The relevant certification requirements are OP03 (aviation fatigue), TH18 (autonomy), SA02 (system design and analysis), SA03 (systems development and design), HF02 (flight deck controls and displays), HF06 (flight crew HF), HF08 (single-pilot HF), HF09 (HF in unmanned aircraft systems (UAS) operations), HF10 (control station HF), HF11 (human-machine interface (HMI)), HF12 (manned-unmanned teaming), TE07 (verification of adaptive systems).

Functional Allocation Subsystem: The relevant certification requirements are OP20 (operational function requirements), TH15 (functional allocation), SA02 (system design and analysis), SA03 (systems development and design), HF09 (HF in UAS operations), HF10 (control station HF), HF12 (manned-unmanned teaming), TE07 (verification of adaptive systems).

Operational Aspects Operational considerations include minimum flight crew requirements, fatigue management procedures, operational procedures (including surface, air, and maintenance aspects), operator training and certification as well as the certification framework. More specific details can be found for GA, SPO, and RPAS operations, with these being distinct from the two-pilot operational requirements in FAR Parts 121, 125, and 135.

According to FAR 25.1523 and FAR 25 Appendix D, the criteria for deciding minimum flight crew are based on pilot workload and flight safety when a pilot is incapacitated. To achieve certification, SPO needs to show that pilot workload remains at an ac-

IEEE A&E SYSTEMS MAGAZINE

JULY 2017

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

Lim et al. ceptable level during normal/emergency operations, and that pilot incapacitation does not compromise flight safety. The operational requirements for commercial air transport are described in FAR 121; in FAR 121.385(c), a minimum of two pilots is required for commercial operations. For air operators, guidance for operations and certification is provided in two documents from ICAO. For SPO, the main guidelines for crew responsibility and authority are described in FAR 23.1523, EASA Annex VIII Part-SPO (Special Operations), Subpart A (SPO.GEN.105/106/107). Unlike FAR 25.1523, FAR 23.1523 does not have a similar requirement mandating a minimum of two pilots for operation. EASA's AMC/ GM to Annex III provides additional guidelines for SPO personnel (SPO.100), high-risk commercial operations (SPO.110), and CRM training (FC.115). ICAO Annex 1, Section 2.1.3 provides recommendations for class and type ratings for single-pilot aircraft. Section 9-11 to 9-17 of FAA-H-8083-9A gives an overview of single-pilot resource management (SRM); FAA AC 91-73B provides guidelines for taxi procedures for Part 91 and 135 SPO; CASA EX43/11 provides an exemption for SPO in Cessna 550/560 aircraft along with accompanying requirements and conditions; CAA AC 91-11 is an advisory circular for SPO under instrument flight rules (IFR) containing the relevant checklists, CRM guidelines, and outline of a typical SPO flight; CAA Standards Document 14 provides guidance for the required skill tests and proficiency checks in the certification and licensing of SPO aircraft.

For RPAS, ICAO's manual on RPAS provides a broad overview of various operational aspects including the integration of RPAS into civil airspace; EASA A-NPA-2015 provides some classification and specification frameworks; the Joint Authorities for Rulemaking of Unmanned Systems (JARUS) gives some recommendations regarding flight crew licensing; Chapter 2 of RTCA DO-304 and Volume 1 DO-344 discuss operational and functional requirements; while Australian and British Civil Aviation Authorities provide some material on operational procedures (CASA AC 101-1), airworthiness framework (CASA DP-1529US), and general operational procedures (CAP 722 Section 5).

Technical Aspects Technical considerations capture the requirements and recommendations for the design and development of CNS systems. Requirements from two-pilot operations provide the required framework, with RPAS references covering aspects of the command and control (C2) link and sense-and-avoid functionalities. There are no specific technical requirements unique to SPO at this point, although some are embedded into two-pilot requirements (e.g., EASA Annex VIII, SPO.IDE.A.126, FAA AC 91-100(0) Sect. 6).

For two-pilot aircraft, the requirements for system design and installation are given under FAR 25, along with the communication (RTCA DO-238, ICAO 9869 AN/62), navigation (ICAO 9613 AN/937) and surveillance (RTCA DO-289, ICAO 9224) system requirements. For RPAS technical requirements, references are made to both civil and military domains. For civil aviation, Chapters 10 to 13 of ICAO's Manual of RPAS make technical recommendations for communications, surveillance, and C2 systems. JARUS D.04 covers the required C2 link performance, Appendix C.3 of FAA's roadmap covers the future technical requirements for integrating UAS into the JULY 2017

civil airspace [19], including ground-based/airborne sense and avoid, as well as C2 and interoperability requirements; these are expected to be (or have already been) captured in FAA Technical Standard Orders (TSO) and RTCA Minimum Operational Performance Standards (MOPS) referenced in its Appendix. CAP 722 provides some guidance on system autonomy, as well as sense-and-avoid. Military regulations for unmanned systems are specified in NATO's STANAG 4586 and DOD's Unmanned Systems Integrated Roadmap – the former defines the interoperability and HMI requirements for RPAS in NATO's Joint Service Environment while the latter recommends research areas to achieve greater interoperability (Chapter 4), system autonomy (Chapter 5), and airspace integration (Chapter 6) as well as required communications (Chapter 7) and HMT (Chapter 10) capabilities.

Safety Aspects The safety requirements for system design are extracted from FAR 25.1309 and the corresponding Advisory Circular FAR AC 25.13091A on showing compliance with fail-safe design. SAE provides Aerospace Recommended Practices for the development and design (ARP-4754A) and safety assessment (ARP-4761) of avionics systems. JARUS AMC RPAS.1309 provides a means of compliance for the safety and risk assessment of RPAS systems, also making reference to ARP-4754A, ARP-4761, and CAP-722. EUROCAE ER-010 accompanies RPAS.1309 and presents the safety objectives, risk assessment approach, and guiding principles for safety/risk assessment.

CAP 722 Section 4, Chapter 4 offers additional guidance for general safety assessment, and ICAO 10019 AN/507 Chapter 7 provides guidelines for safety management in the operational context.

Human Factors Aspects The HF considerations provide a framework for interface and interaction design, system behaviour, CRM, and HMT. FAA TC13/44 is a recent report by the FAA, comprehensively addressing the HF considerations on the flight deck. These include the design and evaluation of display formats; the organization and content of information elements; visual and auditory alerting, control/input devices; design philosophy and function; error management, prevention, detection, and recovery; workload and automation. Additional information can be found in FAR AC 25.1302-1, which provides the AMC for reducing design-related human error on the flight deck. ARINC 837 goes into detail regarding design guidelines for cabin HMI. Part two of ICAO's Human Factors Training Manual (9683 AN/950) is a resource for CRM (Chapter 2) and automation training (Chapter 3). The SPO publications in this area are related to SRM in GA aircraft (CAAP 5.59-1(0)). For RPAS, CAP 722 provides an overview of the HF issue in design, production, operations, and maintenance. STANAG 4586, Appendix B3 provides the HMI requirements for interoperability within NATO operations, and Chapter 10 of the DOD Unmanned Systems Roadmap (11-S-3613) provides a discussion of past, present, and future requirements of HMT with autonomous systems.

Test and Evaluation Aspects Finally, the T&E considerations for two-pilot operations cover the different phases of T&E of the relevant CNS systems, from soft-

IEEE A&E SYSTEMS MAGAZINE

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

9

Commercial Airline Single-Pilot Operations: System Design and Pathways to Certification Table 2.

Certification Standards, AMC, GM and Recommended Practices for SPO Requirements

10

Two-Pilot Aircraft

General Aviation SPO

RPAS

Operational

OP01. FAR Parts 25 and 121 OP02. FAR 25.1523 and Appendix D (minimum flight crew) OP03. FAA AC 120-100 (aviation fatigue) OP04. EASA AMC/GM to Annex IV – Part-CAT, Subpart D (IDE) OP05. ICAO Air Operator Certification and Surveillance Handbook OP06. ICAO Manual of Procedures for Operations Inspection, Certification and Continued Surveillance (8335 AN/879)

OP07. FAR Part 23 OP08. FAR 23.1523 (minimum flight crew) OP09. EASA Annex VIII, Part-SPO, Subparts B and C (OP, POL) OP10. EASA AMC & GM to Annex III AMC2 ORO.FC.115 (CRM training for SPO) OP11. ICAO Annex 1 Section 2.1.3 (class and type ratings) OP12. FAA-H-8083-9A: Sect. 9-11 to 9-17 (Aviation Instructor's Handbook: SRM) OP13. FAA AC 91-73B (procedures during taxi operations) OP14. EASA AMC1 FCL.720.A(b)(2)(i) (flight crew experience requirements and prerequisites) OP15. (AU) CASA EX43/11 (Cessna exemption) OP16. (NZL) CAA AC 9111 (single-pilot IFR)

OP17. ICAO Manual on RPAS (10019 AN/507) Ch. 4 (certification and airworthiness), 6 (operator responsibilities), 9 (operations), 14 (integration into ATM), 15 (aerodromes) OP18. EASA A-NPA 201510 Ch. 3 (specificities of unmanned aircraft), 4 (road map) OP19. JARUS D.02 – FCL Recommendation OP20. RTCA DO-304 Ch. 1 and 2 (operational and functional requirements); Appendix D (operational functions) OP21. (AU) CASA AC 1011 (design specification, maintenance and training) OP22. (AU) CASA DP 1529US (airworthiness framework) OP23. (UK) CAP 722, Sect. 5 (operations)

Technical

TH01. FAR 25.671 to 25.703 (control systems) TH02. FAR 25.1301 to 25.1337 (equipment and installation) TH03. FAA AR-06/2 (flight data integrity for ground-based systems) TH04. RTCA DO-236 (RNP for RNAV) TH05. RTCA DO-238 (data link systems) TH06. RTCA DO-289 (MASPS for surveillance) TH07. RTCA DO-361 (flight deck interval management) TH08. SAE ARP-4109/9A (FMS) TH09. ICAO Manual on RCP (9869 AN/462) TH10. ICAO Performance-based (PBN) Manual (9613 AN/937) TH11. ICAO Surveillance Manual (9224)

TH12. FAR 23.671 to 23.703 (control systems) Th13. FAR 23.1301 to 23.1337 (equipment and installation)

TH14. ICAO Manual on RPAS (10019 AN/507) Ch. 10 to 13 TH15. JARUS D.04 – Required C2 Performance TH16. FAA UAS Roadmap [19], Appendix C (goals, metrics and target dates) TH17. RTCA DO-304, Ch. 3 (standards assessment); Appendix G (functional allocation) TH18. (UK) CAP 722, Sect. 3, Ch. 1 (detect and avoid), 3 (autonomy) TH19. STANAG 4586 Appendix B1 (data link interface); Appendix B2 (C2 interface) TH20. DOD 11-S-3613 Ch. 4 to 7 (UAS roadmap)

IEEE A&E SYSTEMS MAGAZINE

JULY 2017

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

Lim et al.

Table 2. Continued

Certification Standards, AMC, GM and Recommended Practices for SPO Requirements Safety

Two-Pilot Aircraft

General Aviation SPO

SA01. FAR 25.1309 (equipment, systems and installations) SA02. FAA AC 25.1309-1A (system design and analysis)

SA05. FAR 23.1309 (equipment, systems and installations)

RPAS SA06. JARUS AMC RPAS.1309 (safety assessment of RPAS)

SA03. SAE ARP-4754A (systems development and design)

SA07. EUROCAE ER-010 (system safety objectives and assessment criteria)

SA04. SAE ARP-4761 (safety assessment for systems)

SA08. (UK) CAP 722, Sect. 4, Ch. 4 (safety assessment) SA09. ICAO Manual on RPAS (10019 AN/507) Ch. 7

Human Factors

HF01. FAA-STD-004 (human factors program) HF02. FAA TC-13/44 (flight deck controls and displays) HF03. FAA AC 25.1302-1 (design and methods of compliance for systems and equipment)

HF07. FAA TC-14/42 (portable weather applications)

HF09. (UK) CAP 722, Sect.

3, Ch. 2 (human factors in UAS operations)

HF08. (AU) CAAP 5.591(0) (single-pilot human factors)

HF10. RTCA DO-344, Vol. 2, Appendix D (control station human factors considerations) HF11. STANAG 4586 Appendix B3 (HMI)

HF04. ARINC 837 (cabin HMI) HF05. ICAO Human Factors Training Manual (9683 AN/950) Part 2

HF12. DOD 11-S-3613 Ch. 10 (manned-unmanned teaming)

HF06. (UK) CAP 737 (flight crew human factors) T&E

TE01. RTCA DO-178C (software) TE02. RTCA DO-278, Ch. 6 (CNS/ ATM software integrity) TE03. RTCA DO-297, Ch. 5 (integrated modular avionics) TE04. RTCA DO-335, Ch. 9 (automatic flight guidance/ control)

TE12. Flight Standardization Board Report: Embraer EMB500 [20], EMB-505 [21]

TE14. IDA P-3821 (operational test and evaluation: lessons learnt)

TE13. Flight Standardization Board Report: Cessna Citation 525C [22]

TE05. RTCA DO-356 (security) TE06. ASTM F3153-15 (verification of avionics systems) TE07. FAA TC-16/4 (verification of adaptive systems) TE08. FAA AC 20-157 (reliability assessment plan) TE09. FAA AC-25-7C (flight test) TE10. (AU) CASA AC 21-47(0) (flight test safety) TE11. (AU) CASA AC 60-3(0) (flight simulators for validation) NOTE: The standards listed in the table can be found online for verification.

JULY 2017

IEEE A&E SYSTEMS MAGAZINE

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

11

Commercial Airline Single-Pilot Operations: System Design and Pathways to Certification ware-level testing and validation, to system-level, to flight simulators and flight tests. RTCA provides various documents relating to the T&E of airborne software and equipment (DO-178C), airborne electronic hardware (DO-254), CNS/ATM software integrity (DO-278), Integrated Modular Avionics (IMA) (DO-297), Automatic Flight Guidance and Control Systems (AFGCS) for FAR 23 aircraft (DO-335) and data security (DO-356). ASTM F3153-15 provides specifications on the process of the system-level safety verification of various functions in avionics systems. The FAA has recently provided a Type Certificate for the Verification of Adaptive Systems (TC-16/4), which provides valuable information for verifying SPO's adaptive interfaces. Additional information can be found in FAA and CASA Advisory Circulars; these provide guidelines for developing a reliability assessment plan (FAA AC 20-157), flight test evaluation (FAA AC-25-7C; CASA AC 21-47), and on the use of flight simulators for validation of new aircraft systems, avionics and handling qualities (CASA AC 60-3(0)).

There is limited information regarding the T&E of SPO and RPAS but included in the references are the Flight Standardization Board Reports of SPO business jets from Embraer [20], [21], [23] and Cessna [22], containing the compliance checklists (applicable to Part 91 and Part 135 aircraft). For RPAS, a report from the IDA provides information on the development, design, execution, and evaluation of the T&E of RPAS.

VIRTUAL PILOT ASSISTANT SYSTEM As discussed in the previous section, the minimum crew requirements and criteria (specified in FAR 23.1523, FAR 25.1523 and FAR 25 Appendix D) are performance based and assessed through a combination of the aircraft's operating rule, the crew function, their workload/task complexity, as well as the crew's ability to recover from emergencies. Additionally, a single-pilot aircraft shall be able to operate autonomously as an RPAS during pilot incapacitation. To support these operational requirements, the design of a VPA system is proposed with the following objectives: CC

CC

CC

12

Decrease pilot workload by taking control of certain flight tasks, including computing and sharing optimized flight plans (fuel, time, and comfort) through a Next Generation Flight Management System (NG-FMS); performing CAT II (< 200 ft) and CAT III (< 100 ft) landing; system monitoring through Integrated Vehicle Health Management (IVHM) and Avionics Based Integrity Augmentation (ABIA) systems, with the capability to issue cautions and warnings to the pilot when required; and the ability to temporarily assume control authority in the event of pilot incapacitation [16].

Decrease flight deck complexity through biometric monitoring sensors which assess the pilot's workload; adaptive interfaces which suggest appropriate automation modes based on task complexity and pilot load; aural, visual, and haptic alerts, and triggered by priority to avoid pilot confusion.

Increase aircraft surveillance capacity through advanced avionics systems including a surveillance system which ensures autonomous SA&CA in non-controlled and controlled airspace [15]; a weather surveillance system, augmented by

ground forecasts from an air-ground data link; and autonomous strategic/tactical rererouting and conflict resolution.

CC

Facilitate collaborative work and information sharing with the ground station through a combination of direct radio-line-of-sight (RLOS) and beyond radio-line-of-sight (BRLOS) air-to-ground communication channels between ground crew and ATCo, supplemented by ground-to-ground channels for redundancy and load balancing; secure, reliable data links with variable bandwidth and latency performances depending on available timeframe and task requirements; transferral of control authority to GO in the event of pilot incapacitation.

The VPA system architecture is illustrated in Figure 5 and comprises four major systems: the communications, surveillance, flight management/control, and HMI systems. The communications system enables data-sharing between the single-pilot, GO, AOCO, and ATCo via a network comprising various RLOS and BRLOS data links. In case of emergency, a reliable, secure high-speed C2 link enables the GO to assume direct control of the aircraft's flight management and control systems. The surveillance system utilises an Airborne Surveillance and Separation Assurance Processing (ASSAP) subsystem, which is integrated into the FMS, to provide automated SA&CA capabilities. The NG-FMS is interlinked to the flight control unit (FCU), autopilot, and flight control system (FCS) to provide guidance, navigation, and control, as well as trajectory optimisation, planning, negotiation, and validation functions. An IVHM subsystem automates the management and monitoring of aircraft systems, providing appropriate updates, warnings, or alerts to the pilot (via a cognitive HMI) and the ground crew.

Communications Depending on the criticality of information being transferred, different links (with different required communication performance (RCP) levels) are used to support transfer of data and information between the aircraft and various ground agents. The European Organization for Civil Aviation Equipment (EUROCAE) Working Group 73 (WG-73) has developed a methodology for determining the RCP for RPAS [24], based on ICAO's Manual on RCP (Doc 9869) and RPAS (Doc 10019). A similar framework is used to define the command, control, and communications (C3) links for SPO for this section. These comprise safety critical, non-safety critical, and real-time C2 links, as well as links for ATC and ground crew voice/data communications (Figure 6).

The communication links may be within RLOS or BRLOS as depicted in Figure 7. Ground-to-ground links between the ground crew and the ATC provide lower latency and higher reliability than air-to-ground radio links, supporting some information exchange in instances when specific air-to-ground C3 links suffer from degradation such due to weather, terrain, or signal obstruction.

Evaluating SPO RCP requires consideration of the operational risk in the event of a loss-link. The following factors will affect operational risk: increase in single-pilot workload, information carried by the link, level of autonomous operation, population density in area of operations, and SPO operating airspace class. The RCP values for RPAS operations as proposed by WG-73, which are more stringent

IEEE A&E SYSTEMS MAGAZINE

JULY 2017

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

Lim et al.

Figure 5.

VPA system architecture.

Figure 6.

C3 links.

JULY 2017

IEEE A&E SYSTEMS MAGAZINE

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

13

Commercial Airline Single-Pilot Operations: System Design and Pathways to Certification

Figure 7.

SPO communications network.

than manned operations, are shown in Table 3 [24]. The RCP is defined by the separation between the aircraft and the ground station, as well as link transaction time. Limits are set for the continuity of the link (lower transaction time than required time specified by the RCP type), availability (ratio of actual to specified operating time), and integrity (probability of undetected errors in transaction).

Surveillance On-board surveillance systems provide a combination of surveillance and surveillance-based guidance (through interfacing with the NG-FMS) and alerts to enhance flight safety and decreased single-pilot workload by ensuring autonomous SA&CA. Surveillance information can be obtained from information service, and cooperative and non-cooperative sources (Figure 8). Information

services are provided by the ATCo or ground crew and contain information regarding traffic, meteorological or other potential hazards to flight. To allow the same surveillance systems to be deployed in conventional, single-pilot, and unmanned aircraft, a unified approach to non-cooperative and cooperative SA&CA was developed, adopting a combination of navigation and tracking sensors/systems (such as Global Navigation Satellite Systems (GNSS), inertial measurement unit (IMU) and vision based navigation (VBN) sensors) in the navigation and guidance system architecture. Errors in the obstacle/intruder measurements are estimated considering a combination of non-cooperative sensors, including active/passive forward-looking sensors (FLS) and acoustic sensors, as well as cooperative systems, including automatic dependent surveillance broadcast (ADS-B) and traffic collision avoidance system (TCAS).

In this unified approach, analytical models are implemented for real-time processing of navigation and tracking errors affecting the state measurements allowing a direct translation into unified range and bearing uncertainty descriptors [15], [25]. An airborne surveillance and separation assurance processing (ASSAP) subsystem processes the incoming surveillance information according to the relevant surveillance applications for the single pilot (i.e., violation of separation, resolution advisory, etc.); the ASSAP is integrated into the NG-FMS (Section 6.2) to provide autonomous separation assurance, tactical rerouting, conflict resolution, and/or automatic landing in case of single-pilot overload, incapacitation, and/or loss of C2 link. RTCA DO-289 provides the Minimum Aviation System

Table 3.

RCP for RPAS, from EUROCAE WG-73 RCP Type RCP 10

Continuity (probability/ flight hour)

Availability (probability/ flight hour)

Integrity (acceptable rate/flight hour)

Separation (NM)

Transaction Time (sec)

5

10

0.99985

0.999997

1.43x10−6

5

60

0.99985

0.99999

1.43x10−6

15

120

0.99985

0.99999

1.43x10−6

30 / 50

240 / 400

0.99985

0.99999 / 0.99988

1.43x10−6

Tactical control; Continental Europe RCP 60 Routine comms; Continental Europe RCP 120 RCP 240 / RCP 400 Oceanic

14

IEEE A&E SYSTEMS MAGAZINE

JULY 2017

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

Lim et al.

Performance Standards (MASPS) for surveillance applications, with detailed specifications for the information (data content/quality, update interval, latency, coverage, continuity), as well as the transmitting, receiving, ASSAP subsystems and display interfaces.

Flight Management To support 4D trajectory/intent based operations (TBO/IBO) in the future airspace, an NG-FMS [26] is employed to provide autono-

mous flight planning, trajectory prediction, performance computations, guidance and control functionalities for manned, single-pilot, and unmanned platforms. The NG-FMS (Figure 9) introduces a trajectory planning/optimisation subsystem, which performs multiobjective trajectory optimisation through mathematical algorithms, for strategic, tactical, and emergency operations. Information about the flight plan is provided by a navigation subsystem and can be used to correct any deviation of the lateral, vertical, and time pro-

Figure 8.

Surveillance subsystem architecture.

Figure 9.

NG-FMS architecture.

JULY 2017

IEEE A&E SYSTEMS MAGAZINE

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

15

Commercial Airline Single-Pilot Operations: System Design and Pathways to Certification

Figure 10.

Certification guidelines regarding system behaviour (subchapter 5-6, AC 25.1302-1).

file from the intended path. Additionally, optimal trajectory intents are generated based on predefined cost functions to minimize fuel consumption, flight time, operative costs, or emissions, under constraints imposed by weather, airspace and traffic (SA&CA) requirements. The process of negotiation involves communicating these intents to the ground crew and ATCo, which are validated before being executed by the NG-FMS. Finally, a CNS integrity manager [16] is used to ensure the required communication, navigation and surveillance performance levels (RCP, RNP, RSP) are maintained.

Cognitive Human-Machine Interface The CHMI is a crucial component of the VPA system, providing the necessary reductions in workload as well as incapacitation16

detecting capabilities that will support the case for SPO certification. Section 5.4.2 of the DOD's Unmanned Systems Integrated Roadmap has identified adaptive interfaces as a key future development for autonomous systems [27]. The CHMI assists the pilot with several intelligent functions such as information management, adaptive alerting, and situation assessment as well as task allocation (Section 6.4). The design of the CHMI in the VPA system is based on the guidelines specified in FAR AC 25.1302-1 with regards to the HF engineering and system redundancy for safe and effective operations. Figure 12 illustrates the guidelines found in subchapter 5-6 of AC-25.1302-1 [28], which provides information for the design of the interfaces (displays and controls) and interactions (logic and operating conditions) of such an avionics system.

IEEE A&E SYSTEMS MAGAZINE

JULY 2017

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

Lim et al.

Figure 11.

CHMI architecture.

The CHMI utilises psychophysiological sensors, which are integrated into the flight deck, to monitor the pilot in real-time.

Cognition models are used to assess the pilot's cognitive states, such as fatigue, stress, attention, and mental workload based on the physiological data collected. Important physiological indicators include brain (e.g., blood oxygenation levels), cardiac [e.g., heart rate (HR), heart rate variability (HRV)] and eye (e.g., blink rate, eye movements, and pupil diameter) activity. Brain activity provides information on cognitive workload, and can be tracked either electrically [via electroencephalography (EEG)] or optically (via functional near-infrared (fNIR) spectroscopy). Cardiac activity can be measured with wearable devices such as wristbands or smart shirts, and is utilised to assess stress and workload of the pilot.

Eye activity can be tracked remotely with multi-camera systems, and is also a good indicator of workloadâ&#x20AC;&#x201D;blink rates and duration are inversely correlated and decrease with increasing workload [29]. Additionally, pilot attention can be modelled from gaze patterns, which are correlated with information sampling [30]. An inference engine is used to manage task distribution between the automation systems (e.g., NG-FMS) and human operators (air based and ground based) based on the external environment and their cognitive state. If a high single-pilot workload is assessed, the CHMI provides support by suggesting a transition to higher levels of system automation, reducing screen clutter, and/or transferring noncritical tasks to the ground crew. On the other hand, if the system infers that the pilot is losing situational awareness at a high level of automation, the CHMI either suggests a more suitable level of automation or triggers appropriate alerts to keep the pilot in the loop. Adaptive alerting is designed to provide cues that complement the cognitive state of the pilot, based on the system's assessment of the situation. Alerts are prioritised and are provided through a combination of visual, auditory, and haptic feedback; JULY 2017

multi-sensory feedback increases the pilot's perceptual bandwidth with more channels to process information. Figure 11 illustrates the architecture of the CHMI. Based on the SPO concept of operations (Section 4) and current system design-related certification requirements (Figure 10), the key technical requirements for the design of the cognitive HMI have been identified in Table 4, primarily revolving around the reliability/security of the physiological sensors, the operator performance models, decision logics, as well as novel interfaces and interactions.

Functional Allocation Function allocation between the pilot and system, as described in AC 25.1302-1 [28] (Figure 10), is necessary for effective operations. The VPA system achieves allocation of different functions dynamically by performing high-level information fusion [31] on sensor data comprising the external environmental condition, aircraft state, and physiological states of the operator. Based on the available information, the VPA makes an assessment of the required automation level and provides two recommended modes out of six modes for a given application. The pilot can select (but is not limited to) these two modes. The operating modes for guidance, navigation, and control are depicted in Figure 12: Mode 0 implies that the pilot has full control of the aircraft; in modes 1 and 2, the autopilot provides attitude (roll, pitch, and yaw) and trajectory control, respectively; in mode 3, the system follows the flight plan loaded in the NG-FMS; in mode 4, the system handles autonomous separation from traffic, weather, and terrain hazards; mode 5 is reserved for emergency and landing in severe weather conditions, where the system assists the pilot in performing challenging tasks such as CAT III auto landing. As an example, when

IEEE A&E SYSTEMS MAGAZINE

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

17

Commercial Airline Single-Pilot Operations: System Design and Pathways to Certification Table 4.

Technical Requirements, Challenges and Opportunities for Implementation of CHMI Requirements Data Capturing

Challenges

Non-invasive sensors are required

Identification of data requirements

Sensors shall not hinder pilot operations

Specification of sensor performance levels

Sensor performance (accuracy, precision, efficiency) shall be operationally adequate

Design/integration of data capturing devices into the flight deck

Novel multi-modal sensor data fusion techniques for robust assessment of cognitive states

Accurate models (predictive and real-time) of the external environment, aircraft state and pilot's cognitive state

Identification of suitable mathematical/ computational models

Innovative machine learning algorithms and inference engines

Implementation of models in an operationally efficient system

Model-predictive algorithms for increased safety and efficiency

System performance shall be deterministic

Identification of suitable decision logics

Innovative knowledgebased systems

Pilot shall have the final authority

Identification of specific areas for application (i.e., FMS flight planning, collision avoidance, 4D trajectory negotiation and validation)

Adaptive decision logic driven by sensor/system performance

The reduction in the pilot's cognitive load (due to system support) shall be greater than the additional load induced from monitoring the system

Development of suitable interfaces

More natural/intuitive decision support tools

Evaluation of effect of interfaces on pilot performance

Augmented reality for pilot/ATCo training

Task allocation shall not be overly disruptive or too inconspicuous

Evaluation of effect of interfaces on system performance

New monitoring and augmentation strategies for increased integrity

Task allocation shall provide a range of options to the pilot

Development of suitable training programs

Loss/degradation of sensors shall not compromise system integrity Modelling

Decision Logics

Decision logics and intent of system shall be transparent to the pilot Interface and interactions

the aircraft flies in a congested airspace (e.g., a terminal area), the pilot selects the guidance sensor command mode 3, allowing him to focus more on the approach procedure while the VPA system assists in monitoring the traffic situation.

PILOT INCAPACITATION: ENABLING THE TRANSITION OF SPO TO RPAS OPERATIONS In the event of a pilot incapacitation, the SPO aircraft becomes a remotely piloted aircraft (RPA). Incapacitation of a pilot is defined as â&#x20AC;&#x153;any reduction in medical fitness to a degree or of a nature that is likely to jeopardize flight safetyâ&#x20AC;? [32]. According to historic data, pilot incapacitation is a rare event. A single pilot has an incapacitation risk of one in 106 hours. For two-pilot operations, 18

Opportunities Advanced data analytics using data captured using non-invasive sensors

this risk is reduced to one in 109 hours with the addition of the second pilot [33]. The inherently higher risk associated with SPO requires emergency systems and procedures in place to ensure absolute safety in case of an incapacitation event. The emergency procedure is illustrated in Figure 13. An on-board pilot biometric monitoring system first verifies the status of the pilot, and upon confirmation of incapacitation, the VPA system triggers the emergency incapacitation mode in the intelligent 4D NG-FMS, which temporarily assumes control of the aircraft while simultaneously alerting the ground flight crew. The GO, upon receiving notice of pilot incapacitation, locates the closest and safest airport for the aircraft to land and sends a clearance message to the relevant ATCo and guidance commands to the VPA system. The GO monitors the VPA, which manoeuvres the aircraft to the top of the descent point and prepares for autoland. The GO can also override the automa-

IEEE A&E SYSTEMS MAGAZINE

JULY 2017

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

Lim et al.

Figure 12.

VPA functional allocation scheme.

tion system to perform landing enabled by a high-speed and realtime data link communication system.

CONCLUSIONS The transition from commercial two-pilot to SPO necessitates the technical, operational, and certification requirements to be clearly defined and properly addressed during design, integration, and test activities. Based on a critical review of current certification and regulations, standards applicable to two-pilot, single-pilot GA and JULY 2017

RPAS were identified for defining the system design requirements of a single-pilot aircraft decision support system. This novel VPA system was described as a possible system implementation, providing enhanced surveillance, communication, and flight management capabilities, as well as adaptive task allocation and HMIs. By monitoring the pilot's workload through on-board psychophysiological monitoring devices, the VPA adapts its level of support in its various autonomous functions through a context-aware inference engine. Additionally, adaptive alerts and task allocation are provided to the pilot based on the assessment of the situation by the VPA. The

IEEE A&E SYSTEMS MAGAZINE

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

19

Commercial Airline Single-Pilot Operations: System Design and Pathways to Certification

Figure 13.

Incapacitation procedure.

psychophysiological monitoring devices are also capable of detecting an incapacitation event, allowing the VPA to assume temporary autonomous control while simultaneously alerting and transferring control authority to the ground crew. The VPA interfaces with the trajectory optimisation, negotiation and validation, as well as SA&CA functions of the NG-FMS to provide autonomous flight planning and real-time re-optimisation capabilities in the event of pilot incapacitation. The certification aspects of the VPA will need to allocate significant consideration towards the performance and integrity of these adaptive cognitive systems, as well as evaluating the HF implications of the resulting HMT—these are relatively new concepts in civil aviation but are critical enablers for greater autonomy in the future air traffic system. It is envisaged that further research in the area of cognitive systems will support the design, development, test and evaluation (DDT&E) phases as well as provide a pathway to certifying SPO. Ultimately, the SPO is a feasible option for overcoming the foreseen worldwide shortage of experienced flight crews in the context of next generation communication, navigation, surveillance, air traffic management and avionics (CNS+A) system implementations. The eventual deployment of these systems will be enabled by the necessary advances in the certification and training processes, which will have to address all safety, technical, and regulatory implications.

REFERENCES [1] IATA. Air Passenger Monthly Market Analysis (May 2016). International Air Transport Association, Montreal, Canada, 2016.

20

[2] Deloitte. Global Aerospace and Defense Sector Outlook. Deloitte Touche Tohmatsu Limited, Jan. 2016.

[3] Boeing. 2015 Pilot and Technical Outlook. Boeing Commercial Airplanes, Seattle, WA, 2015.

[4] McClellan, M. J. Single pilot jets. FLYING (2006). Available: http:// www.flyingmag.com/single-pilot-jets [5] Deutsch, S., and Pew, R. W. Single pilot commercial aircraft operation. BBN Report 8436, 2005.

[6] Comerford, D., Brandt, S. L., Lachter, J., Wu, S.-C. ,Mogford, R., Battiste, V. Johnson, W. W. In NASA's Single-Pilot Operations Technical Interchange Meeting: Proceedings and Findings. NASA, Ames Research Center, Moffett Field, CA, 2013.

[7] Faber, A. Single pilot commercial operations: A study of the technical hurdles. Master of Science, Department of Control and Simulation, TU Delft, Delft University of Technology, Delft, Netherlands, 2013.

[8] Stanton, N. A., Harris, D., and Starr, A. The future flight deck: Modelling dual, single and distributed crewing options. Applied Ergonomics (2015).

[9] Bayram, K., Fazli, E., Dokic, J., Goodchild, C., Kou, P., Martins, A. P. G. et al. ACROSS: Scope and State of the Art,” ACROSS Consortium, 2013.

[10] DARPA. ALIAS Industry Day Release, 2014.

[11] Liu, J., Gardi, A., Ramasamy, S., Lim, Y., and Sabatini, R. Cognitive pilot-aircraft interface for single-pilot operations. Knowledge-Based Systems, Vol. 112 (2016), 37–53.

[12] Harris, D. A human-centred design agenda for the development of single crew operated commercial aircraft. Aircraft Engineering and Aerospace Technology, Vol. 79 (2007), 518–526.

IEEE A&E SYSTEMS MAGAZINE

JULY 2017

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

Lim et al.

[13] Nielsen, J. Usability Engineering. Amsterdam: Elsevier, 1994.

[14] Sheridan, T. B., and Parasuraman, R. Human-automation interaction.

Reviews of Human Factors and Ergonomics. Vol. 1 (2005), 89–129.

[15] Ramasamy, S., Sabatini, R., and Gardi, A. Cooperative and non-cooperative sense-and-avoid in the CNS+A context: A unified methodology. In 2016 International Conference on Unmanned Aircraft Systems, ICUAS, 2016, 531–539.

[16] Sabatini, R., Moore, T., and Hill, C. A new avionics-based GNSS integrity augmentation system: part 1-fundamentals. The Journal of Navigation, Vol. 66 (2013), 363-384.

[17] Gardi, A., Sabatini, R., Kistan, T., Lim, Y., and Ramasamy, S. 4-dimensional trajectory functionalities for air traffic management systems. In 15th Integrated Communication, Navigation and Surveillance Conference, ICNS 2015, 2015, N31-N311.

[18] Croft, J. NASA advances single-pilot operations concepts. In Aviation Week & Space Technology (2015).

[19] FAA. Integration of Civil Unmanned Aircraft Systems (UAS) in the National Airspace System (NAS) Roadmap, 1st ed. Washington, DC: Federal Aviation Administration, 2013.

[20] Edwards, D. L. Flight Standardization Board (FSB) Report: EMBRAER S.A. EMB-500. Washington, DC: Federal Aviation Administration, 2014.

[21] Edwards, D. L. Flight Standardization Board (FSB) Report: EMBRAER S.A. EMB-505. Washington, DC: Federal Aviation Administration, 2013.

[22] Kieffaber, T. Flight Standardization Board (FSB) Report: Cessna 525 (CE-525, 525A, 525B, 525C). Washington, DC: Federal Aviation Administration, 2014.

[23] Fernandes, R. C., de Lucena Costa, Jr., A., Ferreira de Araújo, H., Zwanziger, M., Duvoisin, C., di Pablo Saliba Ferreira, S. et al. Op-

JULY 2017

[24]

[25]

[26]

[27]

[28] [29]

[30]

[31]

[32] [33]

erational Evaluation Report – Embraer EMB-500, EMB-505. Rio de Janeiro, Brazil: Agência Nacional de Aviação Civil (ANAC), (2016).

EUROCAE Concept of RPAS Required Communication Performance Methodology for the Command, Control and Communication Link.

European Organisation for Civil Aviation Equipment (EUROCAE), Malakoff, France, 2015.

Ramasamy, S., Sabatini, R., Gardi, A., and Liu, J. LIDAR obstacle warning and avoidance system for unmanned aerial vehicle senseand-avoid. Aerospace Science and Technology (2016).

Ramasamy, S., Sabatini, R., Gardi, A., and Kistan, T. Next generation flight management system for real-time trajectory based operations.

Applied Mechanics and Materials, Vol. 629 (2014), 344–349.

U. S. Department of Defense. Unmanned Systems Integrated Roadmap (FY2011 - 2036). Washington, DC: Department of Defense, 2011.

FAA AC 25.1302-1: Installed Systems and Equipment for Use by the Flightcrew. Washington, DC: Federal Aviation Administration, 2013.

Di Stasi, L. L., Antolí, A., Gea, M., and Cañas, J. A neuroergonomic approach to evaluating mental workload in hypermedia interactions.

International Journal of Industrial Ergonomics, Vol. 41 (2011), 298– 304.

Wickens, C. D. Visual attention control, scanning, and information sampling. In Applied Attention Theory. Boca Raton, FL: CRC Press, 2007, pp. 41–61.

Blasch, E. P., Lambert, D. A., Valin, P., Kokar, M. M., Llinas, J., Das, S. et al. High level information fusion (HLIF): Survey of models, issues, and grand challenges. IEEE Aerospace and Electronic Systems Magazine, Vol. 27 (2012), 4–20.

ICAO. Chapter 3 concerns Flight Crew Incapacitation, 2012.

ICAO. Manual of Civil Aviation Medicine, 2012.

IEEE A&E SYSTEMS MAGAZINE

Authorized licensed use limited to: Khwaja Fareed University of Eng & IT. Downloaded on July 04,2020 at 03:48:08 UTC from IEEE Xplore. Restrictions apply.

21