1 Introduction

With an increase in automation in various complex sociotechnical systems, reducing human operators has become a hot topic in many domains. In seafaring, ships’ crews have been decreased despite the fact that the mechanical and electronic systems on-board have become more and more complex (Bertram 2005). Remotely commanded civil vessels are already anticipated (Levander 2017). The crews of military vessels, such as the British Type 26 frigate or the US-American USS Zumwalt (DDG 1000), have been reduced (Wetteland et al. 2000). In commercial aviation, the flight crew has been reduced since the 1950s from five to two crewmembers. The flight engineer’s profession most recently disappeared in commercial aviation (Boy 2016). Their duties of monitoring all aircraft systems and fuel management have been assigned to an electronic flight management and the two remaining pilots.

This evolutionary development in (de-)crewing is one basic factor of a system of systems (Maier 1998). Likewise, aviation shows all the characteristics of a complex sociotechnical system (Harris and Stanton 2010). It is characterized by an operational and managerial independence of elements [development, production, aircraft operations, maintenance and Air Traffic Control/Management (ATC/ATM) are offered by different companies/providers], possesses emergent behaviour, and has a geographical distribution of elements. Nonetheless, a set of common operating principles and international regulations for design and system operations keeps it safe. The aviation sociotechnical system has developed over decades and now has a legacy of evolving and adapting to developments in technology and human factors. It has been argued that reducing the crew from two pilots to one pilot would be the logical next step (Harris 2007; Lachter et al. 2017; Stanton et al. 2016a). Currently, whilst different crewing configurations and concepts have been proposed, there is a general consensus that this would include ground-based assistance by a remote-operator and remote-pilot as illustrated subsequently.

Different theoretical analyses have opposed and excluded the option of a single-piloted airliner without any ground-based support very early in research’s time course. The system resilience in terms of network architecture suffers compared to an option including one remote copilot at a ground station (GS; Stanton et al. 2016a). Other system-theoretic approaches to accident modelling have agreed in the trend that support by a remote-copilot to a single-pilot can be advantageous over the current crewing configuration and other options of distributing the crew. Examples are rapid decompression (Revell et al. 2018), a laser attack (Schmid and Stanton 2018), and a hypothetical Kegworth accident scenario (Harris 2018). A series of empirical studies has investigated different setups of GSs including a ground operator as either super-dispatcher or remote-copilot providing support to multiple or one single-pilot aircraft in different situations (Lachter et al. 2017; Vu et al. 2018). In general, this type of support seems viable for future commercial Reduced-Crew Operations (RCO). Without any support, workload on a single-pilot dramatically increases and subjective measures of safety and performance significantly decrease (Bailey et al. 2017).

The procedures and practices of workers in these RCO’ systems are not yet fully developed, it is most likely to be based (at least in part) on contemporary Multi-Crew Operations (MCO) in commercial airliners. Hence, we do not propose to design and analyse a first-of-a-kind-system (Naikar et al. 2003; Roth and Mumaw 1995). Rather, we propose to design a system whose analogues to older existent system designs will remain. Consequently, present research aims to reduce its crew in line with the legacy of the aviation system as it continues to evolve. The crew reduction concept should fit within the existing environment of commercial aviation, which is shaped by a multi-structured organisation of hierarchical control, from regulators such as international and national aviation authorities, to airlines and their crews to aircraft and their manufacturers, ATC, and airports (Schmid and Stanton 2018; Schmid et al. 2018). MCO and RCO will need to coexist for the foreseeable future, as they are gradually introduced and evolve.

Since aviation has developed as a legacy system, a radical change of its overall structure is unlikely. Only some aspects of crew, aircraft and the related infrastructure will be adapted to the requirements of RCO. A single-piloted commercial airliner will most likely comprise of similar systems found in contemporary commercial aircraft. Novel automation technologies will be required and the role of the pilot requires a re-conceptualization (Harris 2007). Hence, it is vital to employ a system-wide approach when analysing and designing for crew reduction.

The present paper introduces a subset of well-established methods which are used to refine the crew reduction concept. The case study of RCO in which the copilot on-board is reduced exemplifies the application of the methodology. The framework of Cognitive Work Analysis (CWA) is used in combination with a Social Network Analysis (SNA) to allocate functions to the different (remaining) human and non-human agents of the sociotechnical system. This combination of methods provides first insights in a possible loss of system functions at the beginning of a detailed design process.

1.1 Methodological approaches to reducing the crew

Reducing the crew of operators of a sociotechnical system has already been investigated using different approaches. The human-centred design process was applied to the prototype of the guided missile destroyer of the United States Navy USS Zumwalt (DDG 1000) (Hagan et al. 2011; Quintana et al. 2007). The process included a selection of off-the-shelf technologies, a cognitive task analysis, 3D visualization aids for modelling and simulation, and empirical test simulations using the NASA-TLX (Hart 2006). Not all methods yielded positive results. For example, a discrete-event task network simulation model of the impact of human interaction in a land attack fire support mission showed that workload was too high for a small watchteam (Wetteland et al. 2000). These procedures were cost-intensive (Hagan et al. 2011). Due to a lack of viability of initial designs, additional crew or changes in its composition were required. This shows the usefulness of conducting early evaluations (Stanton et al. 2016a). It is essential that all function allocation decisions are based on a robust methodology to guide analysis and design of new systems.

Human Factors and Ergonomics provide many methods which support design and analysis of complex sociotechnical systems throughout the whole design lifecycle (Stanton et al. 2013, 2014b, 2017). For example, CWA is a structured framework to analyse such systems by identifying the purposes and constraints in support of work boundaries (Jenkins et al. 2009; Naikar 2006; Rasmussen et al. 1994; Read et al. 2015b; Stanton and Jenkins 2017; Vicente 1999). In this way, the method aims to foster safer and more effective system performance in a variety of situations. CWA contributes to most and various human factors design issues (Stanton et al. 2017) among which are establishing a Concept of Operations (ConOps; Bodin and Krupenia 2016), function analysis (Millen et al. 2011; Stanton and Bessell 2014), normal and emergency situations, function allocation (Jenkins et al. 2008), training needs analysis (Fleming and Pritchett 2016; Kilgore and St-Cyr 2006; Lintern and Naikar 2000), operating procedures specification (Stanton and Jenkins 2017), design advice (Salmon et al. 2016), and interface design (McIlroy and Stanton 2015; Stanton et al. 2016b). In this connection, the term ConOps refers to defining roles and responsibilities of the principal human operators, the automation tools used by them, and the operating procedures for human–human and human–automation interactions (Bilimoria et al. 2014).

CWA has been shown to be beneficial in designing new systems or integrating new technology in existent systems. It supports system design and analysis at all phases of the system’s life cycle (Naikar and Sanderson 2001; Sanderson 2003). In general, CWA consists of five phases: (1) Work Domain Analysis (WDA), (2) Control Task Analysis (ConTA), (3) Strategies Analysis (STA), (4) Social Organisation and Cooperation Analysis (SOCA), and (5) Worker Competencies Analysis (WCA). The method has become a standard analytic framework in designing complex sociotechnical systems (Stanton et al. 2017). In the present case study, we focus on WDA, ConTA and SOCA which were used to investigate some of the likely effects of reducing the crew in commercial aviation.

1.2 Methodology: cognitive work analysis (CWA) and social network analysis (SNA)

Based on the latest approach to CWA (i.e., including SNA to investigate team cooperation and organisation: Houghton et al. 2015), we propose an approach to examine the likely effects of crew reduction in complex sociotechnical systems. Whilst the current system has already been operated for decades, its crewing characteristics limit further developments. The overall organisation of system components will not change but new advanced automation of how information is processed and displayed in inter- and intra-organisational boundaries will define the ConOps. Hence likely behaviours of workers within the system can be anticipated from the previous system organisation. Against this background, legacy issues will be always apparent in reducing the crew of an existent system.

We start at the specific following stage in the design process as outlined in ISO 9241-2010 (ISO/TC 159/SC 4 Ergonomics of human–system interaction 2010) and the CWA Design Toolkit (CWA-DT; Read et al. 2015a, 2016, 2018). The ISO/TC 159/SC 4 represents an industrial norm for human-centred design principles throughout the life cycle of computer-based interactive systems whereas the CWA-DT is a design approach on how to practically include CWA’ results into the design process itself. The ISO norm is used during the design process and describes its main stages and iterations whereas the CWA-DT provides tools on how these results can further be integrated into the future design process. We begin at the stage where we have already decided that the crew of an airliner will be reduced by the copilot and supported by a ground-based remote-copilot due to the reasons outlined above (Harris 2018; Revell et al. 2018; Stanton et al. 2016a; Vu et al. 2018). We introduce a CWA-based technique to evaluate a specific design concept against possible system failures of new technology on theoretical level to proceed with detailed design. It represents a cost-effective procedure to early tailor the system to its later application.

1.2.1 Cognitive work analysis (CWA)

In reduced crewing, we consider a concept design in keeping with the evolutionary development process. This includes other initial research approaches and current advances in automation. Various studies have already evaluated automation tools for RCO empirically concluding such operations including ground support are viable in near future (Battiste et al. 2018; Lachter et al. 2017; Vu et al. 2018). Other proposals have validated advanced automation tools for MCO, which autonomously monitor and evaluate pilot health as well as hazardous of entries into aircraft (Çakır et al. 2016; Gateau et al. 2018; Gaultier and SAFEE Consortium 2008; Hanakova et al. 2017; Laviv and Speijker 2007; Maiolo et al. 2017; Oliveira et al. 2012; Schmitt et al. 2010). In addition, concepts for ground support of a single-piloted airliner all point to the use of ground-based remote-copilots (Vu et al. 2018). Analyses suggest that an equivalent resilience in network architecture terms may be reached (Stanton et al. 2016a) when checking, surveilling and monitoring activities of MCO are distributed between automation and ground personnel (Harris et al. 2015; Huddlestone et al. 2017). A single pilot without any support can become rapidly overloaded in emergency situations (Bailey et al. 2017; Harris 2018).

Based on preliminary considerations of commercial RCO, the change in (de-)crewing requires one remote-copilot at ground per single-piloted aircraft for high-workload situations as well as off-nominal events and emergencies. Our analysis starts with these assumptions as a high-level ConOps. We recommend consulting at least one Subject Matter Expert (SME) during and after analysis, which can be complemented by observation of the work context in the current operating system. At first, a WDA of the existing sociotechnical system is conducted to formally model the current work domain. It describes the constraints of the workers’ behaviour that are given by its purposive and physical context of operation (Stanton and Jenkins 2017). Here, the corresponding Abstraction Hierarchy (AH) is considered at each level to identify the legacy issues (Harvey and Stanton 2014). The entire work domain is outlined by an analyst-defined boundary on five levels of abstraction that are explained subsequently top down. First, functional purposes simply describe the reasons why the system exists. Second, values and priority measures represent the measures for determining how well the system is achieving its goals above. Third, the purpose-related functions are the general functions of the work system that are required to progress toward its overall goals. Fourth, the object-related processes represent the processes that are conducted by the physical objects beneath to achieve the purpose-related functions above. Last, the physical objects describe the elements that are controlled by agents of the system.

As second step, a ConTA is undertaken to look at the agent-independent work functions in each situation of the current system under operation. The current control tasks can be adopted or changed depending on work functions of the new automation tools. In general, nothing new was added to this phase of CWA (Lamoureux et al. 2006; Lamoureux and Sartori 2007; Naikar et al. 2006). The Contextual Activity Template (CAT) is used as preferred tool for representing the control tasks which result from the execution of work functions in different recurring classes of work situations. It is further elaborated in the following step.

Third, the SOCA is applied to allocate functions to the agents of the reduced-crew system. The SOCA-Contextual Activity Template (SOCA–CAT) describes how tasks are distributed between the different resources of social and technical agents. It focuses on team communication and cooperation, and is useful for considering dynamic allocation of function (Stanton and Jenkins 2017). Furthermore, it served as a design advice for additional automation systems on-board of a single-piloted aircraft and at the GS. The team communication and cooperation of SOCA are analysed to understand the effects of address loss of functions that may arise from technical failures of infrastructure and new automation tools.

1.2.2 Social network analysis (SNA)

Last, SNA is applied to the SOCA to evaluate the new crew composition in context of possible failures in team interactions due to a loss of communication links. The application of new technology into a sociotechnical system can always introduce new potential sources for hazardous operations leading to off-nominal situations or emergencies (Burian 2008). Hence, three network architectures of possible team interactions in following systems configurations are constructed from the SOCA–CAT: the current existent system of MCO as baseline, RCO as they are supposed to work, and RCO containing a loss of distinct work functions which are defined by the analysts in a technical malfunction incident scenario (Houghton et al. 2015). All SOCA–CAT interactions were derived and plotted in matrices representing the social network.

In this step, we considered all work functions to involve all safety critical components of the sociotechnical system. In particular, new automation technology can create new types of incidents that are critical to system safety. These can rapidly lead to off-nominal or emergency situations, such as when outage or failure occurs. SNA can be used to assess the network’s resilience against such situations that arise from a loss of technological or communication work functions. SNA provides parameters to describe the whole network and the agents’ characteristics within it (Wasserman and Faust 1994). These metrics were calculated to compare the different networks as well as certain agents within and between the networks. Non-directed inverted weights are used for calculation since they represent interactions. Subsequently, we introduce the most important measures with reference for their interpretation. Density measures the network’s group cohesion as fraction of possible ties present in the network. It takes values between 0 and 1 and can be interpreted as the rate of participation of all agents in the network (Driskell and Mullen 2005). The network’s agents themselves are described by following nodal statistics of centrality and prestige:

  • Degree centrality CD'(ni): the proportion of the number of nodes an agent is connected to. A high value indicates an active agent that is directly or indirectly interacting with many other agents.

  • Closeness centrality CC'(ni): the inverse sum of the geodesic distances from one agent to all others. It measures how quickly an agent can interact with all others to access information. It describes how close that agent is located to all other agents.

  • Betweenness centrality CB'ni): the ratio of all (geodesic) distances between pairs of nodes which run through the node of interest. It indicates how often an agent is located between two other agents. It is a measure of potential control and assumes that communication occurs along the shortest possible path.

  • Eccentricity centrality (Harary Graph Centrality) CEcc'(ni): the inverse of the largest geodesic distance between a given node and any other node. It describes how close a node is located to every other node, i.e., to the middle of the network

  • Information centrality CI'(ni): an index of the proportion of total information flow that is controlled by one agent. The metric includes all paths between agents weighted by strength of tie and distance.

  • Page Rank Prestige PR'(ni): this measure ranks the importance of each agent based on the structure of incoming links and the ranks of the connected nodes.

There are several software tools available for SNA to calculate and visualize the parameters of the network (Huisman and van Duijn 2012). We used the Social Network Visualizer (SocNetV) Version 2.3 (Kalamaras 2015a, b) which is based on the standard reference of Wasserman and Faust (1994).

The case study of an airliner’s reduced crew demonstrates how this approach provides a useful set of techniques to analyse a system at early developmental stages of a new system. It focuses on a system whose work domain is already defined well but is altered to save costs and efforts driven by advances in technology. It integrates and connects two well-established methods of SNA to CWA to emphasize the potential of the rather neglected CWA phase of SOCA as design advice (Baber et al. 2017; Houghton et al. 2015). In doing so, the investigation of a possible loss of work functions is incorporated into SOCA, referring to a systems network’s resilience. Thus, this set of methods can be used to refine and specify a selected ConOps to support detailed design issues before prototyping implementation.

2 A case study of reduced-crew operations in commercial aviation

The most common approach to consider RCO for commercial flights is to establish a remote ground support that assists the single-pilot during such high-workload situations (Bilimoria et al. 2014; Harris 2018; Lachter et al. 2017; Stanton et al. 2016a; Vu et al. 2018). In combination with a ground (aircraft systems’ software) mirror the distributed crewing concept can be at least as resilient as current MCO in terms of the network’s architecture of possible interactions (Stanton et al. 2016a). All concepts for RCO including any type of ground support require a reliable and secure high-bandwidth data-link (Driscoll et al. 2017). No data-link can be completely reliable which is why the system has to be designed to withstand disturbances. This issue becomes even more relevant because a data-link failure on-board might coincide with a loss of the human single-pilot’s capability. Consequently, any possibility to recover from such type of incident must be anticipated and developed. Additional advanced automation tools are required to recover from pilot incapacitation in general, a data-link outage or break-up, as well as a coincidence of both events together. Data-link outage and break-up have not been investigated for RCO yet. Thus, we aimed to allocate functions in RCO specifically to tackle pilot incapacitation as well as a possible data-link failure. We integrated the most resilient concept for RCO, including ground support (Stanton et al. 2016a) together with proposals for advanced automation tools (e.g., Gaultier and SAFEE Consortium 2008; Schmitt et al. 2010). This served as a basis for our RCO ConOps at early design stages. In addition, we compared the design concept’s resilience to contemporary MCO and a data-link failure. The objective of this final evaluation was to include possible concerns with the reliability of the communications and data-link infrastructure. In fact, data-link resilience (or the lack of it) might become a limiting factor in RCO development.

The case study was selected to evaluate a pre-existing concept of reducing the crew of a system (including advanced automation tools) with issues in interactions, such as a data-link outage. This set of methods is appropriate for the beginning of a detailed design process (Harris 2018; Stanton et al. 2016a) to refine further detailed design requirements for single subsystems (ISO/TC 159/SC 4 Ergonomics of human-system interaction 2010). It involved one SME at very early stages into the design process. A commercial pilot of a bigger European airline (28; male) reviewed and validated all results of the present case study, after he had received an introduction to the method. He holds a CPL (Commercial Pilots Licence) and a frozen ATPL (Airline Transport Pilot License) having had an experience of 1800 flight hours of which 1400 were undertaken in a Boeing 747–800. In addition, he is a certified aerospace engineer familiar with current research topics. His suggestions were included into the results. The CWA tool (Version 1.00) was used to support all steps of CWA (Jenkins et al. 2007).

2.1 Work domain analysis (WDA)

System analysis and design of commercial RCO builds on current MCO in which the FO would be displaced to ground whereas the Captain remains on the flight deck. Retrofitting current aircraft models would not be economically viable because the whole flight deck needs to be equipped with a ground override system (Driscoll et al. 2017). Hence, the development of a new aircraft model enables adding novel automation tools to recover from all possible hazardous events on-board of the single-pilot aircraft. There are many types of technical incidents and failures (Bailey et al. 2017; Harris 2018) usually characterized by high workload as well as human-related incidents like pilot incapacitation, homicide–suicide (Kenedi et al. 2016), and terrorist attacks. Consequently, we adapted the WDA of MCO by Stanton et al. (2016a) by the addition of the purpose-related function of “Recover” (Fig. 1). This function must fulfil three purposes: pilot health monitoring, aircraft systems monitoring, and passivation to be able to deal with these incidents. We illustrate each of these functions with a reference to validated system prototypes.

Fig. 1
figure 1

A detail of the Abstraction Hierarchy (AH) of current commercial aviation operations with the elements added to enable Reduced-Crew Operations (RCO; in white)

Full size image

Pilot health monitoring refers to one of the five legacy issues which have to be solved in RCO (Johnson et al. 2012). It should prevent a loss of control due to an in-flight incapacitation in RCO. In general, a system that monitors physiological parameters as indicators for the single-pilot’s physiological health state is required to assess his cognitive capacity (Bilimoria et al. 2014). This system is supposed to detect a decrease in physiological parameters and an incapacitation. Current solutions are less matured and further research is needed to elaborate them for actual use on-board of an aircraft (Çakır et al. 2016; Gateau et al. 2018; Liu et al. 2016; Maiolo et al. 2017; Oliveira et al. 2012).

Aircraft systems’ monitoring refers to assessing behavioural actions regarding control of the aircraft such as entries into aircraft systems and control actions. Hazardous system operations such as terrorist attacks or an attempted pilot homicide–suicide (Kenedi et al. 2016) falls among these behavioural hazards. These operations would jeopardize flight safety which is why they should be detected and prevented (Etschmaier and Lee 2016). For example, the EU-project SAFEE (Security of Aircraft in the Future European Environment) provided technologies which tackle hazardous human flight operations in MCO (Gaultier and SAFEE Consortium 2008; Laviv and Speijker 2007) and could be transferred to RCO as well. The on-board threat detection system detects unauthorized access to the aircraft such as an attempt to hijack or crash the aircraft. The threat assessment and response management system assesses the detected incident and recommends an appropriate response action. The prototype was tailored to a few validation scenarios in MCO. Nonetheless, initial efforts have been made to specifically define a system’s architecture and corresponding variables which limit human inputs to a safe range dependent on the status of the aircraft and environment (e.g., Etschmaier and Lee 2016; Etschmaier et al. 2014a, b).

In this way, an airliner is protected against critical human-made incidents including terroristic acts. Followed by an evaluation control can be automatically switched to ground to land the aircraft safely at an adjacent airport. A passivation system passivates aircraft systems and allows it to land automatically at an adjacent airport. Technologies as used for Unmanned Aerial Vehicles (UAVs) could be applied in this case. In SAFEE (Gaultier and SAFEE Consortium 2008; Laviv and Speijker 2007), an emergency avoidance system was foreseen for this purpose. A flight reconfiguration function of the subsequent EU-project SOFIA (Safe automatic flight back and landing of aircraft; Bueno et al. 2010) complemented it by enabling a safe and automatic return to ground. In connection, a ground operator can either monitor or support the procedures.

All three RCO work functions require pilot health monitoring devices as new physical objects for technical implementation. Hence, we added them on the fifth level of the AH. The basic infrastructures of a (quad-redundant or better) ground override system on-board of the single-piloted aircraft and a data-link via C-band satellite system (Driscoll et al. 2017) are inherent in the means-ends links of the AH. The ground override system would have, as partially shown in Fig. 1 links into many locations of most physical objects (and aircraft systems). The GS of the remote-copilot will access and operate the same systems of the single-piloted airliner via a satellite data-link which is why they are not listed separately. This AH represents the work domain of imaginable future RCO including current technological developments.

2.2 Control task analysis (ConTA)

The ConTA of MCO by Stanton et al. (2016a) was adopted and extended by the three novel work functions of pilot health monitoring, aircraft systems monitoring, and passivation. The CAT is represented within the SOCA–CAT in the next section of SOCA (Fig. 3). All other work functions remained to fulfil the purpose-related functions of aviate, navigate, communicate, manage and warn. Hence, all control tasks related to them are not changed. Only the extension of WDA by the purpose-related function of ‘recover’ is required in addition of the three functions named above. All three are conducted in all flight phases to detect, assess and recover from any off-nominal or emergency situation. For example, pilot incapacitation can occur during the whole flight requiring permanent (automated) health monitoring to enable a recovery. The same accounts for any hazardous human operations. Consequently, the affiliated passivation systems are also available during whole operations.

2.3 Social organisation and cooperation analysis (SOCA)

In contrast to MCO, the copilot is displaced to ground at a GS. He remotely monitors and operates aircraft functions. This loss in the crew’s redundancy requires a new high-level ConOps to refine the function allocations of the control tasks in RCO. A dedicated support by this remote-copilot is the common approach to tackle high workload and emergency situations in RCO (Bilimoria et al. 2014; Lachter et al. 2017; Stanton et al. 2016a; Vu et al. 2018). High workload characterizes the departure and arrival phases of flight (European Commission 2015; Federal Aviation Administration 2001) which is why we allocated mandatory support by a remote-copilot (Fig. 2).

Fig. 2
figure 2

The concept of reduced-crew operations including a remote-copilot as ground support depending on flight phase. Grey shading represents mandatory flight planning and navigation support

Full size image

A related specialist ConOps is the so-called harbour pilot concept (Vu et al. 2018). A remote-copilot can complete 4–6 arrivals for one single-piloted aircraft successively which makes it a viable ConOps especially for busy hub airports (Koltz et al. 2015). They conducted monitoring functions, including communication management and navigation in half of the trials whereas they took over the duties of a pilot flying in the other half. In this way, the harbour pilot offered expertise knowledge and support in aircraft-related information depending on current environmental conditions. In the present study, the single-pilot remains in command and control of the aircraft whereas the remote-copilot keeps monitoring functions in normal operations.

The detailed function allocations for normal operations are represented in the SOCA–CAT of RCO in Fig. 3. During cruise the single-pilot operates the aircraft alone. Lavatory, eating, checking on abnormalities, and any activity breaks are classified as off-nominal: “any situation that is out of the idealized norm of NextGen operations with the exception of emergencies” (Burian 2008). In these situations, the remote-copilot would supervise aircraft automation and take over urgent single-pilot’s work functions. Hence, the remote-copilot is not depicted during cruise in the normal SOCA–CAT. Off-nominal situations also cover missed approach and delays in ground operations due to bad weather. Off-nominal situations are out-of-scope of the present paper. If an off-nominal situation persists or an emergency occurs an emergency landing is prepared at the start of an arrival phase. The SOCA–CAT (Fig. 3) is applicable to all these situations in which command and control remain with the single-pilot. In case of a loss of control by the single-pilot the remote-copilot overtakes all of the single-pilot’s work functions to land the aircraft. Therefore, the remote-copilot is involved in the function of passivation, which includes taking over control in emergencies.

Fig. 3
figure 3

Social Organisation and Cooperation Analysis Contextual Template (SOCA–CAT) representing the function allocation in Reduced-Crew Operations (RCO). Please refer to online reference for readability

Full size image

Optional support of distributed team(s) (members) has already been suggested by several researchers (Harris 2018; Schmid and Korn 2017; Stanton et al. 2016a). For example, the engine manufacturer could supply support to the single-pilot in case of engine failures (Harris 2018). This belongs to real-time engineering support which would be located at the level of the aircraft (and engine) manufacturer (Schmid and Korn 2017; Stanton et al. 2014a). The same accounts for an imaginable pilot support program which could support health issues during flight. Such scenarios are anticipated but represent an exception; hence they are out-of-scope of the present paper.

An initial and very broad view on possible workload complements SOCA. This workload assessment is a rather formative approach to give initial insights (Stanton and Jenkins 2017). Table 1 lists the total amount of object-related processes each agent potentially conducts per flight phase. The object-related processes represent the work functions that are conducted by the physical objects to perform the purpose-related functions. Figure 3 lists all object-related process as work functions in detail per flight phase and agent(s). In general, only the values of total object-related processes of the remote-copilot for in-flight incapacitation are slightly higher. This indicates caution in future interface and procedure design but cannot be evaluated any further yet. It would require human-in-the-loop simulations to assess workload it in detail. A first quantification of workload in commercial SPO with convenient high fidelity flight simulations of the current cockpit interfaces and systems confirmed an increase in workload accompanied by a decrease in safety and performance compared to MCO (Bailey et al. 2017). Nonetheless, the crews and single-pilots could deal with all failure modes during flight. It emphasizes the need for new advanced automation tools as discussed above. A SNA regarding the network’s resilience in RCO further illustrates how safety can be compromised in RCO without ground support.

Table 1 Number of object-related processes each agent is associated with given phases of flight in RCO normal situations
Full size table

2.4 Social network analysis (SNA)

The loss of functions of all ground-based support which can occur due to a data-link outage or complete failure has to be investigated because this technology provides the safety critical components of RCO. The support by a remote-copilot and possible other teams is essential to overcome the loss of redundancy of a second pilot on-board. Hence, a loss of this redundant functionality which was built in to compensate the legacy issues like pilot incapacitation impacts the whole sociotechnical system. Its overall resilience against all types of failures would change which is why it has to be considered early in the design process.

We considered all possible interactions in MCO (from Stanton et al. 2016a) and RCO to compare them to the possible interactions during a data-link outage in RCO. Table 2 shows the functional loadings of all scenarios retrieved from the SOCA–CAT (Fig. 3). The functional loadings represent the sum of object-related processes/work functions on one agent retrieved from the SOCA–CAT. In other words, they estimate the amount of different work functions occurring simultaneously for one agent. The network of RCO shows a comparable density in sum across all flight phases. We subdivided them into three main sections to focus on the function allocation made for RCO. The higher density of RCO in departure is due to the additional automation tools in combination with the remote-copilot. The single-pilot shows slightly higher functional loadings in cruise in which he operates the aircraft on his own. The higher loadings of aircraft automation reflect the addition of advanced automation tools for pilot health and aircraft systems’ monitoring as well as passivation. In sum, MCO and RCO’s network’s descriptive values remain similar to each other in normal operational conditions.

Table 2 Functional loadings of the entire flight scenario for multi-crew operations and reduced-crew operations in normal operations and data-link break-up
Full size table

A data-link break-up decreases the network density in all sub-phases of flight except departure. In departure, density remains equal but shows much higher functional loadings of the single-pilot in case of a data-link loss. The issue of workload due to many more work functions becoming the single-pilot’s responsibility is apparent across all flight phases in the data-link outage scenario. The lower density of this network in RCO indicates lower network resilience in comparison to normal MCO and RCO. It characterizes an emergency situation due to high workload on the single-pilot in combination with a loss of redundant recovery options provided by remote-support. It includes all new advanced automation tools. Hence, we further consider the nodal statistics to understand the agents’ altered position in RCO when the data-link fails. Hereby, we used visual analysis to compare the standardised SNA metrics of the three different system configurations on a high-level (Houghton et al. 2015).

Table 3 shows the nodal statistics for the most important agents in MCO, RCO and the corresponding data-link loss scenario across an entire flight. The Pilot Flying (PF; MCO) and single-pilot (RCO) can interact with all other agents being located close to them [degree centrality; CD’(PF) = 0.21; CD’(Single-pilot) = 0.22; closeness centrality; CC’(PF) = 1.95; CC’(Single-pilot) = 1.89], have the same potential control over information [betweenness centrality; CB’(PF) = 0.00; CB’(Single-pilot) = 0.00], are close to every other agent [eccentricity centrality; CEcc’(PF) = 1; CEcc’(Single-pilot) = 1], control the same percentage of information [information centrality; CI’(PF) = 0.12; CI’(Single-pilot) = 0.12], and are most important [PageRank prestige; PR’(PF) = 1; PR’(Single-pilot) = 1]. In data-link break-up, the single-pilot is located much more in the middle of the network [CC’(PF data-link) = 3.21], can more quickly access information [CD’(PF data-link) = 0.46], and controls more information [CI’(PF data-link) = 0.15]. This characteristic is twofold because the single-pilot can react more quickly to any environmental condition but can become overloaded in case of data-link loss. Therefore, data-link break-up can be defined as an emergency in RCO (Burian 2008) since a loss of control resulting from high workload without any recovery option is undesirable.

Table 3 The nodal statistics of the Social Network Analyses (SNA) for the four most important operators
Full size table

The general shift from MCO to RCO is described in comparing the Pilot Monitoring (PM) to the corresponding remote-copilot. We can consider the remote-copilot as a similar role to the PM. The remote-copilot is comparably less in contact with all other agents [CD’(Remote-Dep.) = 0.14] and is slightly less important [PR’(Remote-Dep.) = 0.88]. During arrival, the remote-copilot can access information from other agents less quickly [CC’(Remote-Dep.) = 2.16; CC’(Remote-Arr.) = 1.88], controls much less information flow during arrival [CI’(Remote-Dep.) = 0.12; CI’(Remote-Arr.) = 0.02] and is less important [PR’(Remote-Arr.) = 0.43] than in departure. These differences might be caused by the fact that the remote-copilot supports the single-pilot on its own and does not need to communicate with any ground operators other than ATC, as it is the case during departure and arrival. This is especially apparent with betweeness centrality. This value is much higher for the departure remote-copilot [CB’(Remote-Dep.) = 0.58] than for any other agent. It does mean that others than him are more often connected between pairs of agents which are the ground operators during flight preparations and handling on ground. The arrival remote-copilot does not need to communicate with other ground operators than ATC in normal situations. Hence we do not over interpret these small differences between departure and arrival. In general, the remote-copilot remains comparably resilient as the PM with alterations in the network’s position which make him less central.

In sum, these results point out that a data-link break-up critically affects flight safety by having lost the redundancy of ground support. This RCO specific support is anticipated to distributed workload in any off-nominal situation that potentially overloads the single-pilot. Hence, the data-link outage emergency has significant potential for injury, loss of life, and/or severe damage to aircraft, equipment, or infrastructure (Burian 2008; Burian et al. 2005). UAVs apply several different graded solutions to compensate a data-link loss (Mouloua et al. 2001). First, a supervisory flight management of on-board automation automatically pursues a pre-programmed flight trajectory for short-term data-link outages. Second, the UAV can automatically activate a return-to-base function and land safely when the data-link is completely lost.

In general, data-link applications for RCO have to manage a considerable amount of data. This is only possible via Control and Non-Payload Communications (CNPC) links which enable highly reliable, low-latency, and secure two way communications but with usually low data rate requirements (Yong et al. 2016). They are currently used by UAVs. Hence these links are used for safety critical information such as command and control information, aircraft status reports from air to ground, and sense-and-avoid data of UAVs. Nonetheless, a cryptographic latency problem remains that very high-speed communication with high bandwidth require a special hardware encryption whereas low latencies are difficult to achieve (Driscoll et al. 2017). RCO requires this type of data-link with rather low latencies. Taken together with the impacts on the network’s resilience and subsequent operational issue of high workload and no redundant recovery option RCO have to include a solution on how to mitigate a data-link loss.

The dual-graded solutions of UAVs can be transferred to a single-piloted airliner and combined with its automation technologies. When the data-link fails for a predefined short time period the aircraft systems’ monitoring could activate the supervisory flight management system to pursue the pre-programmed trajectory. The nature of a loss of data-link is defined by a longer time period during which the system fails to re-establish a connection to ground. The single-pilot would always be alerted on data-link outage or failure. In latter case, the aircraft has to land as soon as possible to minimize the likelihood of an overload and incapacitation of the single-pilot in further course of flight. Hence, the single-pilot is required to declare an emergency and land the aircraft by an automated landing system at an adjacent airport. SNA finally complemented SOCA by analysing a loss of work function in RCO which result from the new type of technical failure of data-link break-up. The network’s resilience suffers being accompanied by a higher workload on the main operator (the single-pilot) which is why initial solutions have been proposed.

3 Conclusions

The present paper introduced a set of widely established CWA phases combined with SNA to refine reduced-crew concept in commercial aviation. In contrary to first-of-a-kind systems (Lundberg et al. 2018; Naikar et al. 2003) behaviours of the workers in the current system are already well known (Stanton et al. 2019). Since the aviation is shaped by legacy systems (Harris and Stanton 2010; Maier 1998) a reduction in crew requires both flight deck function allocation and advanced automation tools. The methods connect the higher-level evaluation with detailed design in the overall design process by providing design advice as for example for future monitoring systems. They extend the function allocation by an early theoretical evaluation of the network’s resilience due to a loss of functions which can result among others from new automation tools. In doing so, recovery options can be anticipated and implemented in the later technical development to solve legacy issues like pilot incapacitation.

WDA provides the foundation for having modelled the constraints of the problem space in which the (reduced) crew of the system under analysis operates (Stanton and Jenkins 2017). As in our example, the AH is considered to specifically evaluate the present work domain and check where the system can be extended to fit future requirements of the reduced crew. Adding new purpose-related functions can become inevitable when different object-related processes are assigned to automation likewise to compensate the crew reduction. This update of the sociotechnical system might be accompanied by an addition of physical objects in the workers’ environment. In RCO, the issue of the lost redundancy of a second pilot on-board including a possible single-pilot incapacitation requires a possibility to administer a recovery from such emergencies which include a loss of control on airside. Hence, the object-related processes of pilot health monitoring, aircraft systems monitoring, and passivation had to be added including health monitoring devices on the physical level. They complete the function of recovery. In this way, WDA completed establishing a ConOps, a function analysis of the system, and began to lay a base of an operating procedures specification and of allocating function for the reduced-crew configuration of an airliner.

ConTA and SOCA both allocate functions to the agents of RCO on a base of an analysis of current MCO (Stanton et al. 2016a). A high-level model of function allocation is accomplished which is further used in following theoretical evaluations. A first and very broad workload assessment can be made based on counting the numbers of work functions conducted by one agent simultaneously. Of course, we refer to assess and evaluate mental workload empirically by standard methods in case of interest (Young et al. 2015). Furthermore, we retrieved the functional loadings on the agents from the SOCA–CAT to evaluate the social network of the possible interactions in RCO in normal situations and when the data-link is lost. SNA provided detailed results about the network’s resilience against a loss of data-link and about the characteristics of interactions each agents is exposed to. Data-link loss clearly poses a hazard for flight safety in RCO. These results can be further used to proceed with job and interface design. The requirements and boundaries of the work environment that captures all possible occurring situations are specified.

In general, all results of this analyses can be used for design advice and interface design in the subsequent design process. Here, the CWA-DT can be applied to integrate results in the overall design process. We have not conducted the other two phases of CWA yet because they focus on different design issues. STA mainly deals with operating procedures specification to additionally advice the design of interfaces (Naikar 2006; Stanton and Jenkins 2017). It investigates how activities can be conducted. WCA deals with investigating the operators’ behaviour that is required to complete the tasks. This last phase of CWA is based on the work requirements which were defined and analysed in the previous phases. Hence, it complements a target audience description and design advice. Both, STA’ and WCO’ design purposes become more important later on in the design process and are out of the scope of the present paper.

As the present work strengthens the link between CWA and SNA, the issue of validity has to be raised against the background of a theoretical analysis and evaluation technique. As such, the subset of methods from CWA including SNA aims to analyse the work domain and allocate functions of a reduced-crew configuration of the system with respect to a possible loss of new automation technology. This is how we can apply SNA in the SOCA phase to construct interaction networks of the agents to obtain a preliminary risk assessment. This step is useful to investigate the effects on the agents’ interactional characteristics to any type of loss of (human and/or non-human) function(s) of the system under analysis. If someone aims to study communications and their management in depth we recommend adding an observational scenario of the system under analysis at a later stage in design process. SOCA–CAT and SNA can only serve a model of a high-level evaluation of possible interactions which is nonetheless valuable to include them into early design stages.

SNA metrics themselves represent a form of analysis which has been not common in the CWA community yet (Baber et al. 2017; Houghton et al. 2015). The major criticism is that the SNA nodal statistics can be reductionist in describing how actors and functions relate to each other in terms of interactions. Nonetheless, the method theoretically illustrates how the network structure inherent in possible interactions from SOCA can differ depending on factors like crewing and availability of work functions. The risks that one should take into account are the assumptions that have to be made to retrieve interactions as type of communication from the SOCA phase of CWA. When two or more agents conduct a work function it does not necessarily mean that they have to interact with each other (Baber et al. 2017). Hence, the different probabilities of agents engaging in any kind of communication to perform a work function might differ. The present analysis does not take it into account. SNA in combination with the SOCA phase represents a rather formal approach to model the boundaries of interactions. Actual patterns of communications might deviate from these models are recommended to be investigated later in the design process.

Last but not least, the results of the modelling in this paper require validation from empirical human-in-the-loop simulations. For example, the Event Analysis of Systemic Teamwork (EAST) can be applied to model among others social networks of team performance in an observational study of system operations (Stanton et al. 2018). At this point, initial empirical investigation of single aspects in SPO of commercial airliners like workload quantification (Bailey et al. 2017), collaboration tools for the ground operator (Lachter et al. 2017; Vu et al. 2018) match the anticipated assumptions of higher workload without ground support. Unfortunately, none of the studies investigating commercial RCO empirically provides a methodology like EAST to model the interactions to the best of the authors’ knowledge. Thus, the advantage of the methodology of the present paper is as follows. Whereas the collaboration tools represent only a piecemeal suggestion on how to handle different situations the CWA in combination with SNA address the whole sociotechnical system of imaginable future RCO before systems’ implementation. In doing so, the method enriches the design process by including issues which arise from de-crewing early into detailed design steps no matter of which nature they are. The three phases of CWA including SNA integrate different design issues in a structured way into an early stage of the design process of RCO: defining a ConOps, function analysis, function allocation, analysis of possible interactions, to parts operating procedures specification, and a design advice in general. The proposed subset of methods identifies the requirements for new automation tools and enables to anticipate the effects of off-nominal and emergency situations on the overall system. In doing so, this work has drawn more attention to the design potential of the SOCA phase which has been a rather neglected phase of CWA (Stanton and Jenkins 2017). We hope to encourage taking up SNA as a core element into SOCA of CWA and giving SOCA more attention. The methodology fosters evaluating resilience in terms of the a network’s architecture between concurrent (mal)function allocations of a sociotechnical system (Houghton et al. 2015).