Modelling distributed crewing in commercial aircraft with STAMP for a rapid decompression hazard

Abstract

Changes to crewing configurations in commercial airlines are likely as a means of reducing operating costs. To consider the safety implications for a distributed crewing configuration, system theoretic accident model and processes (STAMP) was applied to a rapid decompression hazard. High level control structures for current operations and distributed crewing are presented. The CONOPS generated by STAMP-STPA for distributed crewing, and design constraints associated with unsafe control actions (UCAs) are offered to progress in the route to certification for distributed crewing, and improve safety in current operations. Control loops between stakeholders were created using system-theoretic process analysis (STPA). The factors leading to the Helios 255 incident demonstrated the redundancy that a ground station could offer without the risk of hypoxia, during a decompression incident. STPA analysis also highlighted initial UCAs that could occur within the hypothetical distributed crewing configuration, prompting consideration of design constraints and new CONOPS for ground station design. Practitioner Summary: SPO in commercial aircraft is likely as a means to reduce costs. This paper makes a case for distributed crewing using STAMP-STPA. Comparing current operations with a distributed crewing configuration, the redundancy offered by a ground station is demonstrated. Design constraints and new CONOPs for distributed crewing, and current operations are proposed.

A future airliner’s reduced-crew: modelling pilot incapacitation and homicide-suicide with systems theory

“…STAMP and STPA have been applied mostly retrospectively to a series of incidents and accidents in aviation and aerospace as well as in transport and military, whereas the predictive use of both methods is less widespread in the peer-reviewed literature (e.g. Allison et al 2017;Fleming and Leveson 2014;Ishimatsu et al 2014;Leveson 2004b;Plioutsias et al 2017;Revell et al 2018;Rong and Tian 2015). STAMP as a causal model of its corresponding hazard analysis STPA uses the basic tenet of systems theory to explain accidents and their causality holistically (Leveson 2017).…”

“…They all establish different types of remote ground support to provide assistance during high-workload situations and emergencies. Nevertheless, the issue of pilot incapacitation per se has only been addressed in very few studies on RCO (Revell et al 2018;Stanton et al 2016;Stanton et al 2019). Hence, the present paper's aim is to model pilot incapacitation and its potential effects.…”

“…Furthermore, STAMP and STPA have been rarely applied in a predictive context to evaluate future designs of complex sociotechnical systems (Fleming et al 2013;Grant et al 2018;Leveson 2015). There are notable exceptions, such as the STAMP analysis of a rapid decompression event for SPO (Revell et al 2018). This major advantage of STPA enables evaluating a design concept such as a RCO in early stages of the development process.…”

Evaluating the reduced flight deck crew concept using cognitive work analysis and social network analysis: comparing normal and data-link outage scenarios

“…The ISO norm is used during the design process and describes its main stages and iterations whereas the CWA-DT provides tools on how these results can further be integrated into the future design process. We begin at the stage where we have already decided that the crew of an airliner will be reduced by the copilot and supported by a ground-based remote-copilot due to the reasons outlined above (Harris 2018;Revell et al 2018;Stanton et al 2016a;. We introduce a CWA-based technique to evaluate a specific design concept against possible system failures of new technology on theoretical level to proceed with detailed design.…”

“…Other systemtheoretic approaches to accident modelling have agreed in the trend that support by a remote-copilot to a single-pilot can be advantageous over the current crewing configuration and other options of distributing the crew. Examples are rapid decompression (Revell et al 2018), a laser attack , and a hypothetical Kegworth accident scenario (Harris 2018). A series of empirical studies has investigated different setups of GSs including a ground operator as either super-dispatcher or remotecopilot providing support to multiple or one single-pilot aircraft in different situations (Lachter et al 2017;.…”