A Socio-Technical Simulation Model for the Design of the Future Single Pilot Cockpit: An Opportunity to Improve Pilot Performance

The future deployment of single pilot operations must be supported by new cockpit computer services. Such services require an adaptive context-aware integration of technical functionalities with the concurrent tasks that a pilot must deal with. Advanced artificial intelligence supporting services and improved communication capabilities are the key enabling technologies that will render future cockpits more integrated with the present digitalized air traffic management system. However, an issue in the integration of such technologies is the lack of socio-technical analysis in the design of these teaming mechanisms. A key factor in determining how and when a service support should be provided is the dynamic evolution of pilot workload. This paper investigates how the socio-technical model-based systems engineering approach paves the way for the design of a digital assistant framework by formalizing this workload. The model was validated in an Airbus A-320 cockpit simulator, and the results confirmed the degraded pilot behavioral model and the performance impact according to different contextual flight deck information. This study contributes to practical knowledge for designing human-machine task-sharing systems.


I. INTRODUCTION
Pilots have to perform multiple concurrent tasks in the flight deck. The tight time constraints these tasks must be attended to, has been the main driver in the deployment of different component functionalities [1] to lessen the pilot flying (PF) and pilot monitoring (PM) workload. Analogous to the airside, the Air Traffic Controllers (ATC) control work position (CWP) has been modernized with new functionalities [2] to better support their monitoring and decisionmaking actions.
The information provided by supporting tools to the human operator (e.g. PM or ATC) can have similar consequences at the cognitive level as an interruption. The effects include The associate editor coordinating the review of this manuscript and approving it for publication was Arianna Dulizia . attending the interrupting task and disruptive effects on postinterruption performance [3].
The importance of interruption management [4] for a smooth integration into the ongoing tasks to avoid a negative impact on human performance have been investigated in several works. Increase in post-interruption times [5], error rates [6] and perceived workload [7] have been reported. Whereas, Cellier et al. [8] report a motivation for compensatory behavior.
For this objective, different workload (WL) analysis tools such as ''Control Work Domain'' [9] and the application ''Control Task Analysis'' [10] have been used to design work positions that guarantee the efficient management of the assigned duties under nominal conditions. These WL analysis tools attempt to provide better comprehension by interviewing Subject Matter Experts (SME) about the cognitive demand of each task. However, there is little evidence of validation studies to analyze the effects of interruptions in a complex time-sensitive socio-technical system [11].
Pilots have been trained with formal written procedures, acquiring the skills for setting switches, buttons, or introducing data in flight systems at different phases of flight. In fact, pilots have the impression that the procedures are linear, that they have full control of their execution, and that the procedures flow uninterrupted [12].
At the training level, the role of procedures in the flight deck can be seen as a guide for actions that tell the pilot what, when, and how to do a task. In addition to this role, procedures also provide a task-sharing mechanism with other actors (that is, PM and ATC), which rely on a collective reading of the procedure.
This organized task delegation should create a shared action plan enhanced by a ''mental template'' to act, synchronize actions, and manage time. Furthermore, under nominal conditions and the absence of interrupting events, welltrained PF -PM can manage different concurrent tasks with present automation and cockpit supporting tools.
Unfortunately, there is a gap between the procedure instructions at the training level and the implementation of procedural actions at the practitioner level [13]. In addition to the fact that the PF performance variability depends on a variety of human factors such as fatigue, stress, workload, or operational pressure, the interruption of a procedure by an internal or external event fires a set of PF mental actions to determine the time criticality at which a response should be taken while analyzing the consequences of postponing the current set of procedural actions.
For each flight deck interrupting event, the PF is responsible for deciding whether to finalize the present task before attending the communication message or suspending it to attend the communication message. Thus, the PF workload is increased by the concurrency of current actions plus the added interrupting decision-making process. As a result of the concurrency of more than two actions, a pending memory action is created at the cognitive level, which has an important impact on PF performance. This paper presents a methodology that relies on a sociotechnological cockpit model validated in the E-PILOTS [14] project, as an effective approach to enhance the functional integration of cockpit supporting tools with non-functional cognitive factors. The main contribution of the paper is a modelling methodology to formalize the hidden dynamics that underly in the human interaction with intelligent entities to consolidate a real symbiosis, in which the human operator and the smart services must adapt dynamically to each other and cooperate to achieve common goals.
The methodology is described in the paper through a very demanding use case in which the pilot can be overloaded by concurrent events and it is necessary to identify when and how cognitive supporting services can improve the pilot performance in the cabin. The design of future cockpits for the single pilot operation framework [15] will require a bet-ter knowledge of human-in-the-mesh behavior to avoid the deleterious effects of auditive or visual interruptions that new digital assistants could rise.
The remainder of this paper is organized as follows. In Section II, a literature review is summarized. Section III describes the socio-technical components that interact in a cockpit. Section IV elaborates the FRAM methodology to formalize the reliable anticipated technical dynamics with context-aware pilot behavior, and Section V provides test evidence and validated results. Finally, Section VI discusses the achieved outcomes while Section VII discusses the limitations and Section VIII concludes the paper.

II. RELATED WORK
The modeling of the human operator performance as well as the analysis of the human operator behavior to improve the overall system performance has received more attention by interdisciplinary research teams. In Industry 4.0 [16], the improvement of some key performance indicators (KPI's) requires a proper integration of automation with human operator on going tasks, to provide the right supporting services at the right time.
Early works on the static analysis of manual human task components have its roots on the Task Analysis techniques described by [17], [18]. The increase in the complexity of tasks for different work positions, has resulted in the extension of the original Task Analysis technique, such as Hierarchical Task Analysis (HTA) and Cognitive Task Analysis (CTA). The increase in the complexity of present concurrent human task in different work positions with computerized supporting services has resulted in the extension of the original Task Analysis technique, such as Hierarchical Task Analysis (HTA) and Cognitive Task Analysis (CTA). In [19] more than 100 different task analysis methods are compiled. Some analytical tools have also been developed at research level to support proposed task analysis methods such as for example TaskArchitect [20] or the implementation of human performance models in generic simulation frameworks such as MicroSaint [21].
Task Analysis methods cannot simultaneously represent human operators [22] as a set of dynamically bounded cognitive resources and the environmental components that influence human actions. Therefore, the majority of Task Analysis works focus on a limited subset of interactions between mainly physical actions such as MTM [23] or only cognitive processes [24].
More recently, agent-based simulation models have been implemented to consider the diversity of human profiles with varying levels of skills and expertise. Agents can express a large variety of behavioral patterns influenced by specific processes and characteristics of the human under study supporting the specification of a wide range of cognitive and affective aspects that influence their behavior. In [25] the use of UTASIMO for task analysis is described, while [26] outlines a socio-technical agent-based approach to analyze the impact of ATM hazards.
The limitations of Task Analysis methods seem to be overcome by agent-based simulations. However, there is a lack of formalism to describe the interdependencies among human cognitive and technical resources to implement concurrent tasks.
Furthermore, agent-based models are recognized to generate ''emergent behavior'' as a result of stochastic agent interactions, which is a barrier to identify the causes of system failures in which human performance is critical [27]. Higher fidelity human performance models can be achieved by reducing the scope of the dynamics to be formalized. In [28] pilot-in-the-loop dynamics are described while ergonomic cockpit design is described in [29], [30], but the lack of a modelling formalism constrains drastically a holistic approach to work position.
The analysis of human performance variability which can lead to human error in safety critical systems, requires a different modeling approach to formalize those dynamics that can cause failures in order to design the right mitigation mechanism. Functional Resonance Analysis Method (FRAM) has been successfully applied to model a high diversity of socio-technical systems in which timed and un-timed interdependencies among cognitive and technical resources can be formalized together with contextual information such as procedures and goals. Tian et al. [31] provide a review of FRAM models developed for safety analysis in aviation. However, reported analysis are qualitative or semiquantitative using stochastic methods useful only to re-create the emergent behavior of un-modeled dynamics. In this paper, we extend the FRAM formalism to analyze human performance by means of a quantitative causal approach when variability is caused when a human performs several concurrent tasks in a very demanding operational context. This research paves the way for the design of cognitive computing supporting services to human operators that can be overloaded by un-opportunistic interruptions that usually appears when performing concurrent tasks.

III. COCKPIT SUBSYSTEM COMPONENTS
Flight deck components are integrated considering functional requirements and are distributed in the cockpit, considering ergonomic factors [32]. Figure 1 shows the main technical components of the A320 aircraft cockpit.
• Flight Control Unit (FCU): This sub-system is designed to allow the pilot to set values that control the aircraft, such as the guidance modes, the vertical speed, heading, match, altitude and latitude, among others.
• Electronic Flight Instrument System (EFIS): This sub-system is designed to allow the pilot to set barometer parameters, set different navigation modes (ILS, VOR, NAV, ARC, PLAN), set ranges (10, 20, 40, 80,160, 320 NM), and visualize some parameters such as the pressure (QNH), among others.
• Primary Flight Display and Navigation Display (PFD-ND): This sub-system is designed to provide aircraft information such as speed, heading, altitude, flight modes, and aircraft restrictions and limits.
• Electronic Centralized Aircraft Monitoring (ECAM): This sub-system is composed of two more subsystems with an upper display to inform the engine parameters, flaps, and slap position and unable systems, and a lower display that provides flight data and status messages.
• Multipurpose Control and Display Unit (MCDU): This sub-system allows the definition and selection of a flight plan. The pilot introduces performance data after take-off or during the flight, and the system generates the climb and descent profiles, as well as the progress of the flight plan.
• Auto Thrust (A-Thr): This sub-system allows the PF to control the engine position (IDLE, CLIMB, TOGA).
• Side Stick (Side-st): Allows the pilot to give pitch and roll instructions to the flight computers.
Besides the technical components, latest evolution on enabling technologies from the artificial intelligence community paves the way to upgrade the cockpit with new AI services to improve the flight performance. The implementation of a machine learning algorithm to inform pilots about the probability of a hard landing is described in [33], which enhance pilot to anticipate an informed go around procedure. Some AI services that could be integrated in a flight digital assistant [34] has been summarized in the E-Pilots roadmap [14], where some of the most relevant are the voice recognition to process the ATC instructions, predictive fault detection to anticipate potential aircraft abnormal scenarios, and shared situational awareness services among ATC, Pilots and the Flight Operation Center.

A. HUMAN IN THE LOOP
The right spatial distribution of all these sub-systems considering ergonomic factors together with the proper integration of the different supporting functionalities has been  key to reduce pilot workload and improve flight efficiency and safety. Regardless of whether pilots are flying manually, or autopilot is engaged, the flight computers continuously monitor pilot or autopilot inputs, aircraft states, and environmental states (e.g. winds) to ensure a stable aircraft configuration.
Similar to aircraft computers, pilots continuously monitor aircraft states and environmental information to ensure a safe flight. This constant pilot monitoring task is the basis for pilot situational awareness (SA) [35] and relies on the basic concept of pilot in the loop structure. Figure 2 provides a basic description of this structure, which relies on a feedback loop that allows the pilot to maintain situational awareness about aviation tasks.
As can be observed in Figure 2, even though the autopilot is controlling the aircraft (''flight systems feedback loop'') the pilot preserves SA by monitoring the cockpit displays, understanding the information, and thinking ahead. Formal written procedures allow pilots to acquire the skills for setting switches, buttons, or introducing data in flight systems at different phases of flight. Figure 3 extends the structure presented in Figure 2 by considering navigate and communicate procedures. Thus, skilland rule-based tasks should allow trained pilots to sequence the different actions formalized in each procedure.

B. HUMAN IN THE MESH
The description of the human-in-the-loop scenario gives the impression that the procedures are linear, flow uninterrupted and that the pilots have full control of their execution. Unfortunately, pilots are frequently interrupted while performing a procedure using cockpit subsystems (that is, internal events), such as an ECAM cautions or warnings or external events such as ATC communications. Regardless of the particularities of the interruption, pilots must carefully screen the information attached to the interruption to determine its relevance.
Unlike planned procedures in the different phases of flights, the time an interruption will emerge in the flight desk cannot be planned. Furthermore, any interruption will raise a set of mental actions just to determine the time criticality at which a response should be fired while analyzing the consequences of postponing the present procedure. Both the time criticality of an interruption and the projection of the aircraft state are unpredictable, which means that pilots cannot be trained to plan in advance how to interleave the interrupting activity into the ongoing flow of tasks.
In [36], a Skill-Rule-Knowledge framework is described, providing a mapping of the cognitive resources required to perform different tasks. The less demanding behaviors in terms of cognitive resources and active control are wellestablished procedures carried out on the basis of established patterns called skill-driven behaviors. Pilot-in-the-loop aviate tasks are examples of this group. Complex activities that regularly require the active involvement of a human operator can be modeled as rule-driven behaviors.
Note that a change in procedure by a planned navigation or communication goal belongs to this group. Finally, when the situation is novel, critical, or very complex, the highest cognitive resources, including problem solving and decision making, support knowledge-driven behaviors, often oriented to obtain novel behavioral solutions. Figure 4 illustrates a set of pilot-knowledge-based processes that are fired when unplanned events emerge in the cockpit. Thus, such an event will fire a set of mental actions to predict the state if an ongoing task is prioritized before responding to the interruption, or if the interruption is attended immediately. Regardless of the pilot choice, there is an increment in the pilot mental workload because they must constantly remember to return to the deferred task later.
Cognitive tasks in pilot-in-the-loop scenarios rely mainly on retrospective memory (i.e. memory for content) of tasks in which pilots have been well trained, which lead to skillbased and rule-based tasks. On the other hand, tasks in pilot-in-the-mesh scenarios rely mainly on prospective memory items that fire several intensive knowledge-based tasks, reducing the cognitive resources to attend ongoing tasks.
In [12], the degraded mode of pilots was analyzed owing to the effects of prospective memory items caused by constant interruptions, which require pilots to shift their attention among them. Multiple knowledge-based tasks raise a concurrency task management problem [37] that must be modelled as a decrement in performance caused by the time required to switch between tasks [38].
Besides the proper integration of the functionalities provided by cockpit automation there is a lack of non-functional requirements. This research considers the cognitive status of the pilot, when and how elaborated information of nonsafety-critical events should be provided to the pilot.

IV. FLIGHT DECK AS A SOCIO-TECHNICAL SYSTEM
The proper functional and non-functional integration of new cockpit technologies that adapts continuously to provide a reliable and predictive output with the reactive behavior of a pilot with an output sensitive to its cognitive status and SA, is a challenge that can be analyzed by means of sociotechnical models. Thus, despite the technologies deployed in present commercial aircraft cockpits, callouts are the basis of the coordination, which increases the pilot mental workload to tackle each interrupting task at a time when the flight crew is already occupied with multiple concurrent tasks.
Most Air Traffic Management (ATM) digitalization approaches [39] have not considered the impact of human factors in the supporting service they try to provide, which has been useful for solving some problems but generating new downstream shortages. Consider, for example, Controller Pilot Data Link Communications (CPDLC) to replace auditive communications by text. Early NASA works [40], [41] reported evidence about the crew's strong preference for the quiet flight deck, and the reduced frequency congestion fostered the deployment of CPDLC, which has been designed to alleviate ATC and Crew workload by reducing the workload of auditive communications between pilots and controllers (waiting for channel availability, acknowledgement, repetitions, etc.) by a texting device. Thus, although text messages through to be CPDLC seem preferable to auditive instructions, since it allows Pilot to move concurrent actions to a convenient stopping point to attend the instruction. Rehmanns in [42] describes that party lines are important near the airport at lower altitudes with more traffic and decreased separation minimums. Situational awareness gained by the party line effect from ATC voice circuits was identified as necessary [43].
As a result, CPDLC probably will not be used below flightlevel FL285 because pilots cannot benefit from listening to the ATC instructions (e.g. speed reduction) to the leading aircraft. Note, that pilots benefit from this information by thinking ahead and configuring the aircraft earlier enough to improve the fly performance and even avoid the ATC instructions.
The human-in-the-loop context scenario has been studied in different application domains, such as the deployment of cyber-physical systems in a manufacturing environment [44]. However, the human-in-the-mesh in very demanding complex engineering systems has not yet been well explored in the literature.
Although data-driven models can be very effective in relatively well-defined problems, and can even provide a baseline to identify human decision-making patterns [45], there is a lack of data and means to obtain them. Note that gathering data on how knowledge-based tasks impact mental workload and its effects on human performance is a challenging research area. Consider for example, the pilot flexibility to analyze and change plans according to perceived alerts or identified situations under overloading conditions.
Modelling context-aware systems with socio-technical dynamics requires appropriate methods to describe the links between the evolving context and human management of concurrent tasks. Note, that dynamic priority of co-existing tasks that compete for human cognitive resources is spatio-temporal dependent to the context.

A. MODELING METHODOLOGY
A socio-technical modeling framework is required to better understand the interdependencies between human cognitive tasks and technology-supporting tools in a very demanding environment, such as a flight deck. The FRAM modeling formalism [46] allows the analysis of 'distributed cognition', in which the interdependencies between technological supporting tools and cognitive processes can be formalized and simulated as follows: • Understanding the interaction between the human and the technological supporting tools in a time-constrained task environment.
• Capture the timestamp added value of humancontributed activity • Consider and match a specific situational context with required cognitive resources.
One of the main advantages of FRAM formalism is the holistic approach supported by the specification of procedures, functionalities, and architectural interdependencies. Figure 5 illustrates a functional entity in FRAM which is considered an atomic component which interfaces with other atomic components.
A functional entity is described in FRAM by the 6 following relations: • Input: Triggers an action to be implemented by a computer service, a machine or by a human.
• Time: Available time horizon for performing an action It can be immediate or with a latency in the case of computer service or can be a stochastic time parameterized by values of influence variables in case of a human action.
• Control: An action usually requires the adjustment of a function that can be a plan, a procedure or a human task. 22334 VOLUME 10, 2022 • Output: The results produced by an action.
• Preconditions: State variables that must be fulfilled to proceed with the action.
• Resources: Provides an estimation of resource availability at a particular time instant required to perform the action

B. FRAM METHODOLOGY
The functional representation approach in FRAM to describe pilot tasks consists of 4 steps: • Identify and characterize functions by analyzing the actions and task formalized in the airline Standard Operations Procedures (SOP), the technical components and the human actors which takes a role in the scenario under study.
• Characterize the potential for causal variability using a checklist of potential concurrent tasks.
• Define functional resonance by formalizing time-out safety-critical actions. Some PF actions in the flight deck have assigned a hard deadline that can be described by a time-stamp deadline or a state variable threshold. Lack of available cognitive resources when dealing with several concurrent tasks can fire a time-out and in consequence an alternative procedural flow with an impact on the overall performance.
• Identify barriers for causal variability (damping factors) and specify required performance monitoring. In this step, modeler should consider the design of AI supporting tools that could lessen the cognitive WL of human operator. The result of each step is the input to the next step except for the last step, in which once the barriers has been identified, the modeler introduces changes to the scenario (components/actors/inter-relationship) guided by the information obtained in the first 3 steps.

C. SOCIO-TECHNICAL SIMULATION FEATURES
FRAM is a structured representation method for the purpose of resilience engineering. Although the cockpit components, the procedures and pilot actions are designed to function in a reliable and predictable manner, performance is always variable to a smaller or larger extent. Performance variability at action level can be seen as a weakly modulated signal, which is difficult to detect, since it is within the limits of tolerance of the system.
The aggregated performance variability of the cockpit actions can be understood as random noise, and it is this random noise that can give rise to resonance, that is, to a performance variability that is too high. In Figure 6, this concept is represented graphically as the effect of functional couplings in which small performance variations properly aligned can deal with a resonance (e.g. a malfunction). Figure 6 (a) represents the estimated dwell time pilot required to perform an action, b) represents the time variability when the action is performed in a context-aware condition, while c) denotes an excessive time to finalize an action (i.e. time-out) owing to the combination of early and late timestamp events.
Although the FRAM approach provides an excellent normative organization of functions, there is a lack of methodologies to guide the changes and the possibility of re-use actions/activities. Furthermore, the quantitative analysis through simulation requires a logic rationale about how actions should be interleaved.
A FRAM simulator has been implemented for a quantitative analysis considering the characteristics of pilot cognitive tasks in the cockpit context-aware scenario. Two key functional requirements for generating accurate results that have been implemented in the simulator are: VOLUME 10, 2022 • Regardless of the pending cognitive actions a pilot must take, the simulator will allow only 2 (this value is parameterized) concurrent knowledge-based tasks at the same time if they do not require the same cognitive resources (i.e. voice, visual, listening, psychomotor actions).
• Prospective memory items are modelled as pending actions that have been fired and are enabled to be executed but cannot be performed by the pilot because is attending other tasks. Figure 7 shows the simulation mechanism implemented to identify human degraded mode due to prospective memory items (i.e. pending memory actions). Each action that cannot be attended by the pilot generates a ''remember to remember'' background workload that decreases the performance of the pilot.
In the E-pilots project [14], the concept of degraded mode using the FRAM model has been validated by means of an A-320 mock-up simulator considering an unstabilized approach and an ECAM signal. Figure 8 shows a pilot wearing an electroencephalogram during a validation experiment together with the FRAM actions that represent the Pilot tasks. These experiments provided relevant data on pilot performance penalties due to pending memory actions.
Further experimental work will be required to better parameterize the degraded mode, but in this paper a time increment of 40% for any concurrent action that coexists with a prospective memory item will be considered. This 40% value was obtained as an average of the values collected  during the A-320 approach flight simulation scenario. For example in flights without interruptions an ''Altitude Authorization'' task took 46 seconds, while the same task took 58 seconds when auditive interruptions creating a pending memory action.

V. USE CASE
To illustrate the benefits that can be achieved by simulating flight deck socio-technical dynamics, a recurrent problem in the final approach that considerably increases the pilot WL has been analyzed. Figure 9 shows the flight plan from LEGE (Girona airport) to LEBL (Barcelona airport), although the focus of the use case is in the final approach to LEBL.
The flight is flown in an Airbus A-320 fixed base simulator in which typical interruptions are fired during the final approach. For the experiments reported in this paper, three different interruptions were fired that generated a pending memory action: 1. At the time PF is pushing Flap 3 and Checking Deceleration, a cabin crew secured for landing interruption is fired. 2. At the time PF begins the landing checklist by 1000 fts, approach ATC communicates the tower frequency change to PF. 3. At time, PF finalizes the landing checklist before reaching minima 200ft the controller calls for a report stabilized at 4 Nm and confirms RW 25 L. These simulation exercises are performed using airline SOP and assuming PM incapacitated, to evaluate the performance improvement of an interruption management system.  Different AI cockpit supporting tools are simulated, such as voice recognition, to diagnose the ATC instructions and postpone the interruption to a convenient PF workload valley. For validation purposes, the first flight is considered a nominal flight without cabin interruptions, the second flight PF perceives the mentioned interruptions, while in the third flight, non-safety-critical interruptions are postponed to a convenient time window in which the estimated PF WL is low. In Figure 10, the descending approach profile of the simulation exercises is represented with reference to the PF main tasks to be performed according to the ATC instructions (that is, FL Authorization, Alt. Authorization ) or aircraft state variables (that is, Precision Approach, Reaching Minima. Table 1 summarizes the main flight state events that trigger the PF procedure.
To better understand the very demanding task scenario a PF must deal in a SPO, the different concurrent action PF must perform during ''Precision Approach'' are summarized in Table 2. The cognitive resources column describes the required cognitive resources (Pm is used for psychomotor action) to perform the action, while technical components describe the required subsystems to perform the action. Figures 11-16 represent the FRAM model of the different actions PF must perform when dealing with Precision Approach task (action codes are described in Table 2). Concurrency of actions depends on PF cognitive conditions and the required cognitive and technical resources. The FRAM model for Flap 1 action, which is triggered by the PF when the aircraft is at 12 Nm to the touchdown, is represented in Figure 11. As it can be observed, action 1-8.1 (Flap 1) requires a psychomotor action (HM) and the visual resource at cognitive level to push Flap 1 (physical device), while action 1-8.2  (check deceleration) only requires the visual resource and the primary flight display. If PF is attending another action that requires psychomotor cognitive resources, one of both actions will be postponed, affecting flight performance. Empty connections means that the interface functionality is not required in the FRAM component.    The FRAM model for Flap 2 action, which is triggered by the PF when the aircraft is at 6 Nm to the touchdown is represented in Figure 12. Required cognitive (visual and  The FRAM model for a landing gear-down action, which is triggered by the PF just 1Nm after finalizing Flap 2 task is represented in Figure 13. Delaying flap2 will delay the geardown action, which can affect not only the performance but also the stability of the aircraft. The FRAM model for FLAP3 action is described in Figure 14. This action is triggered by the PF as soon as the gear down is confirmed, if the required cognitive (visual and psychomotor) and technical resources (Flap, PFD) are available.
Full Flap action, which is triggered by the PF when the aircraft is at 3 Nm to the touchdown. The FRAM model is described in Figure 15. Required cognitive (visual and psychomotor ) and technical (flap, PFD) resources are similar to Flap 1, Flap 2 and Flap 3 actions.
The FRAM model triggered by the PF to perform the landing checklist is represented in Figure 16. Pilots use to begin with the landing checklist after gear-down ( Figure 13) action concurrently with other actions such as flap3 ( Figure 14) and full flaps (Figure 15).
In the ideal case where no interruption affects PF during the precision approach, most actions can be performed sequentially or concurrently without any impact on the flight performance. Real flights are subject to constant interruptions from the ATC/CREW/ECAM that compete with ongoing PF actions, increasing its WL and increasing the probability of a time-out action that impacts not only flight performance but also safety indicators. Figure 17 represents the PF WL evolution considering adherence to trained procedures and the lack of any flight deck interruption.
As can be observed, rule-based tasks such as flap actions can be easily identified as events with a WL value of 30. Concurrent actions such as the landing checklist that is performed with other flap actions, are also easily identified with a WL value of 50.

A. NOMINAL FLIGHT WITH INTERRUPTIONS
To validate the effects of interruptions, the same nominal flight but with three different time-stamp interruptions events in the flight deck has been simulated. These interruptions happen during the precision approach at peak workload to generate prospective memory items.
In Table 3, the different concurrent actions PF must perform to attend a cabin crew interruption are described according to the SOP of the airline assuming PM incapacitation. Despite actions are described as a sequential procedure, an action can be postponed if other ongoing tasks must be attended. Figure 18 shows the SOP that PF should perform when a cabin crew interruption is fired. ''MAS Cabin Crew'' action represents the triggering event and is identified by the purple color. Figure 19 shows a timeline description of the concurrent FRAM actions when there is a TCP and an ATC interruption while pilot is performing Final Approach actions. The coexistence of different concurrent actions that require the same cognitive or technological resource provokes PF to delay some actions. Prospective memory items are created, degrading PF performance while simultaneously introducing  To better illustrate the concurrent and pending actions, the FRAM results of this second flight has been represented in Figure 19, in which the pending memory actions generated by interruptions are represented in the grey area. Meanwhile, there is at least a pending memory action, the ''remember to remember'' background cognitive action is active and a degraded mode is simulated.
The cabin crew (TCP) interruption appears at time 341, while PF checks the deceleration after flap3, which captures the auditive and visual cognitive resources of the PF despite VOLUME 10, 2022  deciding to continue with the flap full due to its proximity to touchdown and the aircraft configuration. It can also be observed that at time 355, the ATC interruption informing about the frequency change to tower control is also perceived by the PF but postponed finalizing the current aircraft configuration. Figure 20 represents the PF WL of the second A-320 simulation experiment. A time increment of 40% has been observed when performing actions that co-exist with the ''remember to remember'' background cognitive action. As a result, two time-outs of actions not attended by the PF due to ATC interruptions have been recorded. These time-outs can be identified in Figure 20 when the WL peak is above 50.

B. NOMINAL FLIGHT WITH INTERRUPTIONS POSTPONED AT CONVENIENT POINTS
To validate the effects of an interruption manager as a cockpit supporting tool, the same nominal flight was simulated with the same three different interruptions in the flight deck during the precision approach. Both visual and auditive interruption signals were filtered and slightly postponed according to the predicted low PF WL. Figure 21 shows the dynamic evolution of the PF WL when the three interruptions have been slightly delayed to a time window in which the PF WL is low and the cognitive and technical resources are available. Furthermore, no time-out actions were recorded during the simulation exercise.
As a main outcome, the functional integration of cockpit technical components with non-functional aspects of the human operator workload is confirmed as an important asset for preserving PF performance. Postponement of non-safetycritical interruptions is confirmed as an effective mechanisms to avoid the creation of pending memory items.

VI. DISCUSSION
The study of the mesh between humans and technology has been analyzed along different perspectives to replace human skill-based tasks by automatisms introduced in the human work position. At a practical level, the capabilities and limitations of humans and machines are listed to identify tasks that can be automated. However, the evolution from automating physical tasks to cognitive tasks requires the modeling of those human factors that influence the human decisionmaking processes such as the amount of concurrent tasks to be attended before a deadline, the available gap time to take a decision and the situational awareness among others.
Nevertheless, there is a lack of modeling frameworks and tools to steer the design of new work position supporting services that benefit from the physical and cognitive process perspective of work to enhance human role with a full development of its potential. There are needs for novel approaches to support the design and assessment of work design, in very demanding contexts were the right deployment of AI supporting tools could have a positive impact on the performance of the overall system.
The human collaboration with intelligent entities adds considerable complexity to the automation of work positions. To achieve real symbiosis collaboration, the human operator and the smart services must adapt dynamically to each other and cooperate to achieve common goals.
When the socio-technical system is decomposable and the interdependencies among the components are wellunderstood, human operators can behave as it is expected, reaching the KPI's considered during the design phase. However, modern socio-technical systems are characterized by a smooth transition among human operator and machines through adaptive-automation techniques in which the human can take control of a task or vice versa through overriding control mechanisms. This ''symbiosis'' among humans and machines when performing knowledge-based tasks, usually requires the implementation of artificial intelligence supporting tools that monitor human operator tasks and can provide support when the operator is overloaded or even take the full control if the human operator is incapacitated. Under this new ''symbiotic'' context, functional system decomposability is not an easy task since systems are designed for a functional seamless transition among cognitive tasks to be performed by the human or by a machine.
The proposed solution extends the FRAM modelling approach to consider variability of functions assigned to humans. This is done not just by modelling this as a stochastic process, but rather by formalizing it as a cognitive degraded mode of a human operator when attending concurrent tasks with and without supporting tools.
The results achieved simulating the co-existence of different interruptions during abnormal Flight scenarios validates the socio-technical simulation model to tackle the extreme complexity of Flight deck tasks and the latest evolution of cognitive computing technologies. Some important results that have been achieved by the scenario experiments validated by SME are: • Better understanding of the interaction between the Pilot and the AI supporting services: when and how a smart support improve the pilot performance and when it can be an un-opportunistic interruption.
• Consequences of extra cognitive tasks when human must interleave different concurrent actions that compete for the attention of the human operator.
• Performance deviations in the FRAM model from nominal pilot behaviour can be used as a feedback mechanism to particularize the socio-technical model to the pilot skills and experience.
The relevance of understanding the inherent complexity of the ''human-in-the-mesh'' role rather than simplifying it, opens a window of opportunities in the design of new AI supporting services. Digitalization of new services accommodating issues related to ageing, disabilities or inexperience, comfort and wellbeing are some ''human-in-the-mesh'' hot application areas.

VII. LIMITATIONS
A main concern when developing smart technologies to improve human operator performance is the alternative between a techno-centric solution in which human work will be determined by technology, or the anthropo-centric approach in which workers will be master and make decisions supported by advanced technological services. Human-inthe mesh model should be extended with more sophisticated cognitive interleaving mechanisms to identify the limits of an anthropo-centric approach in which the pilot can take decisions supported by a library of cognitive computing services that are fired just when pilot overloading scenarios are predicted.
Very demanding work positions in which safety-critical tasks must be finalized before hard deadlines, increases the stress and the fatigue of human operators. The proposed FRAM model should be extended with a dynamic mechanism that formalizes the degraded mode dynamics considering the gap to a time-out of safety-critical tasks and the accumulated fatigue when valley workload periods are too short or too infrequent.

VIII. CONCLUSION
In this work, we introduced a socio-technical model of a multi-crew flight deck with different subsystems, which aims to improve the performance of a digital assistant framework with given automatisms and rigid procedures. The simulation model was extended with SOP assuming one pilot incapacitated to provide a baseline for the future single pilot operation (SPO) framework. A holistic analysis considering procedures, cockpit component functionalities, and cognitive workload has been performed to better understand the negative effects of interruptions when the pilot is performing concurrent tasks. A detailed implementation of the sociotechnical dynamics during a very demanding flight phase has been presented (Precision Approach), and the experimental results have shown that the proposed socio-technical engineering approach is efficient in mitigating the negative effects of interruptions while improving the overall performance. It can greatly improve the efficiency of a human-machine teaming system in terms of both workload distribution and system resource utilization compared to introducing more pilot aid components that could overload the pilot with unopportunistically valuable elaborated information.
In future work, we predict to extend the socio-technical simulator with the standard operation procedures of the different phases of flight to identify those context-aware actions that overload a pilot to guide the design of new aids that should be implemented in future single pilot operation (SPO) cabins. In the meantime, more experiments with non-safetycritical interruptions in a fixed base A-320 cockpit simulator will be performed to identify concurrent actions that degrade the pilot performance and can provoke action time-out.

ACKNOWLEDGMENT
Opinions expressed in this article reflect the authors' views only. VOLUME 10, 2022