1. Introduction

Safety has always been the core priority of civil aviation which is the basis of its survival and development [1]. A nominal flight refers to a standard flight without any abnormal condition. Although most of the flights are nominal flights, abnormal situations about mechanical failures and bad weather sometimes happen. To address such challenges, many countries have relevant trainings in the civil aviation field. Well-trained pilots can solve a part of mechanical non-nominal situations safely, as demonstrated in the case of Sichuan Airline flight 8633. During the flight, one of the cockpit windshields shattered at high altitude, posing a severe safety risk. However, due to the pilot’s calm and decisive response, the aircraft returned to the airport safely with no fatalities. But some malfunctions—particularly those involving hydraulic control systems or aerodynamic surfaces—are significantly more difficult to manage. An example is the Japan Airline flight 123, while the Boeing 747 ascending after took off, the pressure compartment at the rear end burst due to improper maintenance, which resulted in the complete failure of the hydraulic system and the plane crashed, over 500 people were killed, this has become the most people killed accident in one plane. The human factor is also deadly, like the Germanwings Airline 9529. The investigation showed that the immediate cause is the copilot got rid of the pilot and locked the cockpit door deliberately and reduced the aircraft's altitude greatly which made that Airbus A320 hit the mountain. There were 150 people dead including him. During the plane descending, other 149 people including the pilot couldn't enter the cockpit and stop him. The cockpit door, which had been reinforced to prevent hijacking, preventing them from saving themselves. After that, the International Civil Aviation Organization (ICAO) amend the rules immediately, it stipulated there must be over 2 people in the cockpit during the flight.

Therefore, aviation safety is an important field for researching of academic scholars all the time. Gu et al. [2] put forward a kind of multivariate grey model optimized by genetic algorithm, its average prediction error was only 1.6% during the short-time aviation safety forecasting projects., which had high accuracy. Wang et al. [3] focused on psychological problems about pilots, constructed psychological competence evaluation index system that applied to China preliminarily, which helped selecting pilots.

With the progress of science and technology, DPO is gradually transforming to SPO, but safety assurance is essential. Design and research of human-machine interaction in civil aviation cockpit is necessary. Wang et al. [4] used QN-MHP model to model and simulation for pilot’s working load, this model could shorten the time about single pilot accomplishing the mission. Reduce the working load, which used in the scenario of aircraft single engine failure effectively. Zhang et al. [5] based on different flight conditions and pilot psychological behavioral capacities, analyzed typical scenarios of SPO human-machine co-driving, constructed different air-ground coordination operation mode, and designed the corresponding organizational structure of the ground flight managements and operations control departments. Meanwhile, SPO mode needs higher level of signal transmission. When the ground controller remotes contract the pilot, even remotes control the plane, his/her view must be as same as the pilot’s sight, especially during the taking off, landing and non-nominal phases. Excessive delay will make dangerous situations, which should be considering to solve at first.

In the article, mainly focuses on Airbus A320 plane during the nominal flight, if pilot pulls the lever by a large margin and make the plane enters non-nominal phase. Then SCS diverts and stabilizes the plane initiatively, and used Python to code the program, make it can recover the plane to the nominal flight phase. To sum up, the article not only provides ideas for the SPO cockpit computer programs, bust also provide references to DPO cockpit computer system upgrading.

2. The improvements of existing human-machine interaction system of civil plane

During the development of civil aviation, many kinds of plane were made up. Every plane was based on the last generation by improving deficiencies and satisfying the status. The human-machine interaction system develops more and more intelligent. At present, the human-computer interaction system has replaced the traditional mechanical instrument by the traditional electronic instrument, and is gradually moving towards the touch screen system. Touch screen has been the main human-machine interaction way on Gulfstream G500 and G600 jets, the whole cockpit uses 10 touch screens to replace traditional physical keys (Figure 1) [6].

Figure 1: Gulfstream jet uses 10 touch screens

Compared with traditional physics keys, touch screen system can provide redundancy to any realized touch flight system, which is not limited by space. During its early development, traditional touch screens usually occur feedback failures. During nominal flight conditions, this issue had minimal impact; however, during non-nominal flight scenarios, it could significantly compromise safety and even lead to accidents. Today, the technology of touch screen has developed relatively mature, and the situations of feedback failure also become far less frequent.

However, not all kinds of human-machine interaction systems can improve only by changing the hardware, such as the flaps. Flaps can increase lifting force during the taking off and landing when the speed is lower, while also increasing to ensure the safety and property.

For instance, a diversion incident involving an MD-11 aircraft occurred due to an inadvertent touch of the flap control handle. During cruise flight, the pilot accidentally activated the flaps, disrupting the aircraft’s aerodynamic stability. This led to severe pitch oscillations, causing injuries to several passengers and crew. The aircraft was eventually diverted to a military base for an emergency landing. Investigations identified a design defect that made unintentional activation more likely.

Although modern aircraft now position the flap control handle in a way that reduces accidental activation, safety risks still exist. Therefore, improving aircraft computer systems remains critical in minimizing operational errors and enhancing flight safety.

3. Analysis for the design about SPO computer system

3.1. About assisted driving

In SPO phase, though there is only one pilot in the cockpit, the plane is still controlled by two sides: the pilot and the ground controller. The ground controller can remote control the plane if necessary (Figure 2).

In Dual Pilot Operation (DPO) mode, tasks are divided between the pilot and co-pilot, ensuring an efficient workload distribution. However, requiring a single pilot to handle all tasks violates the workload management principle—one of the three fundamental principles proposed by NASA. To address this, the assistance system delegates certain tasks to the computer, reducing the pilot’s workload and enhancing operational efficiency.

Figure 2: The air-ground control mode under SPO mode

Throughout the whole nominal flight, the most workload phase is taking off and landing, the working load during cruise flight is much less. Consequently, when designing the assistance system, greater emphasis should be placed on optimizing takeoff and landing procedures.

For instance, the system should:

Verify instrument settings to ensure they are aligned with the aircraft’s takeoff or landing phase.

Monitor pilot operations to confirm they are consistent with Air Traffic Control (ATC) instructions.

Prevent incidents, such as runway incursions, by issuing timely alerts when inconsistencies or potential risks are detected.

These enhancements will contribute to flight safety, mitigate pilot workload, and ensure a seamless transition to SPO operations.

3.2. Aviation safety

The design of computer system in SPO mode needs to put emphasis on flight safely. With only one pilot in the cockpit, there is a possibility that they may inadvertently or deliberately put the aircraft into a non-nominal state. These sensors would analyze the data pilot input in real time, and combine with other outside sensors to analyze the probably influences with the controls synthetically. If necessary, they can change the right of control to the ground controller. The following section examines an incident where a pilot abruptly pulled the control lever on an Airbus A320 during nominal flight, using it as a basis for designing a Safety Control System (SCS) to address such scenarios.

3.2.1. Theoretical analysis

The flying of civil aircraft is mainly due to the uneven air velocity above and under the wings. The engines give the plane a velocity, when the two forces are different in magnitude, it creates lift. If the lift is larger than gravity, the plane will ascend, instead, the plane will descend. Speed and lift can be expressed by following formula:

\( L=\frac{1}{2}ρ{v^{2}}S{C_{L}} \) (1)

\( ρ \) is the air density; \( v \) is the velocity; \( S \) is the reference area of the wing; \( {C_{L}} \) is the lift coefficient.

Meanwhile, the air resistance of the aircraft is also relational to speed as shown by following formula:

\( f=\frac{1}{2}ρ{v^{2}}A{C_{d}} \) (2)

\( ρ \) and \( v \) have the same meaning; \( A \) is the area of the projector facing the airflow; \( {C_{L}} \) is the resistance coefficient.

For the same A320 aircraft, \( S \) and \( A \) is unchanged. In a short distance of cruise flight, \( ρ \) can be also unchanged. In ideal states, the change of lift coefficient and resistance coefficient is mainly because of the change of attack angle and flap deflection. Krzysiak et al. [7] focus on TU-154M aircraft, studied the aerodynamic characteristics at supercritical attack angle. The research shows that the flap deflection of Tu-154M aircraft affects the resistance and lift coefficients over a wide range of critical attack angle and sideslip angle. The article assumes that the two coefficients are unchanged, and the formula can be:

\( L∝{v^{2}} \) (3)

\( f∝{v^{2}} \) (4)

Both lift and coefficient are proportional to speed squared.

As can be seen from the following figure (Figure 3), the exist of attack angle will make lift, coefficients and thrust generate horizontal and vertical component forces, the formula are:

\( {L_{v}}=Lcos{θ} \) (5)

\( {L_{l}}=Lsin{θ} \) (6)

\( {f_{v}}=fsin{θ} \) (7)

\( {f_{l}}=fcos{θ} \) (8)

\( {F_{Wv}}={F_{W}}sin{θ} \) (9)

\( {F_{Wl}}={F_{W}}cos{θ} \) (10)

Figure 3: The force analysis when plane has an attack angle

\( θ \) is the attack angle; \( {L_{v}} \) , \( {f_{v}} \) and \( {F_{Wv}} \) are the vertical components of lift, resistance and thrust; \( {L_{l}} \) , \( {f_{l}} \) and \( {F_{Wl}} \) are the horizontal components of lift, resistance and thrust.

During the whole nominal flight, only the taking off phase exists the positive attack angle for a long time, to keep the safety of flight and the comfort level, the attack angle will not be so large. The take-off attack angle of Airbus A320 aircraft usually is about 10 degrees to 15 degrees, but its stall attack angle is about 16 degrees to 18 degrees, the two angles are relatively close, so if the pilot initiatively let the plane into non-nominal situation during cruise flight, if he/she pulls the lever all the time and the attack angle is over 10 degrees, SCS will alert and take the right of control. It can decrease the attack angle and avoid stall.

Therefore, if the pilot pulls the lever, the force analysis formula is as follows:

\( θ={θ_{0}}+αt \) (11)

\( {F_{x}}={F_{Wl}}-{L_{l}}-{f_{l}} \) (12)

\( {F_{y}}={F_{Wv}}+{L_{v}}-{f_{v}} \) (13)

\( {θ_{0}} \) is the attack angle during cruise flight, is usually considered as 0 degree; \( α \) is the instantaneous attack angle acceleration caused by the pilot pulling the lever; \( {F_{x}} \) and \( {F_{y}} \) are the resultant force of the plane in the horizontal and vertical directions; \( {F_{W}} \) and \( f \) are the thrust and resistance; \( m \) is the quality of A320 aircraft, assume is 75t.

3.2.2. Programming

SCS is coded by Python and is structured into six parts: detects the attack angle is too large and the pilot is keeping pull the lever; decrease the attack angle; level off the plane; level off flying for a while; begin to descending stabilized; return to primary flight level. Assuming an A320 aircraft which has this system, it begins to fly level from 0 second at the 10000-meter height, with a speed of 250m/s. After one second, the pilot pulls the lever in a large margin, which causes the plane has a 0.1rad/s (about 5.73 degrees per second) steady attack angle acceleration. With the assistance of safety control system, the height, attack angle, time and the height of critical time are shown below (Figure 4, 5, 6):

Figure 4: The relation between height and time

Figure 5: The relation between angle of attack and time

Figure 6: The height of critical time

According to the graphs and data, the attack angle achieves 10 degrees after 1.7 seconds from the pilot pulls the lever, the plane ascends about 30 meters. Then, SCS begins to change the attack angle acceleration and reverses it. The plane finally ascends about 4.25 seconds and become stable. The height is about 93 meters higher than the original flight level. The flight level generally 300 meters for a layer [8], and the plane flies in the middle of it, the upper and lower distance from the adjacent altitude layer boundary is about 150 meters. Although the plane deviates from normal altitude after the system controls, it is still about 200 meters from the flight route in adjacent altitude level, and the system control the plane to keep it steady only uses 2.5 seconds.

When the plane is stabilized, it needs to return to the original height of flight level. After 2 seconds of steady flight, SCS starts to accelerate the attack angle in the direction of pushing lever. The attack angle stops adding after it achieves about 3 degrees, when after 1.5 seconds, the height of the plane is 10083 meters. After that, the plane descends steady, and levels off in the end to keep cruise flying. In the whole process, SCS only controls the plane only uses 13 seconds, but effectively avoids the probability of stall. Therefore, when the plane returns to the original height, the difference between return height and original height is less than 0.1 meter, which has a high accuracy. The key python code used to implement this system is as follows (Figure 7):

Figure 7: The key code of safety control system

All the units of angles in the figure are rad.

The contrast ‘2’ in sentence ‘ \( if t[i] \lt time+2 \) ’ can be changed to any time after the system level off. The example sets it as a small number due to image display limitation. Similarly, the contrast ‘10’ in sentence ‘ \( if h[i] \lt h0+10 \) ’ also needs to change for different velocity. In this study, the gap of height is small when it is set at 10.

In real situations, the plane design team also need to add sensors on the lever which can’t be turn off by manual operation, and connect these sensors to the auto-pilot system to check if the acceleration is by pilot or by the auto-pilot system. During the SPO flight phase, if the sensors detect that the pilot is pulling the lever for a long time, it will transmit the live images in front of the plane to the ground controller immediately, and get the air-to-ground radio voice. The controller will ask the pilot what happen first. If the pilot rejects to communicate and keeps making the plane in dangerous situations, SCS will cut off the right of control in the cockpit and level off the plane. Finally, the ground controller will diversion the plane at last.

4. Conclusion

The study presents a simple analysis of computer functions in SPO mode, and puts forward the ways which the system needs to assist the pilot. Regarding SCS coding, the article provides a method of safely leveling off an A320 aircraft in SPO mode when the pilot pulls lever for a long time initiatively to put the plane into a non-nominal state. The SCS basis on force analysis during cruise flight and the change of attack angle. Initially, the system connects with ground control for approval. If intervention is deemed necessary, the system autonomously levels the aircraft before transferring control to ground operators, thereby preventing catastrophic consequences.

However, the proposed system is based on ideal conditions, assuming constant velocity. In real-world scenarios, the auto-throttle system typically regulates thrust, making it difficult to maintain a steady velocity. Further improvements to the program are necessary to account for these dynamic conditions.