Flight Control Problem Could be the Autopilot

[pelmet]

It makes sense that an inadvertent autopilot activation could cause confusion. Something to consider when analyzing a flight control issue.....

"C-GOVX, a Piper Navajo PA-31 operated by Les Levées Aéroscan Inc., was on a flight of
aerial photograph according to visual flight rules under the code SCANNER1 from the airport
from Quebec / Jean Lesage, QC (CYQB) with 2 crew members on board. While the device
was flying following a line of aerial photographs at an altitude of 13,000 feet, the pilot with
controls felt the aircraft stick suddenly stiffen in the roll axis. By forcing
with two hands in order to keep the stick straight and prevent the aircraft from making a turn, the pilot in
Controls declared an emergency and the aircraft returned to land on runway 25 at CYQB. Once
with the aircraft parked, it was noted that the autopilot's "ROLL" function button was
triggered. By disabling it, the controls are returned to normal. An inspection of the
maintenance concluded that there was no technical anomaly in the piloting system
automatic."

[Gannet167]

I would say the AP functioned perfectly. Perhaps a better way to think of it is the flight control problem was due to the AP, but possibly caused by poor automation mode awareness, bad SOP, misuse of SOP, poor training/misunderstanding of AP function.

[AuxBatOn]

I would say the AP functioned perfectly. Perhaps a better way to think of it is the flight control problem was due to the AP, but possibly caused by poor automation mode awareness, bad SOP, misuse of SOP, poor training/misunderstanding of AP function.

Or bad design. You should always be able to overcome an autopilot.

[ahramin]

The pilot did overcome the autopilot and landed the aircraft.

[AuxBatOn]

The pilot did overcome the autopilot and landed the aircraft.

Overcome as in kick the autopilot mode off.

[switchflicker]

Oh THAT overcome.
Not the overcome as in overcome.

[ahramin]

I'm no longer sure what we are talking about. From what I read, the autopilot could have been switched off but was not. The pilot physically overcame the autopilot to land the aircraft.

[pelmet]

I'm no longer sure what we are talking about. From what I read, the autopilot could have been switched off but was not. The pilot physically overcame the autopilot to land the aircraft.

It might be something to check if the flight controls suddenly become stiff.

[AuxBatOn]

I'm no longer sure what we are talking about. From what I read, the autopilot could have been switched off but was not. The pilot physically overcame the autopilot to land the aircraft.

In the aircraft I fly, when you put a certain control force against the autopilot commands, the autopilot will automatically disengage that axis as it generally means that you purposely want to do something else than what the autopilot is commanding. This design should be incorporated in every autopilot.

[KISS_MY_TCAS]

In the aircraft I fly, when you put a certain control force against the autopilot commands, the autopilot will automatically disengage that axis as it generally means that you purposely want to do something else than what the autopilot is commanding. This design should be incorporated in every autopilot.

Every autopilot I've ever seen works this way, the servos have clutches that when a specified force is applied to the column or flight control, the servo will command the computer to disengage. It is measured at the servo by the amount of torque the servo needs to generate to maintain the selected command, any more than that value it should disconnect. Either bad info in the report, or a dangerously malfunctioning autopilot.

[ahramin]

Ah I understand now.

When an aircraft has hydraulically actuated flight controls, the autopilot obviously cannot be overcome by human force, hence the need for it to sense the input and disconnect. In any aircraft I am familiar with this is a last resort and not the "correct" way to disconnect the autopilot.

When flight controls are directly connected to the control surfaces and the servos are connected to the control run, the servo doesn't know the difference between aerodynamic forces and pilot control inputs. The clutches are adjusted so that they don't slip from aerodynamic forces, but are kept low enough so that the pilot can overpower the servos. If there is a problem with the autopilot, the human pilot overpowers it, turns it off, and then removes power to the autopilot via switch or breaker.

This is the nature of these autopilots. While it would be theoretically possible to add something into the controls runs to sense whether each push or pull is coming from the control end or the surface end, I would think the downside of the added complexity would outweigh any gains.

[fleetcanuck]

Have a look at the series of MD11 pitch control incidents which in some cases killed people. Some involved the autopilot being overpowered by the pilot and then re-engaging in pitch. Aft C of G created instability and the resulting pitch oscillations produced large +/- g forces.

[iflyforpie]

Yes. It’s child’s play to introduce a disconnect system into an irreversible powered flight control system or a FBW aircraft.

Not so much at the small, manual, general aviation side of things. All they have is a clutch or servo you can overpower, or a button to disconnect.

[Big Pistons Forever]

As a general comment auto pilot systems knowledge seems to be week in the 703 world. At one 703 company I flew for, not one pilot knew how to do a pre-flight function check for the KFC 200 autopilot. They also did not understand why you never want to give the wheel a nudge when the auto pilot was working.

[airway]

You cannot physically overcome or disengage the autopilot in the DH8 100/300/400 by applying any amount of force to the control column. Also, there is no way to disengage pitch or roll A/P functions separately. You can temporarily disengage the A/P with the TCS button on the control column, but the A/P will automatically reengage when you let go of the button.

[ahramin]

So how do you disconnect the autopilot on a dash 8 then?

It's also worth noting that if ease of disconnection is an overriding factor, the B737 is probably the best system out there. Just look at it the wrong way and it disconnects.

[pelmet]

It's also worth noting that if ease of disconnection is an overriding factor, the B737 is probably the best system out there. Just look at it the wrong way and it disconnects.

That is actually bad news as well. I have seen the aircraft drifting off course because the control wheel was accidentally bumped which disconnected the lateral mode.

Now I always check the modes when the control wheel is bumped, although the newer types seem less susceptible to this happening

[rxl]

Here are the ways to disconnect the auto pilot in a Dash 8 ... from the Q400 AOM ... including failure modes and inhibits -
Bullet 8 contradicts what airway said above.

The flight crew disengage the AP manually using the AP or YD pushbutton on the FGCP. The flight crew also manually disengage the AP by pressing an AP Disengage Switch, by selecting Go Around or by operating manual pitch trim.

The Autopilot disengages when one of the following conditions is met:
1• AHRS 1 or AHRS 2 is failed.
2• AHRS 1 and AHRS 2 disagree.
3• ADC 1 or ADC 2 is failed.
4• ADC 1 and ADC 2 disagree.
5• The aeroplane is not airborne.
6• The crew press the AP or YD pushbutton on the FGCP (manual disengagement).
7• The crew operates manual pitch trim, setting the Manual Pitch Trim AP Disconnect discrete, except if
TCS is active (automatic disengagement).
8• The crew manually override the AP using the control column.
9• The crew press an AP Disengage Switch (manual disengagement).
10• The TCS function fails.
11• A Stall Warning AP Disconnect discrete from SPM 1 or SPM 2 is set.
12• A GA switch is selected (manual disengagement).
13• An AP actuator failure is detected.
14• The Yaw Damper disengages automatically.
15• Internal AFCS monitoring is failed.
16• A Power interrupt greater than the transparency time occurs.
17• The aeroplane attitude is outside the domain limits

[AuxBatOn]

Yes. It’s child’s play to introduce a disconnect system into an irreversible powered flight control system or a FBW aircraft.

Not so much at the small, manual, general aviation side of things. All they have is a clutch or servo you can overpower, or a button to disconnect.

If an autopilot is unable to cope with the forces it is subjected to (regardless of pilot input or aerodynamic forces) it should disconnect. It is a fairly simple logic to implement (if the difference between the commanded output and the actual output grows by y over x seconds, disconnect). It means the autopilot is not able to do its task and control should be handed back to the pilot.

[ahramin]

Why?

[AuxBatOn]

Why?

To avoid what happened in the subj incident or worse.

[ahramin]

Well I think the outcome of the above incident is acceptable. Despite a series of errors the aircraft was safely recovered. Do you have any examples of the or worse you are trying to prevent?

We do have examples of autopilots disconnecting unexpectedly which end in large body counts (AF447). As a result TC, the FAA, and EASA seem to be working towards autopilots that disconnect less readily, not more.

[Gannet167]

Recovering an aircraft undamaged with no injuries is generally hard to argue against as an "acceptable" outcome. However, there likely are some problems with the pilot either not knowing he/she had that mode engaged, and/or didn't understand what that mode does, and/or didn't know how to disengage the mode. Had this scenario happened in a more critical phase of flight, and/or on a different AP axis, it might've ended differently.

In AF447, the autopilot disconnected expectantly, but by design, due to alternate law. That it disconnected wasn't a problem (it needs to in such a circumstance), that the disconnect was unexpected wasn't a problem. The problem was with aircraft handling after the disconnect. The FMA is typically verbalized out loud in the bus and mode awareness is pretty important, much like in any automated airplane. An AP kicking off in a Bus results in a loud chime and flashing red lights in front of the pilot's face. It may have been unexpected, but the crew had to be aware that it did disconnect. The data shows they immediately began flying manually, so I'd say they were aware.

[Gannet167]

If an autopilot is unable to cope with the forces it is subjected to (regardless of pilot input or aerodynamic forces) it should disconnect. It is a fairly simple logic to implement (if the difference between the commanded output and the actual output grows by y over x seconds, disconnect). It means the autopilot is not able to do its task and control should be handed back to the pilot.

I believe this is a fairly common design among some aircraft certification. All the automated planes I've flown would kick off the AP if they weren't flying as commanded, within a specific tolerance, or if sufficient manual force was applied to flight controls by the pilot. As you say, if the AP is not able to manoeuvre the aircraft as it's being commanded to, and therefore the aircraft is not being flown as desired/properly, then absolutely the AP needs to be taken out of the equation and control handed to the pilot - so they may do some of 'that pilot thing.'

Why?

To the question "why", I can't possibly see any advantage of having an autopilot that isn't providing the commanded flight control inputs remaining engaged and continuing to incorrectly fly the plane, and not alerting the pilot that they need to intervene. It's analogous to one pilot making a gross error, the other pilot needs to take control and save the day. Asking why seems rhetorical. But to spell it out more clearly, if the AP isn't getting the job done, then the pilot needs to take over so it doesn't crash. That's why.

I flew a plane that had a recurring problem with the AP. The control column would pump abruptly in the climb. It would do this for a few seconds and then, without being able to provide the required pitch inputs, it would give up and by design kick off, requiring the pilot to take control and manually fly. Thankfully it was designed to kick off after exceeding parameters. It turns out the system was getting bad data from a partially broken wire for the airspeed signal that provided inconsistent voltage. The AP was trying to pitch up because it saw the speed too high, then pitch down because speed was too low as the voltage signal fluctuated. Imagine the potential consequences if it was designed to remained engaged.

[airway]

Here are the ways to disconnect the auto pilot in a Dash 8 ... from the Q400 AOM ... including failure modes and inhibits -
Bullet 8 contradicts what airway said above.

The flight crew disengage the AP manually using the AP or YD pushbutton on the FGCP. The flight crew also manually disengage the AP by pressing an AP Disengage Switch, by selecting Go Around or by operating manual pitch trim.

The Autopilot disengages when one of the following conditions is met:
1• AHRS 1 or AHRS 2 is failed.
2• AHRS 1 and AHRS 2 disagree.
3• ADC 1 or ADC 2 is failed.
4• ADC 1 and ADC 2 disagree.
5• The aeroplane is not airborne.
6• The crew press the AP or YD pushbutton on the FGCP (manual disengagement).
7• The crew operates manual pitch trim, setting the Manual Pitch Trim AP Disconnect discrete, except if
TCS is active (automatic disengagement).
8• The crew manually override the AP using the control column.
9• The crew press an AP Disengage Switch (manual disengagement).
10• The TCS function fails.
11• A Stall Warning AP Disconnect discrete from SPM 1 or SPM 2 is set.
12• A GA switch is selected (manual disengagement)
13• An AP actuator failure is detected.
14• The Yaw Damper disengages automatically.
15• Internal AFCS monitoring is failed.
16• A Power interrupt greater than the transparency time occurs.
17• The aeroplane attitude is outside the domain limits

If that is true it would take very heavy amount of force, not just a nudge or even a medium amount of force. In the simulator I have seen pilots forgetting the A/P is on, applying heavy force on the frozen control column, and thinking the controls were jammed.