Flight Control Problem Could be the Autopilot

[AuxBatOn]

I believe this is a fairly common design among some aircraft certification.

There is no certification requirement to design autopilots that way.

FAR 23 (Normal, Utility, Acrobatic and Commuter Category airplanes) states:

§23.1329(a)
If an automatic pilot system is installed, it must meet the following:
(a) Each system must be designed so that the automatic pilot can
(1) Be quickly and positively disengaged by the pilots to prevent it from interfering with their control of the airplane; or
(2) Be sufficiently overpowered by one pilot to let him control the airplane.

This certification requirement does not account for human factors and only require something to “quickly and positively” disengage the autopilot. In today’s age, my belief is that this certification requirement should be changed to something a little more strict such as an automatic disengagement when the autopilot isn’t able to cope anymore. If you miss that the A/P is engaged and you fight the controls, to the point of declaring an emergency, it cannot be sufficiently overpowered.

FAR 25 (Transport Category airplanes) states:

§25.1329(l)
The autopilot may not create a potential hazard when the flightcrew applies an override force to the flight controls.

I think anytime you are fighting the autopilot with force, it introduces a hazard, hence why most transport category airplanes have this design feature incorporated. This is a very good example of the FAA accepting a higher risk for non-Transport Category airplanes.

[pelmet]

We do have examples of autopilots disconnecting unexpectedly which end in large body counts (AF447).

Actually, it was inappropriate manual flight control inputs that resulted in the crash. One could try to argue that it was the autopilot disconnecting and that it wouldn't have crashed if the autopilot had not disconnected but the accident also wouldn't have happened if they never took off. Neither is a valid argument.

[rxl]

Here are the ways to disconnect the auto pilot in a Dash 8 ... from the Q400 AOM ... including failure modes and inhibits -
Bullet 8 contradicts what airway said above.

The flight crew disengage the AP manually using the AP or YD pushbutton on the FGCP. The flight crew also manually disengage the AP by pressing an AP Disengage Switch, by selecting Go Around or by operating manual pitch trim.

The Autopilot disengages when one of the following conditions is met:
1• AHRS 1 or AHRS 2 is failed.
2• AHRS 1 and AHRS 2 disagree.
3• ADC 1 or ADC 2 is failed.
4• ADC 1 and ADC 2 disagree.
5• The aeroplane is not airborne.
6• The crew press the AP or YD pushbutton on the FGCP (manual disengagement).
7• The crew operates manual pitch trim, setting the Manual Pitch Trim AP Disconnect discrete, except if
TCS is active (automatic disengagement).
8• The crew manually override the AP using the control column.
9• The crew press an AP Disengage Switch (manual disengagement).
10• The TCS function fails.
11• A Stall Warning AP Disconnect discrete from SPM 1 or SPM 2 is set.
12• A GA switch is selected (manual disengagement)
13• An AP actuator failure is detected.
14• The Yaw Damper disengages automatically.
15• Internal AFCS monitoring is failed.
16• A Power interrupt greater than the transparency time occurs.
17• The aeroplane attitude is outside the domain limits

If that is true it would take very heavy amount of force, not just a nudge or even a medium amount of force. In the simulator I have seen pilots forgetting the A/P is on, applying heavy force on the frozen control column, and thinking the controls were jammed.

It is true. I don’t think that you would want “just a nudge” to do it.
Like I said, this list is from the manufacturer’s AOM.

[iflyforpie]

[quote=iflyforpie post_id=<a href="tel:1125261">1125261</a> time=<a href="tel:1598196899">1598196899</a> user_id=16238]
Yes. It’s child’s play to introduce a disconnect system into an irreversible powered flight control system or a FBW aircraft.

Not so much at the small, manual, general aviation side of things. All they have is a clutch or servo you can overpower, or a button to disconnect.

If an autopilot is unable to cope with the forces it is subjected to (regardless of pilot input or aerodynamic forces) it should disconnect. It is a fairly simple logic to implement (if the difference between the commanded output and the actual output grows by y over x seconds, disconnect). It means the autopilot is not able to do its task and control should be handed back to the pilot.

It’s not simple logic to implement if you don’t have any data to work off of. Lots of small aircraft autopilots don’t have any form of feedback at all, or only in pitch for the purposes of trimming away the forces.

You also have to balance between having an autopilot that can be overpowered by the pilot, yet not disconnect all of the time in any turbulence or fuel imbalance situation (since most don’t control rudder or aileron trim).

Well.. having a clutch or servos that can be overpowered achieves the same thing.

Having an autopilot disconnecting because it “can’t cope” can introduce many more problems. What is the definition of “can’t cope” if you can’t measure the force at the servo? An altitude excursion? An attitude excursion? A stall? What about some of the more complex modes like Flight Level Change and Vertical Speed? What if this is a single pilot IMC and all he need to do is for the AP to keep the plane flying while he sorts himself out?

You could make a light aircraft to transport category standards, and you’d have an airplane too expensive to buy and too heavy to fly. All flying is risk. Your airplane suffers a mishap rate much higher than that of transport category aircraft—is it unsafe and should it be redesigned to a higher standard?

No.. we weigh risk. Risk is defined as the likelihood combined with the severity of something happening.

Likelihood of a pilot having control problems because of an inadvertent autopilot activation. Slim. I remember as a 30 hour student pilot I accidentally turned on the autopilot in the 172S. I didn’t like what it was doing, realized the autopilot was on, so I turned it off. End of story.

Severity of outcome of an inadvertent autopilot activation? I think this would be more of a case where the pilot isn’t fighting the controls and isn’t aware of what his aircraft was doing. UPS 1354 is an example of this. Though the autopilot was intentionally on, the captain was unaware of what the AP was doing and the FO not effectively briefed or monitoring and it flew them into a hill.

In those cases, the autopilot is coping fine, it’s the pilots who are unaware of what the autopilot is doing.

In the case where the pilot wasn’t aware and continued to fight it, he was very aware of his aircraft’s immediate state, and was able to land successfully.. though with difficulty.

So I think the risk of inadvertent autopilot activation with the pilot having to overcome it is negligible, personally.

So a better solution—one that’s been mentioned in this thread and how most companies with automated aircraft operate... and a catch all for both inadvertent activation and situational awareness—is proper training on the aircraft automation and awareness of its state.. which include callouts for activation, modes selected, values selected, modes annunciated on the rumour board, training in emergencies and abnormalities regarding the automation, and all of the ways to disconnect it—of which there are six distinct ones in the aircraft I fly.. three of which are HOTAS.

[AuxBatOn]

Autopilots have feedback loops. That’s how they know how far off state they are and figure out what to command to achieve a desired state. There is a commanded output and a measured output. A simple integration of the difference between commanded vs measure outputs. When you hit a certain threshold (depending on the mode), it kicks off.

It is relatively easy and cheap to implement.

[rxl]

Any aircraft that I have flown that was certified under Part 23 i.e., PA31, C210, C310, C402, that had an autopilot, from what I recall, had no annunciation of autopilot disconnect either visual or aural. Maybe it’s time that part 23 is updated ... or maybe it already has. Anyone know?

[pelmet]

Of course, there are always the smart guys....much smarter than me who know all kinds of details about autopilot design and operation. But for the very average guy like me, I like to keep things simple.

So bottom line.........if the controls suddenly become stiff and it is unexpected, consider that it could be Inadvertent autopilot activation.

[rxl]

So bottom line.........if the controls suddenly become stiff and it is unexpected, consider that it could be Inadvertent autopilot activation.

Yup.
And I would add, know your aircraft, pay attention to aircraft state and FLY THE AIRPLANE!

[iflyforpie]

Autopilots have feedback loops. That’s how they know how far off state they are and figure out what to command to achieve a desired state. There is a commanded output and a measured output. A simple integration of the difference between commanded vs measure outputs. When you hit a certain threshold (depending on the mode), it kicks off.

It is relatively easy and cheap to implement.

I still don’t think it’s as easy as you think.

If they are values, like a heading, for example.. it would be easy to say the autopilot disconnects with a ten degree heading excursion. But then it would disconnect every time you selected a heading more than ten degrees off your current heading.

If it’s a command.. like what your flight director is showing.. same thing. I’m level and command ten degrees up. I’ll often do this when ATC wants me to expedite a climb since Flight Level Change usually takes forever to initiate the climb (its priorities are passenger comfort, not moving further away from selected altitude, speed, and altitude in that order). Now because the commanded and measured outputs are greater than a defined parameter, the autopilot disconnects.

Speaking of Flight Level Change. If you select a speed beyond what the aircraft is capable of.. it will level out to try and reach the speed.... forever. It won’t dive to catch the speed, nor will it climb to reach the altitude. I use FLC like this all the time to avoid capturing an altitude (with all of the mode callouts rather than just a simple speed change) when I know I’m going to be cleared higher momentarily (with more mode selections and callouts). I don’t want the autopilot to disconnect for this.

One final example. There was a Piper Comanche where the pilot had CO poisoning. He passed out. The plane continued on in altitude hold mode until it ran out of fuel. The autopilot commanded full nose up and full up trim, and instead of stalling, the plane mushed along as it lost altitude as the autopilot still tried to maintain the selected altitude. It wound up in a farmers field, and the pilot survived.

Had the autopilot disconnected, the plane would likely have spiralled and the pilot would have been killed.

I know that this is just one incident, but there are likely a few more, plus many times where an autopilot that didn’t disconnect in a situation it couldn’t cope with was instrumental to the safety of the aircraft. I don’t think you’ll find as many instances in light aircraft where the autopilot caused the plane to crash as the pilot was fighting it.

They aren’t a 737 MAX with a draconian Elevator Feel and Centering Unit as a poor mans envelope protection designed to keep pilots from ripping the wings off... so that when it’s mistrimmed because of MCAS it’s physically impossible to overcome.

[AuxBatOn]

Autopilots have feedback loops. That’s how they know how far off state they are and figure out what to command to achieve a desired state. There is a commanded output and a measured output. A simple integration of the difference between commanded vs measure outputs. When you hit a certain threshold (depending on the mode), it kicks off.

It is relatively easy and cheap to implement.

I still don’t think it’s as easy as you think.

If they are values, like a heading, for example.. it would be easy to say the autopilot disconnects with a ten degree heading excursion. But then it would disconnect every time you selected a heading more than ten degrees off your current heading.

If it’s a command.. like what your flight director is showing.. same thing. I’m level and command ten degrees up. I’ll often do this when ATC wants me to expedite a climb since Flight Level Change usually takes forever to initiate the climb (its priorities are passenger comfort, not moving further away from selected altitude, speed, and altitude in that order). Now because the commanded and measured outputs are greater than a defined parameter, the autopilot disconnects.

Speaking of Flight Level Change. If you select a speed beyond what the aircraft is capable of.. it will level out to try and reach the speed.... forever. It won’t dive to catch the speed, nor will it climb to reach the altitude. I use FLC like this all the time to avoid capturing an altitude (with all of the mode callouts rather than just a simple speed change) when I know I’m going to be cleared higher momentarily (with more mode selections and callouts). I don’t want the autopilot to disconnect for this.

One final example. There was a Piper Comanche where the pilot had CO poisoning. He passed out. The plane continued on in altitude hold mode until it ran out of fuel. The autopilot commanded full nose up and full up trim, and instead of stalling, the plane mushed along as it lost altitude as the autopilot still tried to maintain the selected altitude. It wound up in a farmers field, and the pilot survived.

Had the autopilot disconnected, the plane would likely have spiralled and the pilot would have been killed.

I know that this is just one incident, but there are likely a few more, plus many times where an autopilot that didn’t disconnect in a situation it couldn’t cope with was instrumental to the safety of the aircraft. I don’t think you’ll find as many instances in light aircraft where the autopilot caused the plane to crash as the pilot was fighting it.

They aren’t a 737 MAX with a draconian Elevator Feel and Centering Unit as a poor mans envelope protection designed to keep pilots from ripping the wings off... so that when it’s mistrimmed because of MCAS it’s physically impossible to overcome.

It is actually easy to implement. Electronics don’t care whether you are commanding a heading or a flight path. For the autopilot, the difference between the commanded guidance and the output is an electric signal and that signal is null if the autopilot is doing its job properly and keeping you exactly as commanded. That electric signal is converted, with different gains depending on the mode and some air data to a flight control input. Any autopilot already incorporate this. All you need to add is an integrator or differentiator (depending on what logic you want to use) that will calculate the error over time or the rate of change in the error and, upon reaching a defined limit, disengage the autopilot. I am pretty sure that anyone with a bit of electronic know-how could build that system cheaply and easily.

[cncpc]

They can also disconnect when the trim goes way out of whack. Had that happen once when a large hockey player got out of the seat behind me in a Chieftain and walked to the back to pee in a jar.

Autopilot kicking off is likely the leading suspect in that Citation crash just north of YLW a few years back.