The FAA Looks for Trouble

haps most important, the complexities of autopilots in general and those of the KFC 150 in particular. Testing the airframe Structural testing and review of the Malibu/Mirage airframe came from several sources. The fAA, Piper, and the NASALangley facility validated the results of Piper's original calculations on the PA-46's aeroelasticity and flut- ter characteristics. The analysis proved that the wings would begin to flutter at about 600 KIAS,the horizon- tal tail at better than 1,000 KIAS.That's better than three times the airplane's VNE of 198 KIAS and well into the supersonic realm. Because the accident aircraft all showed an essentially simultaneous failure of the wings and horizontal tail, great attention was paid to both static and dynamic load testing. Piper did a static load test of the Malibu's tail and found that it failed at 239 percent of its 3.8-G limit load, or approximately 9 Gs. Other static tests were performed at loadings ranging from 3.8 to -2 Gs. Then Piper performed flight tests, using one of its own test aircraft (N9135D-the one used in the original certification process). For each of the 75 tests, the airplane was loaded to the same weights as the accident aircraft and at their most rearward and most forward CGs at the times of the acci- dents. The aim here was not to load the test airplanes to their CG and gross-weight limits (that had already been done when the Malibu was first certified), but to duplicate the acci- dent aircraft weights at the edges of the potential CG envelope for those weights. (Except for one accident air- craft, which was determined to have had a CG dangerously aft of the design envelope.) Test pilot David Schwartz with N9135D. Air data compllters (below, left and right) kept track of each test, while the stabilizer's referellce lilies revealed allY excessive airloads. Video cameras are all the vertifical fill alld in the aft cabin. To document test results, pressure- sensitive "Strip-a-tube" was applied the length of the horizontal tail's chord; this recorded pressure distribu- tion over the tail. Strain gauges were installed to measure aerodynamic stresses electronically. Potentiome- ters, installed at the end of the eleva- tor push rod, gave precise readings of control deflections. Finally, two video cameras were aimed at the tail sur- faces-one in the cabin, aiming rear- ward, and one on the vertical fin, look- ing down. What followed were a number of tests-far too many to cover in a mag- azine article. Among the most impor- tant, however, were those measuring stick force per G, in which control forces were measured at speeds between 130 and 200 KIAS, pulling anywhere from 1.2 to 3.05 Gs. These tests measured the amount of control force required to deviate from the air- plane's trim speed and, as such, are important measures of an airplane's longitudinal stability: The farther you deviate from trim speed, the harder you must pull on the control yoke. The Malibu/Mirage not only passed these tests-each one, remember, at differ- ent weights and CGs and conducted at lO-knot intervals-with flying colors, it exceeded certification requirements. For example, Piper didn't have to per- AOPA PILOT· 71 form stick force per G tests at speeds as high as 200 KIAS. But it did, even though this was some 40 knots higher than the letter of the law. In addition, extra, out-of-trim stick-force tests were conducted. Here, the pitch trim wheel is run for three seconds against trim speed. Then the controls are pushed and pulled for G measurements. These tests proved satisfactory, as well. Another series of flight tests addressed the airplane's behavior at and below maneuvering speed. Called unchecked pullups, they entailed tests between 70 and 126 KIAS (Piper's cal- culated average maneuvering speed for the accident aircraft), once again, each at different weights and CGs. This test goes as follows: (1) Trim the airplane to the target speed; (2) haul back on the yoke very quickly; (3) keep pulling until full elevator deflection is reached; and (4) measure the time it takes for the airplane to stall. Once again, the airplane passed with ample margins. Incidentally, it took the air- plane one second to stall when pulled up from 70 KIASand four seconds (the regs set a three-second minimum for this test) to stall from 126 KIAS. In every case, the airplane stalled, as it was supposed to, before reaching the limit load of 3.8 Gs. For Piper test pilot David W. Schwartz, the unchecked pullups were the hairiest of all in the SCR series. "We were uncertain about the air- plane's reaction to an unchecked pullup from VA at these weights and CGs. It hadn't been done before. So I didn't know if the airplane would enter a loop or do whatever," he said. "But it all worked out fine. Just a straight-ahead stall with no tricks." Checked, or balked, maneuvers were also performed, at speeds rang- ing from 150 to 200 KIAS,at the differ- ent weights and CGs and at the stan- dard 10-knot intervals. Checked maneuvers are those in which the test pilot suddenly pulls on the control yoke, then, just as suddenly, pushes on it. It's a maneuver designed not just to measure aerodynamic loads over the flight surfaces, but to simu- late a panicky pilot trying desperately to keep his airplane within the design flight envelope and load limits-as might be the case in severe turbulence or convective activity. This maneuver requires precise At high G loads, video footage showed slight, almost imperceptible movements of the horizontal stabilizer. timing because the goal is to obtain precise positive and negative G mea- surements for displacements from each 10-knot increment of airspeed. Fleeting, thousandths-of-a-second- long motions of the yoke are needed. Piper's checked maneuvers yielded data at points ranging from -2.5 to 4.2 Gs. "That 4.2 Gs was unintentional," said Schwartz, "I pulled a little too hard, a little too fast on one test and went outside the envelope for just a little bit." The videotape? Piper engineers kindly offered this author the chance to look at the footage. The pictures showed but the slightest, almost imperceptible, flexing of the horizon- tal stabilizer, and even then at only the highest G loads. Piper's chief engineer of aerodynamics, Mal Holcomb, when asked if the SCR tests brought any sur- prises, said, "The strength of the tail. We didn't realize it was so stiff." Inside the autopilot One third of the SCR team's 60 recom- mendations dealt with the Malibu/ Mirage's autopilot systems. But the autopilot recommendations seem to carry a greater sense of urgency than the rest. Maybe that's because the SCR team uncovered some autopilot tricks, traps, and unknowns that it-let alone most pilots-hadn't fully explored or understood before. For those pilots with the patience and discipline to read it, the SCR report provides valuable insight into the world of autopilot malfunctions. As far as most pilots are concerned, this is a world that has never seen the light of day-not in any classroom, and certainly not in any manual or check list. Here is a smattering of what the SCR team learned about the KFC ISO and its associated hardware: • Not all failures of the KFC 150 are detected by the system's monitor cir- cuits, and not all failures are "soft" (return control to the pilot automati- cally). A failure of the autopilot com- puter's attitude-sensing capability, for example, is not annunciated. A pre- flight check of the autopilot system will show everything normal. Should an attitude-sensing signal be lost in flight, the flight envelope could be expected to be exceeded (60 degrees of bank) within five to eight seconds. • Failure of the KFC ISO's KC 192 gyro sensor can cause runaways in both pitch and roll simultaneously. For example, after an attitude gyro sensing failure during an autopilot-controlled climb, the autopilot sensed a level flight condition-even though the pitch-up rate increased, and the air- plane rolled first to the right, then the left. After eight seconds, the airplane had rolled 80 degrees to the left and 10 degrees nose down. It was noted that excessive roll rates would not disen- gage the autopilot in this failure mode. In a descent from level flight at 160 KIAS,test pilots failed an attitude gyro sensor while simultaneously disengag- ing the vertical speed mode. Bank angle went from 45 degrees left to 30 degrees right, and pitch angle went to 20 degrees nose down. After 16 sec- onds, the airplane reached 200 KIAS. • After failing the vacuum system dur- ing an autopilot-controlled climb at 160 KIAS, the system commanded a continuation of the climb. But after three minutes, a 500-feet-per-minute descent rate began, and a yawing right turn developed. After 4.5 minutes, the airspeed was at 185 KIAS, and 2,000 feet had been lost. • During flight tests of simulated nose- up pitch trim runaways, it was deter- mined that "manually stopping the trim wheel rotation could only be accomplished momentarily as the overpower force to counteract the electric trim was too high." This was a significant finding for two reasons. One is that manually overpowering the electric pitch trim with the trim wheel is supposed to be a way of stop- ping a pitch trim runaway. Another reason is that, until recently, the Bendix/King manual specified such a check during each preflight. "Until recently corrected," the SCR report stated, "the normal procedure of the airplane flight manual supplement outlined a preflight test procedure for the manual electric trim system which was incorrect because it could not be accomplished as written. One step of the proced ure asked the pilot to, 'rotate the trim wheel manually against the engaged clutch [the left half of the manual electric pitch trim's split switch. The right half activates the trim motor-Ed.] to check the pilot's trim overpower capability.' This can- not be done in the PA-46-310P/350P airplanes because the pilot does not have enough mechanical advantage to manually rotate the trim wheel with the clutch engaged." A subsequent revision eliminated this check, which was also unusual. This manual override capability must be demonstrated in other installations of the same system in other airplanes with similar servo clutch torque limit values. The SCR team "assumed that the reason for this variance was a result of the unique design for this air- plane's pitch trim wheel linkage to the trim servo and trim tab controls." The autopilot supplements in Piper's air- plane flight manual still contain this preflight check. This raised a question. If pilots per- formed the preflight check. they would have noticed their inability to override the pitch trim servo clutch manually. In this case, the manual override failed the test, and use of the electric pitch trim would be prohibit- ed. Did pilots do the check and ignore the findings? Or did they not perform checks at all? oln the Mirage, the pilot couldn't easi- ly pull the pitch trim circuit breaker. That's because it is located on the copilot's side-wall panel, virtually out of the pilot's reach. In spite of these and other quirks, the SCR team found the autopilot in full compliance. Other disconnect fea- tures worked, so the chances of a completely out-of-control pitch trim runaway were almost nil (there are seven means of disconnecting the autopilot). Addition of a gyro sensor monitor feature was listed among the SCR's recommendations. So were requests for interlocking the stall warning sen- sor to the autopilot (so that the autopilot would automatically discon- nect if the stall warning activates), installing sensors that would discon- nect the autopilot if airspeed exceeded 185 KIAS (the maximum speed for autopilot use), and changing the certi- fication rules so that a single autopilot malfunction cannot lead to multi axis deviations in aircraft attitude. The SCR emphasized that the rules for autopilot certification came about in the era when Transport-category airplanes with two-man crews were the only autopilot users. The assump- tion was that one of the pilots would always be monitoring the autopilot, on the lookout for malfunctions. Another assumption was that it would take a crew just three seconds to rec- ognize and correct an autopilot prob- lem. To this day, certification rules still carry the three-second-delay require- ment before initiating a recovery from an autopilot malfunction. In that three seconds, the airplane must not enter an unsafe attitude or condition. The report pointed out that in sin- gle-pilot operations-the kind typical of Malibu/Mirage flights-three sec- onds is too short a time to be repre- sentative. For this reason, many of the autopilot malfunctions reenacted for the SCR review were conducted with recovery delays greater than three sec- onds. Some delays were as long as 24 seconds, others just under five min- utes. The report strongly suggested that the rules be changed to extend the recovery delay beyond the three- second limit. The moral: Continuously monitor any autopilot's performance at all times. While a lot of attention is focused on pitch trim runaways, or so-called "hardovers," the SCR noted that subtle malfunctions may be much more diffi- cult to recognize and take longer to recognize. Because of this, the maneu- vers produced by subtle malfunctions may be more severe than those result- ing from trim runaways. But above all, the SCR's recommen- dations asked for more pilot education and better manuals and other product information. One Bendix/King official recounted a story that underscores the level of pilot misunderstandings. A Maneuvers caused by subtle, unrecognized autopilot malfunctions can create dangerous attitudes and airspeeds. Malibu pilot called Bendix/King, com- plaining that his autopilot would oscillate wildly in pitch during attempts to level off from descent. It turns out that the pilot initiated his descents with the autopilot's altitude- hold feature engaged. The descent was accomplished by pushing on the con- trol yoke. When the desired altitude was reached, the pilot released the yoke, expecting the autopilot to some- how capture the new altitude. Instead, of course, the autopilot commanded an immediate climb back to the origi- nally programmed altitude. The pilot had been fighting the autopilot during his descents and inducing huge mistrims in the process. A proper autopilot descent requires the pilot to first disengage altitude hold, then use the auto trim switch to command a safe descent rate. The SCR report also mentioned other, simple bits of autopilot knowl- edge (affecting all types, not just the KFC 150) that should be emphasized in the course of autopilot training- such as never putting any manual restraint on the normal operation of the autopilot; large pitch mistrims could occur. Pilots also should under- stand that it's possible to program an autopilot climb that's beyond the per- formance capabilities of the airplane; commanding the autopilot to climb the airplane at a rate higher than it's able to execute, for example, can result in a stall. So where does this leqve us? The airframe and autopilot passed the review. Though 60 recommendations were made, the FM saw fit to propose only four airworthiness directives, all of them fairly benign in impact. Those affecting the airframe (strengthening the empennage with stronger rivets and inspection of elevator trim cable guide tubes) have, for the most part, already been addressed by owner compliance with previously issued Piper service bulletins (see "Pilot Briefing," April Pilot). One proposed AD affecting the autopilot asks that the low vacuum warning lights be placarded as inoper- ative and that vacuum gauge markings (a green arc showing the range of nor- mal suction values) be added. During the SCR's tests, it was learned that the low vacuum light switches sometimes did not illuminate when system suc- tion dropped below normal levels. The other proposed autopilot AD would require a cover for the pitch servo unit. This was prompted by reports of circuit board corrosion, caused mainly by pressure washing. Apparently, water could pass by the servo unit and enter internal compo- nents of the autopilot. Again, most Malibus already had this fix complet- ed, per a March 1990 Bendix/King ser- vice bulletin. The NTSB's response took more of an educational tack and emphasized human factors. It urged that pilots bet- ter familiarize themselves with the capabilities and limitations of the Mal- ibu/Mirage's autopilot, flight director, and altitude preselect components. It also asked for more training in unusual attitude recoveries and high-altitude operations. These are good ideas for pilots of any high-performance, autopilot-equipped airplane. It's tempting to say that the Mal- ibu's reputation has been saved by the SCR's findings. But if the certification team spoke the truth about the Mal- ibu/Mirage, it also revealed some other truths. One of them is that many pilots stepping up to the Malibu/ Mirage's left seat apparently'don't have sufficient respect for the kind of high-performance airplane that they've bought, nor the environment in which they fly. 0