The Cloaking of the Autopilot can Conceal Imminent Upsets
On the night of May 3, 2005, Fairchild-Swearingen SA227-AC Metro III airplane ZK-POA, operated by Airwork (NZ) Ltd, was on a freight flight with two crew and 1,790 kilograms of cargo when it suffered an in-flight upset that developed into a high g spiral dive. The aircraft quickly became overstressed and broke up. Eyewitnesses described a possible fuel- tank explosion. Investigators later found that fuel was involved, albeit not explosively. Of greater interest was the part played by the autopilot (A/P).
A/Ps are a great aid in allaying fatigue. In fact, the more capable ones come in pairs (or even threes) and are capable of conducting an autoland in zero/zero conditions. You may even hear them referred to as an AFCS (Automatic Flight Control System). Depending on the model, they will be able to trim, lock in a barometric altitude, capture a heading or track a course, level off at a specified altitude and even allow you to maneuver using the yoke, in Control Wheel Steering mode (CWS). Some can even lock in a radar altitude at lower levels.
With more sophisticated systems, you get autothrottle and speed maintenance. Quality autopilots are required if you need to fly within Reduced Vertical Separation Minima (RVSM) airspace. One thing that you should not do with the more rudimentary models is trust them. They can be a source of great confusion and they can mask potential aircraft control problems.
Autopilot Abuse
In the ZK-POA case, the recently released report reveals that Metro pilots were using a homespun method to transfer fuel from one side to the other. To expedite refueling, or because access to one side of the aircraft was difficult, the refueller would often add all the fuel to one wing-tank. Pilots would then get the asymmetry within limits for take- off by inducing tank crossflow via orbit turns during taxi.
Once airborne and in the cruise, crossflow transfer to cancel any residual imbalance could only be achieved by trimming into a cross-controlled sideslip. Not all Metros sport autopilots; ZK-POA did. That allowed pilots to have it do the work of holding a sustained wing-high sideslip of up to 20 degrees. The captain was heard to be encouraging the new F/O to increase the rudder out-of-trim condition, just prior to the upset. Once the torque holding capacity of the A/P servo was exceeded, that axis “let go” and the aircraft “departed” controlled flight in a sudden banking, nose-dropping yaw that caught the pilots by surprise.
The Metro is an aerodynamically clean aircraft, so once its nose is buried below the horizon, speed rapidly increases. Because it is pitch-trimmed for a much lower IAS (as well as a significant yaw), the nose tends to pitch into the banked spiral, the bank tends to increase and the g force rapidly increases. The rudder trim would also have been inducing “rolling g”. That can induce a wing torsional overload well below the ultimate load structural limit. The max maneuver speed was 181kts and ZK-POA broke up as it reached 300kts.
On a dark night, it’s debatable whether the pilots will cotton on to what’s happened, disconnect the A/P and use restraint in recovering on instruments from the unusual attitude. Indicative is that the power came back only seven seconds before the break-up occurred. Two seconds before the break-up, the captain asked the co-pilot whether the A/P was off.
A method of cross-transferring fuel is needed for engine failure cases, but N.Z. Civil Aviation is now saying that it should be done with the A/P OFF. It may have been simpler to include a few simple valves and transfer pumps in the design. However, the cloaking effect of the abused A/P was the real killer. Similar scenarios had led to an Australian Merlin (VH-SSL) losing 11,000ft before recovering and, on Feb. 8, 2006, a Metro N629EK crashing near Paris, TN after reporting an asymmetric fuel condition.
Idiosyncratic Autopilots
A similar upset and inflight break-up occurred to VH-LST on Feb. 19, 2004 in northern Tasmania. In this case, fuel was not a factor. Two identical planes in the operator’s fleet had Century III A/P’s but VH-LST had a Bendix. A peculiarity of the Bendix was in the Flight Manual (AFM) but photocopied illegibly – i.e., if the aircraft wasn’t in trim and the A/P pitch trim zeroed out before the A/P was engaged, it would pitch up or down upon engagement.
The illegible manual also stated that any resulting attempt to overpower the A/P would cause the electric trim to oppose the yoke-applied force, resulting in an out-of-trim condition. For example, if the pilot applied a nose-up input to the control column to counter a nose-down pitch upon engagement, the elevator trim would be activated to produce a greater nose-down force. That behavior is not exhibited by A/P systems without automatic pitch trim such as the Century III.
The emergency operating procedures in the AFM A/P supplement stated that if a malfunction in the A/P was detected, the pilot must immediately disengage the A/P by momentarily pressing the A/P release switch on the control wheel.
Once again, it’s debatable whether that’s likely when the pilot has both hands on the yoke fighting an apparent runaway elevator trim and a nose-down divergent attitude. The Operator’s Operations Manual only covered the Century III, no mention being made of the Bendix A/P. The accident flight had been the pilot’s first charter flight in VH-LST.
An FAA study on pitch-trim malfunctions indicated that 13 of the 24 subjects encountered “flight-terminating” outcomes…. with airspeed increases of up to 200kts. The A/P controller’s pitch command wheel was found at the accident site in the maximum nose-down position. Both elevator trim tabs were at the maximum nose-down trim position.
The Precipitation Factor
Most of the attention on A/Ps and upsets has focused on their masking of icing – particularly of rapid build-ups in freezing rain. Convair 580 ZK-KFU lost such a contest on Oct. 3, 2003 off the New Zealand west coast. After leveling off temporarily during its descent to reduce speed while approaching heavy cells on radar, the CV580 shortly thereafter entered the classic graveyard spiral and disappeared off ATC radar.
Correlation of CVR, flight recorder and radar data indicated that the aircraft’s transponder seemingly “quit” a finite time before the spiral began and the break-up occurred. This was attributed to the sudden onset of heavy airframe icing masking the transponder antenna as the aircraft entered the trailing edge of an active front.
The CV580 was equipped for anti-icing only (i.e., not de-icing). The hot engine bleed air was found to be less effective in keeping the tailplane clear of ice because it had such a long way to travel. Not mentioned in the N.Z. Report, but deemed relevant, is the fact that turboprop icing is likely to be quite asymmetric. This is due to the direction of rotation of the port and starboard props being the same. This will influence the spanwise distribution of ice upon the wings, fuselage and tailplane.
Consequently, when a turboprop stalls due to the cumulative weight and drag of ice, the outcome is likely to be an uncontrollable roll, very much akin to the spin entry phenomenon of autorotation. Once the port wing (say) stalls first, the aircraft will roll left with the nose dropping. Any attempt to counter that roll with right aileron will only exacerbate the lift dissymmetry, further embed the left wing in its stall and increase the rate of roll. If the sudden “roll departure” catches the pilots by surprise, it’s unlikely that the A/P will be disengaged during the ensuing upset. Their recovery task would be further complicated.
After the 2002 loss of an ATR72 freighter in the Taiwan Straits emulated the 1994 icing crash of an American Eagle ATR-72 at Roselawn Indiana, the FAA endorsed the philosophy that pilots should disconnect A/Ps when in significant icing. The Trans Asia Airways plane broke up a mere 73 seconds after the crew had remarked on the severity of the icing and loss of speed.
ON/OFF & Tricky Buttons
When a Flash Airlines 737 pilot instructed his F/O to engage the A/P for him during a late night climb-out of Sharm-el-Sheikh on Jan. 3, 2004, it was done in a turn. The turn gradually reversed into an unwanted direction, and the aircraft plunged into the Red Sea. Typical of many A/Ps, the 737-300 doesn’t like engaging under load or when out of trim and can fail to engage or jump out.
What’s more, the EFIS model has a non self-evident illuminated push-button rather than the latching paddle switch of older designs. To verify the A/P has engaged, you must check the Mode Annunciator Panel. It wouldn’t be hard for a tired crew to push the button while some control input was in, believe the A/P was engaged, and miss the lack of the little green “CMD” caption on the ADI (attitude direction indicator).
The “not nice” characteristic of push-button A/P engagement is that it can passively indicate non-engagement via an internal lamp, whereas a paddle switch will not latch magnetically when held to the position and returns very evidently to a slack bolt upright. That’s a very tactile clue. In the Flash case the pilot is unlikely to have missed the significance of a cavalry charge audio (signifying an A/P disconnect) and just continued on into a lather of confusion as if the A/P had been engaged in his desired mode.
To an extent, this can be seen as an ingrained expectation and an over-reliance upon the A/P’s ability to always reliably capture and fly speeds, headings and tracks on a black night departure – once summoned. On the other side of the same coin, see it as a pilot’s total inability to recognize that the A/P hadn’t come to the party and an unwillingness to concede failure. In the Flash crash the co-pilot blandly fed the pilot useful data but failed to intervene usefully. The paralytic outcome was a quadraplegic coming together of a failure of piloting, command responsibility, CRM and automation design.
Mode Muddles
In a more recent June 15, 2006 737 crash, TNT’s OO-TND was diverted from destination Stansted to East Midlands due to weather – and converted to a touch and go after shedding its right main-gear. It eventually ended up crash-landing on its remaining gear at Birmingham, where it’s destined to abide a while. The accident is still under investigation, but it would appear that the crew were called on late finals by ATC during their CAT III autoland approach, for relay of a company message.
The pilot’s reply attempt unfortunately miscued when he pressed his A/P disconnect instead of his yoke-mounted PTT (press-to-talk) button. Instantly realizing what he’d done, he re-engaged the A/P. Unfortunately, that was the exact wrong thing to do during an autoland in zero/zero conditions.
The A/P factors in some nose-up pitch trim in the last 400ft above the runway in case of a go-round, so on a pilot-initiated A/P disconnect the nose pitches up into an already trimmed go-round profile. If the pilot countered that attitude change as well as re-engaging “George”, it could explain why the aircraft touched down hard well left of the runway and then frightened a terminal full of people while on an unusual overhead overshoot profile.
An Unwelcome Coupling
A KC-135 had two engines break off, shortly after take-off, during Op Desert Storm. An A/P malfunction overstressed the airframe, causing one engine to break away and hit a second, which was also torn from the wing. KC-135s have overstressed in the past because of A/P disconnects. Apparently, due to a divergent coupling of roll and yaw, the 135 performed a prompt dutch roll, leading to nacelle overstress.
Before you and your A/P become engaged, think first about surveillance, divorce, a contingency pre-nup and who gets the passengers (the ceiling or the floor?). Chances are, your autopilot never went to flight school — and might also lack redeeming social graces.