The FAA looks for trouble
A reputation is a fragile thing, especially when it comes to high technology. In the aviation world, there have been numerous cases where aircraft presumed to have been brilliant milestones turned out to be conspicuous disasters. For example, the de Havilland Comet, the world's first jet airliner, got rave reviews when it went into service in 1952. But by 1954, a series of fatal crashes ended its brief time in the spotlight; the problems were traced to cabin designs insufficiently strong to withstand repeated pressurization cycles.
Likewise, general aviation aircraft have had their share of reputation-damaging events. Over the years, various airplanes have experienced design-related safety problems. In most cases, suspicion about an airplane's design were raised by patterns of accidents taking place under similar conditions. In the case of the Mitsubishi MU-2 and Learjet, a series of fatal, unexplained plunges from altitude prompted Federal Aviation Administration reviews of these airplanes' compliance with certification standards. The airplanes passed this scrutiny with minimal fuss.
In the late 1970s and early 1980s, the safety of the Beechcraft V35 Bonanza became a major issue. The problem was a pattern of in-flight airframe failures. Many of these disintegrations occurred in instrument meteorological conditions and with non-instrument-rated pilots at the controls. There was considerable speculation that the V35's V-tail design was partially to blame. It was learned that under certain high G loadings, the tail structure could twist and bend to an unusually large degree. Once again, a certification review was ordered, and once again, it was determined that the airplane met the rules. Eventually, a method of strengthening the V-tail's tail spar assemblies was developed by Beech, then offered to owners free of charge.
That took care of the structural component of the situation. As for the human factors aspects, the picture was less clear. Was the Bonanza too slippery, too demanding for a low-time — or unproficient — pilot?
We'll probably never know the answer to that kind of question, but it came up again in 1989 and in a similar context. This time, the reputations of the Piper Malibu (PA-46-310) and Malibu Mirage (PA-46-350) aircraft were on the line. Between May 1989 and March 1991, there were seven fatal accidents, six of them involving Malibus, one of them a Mirage. All were in-flight breakups; most occurred at altitude, some involved flight in thunderstorms, and some involved relatively low-time pilots.
In March 1991, the FAA was moved to issue an airworthiness directive prohibiting Malibu and Mirage pilots from flying in instrument meteorological conditions. The following month, after howls of protest, it rescinded the AD, then published another. This unusual rule prohibits flight in or near thunderstorms, icing, and moderate to severe turbulence. The rule was rather unusual — it inferred that other airplanes may fly in these conditions without suffering harm, when in fact every pilot knows that severe weather can down even the strongest, most powerful airplanes carrying the most experienced crews.
Suspecting — as with the MU-2 — that autopilot problems may have been responsible for the crashes, the FAA also prohibited the use of the PA-46's Bendix/King KFC 150 autopilot for altitude changes.
At the same time, the FAA ordered a special certification review (SCR) of the PA-46 series. It turned out to be one of the most thorough certification reviews ever conducted.
The review process consumed the better part of 1991 and involved the full cooperation of both Piper and Bendix/King. Finally, on December 5, 1991, the review was published. The aviation press dutifully reported the news: The Malibu and Mirage, as well as their autopilots, were in full compliance with certification rules.
Piper jumped for joy, saying "this proves what we've been saying all along...that there is nothing wrong with the airplane." In a press release, Piper's then-owner, M. Stuart Millar, added a line that all could agree upon: "...but a focus is needed on pilot training and systems familiarity."
Bendix/King was more reserved. In its release, it said simply, "FAA personnel were also asked whether they had found any evidence linking the KFC 150 autopilot to any Malibu/Mirage accident, and their response was in the negative." This comment was obviously crafted with legal defense in mind. It's important to remember that the SCR was just that, a certification review — not an accident investigation. Rulings of these accidents' probable causes (which are still pending, as of press time) are the province of the National Transportation Safety Board, not the FAA. So the SCR does not blame. Instead, it identified various problems and made recommendations — 60 of them, in this case — for improving the airplane and its autopilot.
It's doubtful that many took the time to read the SCR report. It's 3 inches thick and has about a thousand pages. Still, it's interesting to take a look inside, especially at those sections dealing with the autopilot tests. Finish reading the text sections of the full report (don't bother reading the graphs or raw data unless you're an aeronautical engineer), and you'll come away with a greater respect for the airplane's strength, the researchers' professionalism, and, perhaps most important, the complexities of autopilots in general and those of the KFC 150 in particular.
Testing the airframe
Structural testing and review of the Malibu/Mirage airframe came from several sources. The FAA, Piper, and the NASA Langley facility validated the results of Piper's original calculations on the PA-46's aeroelasticity and flutter characteristics. The analysis proved that the wings would begin to flutter at about 600 KIAS, the horizontal tail at better than 1,000 KIAS. That's better than three times the airplane's VNE of 198 KIAS and well into the supersonic realm.
Because the accident aircraft all showed an essentially simultaneous failure of the wings and horizontal tail, great attention was paid to both static and dynamic load testing. Piper did a static load test of the Malibu's tail and found that it failed at 239 percent of its 3.8-G limit load, or approximately 9 Gs. Other static tests were performed at loadings ranging from 3.8 to -2 Gs.
Then Piper performed flight tests, using one of its own test aircraft (N9135D — the one used in the original certification process). For each of the 75 tests, the airplane was loaded to the same weights as the accident aircraft and at their most rearward and most forward CGs at the times of the accidents. The aim here was not to load the test airplanes to their CG and gross-weight limits (that had already been done when the Malibu was first certified), but to duplicate the accident aircraft weights at the edges of the potential CG envelope for those weights. (Except for one accident aircraft, which was determined to have had a CG well aft of the design envelope.)
To document test results, pressure-sensitive "Strip-a-tube" was applied the length of the horizontal tail's chord; this recorded pressure distribution over the tail. Strain gauges were installed to measure aerodynamic stresses electronically. Potentiometers, installed at the end of the elevator push rod, gave precise readings of control deflections. Finally, two video cameras were aimed at the tail surfaces — one in the cabin, aiming rearward, and one on the vertical fin, looking down.
What followed were a number of tests — far too many to cover in a magazine article. Among the most important, however, were those measuring stick force per G, in which control forces were measured at speeds between 130 and 200 KIAS, pulling anywhere from 1.2 to 3.05 Gs. These tests measured the amount of control force required to deviate from the airplane's trim speed and, as such, are important measures of an airplane's longitudinal stability: The farther you deviate from trim speed, the harder you must pull on the control yoke. The Malibu/Mirage not only passed these tests — each one, remember, at different weights and CGs and conducted at 10-knot intervals — with flying colors, it exceeded certification requirements. For example, Piper didn't have to perform stick force per G tests at speeds as high as 200 KIAS. But it did, even though this was some 40 knots higher than the letter of the law. So the static longitudinal stability of the airplane could not be questioned.
In addition, extra, out-of-trim stick-force tests were conducted. Here, the pitch trim wheel is run for three seconds against trim speed. Then the controls are pushed and pulled for G measurements. These tests proved satisfactory, as well.
Another series of flight tests addressed the airplane's behavior at and below maneuvering speed. Called unchecked pullups, they entailed tests between 70 and 126 KIAS (Piper's calculated average maneuvering speed for the accident aircraft), once again, each at different weights and CGs. This test goes as follows: (1) Trim the airplane to the target speed; (2) haul back on the yoke very quickly; (3) keep pulling until full elevator deflection is reached; and (4) measure the time it takes for the airplane to stall. Once again, the airplane passed with ample margins. Incidentally, it took the airplane one second to stall when pulled up from 70 KIAS and four seconds (the regs set a three-second minimum for this test) to stall from 126 KIAS. In every case, the airplane stalled, as it was supposed to, before reaching the limit load of 3.8 Gs.
For Piper test pilot David W. Schwartz, the unchecked pullups were the hairiest of all in the SCR series. "We were uncertain about the airplane's reaction to an unchecked pullup from VA at these weights and CGs. It hadn't been done before. So I didn't know if the airplane would enter a loop or do whatever," he said. "But it all worked out fine. Just a straight-ahead stall with no tricks."
Checked, or balked, maneuvers were also performed, at speeds ranging from 150 to 200 KIAS, at the different weights and CGs and at the standard 10- knot intervals. Checked maneuvers are those in which the test pilot suddenly pulls on the control yoke, then just as suddenly, pushes on it. It's a maneuver designed not just to measure aerodynamic loads over the flight surfaces, but to simulate a panicky pilot trying desperately to keep his airplane within the design flight envelope and load limits — as might be the case in severe turbulence or convective activity.
This maneuver requires precise timing because the goal is to obtain precise positive and negative G measurements for displacements from each 10- knot increment of airspeed. Fleeting, thousandths-of-a-second-long motions of the yoke are needed. Piper's checked maneuvers yielded data at points ranging from -2.5 to 4.2 Gs. "That 4.2 Gs was unintentional," said Schwartz, "I pulled a little too hard, a little too fast on one test and went outside the envelope for just a little bit."
The videotape? Piper engineers kindly offered this author the chance to look at the footage. The pictures showed but the slightest, almost imperceptible, flexing of the horizontal stabilizer, and even then at only the highest G loads. Piper's chief engineer of aerodynamics, Mal Holcomb, when asked if the SCR tests brought any surprises, said, "The strength of the tail. We didn't realize it was so stiff."
Inside the autopilot
One third of the SCR team's 60 recommendations dealt with the Malibu/Mirage's autopilot systems. But the autopilot recommendations seem to carry a greater sense of urgency than the rest. Maybe that's because the SCR team uncovered some autopilot tricks, traps, and unknowns that it hadn't fully explored or understood before.
For those pilots with the patience and discipline to read it, the SCR report provides valuable insight into the world of autopilot malfunctions. As far as most pilots are concerned, this is a world that has never seen the light of day — not in any classroom, and certainly not in any manual or check list.
Here is a smattering of what the SCR team learned about the KFC 150 and its associated hardware:
Not all failures of the KFC 150 are detected by the system's monitor circuits, and not all failures are "soft" (return control to the pilot automatically). A failure of the autopilot computer's attitude-sensing capability, for example, is not annunciated. A preflight check of the autopilot system will show everything normal. Should an attitude-sensing signal be lost in flight, the flight envelope could be expected to be exceeded (60 degrees of bank) within five to eight seconds.
Failure of the KFC 150's KC 192 gyro sensor can cause runaways in both pitch and roll simultaneously. For example, after an attitude gyro sensing failure during an autopilot-controlled climb, the autopilot sensed a level flight condition — even though the pitch-up rate increased, and the airplane rolled first to the right, then the left. After eight seconds, the airplane had rolled 80 degrees to the left and 10 degrees nose down. It was noted that excessive roll rates would not disengage the autopilot in this failure mode.
In a descent from level flight at 160 KIAS, test pilots failed an attitude gyro sensor while simultaneously disengaging the vertical speed mode, bank angle went from 45 degrees left to 30 degrees right, and pitch angle went to 20 degrees nose down. After 16 seconds, the airplane reached 200 KIAS.
After failing the vacuum system during an autopilot-controlled climb at 160 KIAS, the system commanded a continuation of the climb. But after three minutes, a 500-feet-per-minute descent rate began, and a yawing right turn developed. After 4.5 minutes, the airspeed was at 185 KIAS, and 2,000 feet had been lost.
During flights tests of simulated nose-up pitch trim runaways, it was determined that "manually stopping the trim wheel rotation could only be accomplished momentarily as the overpower force to counteract the electric trim was too high." This was a significant finding for two reasons.
One is that manually overpowering the electric pitch trim with the trim wheel is supposed to be a way of stopping a pitch trim runaway. Another reason is that, until recently, the Bendix/King manual specified such a check during each preflight. "Until recently corrected," the SCR report stated, "the normal procedure of the airplane flight manual supplement outlined a preflight test procedure for the manual electric trim system which was incorrect because it could not be accomplished as written. One step of the procedure asked the pilot to, `rotate the trim wheel manually against the engaged clutch [ the left half of the manual electric pitch trim's split switch. The right half activates the trim motor — Ed.] to check the pilot's trim overpower capability.' This cannot be done in the PA-46-310P/350P airplanes because the pilot does not have enough mechanical advantage to manually rotate the trim wheel with the clutch engaged."
A subsequent revision eliminated this check, which was also unusual. This manual override capability must be demonstrated in other installations of the same system in other airplanes with similar servo clutch torque limit values. The SCR team "assumed that the reason for this variance was a result of the unique design for this airplane's pitch trim wheel linkage to the trim servo and trim tab controls." The autopilot supplements in the Piper manual still contain this preflight check.
This raised a question. If pilots performed the preflight check, they would have noticed their inability to override the pitch trim servo clutch manually. In this case, the manual override failed the test, and use of the electric pitch trim would be prohibited. Did pilots do the check and ignore the findings? Or did they not perform checks at all?
In the Mirage, the pilot couldn't easily pull the pitch trim circuit breaker. That's because it is located on the copilot's side-wall panel, virtually out of the pilot's reach.
In spite of these and other quirks, the SCR team found the autopilot in full compliance. Other disconnect features worked, so the chances of a completely out-of-control pitch trim runaway were almost nil (there are seven means of disconnecting the autopilot). The only really questionable aspect of the autopilot seems to be its computers' inability to annunciate a gyro sensor loss.
Addition of a gyro sensor monitor feature was listed among the SCR's recommendations. So were requests for interlocking the stall warning sensor to the autopilot (so that the autopilot would automatically disconnect if the stall warning activates), installing sensors that would disconnect the autopilot if airspeed exceeded 185 KIAS (the maximum speed for autopilot use), and changing the certification rules so that a single autopilot malfunction cannot lead to multiaxis deviations in aircraft attitude.
The SCR emphasized that the rules for autopilot certification came about in the era when Transport-category airplanes with two-man crews were the only autopilot users. The assumption was that one of the pilots would always be monitoring the autopilot, on the lookout for malfunctions. Another assumption was that it would take a crew just three seconds to recognize and correct an autopilot problem. To this day, certification rules still carry the three-second-delay requirement before initiating a recovery from an autopilot malfunction. In that three seconds, the airplane must not enter an unsafe attitude or condition.
The report pointed out that in single-pilot operations — the kind typical of Malibu/Mirage flights — three seconds is too short a time to be representative. For this reason, many of the autopilot malfunctions reenacted for the SCR review were conducted with recovery delays greater than three seconds. Some delays were as long as 24 seconds, others just under five minutes. The report strongly suggested that the rules be changed to extend the recovery delay beyond the three-second limit. The moral: Continuously monitor any autopilot's performance at all times.
While a lot of attention is focused on pitch trim runaways, the SCR noted that subtle malfunctions may be much more difficult to recognize and take longer to recognize. Because of this, the maneuvers produced by subtle malfunctions may be more severe than those resulting from trim runaways.
But above all, the SCR's recommendations asked for more pilot education and better manuals and other product information. One Bendix/King official recounted a story that underscores the level of pilot misunderstandings. A Malibu pilot called Bendix/King, complaining that his autopilot would oscillate wildly in pitch during attempts to level off from descent. It turns out that the pilot initiated his descents with the autopilot's altitude-hold feature engaged. The descent was accomplished by pushing on the control yoke. When the desired altitude was reached, the pilot released the yoke, expecting the autopilot to somehow capture the new altitude. Instead, of course, the autopilot commanded an immediate climb back to the originally programmed altitude. The pilot had been fighting the autopilot during his descents and inducing huge mistrims in the process. A proper autopilot descent requires the pilot to first disengage altitude hold, then use the autotrim switch to command a safe descent rate.
The SCR report also mentioned other, simple bits of autopilot knowledge (affecting all types, not just the KFC 150) that should be emphasized in the course of autopilot training — such as never putting any manual restraint on the normal operation of the autopilot; large pitch mistrims could occur. Pilots also should understand that it's possible to program an autopilot climb that's beyond the performance capabilities of the airplane; commanding the autopilot to climb the airplane at a rate higher than it's able to execute, for example, can result in a stall.
So where does this leave us? The airframe and autopilot passed the review. Though 60 recommendations were made, the FAA saw fit to propose only four airworthiness directives, all of them fairly benign in impact. Those affecting the airframe (strengthening the empennage with stronger rivets, inspection of elevator trim cable guide tubes) have, for the most part, already been addressed by owner compliance with previously issued Piper service bulletins (see "Pilot Briefing," April Pilot).
One proposed AD affecting the autopilot asks that the low vacuum warning lights be placarded as inoperative and that vacuum gauge markings (a green arc showing the range of normal suction values) be added. During the SCR's tests, it was learned that the low vacuum light switches sometimes did not illuminate when system suction dropped below normal levels.
The other proposed autopilot AD would require a cover for the pitch servo unit. This was prompted by reports of circuit board corrosion, caused mainly by pressure washing. Apparently, water could pass by the servo unit and enter internal components of the autopilot. Again, most Malibus already had this fix completed, per a March 1990 Bendix/King service bulletin.
The NTSB's response took more of an educational tack. It urged that pilots better familiarize themselves with the capabilities and limitations of the Malibu/Mirage's autopilot, flight director, and altitude preselect components. It also asked for more training in unusual attitude recoveries and high-altitude operations. These are good ideas for pilots of any high- performance, autopilot-equipped airplane.
It's tempting to say that the Malibu's reputation has been saved by the SCR's findings. But if the certification team spoke the truth about the Malibu/Mirage, it also revealed some other truths. One of them is that many pilots stepping up to the Malibu/Mirage's left seat apparently don't have sufficient respect for the kind of high-performance airplane that they've bought, nor the environment in which they fly.
Related Articles
