Proficiency: The other autopilot failure

However, there’s another failure mode that’s even more insidious—and potentially even more dangerous. It affects systems that pair a primary pitch servo with automatic electric trim. Turning on the autopilot energizes solenoids that mechanically engage the drive gear on each servo with a driven gear on the pulley that moves the bridle cables connected to the corresponding flight control.

When the autopilot commands a change in pitch—say, because the pilot selects a higher altitude—the pitch servo energizes to move the elevator. A separate circuit in the pitch servo detects the torque on the pitch servo’s shaft and activates the pitch trim servo in the appropriate direction to trim off the control pressure, just as the pilot would do while flying by hand. Once the control pressure is neutralized, the torque on the pitch servo is removed, which deactivates the trim servo. The pitch servo itself stays engaged as long as the autopilot is on.

The problem arises if the pilot disconnects the autopilot while also putting forward- or back-pressure on the yoke—as one would naturally do to counter an uncommanded altitude excursion. The control pressure may prevent the pitch servo from mechanically disengaging, even though the bars disappear from the flight director, the autopilot disconnect annunciator lights up, and by every indication the autopilot’s been turned off. Worse, the pressure of the elevator control on the pitch servo puts torque on the pitch servo shaft, triggering the sensing circuit to activate the trim servo. In effect, the system treats the pilot’s inputs as an unintended excursion, which it attempts to counter with opposing trim.

Trying to outmuscle the runaway trim will keep it running in the same direction until it hits its stop, by which time the stick forces may be more than a pilot of normal strength can overcome. If the direction is nose-up, the result could be a stall that’s unrecoverable because of the out-of-trim condition and lack of elevator authority. Usually, though, the control input that triggered this sequence was back-pressure, to which the trim responded by running nose-down. If the pilot’s unable to keep the airplane from descending, aerodynamic loads on the flight controls will build rapidly with the increasing airspeed, making recovery even harder and raising the risk of overstressing the control surfaces or airframe. And the problem is exacerbated if the pilot also makes a roll input while disengaging the autopilot. In that case, mechanical lockup will keep the aileron servo engaged as well, requiring in certain cases the pilot to exert approximately 40 pounds of control pressure to override the clutch and deflect the ailerons. A pilot who reacts to a nose-low, wing-down unusual attitude by grabbing the controls prior to disengaging the autopilot will have to overcome the aileron clutch as well as the ensuing nose-down trim condition.

How many accidents might this have caused? It’s impossible to know. In at least one case, the pitch servo was still engaged when the wreckage was recovered. Aircraft in which trim position can be reliably determined post-impact (such as the Mooney, which adjusts the angle of incidence of the horizontal stabilizer using a jackscrew that locks in place) have been found with full nose-down trim, something the pilot was unlikely to have done deliberately. In models with cable-operated trim tabs, it’s not always possible to determine trim position at the time of impact—but careful analysis of radar-track data can reveal patterns that are simply not consistent with those airplanes having been in trim. In some cases, windows have been found far enough from the main wreckage that they must have blown out prior to impact, implying stresses so severe that they deformed the airframe in flight. It’s fair to suggest that this sequence explains at least some of the accidents in which capable and current instrument pilots inexplicably lost control in IMC—crashes which, for want of other evidence, were attributed to spatial disorientation.

A few pilots have faced this and survived—either because they knew about this anomaly and the recovery procedure or, in at least one case, because two pilots hauling back on the yokes with all their combined strength managed to land successfully. These experiences were harrowing. The lucky survivor who disconnected the pitch servo with forward pressure as the airplane dove through 2,000 feet sold the aircraft after landing and hasn’t flown again since.

As with so many things, prevention is both easier than the cure and safer. Avoiding the problem is simple—if the pilot understands the systems involved. Neutralizing all control pressures before disengaging the autopilot will keep the problem from ever arising. Refraining from corrective action while the airplane’s pitching and/or rolling toward an unusual attitude requires self-discipline, but delaying the action for just a second or two saves no end of trouble.

If the pitch servo doesn’t release and the trim begins to run, the remedy is simple but counterintuitive. A quick control pressure in the same direction as the trim—which is to say, the opposite input from the one needed to recover the airplane—should disengage the servo and de-energize the trim circuit. At very low altitude, however—say, after breaking out on a coupled ILS—even that may not be possible. Some systems do use the autopilot disconnect switch as a trim interrupt, but it requires holding the switch down until the mechanical lock is released—a fact not prominently mentioned in the operator’s manuals. Shutting off the electrical master could also be an option in visual conditions. In each case, the pilot faces the somewhat more tractable problem of recovering from an unusual attitude in an out-of-trim airplane.

It’s not impossible to train for this in the airplane, but it isn’t recommended. The speed with which aerodynamic forces can build calls for approaching this with considerable caution. If you choose to try, give yourself plenty of altitude in good visibility, engage the autopilot in altitude and heading modes, and apply light back pressure before disengaging the autopilot. Be prepared for an immediate nose-down pitching moment! It may help to buy some time by having your instructor or safety pilot try to manually trim against the pitch servo input—and bear in mind that if the servo doesn’t disengage, you may need to turn off the master before control pressures become too extreme.

Finally, owners might consider adding an “electric trim in motion” light to the instrument panel. Provided it’s wired in parallel to the trim motor and doesn’t replace any required equipment, this should be a minor modification that only requires a logbook entry. The pitch trim servo of the autopilot is also used for the normal electric trim. Early warning of a trim runaway, regardless of its cause, can potentially be life-saving. AOPA

Jack Lipscomb is a former NTSB air safety investigator and was a senior instructor at the agency’s National Accident Investigation School. He presently serves as an expert consultant on aircraft accident investigation and reconstruction. David Jack Kenny is manager of aviation safety analysis for the AOPA Air Safety Institute.