You Are The Backup To Safety Enhancing Aircraft Avionics

Theres no going back-we are in an era of high-tech avionics and cockpit automation. Even some LSAs are sporting “glass” cockpits and simple autopilots; cross-country airplanes sport panels and equipment unheard of even in high-end turbines scant years ago, and the turbines themselves are becoming more accessible to owner-pilots. Even the most capable of these airplanes, however, has

its automation limitations. Proper operation and constant monitoring of automated systems remains the responsibility of well-trained and emergency-current pilots.

On April 19, 2008, a Cessna Citation Mustang suffered substantial damage when its pilot ground-looped the light jet to prevent a runway overshoot at Carlsbad, Calif. According to the NTSBs preliminary report, this was an intentional act to prevent going off a cliff past the end of the runway after the pilot landed “fast” and beyond the mid-point of Carlsbads 4600-foot available landing surface. The pilots quick action may be credited with sparing injury (or worse) to the four people on board.

Like most accidents, this event was the end result of a long chain of events that grew to overcome the airplanes and/or the pilots capabilities. In this case the NTSB preliminarily report suggests the chain may have developed like this:

The threatened runway overrun resulted from excess speed (reported to have been 15 knots above V_REF on final approach).

Excess speed on final may have resulted from the aircraft being high and close to the airport at the beginning of the approach.

Excess altitude for the visual approach may have come from a heightened desire to get on the ground quickly.

That heightened desire to land may have been an outcome of pilot fatigue. The NTSB quotes the pilot as saying he was “fatigued from maneuvering the airplane by hand for such a long duration (which he approximated was around 45 minutes).”

Pilot fatigue likely resulted from difficulty flying the airplane with instrument (PFD), autopilot and trim failures resulting from an electrical malfunction.

Delay in reverting to manual trim operation and hand-flying faced with erroneous flight director indications might have been the result of an over-reliance on cockpit automation to the exclusion of practice with reversion to manual flying.

Over-reliance on cockpit automation may have been a by-product of current training philosophies, especially in single-pilot jets.

Running the risk of sounding like Im affixing blame in this specific event (which is

not my intention), consider: Even if faced with systems malfunctions, the requirement to hand-fly a trimmable airplane for 45 minutes should not be so foreign to a pilot that it fatigues him/her beyond the ability to make a visual landing.

Im all in favor of autopilots as workload reducers. Back when I was a high-performance single- and multiengine piston simulator instructor, however, the most common failing I saw in pilots was an inability to hand-fly normal maneuvers to Practical Test Standards criteria as a result of over-reliance on the autopilot. And that was before the current training emphasis on near-constant autopilot use in this class of airplane.

The Citation Mustang has a manual trim system that backs up the electric trim. A recent trend in airplane design, however, is to eliminate manual backups to trim actuation. All-electric trim saves complexity, weight and cost-highly desirable to aircraft manufacturers and owners alike. This trend began in larger jets with redundant electrical systems and in some cases even completely redundant trim mechanisms. It gained popularity in light airplanes through the homebuilding movement where no such backups usually exist, but in which pilots (and passengers staring at the word “experimental” in large block letters) are assumed to be taking additional risks.

The no-backups, all-electric trim approach has now, however, become common in certified production light airplanes as well. Lack of a backup trim means the pilots arms and legs become the only redundant feature of these airplanes trim system.

Lest anyone feel this automation-angst makes me an aeronautical Luddite, what Im saying is this: Despite the workload reduction and situational awareness advantages of advanced navigation and autopilot systems, you are the backup in case anything goes wrong with cockpit automation. You have to be up to the task of quickly identifying failures and taking over manually at all times.

The aviation press-including sister publication Aviation Consumer-has reported extensively on Cirrus Designs recent announcement of its new Cirrus Perspective SR22 variant. The CP22 (my abbreviation, not theirs) sports a first for Cirrus: Garmin PFD/MFDs with larger screens and a number of enhancements over other versions of the hegemonic G1000. New features of the CP22 herald what may be the safest piston-powered general aviation airplane ever produced. I spoke with Rob Haig, manager of Cirrus Designs Flight Standards department, about these latest enhancements. The Perspective upgrades result in an airplane with:

Dual AHRSs: No longer does everything hinge on a single-point failure of the attitude-heading reference system (AHRS, the “brains” behind glass-cockpit flight data displays). Cirrus is the first to fix this oversight in piston airplanes. Data

comparison and switching is in almost all cases automatic. Both AHRS operate simultaneously, a backup taking over automatically when it senses a “hard” failure in the active unit-anything that would generate “red Xs” on the primary flight display (PDF).

Cirrus Perspective has a monitoring system that continually checks for errors and switches AHRS when one is detected.

Since with fewer than three AHRS the system cant automatically compare data and use two to overrule a third, its up to the pilot to constantly monitor the AHRS data and crosscheck it against the standby AI. If any discrepancy appears, Haig says, the pilot should manually switch AHRS input and crosscheck that against the “steam gauge” standby, using pilot interpretation of the gyroscopic instrument as the tie-breaker. Manually switching the system to AHRS 2 makes the autopilot believe there is a problem with AHRS 1, making some autopilot modes unavailable, according to Haig.

Autopilot LVL (Level) Button: This is a life-saving innovation weve waited for but until now no one has delivered. In some respects it may be more significant than the ballistic recovery parachute (BRS). When toggled, the LVL control engages the autopilot for wing-level flight at the airplanes current altitude.

The obvious application is recovery from unusual flight attitudes. But will it work? Anyone experienced in teaching spiral recoveries in an aerodynamically slick airplane knows that speed builds extremely rapidly when the wing banks and the nose points down. After leveling the wings and rolling all the wings lift into the vertical, a big part of recovering is to push forward, hard, on the controls to keep the nose from pitching too far upward and to prevent excessive G-loading of the airframe in the pull-out. Training pilots on unusual attitudes in the simulator I learned its not “unusual” at all for a pilot to let the pitch come up excessively in the recovery, leading to excessive speed loss and either a (1) wing-over-like transition to a new, nose-low attitude or (2) an aerodynamic stall. Accident records show that many unusual attitude inflight breakups occur when the pilot allows the pitch to raise so rapidly the airplane exceeds design G-limits.

Perspectives LVL function can reportedly recover the aircraft from an attitude of 75 degrees of roll and 50 degrees of pitch, even if they occur simultaneously. Can LVL do this without overstressing the airframe, or turning a nose-low attitude into a nose-high stall? Can it do so without exceeding control-force limitations that will disengage the autopilot?

Haig is quick to dispel rumors that the LVL button is meant for unusual-attitude recovery. “Its not designed for that,” he says. Instead, LVL is there for situations “weve all been in” with high workload, perhaps in turbulence, when things happen quickly and the pilots attention is maxed out. Engaging the LVL function (which activates from any autopilot mode, including “off”) gives the pilot time to figure out whats going on, whether from external pressures or “automation surprise” when the autopilot does something unexpected. Its the same effect as hitting altitude hold, heading hold and autopilot “on,” only quicker. Haig is emphatic that “if the browns and greens are swapping” on the PFD “youve lost control,” and “thats what the red handle [CAPS deployment] is for.”

In terms of a one-step cockpit management aid the LVL function is potentially a life-saver at least as significant as CAPS. But it does not replace the need for a pilot competent in unusual attitude avoidance, recognition and recovery.

Synthetic Vision: Weve known this is coming for years, but (despite an excellent albeit not widely retrofitted Highway in the Sky [HITS] system from Chelton) now its part of the Garmin G1000 family. Diamond Aircraft beat Cirrus to the skies with the Garmins Synthetic Vision Technology (SVT), but its a natural for the CP22. The only hazard? Like many cockpit technologies, SVT threatens to pull the pilots attention even further into the cockpit when taxiing and when flying with visual reference. Haig says pilot transition to the CP22 will emphasize “directing the pilots eyes” back outside the airplane for a visual scan. Pilots are more likely to see and avoid obstacles other aircraft, Haig notes, when enhancing their visual scan with synthetic vision and traffic avoidance warnings.

Go-around Button: The CP22 also adds a new (for Cirrus) feature, the go-around (“GA”) button. When pressed, this throttle-mounted switch disengages the autopilot and cues the flight director (FD) for wings-level climb. Unique to this application, GA also activates the missed approach segment of the GPS if the pilot was flying a coupled (autopilot or FD) instrument approach.

Like GA buttons that have been in other aircraft for decades, the pilot needs to know that when it is pressed, he/she is hand-flying the airplane in the initial stages of the “miss”-the autopilot must be re-engaged for it to fly the missed approach. In other words, if youre not proficient enough to hand-fly tight tolerances in LIFR conditions close to the ground for the approach, dont let the autopilot take you there either just in case you need to miss.

All this potential comes in an airplane already equipped with an emergency parachute system and TAA enhancements that have now been demonstrated to make a big (positive) difference in accident rates (see “Are TAAs Safer?” in the June 2008 issue of Aviation Safety).