Re: Honeywell KFC-225 autopilot - what could cause this failure?

[Joerg]

Hi Peter,

The mpeg didn't play for me but just a few thoughts:

Since they say they couldn't reproduce it on the ground, could this be a
noise issue? Possible sources would be the radio, a transponder
transmission, engine ignition, maybe a motor driven trim, fuel equalizer
pump if you have one. Just think about other stuff on your aircraft that
produces either RF or commutation noise and comes on automatically and
possibly unnoticed by the pilot.

I have seen such noise become a real problem with composite structures.

Regards, Joerg

http://www.analogconsultants.com

[Joerg]

Hi Peter,

As far as I know the Socata TB20 is metal but has a composite cabin,
cowl and tail. Ground Radar is one source and when you fly through a
powerful long range beam that can really upset electronics. These are
hard to discern because it can happen tens of miles from the site and
their antennas turn slowly. But the software should recover. I don't
know about aerospace electronics but in medical we must demonstrate that
our systems come back to normal within seconds after a defibrillator
hit. If they remain in la la land instead of recovering we would not get
the agency blessing.

Anyway, there is another noise source but this one could only be
correlated if you'd record the NAV or GPS data the instant the AP quits.
There could be a high powered AM station on the ground. Also, some VHF
and UHF TV transmitters use highly directional antennas so you might get
hit with the full brunt well after passing a mast. They also concentrate
the beam to a very narrow vertical range of just a few degrees, mostly
to save energy costs. Therefore, the magnitude of the EMI effect depends
on the altitude when you fly through their antenna pattern. Last but not
least there are satellite feeder stations for TV and communications
which work with a beam width of just a few degrees and point upward. Due
to the narrow beam width the field strength can be tremendous. Again,
these can often be identified as a cause if the location where the AP
fails happens to correlate.

Then there is always the chance that a certain data pattern the AP sees
upsets the software. But that would be a very bad sign.

There is a way to test for at least some of the EMI behavior but it
would have to happen in a shielded environment and that can be expensive
or hard to find. You can blast the unit with variable frequencies. It is
a test that all system have to go through after completing a design.
What I do for pre-compliance is a trick that can pinpoint vulnerable
spots: I use an EMCO near field probe kit (little loop and point
antennas on a stick with a BNC at the end) or just a 2" loop soldered to
a coax if I don't have the kit with me. Then I send a few watts into the
probe and go over the unit under test in a dousing rod fashion. It is
tedious but usually finds the culprit.

The oil pressure EMI issue is a bit scary. Does Socata know about that?
They should really fix this. Protecting an input from EMI isn't rocket
science. If it is legal you could use ferrite toroids and have these
affixed on the cable bundle right before the gauge or its electronics
box if it has a separate one. 43 material (Amidon) works pretty good at
VHF. Even Radio Shack has some but in aircraft I'd stay away from the
snap-on cores because they can come off when you hit rough air.

Regards, Joerg

http://www.analogconsultants.com

[Everett M. Greene]

Peter > writes:
> The bottom line is whether servos should burn out, no matter what. The
> KFC-225 has only one processor (I have the schematics) and the
> software didn't appear to crash outright in any of the failures.

There was some discussion recently in one of the embedded
computing newsgroups about damage that can occur if motors
aren't driven properly (as in correct waveform, duration,
etc.).

[Joerg]

Hi Peter,

In addition to Everett's post, why do these servos burn out? Did the
manufacturer of the servos comment? I would assume they should be
protected by some means such as a circuit breaker against excessive
stress, no matter whether that is due to faulty control signals of a
jammed output load.

Regards, Joerg

http://www.analogconsultants.com

[Dan Luke]

"Joerg" wrote:
> In addition to Everett's post, why do these servos burn
> out? Did the manufacturer of the servos comment? I
> would assume they should be protected by some means
> such as a circuit breaker against excessive stress, no
> matter whether that is due to faulty control signals of a
> jammed output load.

Servos also have a finite number of repositions before failure. An
autopilot that was excessively sensitive might overwork the servos and
cause premature faiure.
--
Dan
C172RG at BFM

[Joerg]

Hi Dan,

>Servos also have a finite number of repositions before failure. An
>autopilot that was excessively sensitive might overwork the servos and
>cause premature faiure.
>
>
Wouldn't the pilot feel if the auto pilot issued lots of servo
repositionings? I am not a pilot but I could imagine that would make for
a pretty uncomfortable flight. At least for the passengers.

I had seen that once as a passenger where we got into weather. Pretty
wild until the pilot turned off the AP and flew by hand, commenting "it
can't handle this kind of stuff".

Regards, Joerg

http://www.analogconsultants.com

[Everett M. Greene]

"Dan Luke" > writes:
> "Joerg" wrote:
> > In addition to Everett's post, why do these servos burn
> > out? Did the manufacturer of the servos comment? I
> > would assume they should be protected by some means
> > such as a circuit breaker against excessive stress, no
> > matter whether that is due to faulty control signals of a
> > jammed output load.
>
> Servos also have a finite number of repositions before failure. An
> autopilot that was excessively sensitive might overwork the servos and
> cause premature faiure.

I'm no expert on autopilot servos, but I do know something
about electric motors in general and would question the
statement about the number of repositions before failure.
Unless a motor is overloaded, it should last nigh onto
forever.

[Dan Luke]

"Everett M. Greene" wrote:
>
> I'm no expert on autopilot servos, but I do
> know something about electric motors in
> general and would question the statement
> about the number of repositions before failure.
> Unless a motor is overloaded, it should last
> nigh onto forever.

My experience is with electric actuators (servomotors) for valves and
dampers. Specifications for these devices list the lifetime
repositions. Direct digital control parameters that are too "tight"
will cause early failure of these actuators. Perhaps it is other
components (feedback pots possibly) in the servos that fail.
--
Dan
C172RG at BFM

[Dan Luke]

"Joerg" wrote:
> Wouldn't the pilot feel if the auto pilot issued lots
> of servo repositionings? I am not a pilot but I could
> imagine that would make for a pretty uncomfortable
> flight. At least for the passengers.

Hmm, good question. Still, it might be possible that rapid, very small
repositions could be imperceptible. I was just taking a wild shot at
this one.
--
Dan
C172RG at BFM

[Norm Dresner]

Don't rule out power supply glitches, spikes, etc, especially caused by RFI
in and around powerful transmitters.

Norm

[Joerg]

Hi Peter,

>Looking at the kfc225 computer unit schematic, there is just one CPU
>(68hc16) and no watchdog....
>
>
No watchdog? Ouch. How did they ever get this certified?

>Today I've discovered that once the kfc-225 is in level flight and
>holding altitude, it doesn't use the gray code data from the encoding
>altimeter - it uses its own internal encoding air pressure sensor.
>This rules out the altimeter problem, and narrows it down to the
>computer unit, or very few other things like the input from the
>altimeter subscale pot (which it still uses).
>
>
Maybe that airpressure sensor has a problem. Either EMI or maybe the
mounting location isn't as good as for the regular altimeter. Can the
KFC-225 altitude annunciator be used to see if the unit's altimeter goes
on the fritz?

>The problem is that the ability of any ground based engineers to
>diagnose the product is very limited, due to the really dumb firmware.
>
>
Well, they could blast it with RF in a screened room. It is standard
procedure for any med, AV or other critical gear before type cert. I
have found pretty much any EMI problem in the screen room provided I
could have the room for at least a day. But they have to test to more
than the usual 10V/m field strength.

And I still think Socata should do a courtesy fix on that oil pressure
gauge and take care of the paperwork.

Regards, Joerg

http://www.analogconsultants.com

[Joerg]

Hi Peter,

>I agree; DC servo brushes do last a very long time; generally years of
>continuous operation. There was nothing wrong with the brushes in that
>roll servo; it was the power amp which went up in smoke...
>
>
Looks like a "suboptimal" power amp design. Electronics should not blow
just because of excessive actuation. I guess with all the regs you
aren't allowed to replace the busted part yourself but have to let the
service folks sell you a refurb or new version plus labor.

BTW, the clamp ferrite cores I mentioned the other day might still be pretty useful to diagnose an EMI problem. You can't leave them in there during flight but they are really handy to try out things on the ground, running the engine, keying the mike and so on.


Regards, Joerg

http://www.analogconsultants.com

[Joerg]

Hi Peter,

>>No watchdog? Ouch. How did they ever get this certified?
>>
>>
>
>Easy, general aviation autopilots are permitted to fail at any time,
>without a warning, in any way whatsoever.
>
>
Wow. They'd never let us get away with that in medical electronics. Even
after a defibrillator hit many systems must come back to normal
operation within a prescribed time frame.

>The servo clutches are supposed to be always possible to overpower,
>and the pitch *trim* subsystem is supposed to warn the pilot if the
>trim has been running out of control (because an excessively out of
>trim condition might require more yoke force to overpower than a pilot
>can physically manage). But I think those are the only certification
>requirements for TSO.
>
>
I knew about the servo clutches, without override the airplane would
probably become uncontrollable if the AP fails to disengage for some
reason. But I still can't believe that the amplifiers blow.

Regards, Joerg

http://www.analogconsultants.com

[Rich Grise]

"Dan Luke" > wrote in message
...
> "Joerg" wrote:
> > Wouldn't the pilot feel if the auto pilot issued lots
> > of servo repositionings? I am not a pilot but I could
> > imagine that would make for a pretty uncomfortable
> > flight. At least for the passengers.
>
> Hmm, good question. Still, it might be possible that rapid, very small
> repositions could be imperceptible. I was just taking a wild shot at
> this one.
> --
I read somewhere that the F-16 is so unstable that a human
can't fly it without the computer control. I'd think that
means it makes corrections faster than a human can, but it's
making corrections to a known airframe, I guess. I'd think
they'd want the response time of an autopilot to be fairly
slow so it doesn't do abrupt stuff - but then it really
wouldn't be able to handle weather.

Cheers!
Rich

[Julie]

Rich Grise wrote:
>
> "Dan Luke" > wrote in message
> ...
> > "Joerg" wrote:
> > > Wouldn't the pilot feel if the auto pilot issued lots
> > > of servo repositionings? I am not a pilot but I could
> > > imagine that would make for a pretty uncomfortable
> > > flight. At least for the passengers.
> >
> > Hmm, good question. Still, it might be possible that rapid, very small
> > repositions could be imperceptible. I was just taking a wild shot at
> > this one.
> > --
> I read somewhere that the F-16 is so unstable that a human
> can't fly it without the computer control. I'd think that
> means it makes corrections faster than a human can, but it's
> making corrections to a known airframe, I guess. I'd think
> they'd want the response time of an autopilot to be fairly
> slow so it doesn't do abrupt stuff - but then it really
> wouldn't be able to handle weather.
>
> Cheers!
> Rich

Yes, this is true of all modern fighters.

If you watch movies of a takeoff or landing, you will notice the ailerons and
horizontal stabilizers fluttering all over the place in what is pretty much
straight flight.

[Joerg]

Hi Peter,

>>Looks like a "suboptimal" power amp design. Electronics should not blow
>>just because of excessive actuation. I guess with all the regs you
>>aren't allowed to replace the busted part yourself but have to let the
>>service folks sell you a refurb or new version plus labor.
>>
>>
>
>That's correct; also I have not been able to find the schematic of the
>KFC225 servos anywhere. I have found out that there is no service
>manual as such. One could design an exact functional replica easily
>enough but frankly I have more pressing things to do :)
>
>
Would be a nice biz opportunity though if the legal side is properly
covered. If this problem is widespread people would be willing to pay a
premium for a servo that doesn't give up. You don't have to design it
yourself.

I remember a muffler maker in Europe who created an exhaust set for a
popular car that wouldn't corrode out in just a few years. It cost a lot
more but still the muffler replacement sales of the car manufacturer
then dropped substantially.

>>BTW, the clamp ferrite cores I mentioned the other day might still be pretty useful to diagnose an EMI problem. You can't leave them in there during flight but they are really handy to try out things on the ground, running the engine, keying the mike and so on.
>>
>>
>
>Yes, I could try placing some on the wires close to the oil pressure
>gauge amplifier; that would not require any paperwork.
>
>
The clamp-on versions (just for ground tests) are often available at
Radio Shack. But usually only the large ones that still have the toolbox
type metal drawer shelves. Then when it works you could use real cores
but this often means re-doing at least one connector unless you select a
very large core (they come up to two inches O.D.).

Regards, Joerg

http://www.analogconsultants.com

[Matt Whiting]

Julie wrote:

> Rich Grise wrote:
>
>>"Dan Luke" > wrote in message
...
>>
>>>"Joerg" wrote:
>>>
>>>>Wouldn't the pilot feel if the auto pilot issued lots
>>>>of servo repositionings? I am not a pilot but I could
>>>>imagine that would make for a pretty uncomfortable
>>>>flight. At least for the passengers.
>>>
>>>Hmm, good question. Still, it might be possible that rapid, very small
>>>repositions could be imperceptible. I was just taking a wild shot at
>>>this one.
>>>--
>>
>>I read somewhere that the F-16 is so unstable that a human
>>can't fly it without the computer control. I'd think that
>>means it makes corrections faster than a human can, but it's
>>making corrections to a known airframe, I guess. I'd think
>>they'd want the response time of an autopilot to be fairly
>>slow so it doesn't do abrupt stuff - but then it really
>>wouldn't be able to handle weather.
>>
>>Cheers!
>>Rich
>
>
> Yes, this is true of all modern fighters.
>
> If you watch movies of a takeoff or landing, you will notice the ailerons and
> horizontal stabilizers fluttering all over the place in what is pretty much
> straight flight.

But it is only straight and level flight because of all of the control
surface "fluttering!"

Matt