Honeywell KFC-225 autopilot - what could cause this failure?

Hi Peter,

The mpeg didn't play for me but just a few thoughts:

Since they say they couldn't reproduce it on the ground, could this be a
noise issue? Possible sources would be the radio, a transponder
transmission, engine ignition, maybe a motor driven trim, fuel equalizer
pump if you have one. Just think about other stuff on your aircraft that
produces either RF or commutation noise and comes on automatically and
possibly unnoticed by the pilot.

I have seen such noise become a real problem with composite structures.

Regards, Joerg

http://www.analogconsultants.com

Hi Peter,

As far as I know the Socata TB20 is metal but has a composite cabin,
cowl and tail. Ground Radar is one source and when you fly through a
powerful long range beam that can really upset electronics. These are
hard to discern because it can happen tens of miles from the site and
their antennas turn slowly. But the software should recover. I don't
know about aerospace electronics but in medical we must demonstrate that
our systems come back to normal within seconds after a defibrillator
hit. If they remain in la la land instead of recovering we would not get
the agency blessing.

Anyway, there is another noise source but this one could only be
correlated if you'd record the NAV or GPS data the instant the AP quits.
There could be a high powered AM station on the ground. Also, some VHF
and UHF TV transmitters use highly directional antennas so you might get
hit with the full brunt well after passing a mast. They also concentrate
the beam to a very narrow vertical range of just a few degrees, mostly
to save energy costs. Therefore, the magnitude of the EMI effect depends
on the altitude when you fly through their antenna pattern. Last but not
least there are satellite feeder stations for TV and communications
which work with a beam width of just a few degrees and point upward. Due
to the narrow beam width the field strength can be tremendous. Again,
these can often be identified as a cause if the location where the AP
fails happens to correlate.

Then there is always the chance that a certain data pattern the AP sees
upsets the software. But that would be a very bad sign.

There is a way to test for at least some of the EMI behavior but it
would have to happen in a shielded environment and that can be expensive
or hard to find. You can blast the unit with variable frequencies. It is
a test that all system have to go through after completing a design.
What I do for pre-compliance is a trick that can pinpoint vulnerable
spots: I use an EMCO near field probe kit (little loop and point
antennas on a stick with a BNC at the end) or just a 2" loop soldered to
a coax if I don't have the kit with me. Then I send a few watts into the
probe and go over the unit under test in a dousing rod fashion. It is
tedious but usually finds the culprit.

The oil pressure EMI issue is a bit scary. Does Socata know about that?
They should really fix this. Protecting an input from EMI isn't rocket
science. If it is legal you could use ferrite toroids and have these
affixed on the cable bundle right before the gauge or its electronics
box if it has a separate one. 43 material (Amidon) works pretty good at
VHF. Even Radio Shack has some but in aircraft I'd stay away from the
snap-on cores because they can come off when you hit rough air.

Regards, Joerg

http://www.analogconsultants.com

Peter writes:
The bottom line is whether servos should burn out, no matter what. The
KFC-225 has only one processor (I have the schematics) and the
software didn't appear to crash outright in any of the failures.

There was some discussion recently in one of the embedded
computing newsgroups about damage that can occur if motors
aren't driven properly (as in correct waveform, duration,
etc.).

Hi Peter,

In addition to Everett's post, why do these servos burn out? Did the
manufacturer of the servos comment? I would assume they should be
protected by some means such as a circuit breaker against excessive
stress, no matter whether that is due to faulty control signals of a
jammed output load.

Regards, Joerg

http://www.analogconsultants.com

"Joerg" wrote:
In addition to Everett's post, why do these servos burn
out? Did the manufacturer of the servos comment? I
would assume they should be protected by some means
such as a circuit breaker against excessive stress, no
matter whether that is due to faulty control signals of a
jammed output load.

Servos also have a finite number of repositions before failure. An
autopilot that was excessively sensitive might overwork the servos and
cause premature faiure.
--
Dan
C172RG at BFM

Hi Dan,

Servos also have a finite number of repositions before failure. An
autopilot that was excessively sensitive might overwork the servos and
cause premature faiure.


Wouldn't the pilot feel if the auto pilot issued lots of servo
repositionings? I am not a pilot but I could imagine that would make for
a pretty uncomfortable flight. At least for the passengers.

I had seen that once as a passenger where we got into weather. Pretty
wild until the pilot turned off the AP and flew by hand, commenting "it
can't handle this kind of stuff".

Regards, Joerg

http://www.analogconsultants.com

"Dan Luke" writes:
"Joerg" wrote:
In addition to Everett's post, why do these servos burn
out? Did the manufacturer of the servos comment? I
would assume they should be protected by some means
such as a circuit breaker against excessive stress, no
matter whether that is due to faulty control signals of a
jammed output load.

Servos also have a finite number of repositions before failure. An
autopilot that was excessively sensitive might overwork the servos and
cause premature faiure.

I'm no expert on autopilot servos, but I do know something
about electric motors in general and would question the
statement about the number of repositions before failure.
Unless a motor is overloaded, it should last nigh onto
forever.

"Everett M. Greene" wrote:

I'm no expert on autopilot servos, but I do
know something about electric motors in
general and would question the statement
about the number of repositions before failure.
Unless a motor is overloaded, it should last
nigh onto forever.

My experience is with electric actuators (servomotors) for valves and
dampers. Specifications for these devices list the lifetime
repositions. Direct digital control parameters that are too "tight"
will cause early failure of these actuators. Perhaps it is other
components (feedback pots possibly) in the servos that fail.
--
Dan
C172RG at BFM

"Joerg" wrote:
Wouldn't the pilot feel if the auto pilot issued lots
of servo repositionings? I am not a pilot but I could
imagine that would make for a pretty uncomfortable
flight. At least for the passengers.

Hmm, good question. Still, it might be possible that rapid, very small
repositions could be imperceptible. I was just taking a wild shot at
this one.
--
Dan
C172RG at BFM

Don't rule out power supply glitches, spikes, etc, especially caused by RFI
in and around powerful transmitters.

Norm