Safety of operation of autopilot

As the autopilot is controlling the flight path of the aircraft there are a number of safety issues that are addressed in the test programme. For three-axis autopilots which control vertical modes through the cyclic pitch channel there is a potential problem if the pilot does not apply sufficient collective pitch to maintain airspeed, particularly when climbing in a vertical speed mode. In this case airspeed may fall below the minimum power speed resulting in a higher pitch attitude and a further fall in airspeed. This in turn may lead to the operational pilot becoming disorientated. For these types of systems there should be an airspeed cutout or, at minimum, a warning to the crew that airspeed is decreasing. For systems that control the vertical modes or altitude holds through the collective channel the possibility of the system making demands that result in an exceedence of a power limit is investigated. For example, above a certain airspeed or rate of airspeed increase a height hold may cause an excessive torque demand. In this case the testing may result in limitations being imposed on the maximum airspeed or the rate of airspeed change that is permitted with the hold engaged.

7.3 FAILURE TESTING

While the majority of testing involves the assessment of an aircraft with all its systems serviceable, a smaller but important portion involves evaluating the effect of system failures. The most important failures are those that affect the flight path of the aircraft and for these the test methodology employed always remains the same.

The initial stage of failure testing is to study and fully understand the system under evaluation. This is not simply a question of understanding what the individual parts of a system do but also understanding the way in which the system is used in the role. It is only with a detailed knowledge of the operational use of the aircraft that the implications of failures can be fully realized. As with all testing the incremental approach is fundamental when assessing failures. This is particularly important in the

case of critical components such as the flight control system and powerplants where a failure can take an aircraft rapidly from a safe flight condition to a potentially hazardous one. Even failure testing of aircraft systems that are considered non-critical should be approached incrementally as unexpected results may follow. The golden rule for failure testing, particularly of critical systems, is only vary one parameter at a time. For example, when evaluating the height/velocity diagram of a helicopter the height at the moment of failure should be kept constant and the airspeed varied or vice versa. To vary two or more parameters simultaneously makes it difficult to predict the outcome and to determine trends. There is also a greater risk of unexpectedly meeting a ‘cliff edge’ change in failure characteristics if multiple parameters are varied simultaneously. The identification of trends through the analysis of results is an essential part of the approach to critical system failure testing.