Saturday, November 21, 2009

Surprise, Surprise

The concept of automation surprise has been around for years in the large aircraft world and now it's part of the GA aircraft that you are flying or might soon be flying. Automation surprise occurs when a system, such as a GPS receiver and/or autopilot, does something the pilot neither expected nor intended. The result is that the aircraft deviates from an assigned heading, route, altitude, or approach path and the pilot may lose situation awareness, too. Actually, it's the pilot-in-command who is considered to have deviated, not the plane or it's systems and blaming the machine is an argument that's probably not going to hold water. With all the technically-advanced GA aircraft out there, automation surprise is now something that GA pilots must understand and be ready to handle.

While I don't pretend to be a human factors expert, I've both witnessed and been on the receiving end of automation surprise on several occasions. Most of the surprises I've seen in GA aircraft resulted from the pilot making mode errors - not fully understanding the consequences of their knob twisting and button pushing. Yet I have also seen deviations result from equipment failures and even from shortcomings in the design of an instrument procedure. There can be a seemingly endless number of ways for things to go wrong in a complex, automated environment and while we may want to never make any errors, mistakes are going to happen. I'll provide just a few examples of how things can get out of hand when technology is busy making the pilot's job easier and what you can do when the magic turns evil.

Operator Error
Here's a mistake I've witnessed many pilots make with the two-axis KAP-140. ATC instructs "... climb and maintain 7000." You decide it's time for George to do some flying. So you press and hold AP for 1.5 seconds, then press HDG, then select 7000 feet, then press ALT, and are subsequently confused as to why the KAP-140 won't allow you to use the UP button to select a vertical climb rate.



The key is understanding that the KAP-140 goes into VS (vertical speed) mode by default when your press the AP button. The mistake was pressing ALT, which engages altitude hold mode irrespective of the altitude you just dialed in - an odd design, to say the least! Pressing ALT a second time restores VS mode and allows you to enter a vertical climb rate. The problem is that the second time you press ALT to enter vertical speed mode, the altitude you selected is not armed. That means you'll climb, but the KAP-140 will not capture the selected altitude and if you're not paying attention, you'll bust your clearance. Blast!

Having your own SOP (Standard Operating Procedure) for autopilot use, combined with actually looking at the modes being displayed, can help circumvent this problem. A better knobology sequence would be: Dial in 7000 feet, pitch up for the desired climb rate, press and hold AP for 1.5 seconds, then press HDG, then press ARM. This results in the following KAP-140 display: HDG [AP] VS 7000 ALT Armed. The KAP-140 will climb at 500 feet per minute, fly the bugged heading, and level off at 7000 feet.

Unexpected Mode Changes
In an effort to make the pilot's job easier, Garmin's G1000 will automatically switch the navigation source from GPS to a localizer on an ILS, LOC or LDA approach. Interestingly, the G1000 won't automatically switch back to GPS for the missed approach procedure - you must manually switch the navigation source back to GPS. While this may sound like a good feature, it actually creates unintended consequences in aircraft equipped with a Bendix/King KAP-140 autopilot. Here's the setup.



You're flying the Concord LDA RWY 19R approach, approaching from the South, you've requested pilot navigation, Travis Approach has approved, and you're cleared to "cross KANAN at or above 4000' cleared LDA 19 right approach." You've selected and activated the approach on the G1000 with KANAN as the IAF. Your KAP-140 autopilot is engaged in NAV and ALT modes and it is flawlessly tracking a direct course to KANAN.

Crossing KANAN, the GPS sequences to fly the procedure turn and the KAP-140 continues to do a great job. You select 2500 feet, press ALT to enter VS mode, press DN a few times to command a 400'/min descent, and remove some power to keep the airspeed under control. The GPS and the KAP-140 turn the airplane to the outbound procedure turn, then after a minute, they turn the airplane inbound to intercept the approach course.

Reaching 2500 feet, you restore some power and the G1000 then automatically switches the navigation source to the localizer. If you're not observant, you will miss this mode change. The HSI needle changes color from magenta (for GPS) to green (for the localizer) and the switch in navigation source causes the KAP-140 to silently enter ROL mode. That's right, there's no aural alarm to alert you that this mode change has happened, just ROL flashing on the KAP-140 display - which is out of your primary field of view. If you don't realize the KAP-140 is in ROL mode, the airplane will fly right through the localizer. Ooops!

One SOP you could use to prevent this is to always change the KAP-140 to HDG, manually change the navigation source to the localizer, and follow the GPS prompts to manually command the procedure turn using the heading bug. Once you've turned inbound to intercept the localizer, press NAV and the KAP-140 will capture the localizer course.

Missing the Missed Approach
The Garmin G1000, as well as the 430/530 GPS receivers, can help you fly the missed approach using GPS navigation as long as everything goes as planned. For an ILS approach, the GPS must handle two possible cases: The full ILS and a localizer-only approach. The GPS considers the MAP to be at the runway threshold, even though the MAP on an ILS is technically at decision height, on glide slope, and on the localizer course.

For these GPS receivers to suspend waypoint sequencing, you need to fly over the MAP at the runway threshold. Only then can you press the OBS key (or softkey) to re-enable waypoint sequencing, switch the navigation source back to GPS, and fly the missed approach using the GPS. If you don't fly over the MAP, waypoint sequencing won't be suspended and you'll need to do some more work to activate the missed approach. If you don't understand this GPS behavior, you could find yourself very confused at a high workload moment. Do'h!

Procedure Problems
Though rare, automation surprise may occur due to the way an instrument procedure was designed. This is exactly what happened to a pilot I was flying with recently on an approach I had flown many, many times before. The thing is, it had been quite a while since I flew this approach and the procedure had changed. Here's what happened.

The pilot requested the Sacramento Executive ILS RWY 2 practice approach with the published missed approach. Approach responded "... cross COUPS at or above 3000, cleared ILS 2 practice approach." The pilot selected the approach and activated it with COUPS as the initial approach fix. The autopilot was engaged in NAV mode and flew us to COUPS. What happened next was both dramatic and unexpected.




Reaching COUPS, the GPS commanded a 41 degree heading change to the left from a 015 track to a 334 track to navigate to the newly added Computer Navigation Fix (CNF) UBIYI: A 41 degree heading change for a leg that is only 0.2 miles long! The groundspeed was only 110 knots, but there was no time for GPS turn anticipation to smooth this out. As soon as the GPS commanded a turn to the left, it commanded a turn back to the right as the airplane blew through the approach course. It happened so fast that we both wondered what was wrong. Was this a GPS error or an autopilot error?

No sooner had we begun to doubt the automation, the plane was headed back to intercept the localizer. You have to look really closely at the chart to see that the GPS and the KAP-140 were just trying to fly the approach as it is coded. I emailed the FAA to suggest they take another look at the unintended consequences of the change that was made. Good idea!

Ounce of Prevention
The primary ways a pilot can prevent automation surprise are both simple and straightforward:
  • Know your own limits with regard to currency/proficiency
  • Know thy aircraft's equipment
  • Monitor what the automated systems are doing
  • Stay ahead of (or at least be in synch with) ATC's game plan
  • Maintain situational awareness
  • Develop and use SOPs (standard operating procedures)
  • And be prepared to catch and correct errors.

I'd like to be able to tell you that the average pilot can fly a G1000-equipped aircraft once a month and maintain instrument proficiency. Sadly, this is usually not the case. Unless you are practicing regularly with a G1000 PC Trainer or other simulator, you'll get rusty - fast! Part of this erosion of skill is due to the vast number of features the G1000 offers, but much of the problem lies in the user interface's annoying design that requires you to recognize subtle changes in operational modes. I don't want to mince words here: The G1000 and other GA GPS receivers are not easy to use. They require regular use and practice for pilots to maintain proficiency.

PC-based simulators can be an effective and inexpensive way to maintain your instrument chops, but you need to have a plan. Sitting down and just screwing around is not going to serve you well. As they say in the music world: "If you play when you practice, you'll practice when you play."

A suggestion I've made before is to treat your autopilot and GPS like you would a low-time private pilot. It's okay to trust the systems, but monitor them to ensure they are doing what you intended. This is particularly important during transitions to climbs, descents, level-offs, turns to a heading, and intercepting and tracking a navigational course. So periodically interrupt whatever you were doing to ensure George is still flying the plane the way you intended. Did it capture the altitude you programmed? Has it intercepted the navigational course you intended? Is the autopilot still operating in the mode(s) you intended? If not, promptly drop what you are doing, intervene, fly the plane, and then try to determine why or George will trim you into a stall, flying you into the ground, or take you off course.

Remember that you are the last line of defense when automation goes bad. Never, ever forget that fact.

11 comments:

Eric said...

The KAP 140 actually has one more surprise - if the altitude preselect is set prior to the autopilot being turned on, in your scenario the display would show the following:

HDG [AP] VS 7000

without being armed, and continue the climb past the selected altitude. The proper sequence would be: set 7000, pitch for climb, push AP, push HDG, push ARM.

However, as soon as the autopilot is engaged AND you change the altitude preselect with the rotary knob, the altitude is armed. An alternate way to program your scenario would be to pitch for climb, push AP and HDG, then twist 7000 into the ALTs, resulting in the following:

HDG [AP] VS 7000
          ALT/ARM


I always teach students to program the KAP 140 by first setting what they want (ALTS, heading bug, inbound LOC course, etc), then telling it how to get there. Otherwise automation surprise kicks in and they wonder why the autopilot is still climbing through 7500 feet. Or, even worse, they don't.

ddf said...

Great observations John. I've been flying the Cirrus for about a year now and my difficulties with transition have primarily been with knobology. Understanding what buttons to push and the subsequent ramifications of the various modes requires much more then just a casual understanding of the various systems. They are all designed to reduce workload, but a surprise at DH is not a good time to try to figure out what button to push.

John Ewing said...

Eric,

Thanks for pointing out my oversight, which I have fixed. I actually had started writing a different scenario, then changed my mind but didn't quite finish changing my description before I hit "publish."

I had started describing a problem pilots have with the KAP 140 when commanding a climb or descent after the A/P is engaged and holding course/altitude. Virtually every pilot will intuitively dial in the new altitude (which changes the display to ALT Armed) then press the UP or DN button and find it has no effect. After explaining, training and drilling, they learn the correct sequence, but if they don't fly very often, it's usually back to square one the next time they fly.

Pressing the ALT button to toggle between altitude hold and vertical speed mode seems universally confusing to pilots. If Bendix/King had just designed separate buttons for these two functions, like they did in their higher end KFC 225 ...

Troy said...

Another great article, John. Keep up the great blog!

Head in the Clouds said...

We've also had automation surprise in the approach phase when we put flaps in while flying with the autopilot. For some reason, our KAP 140 does not like flaps to be deployed-- the autopilot will turn itself off. Luckily, it usually sounds an alarm, although turning off the autopilot does not always result in the alarm sound.

John Ewing said...

Head in the Clouds,

I'm not sure what aircraft you're flying, but go to the Supplements section of your aircraft's AFM, find the KAP-140 supplement, and look at the limitations section. In most cases, the A/P can only be used with minimal flap configurations. In the C182 and 172, it's flaps 10. If memory serves me, in the DA40 you're restricted to takeoff flaps with the A/P engaged.

Ron said...

Small world -- I just wrote about this myself a couple of days ago, albeit with sort of a unique twist.

Automation bites us regularly. We don't even realize how often, I think. Sometimes it's an alarm clock that gets mis-set and we're late to work. Or a program that doesn't get recorded because we didn't hit the right button to set up the Tivo.

Flying is the same way. It's just that, as someone much more eloquent than myself once said, although it's a safe activity, aviation can be terribly unforgiving of error.

(So can the FAA, but that's another topic...)

--Ron

Head in the Clouds said...

I think we've checked in the supplements-- but I'll look again. It is a 2006 C-172 with G1000-- one with the KAP-140. Any amount of flaps completely throws the autopilot out of whack. We typically can't even then turn off the autopilot using the off button-- we usually have to pull the circuit breaker to stop the undesired autopilot control responses. Given that you think flaps 10 should be fine, maybe I should ask an avionics shop about the problem. We assumed it was designed that way.

John Ewing said...

Head in the Clouds,

If the A/P is not doing what you want, push the RED disc button on the pilot's yoke or press the AP button on the unit itself. It's A REALLY BAD PRACTICE to use a circuit breaker as a switch, especially when there are three very simple ways to disengage the A/P. CBs were not designed for repeated operation and when you pull that A/P circuit breaker, you're also deactivating the electric trim.

Quoting from AC 25.1357-A1:

"f. § 25.1357(f). This paragraph requires that circuit breakers not be used as the primary means to remove or reset system power for those airplane systems for which the ability to remove or reset power during normal operation is necessary, unless specifically designed as a switch."

The limitation on flaps for the KAP-140 in a Cessna 172/182 is 10 degrees. If the A/P seems to become destabilized when you add flaps, I'd recommend you consider the coordination of power when you configure flaps. Adding flaps on a 172 will cause a pitch up moment which can mess up the A/P's game plan. Try removing some power first, then add flaps 10, then readjust power to keep the speed above 80 KIAS. The minimum speed limitation for A/P use in a 172 is 70 knots, 80 knots when flying an instrument approach.

John Ewing said...

Oh, one more thing. Before using the A/P the supplement requires that you complete the preflight test, part of which involves successfully disengaging the A/P with either the DISC button or the AP button on the A/P itself.

If the A/P fails any part of the preflight, it must be deactivated (pull the CB and wrap it with a wire-tie), placard it as INOP, and log that you deactivated it.

If your A/P is not disengaging when you push one of those two buttons, something is seriously wrong and it should be investigated by an authorized repair station.

John Ewing said...

Head in the Clouds,

Got your last comment, but I accidentally rejected it - fat fingers, iPhone, small text. So ...

If pressing the RED disc button won't disengage the A/P when it is in APR mode, something is wrong. It needs to be investigated and fixed.

As for the addition of flaps destabilizing the approach in a C172, try this when you reach 1000' AGL in APR mode (once your A/P has been inspected, of course):

1) Power smoothly but promptly to idle.

2) Wait two seconds ("one thousand one, one thousand two ...")

3) Set flaps 10 degrees

4) Smoothly restore power to about 1800 RPM

Removing power causes a pitch down moment. Adding flaps 10, causes a pitch up moment. The sequence I described above should allow one to cancel out the other. Restore power once the airspeed reaches about 85 KIAS. Do this smoothly so that the A/P doesn't have to do anything extreme to continue tracking the glide slope.