The Canadian military is reportedly asking Sikorsky Aircraft to revise the flight director software in its CH-148 Cyclone, a military version of the S-92, after a crash off Greece last year. It’s the same platform being developed as the next generation Marine One for presidential and VIP service. The Canadian Press is reporting that the pilot of the Cyclone, who was taking part in a military exercise last April 29, performed an aggressive but common maneuver known as a “return to target” when the flight director overrode his control inputs and dove the big helicopter into the Ionian Sea. A total of six military crew members died. A military source told Canadian Press that the military wants the code for the flight director substantially rewritten to take out “command accumulation bias,” the code that is cited in the report. “We need to look at that software and see if we can eliminate this from the software altogether, being careful to understand when you make any changes like that you may introduce a butterfly effect and cause problems elsewhere,” the source said.
The crew was operating off a Royal Canadian Navy warship in a NATO exercise and was heading to the ship to practice picking up personnel off the deck. The pilot, in line with his training, kicked the helicopter into the maneuver, which is the rotary wing equivalent of a half Cuban 8. He did not disconnect the flight director, but he had also never been warned that the flight director only allowed its programmed flight profile to be “momentarily” overridden by manual control and that longer deviations had not been tested. As the pilot rolled to level after about 20 seconds, the flight director took over and dove the aircraft into the ocean, possibly trying to recover the airspeed lost in the maneuver. According to the news report, “the pilots’ training didn’t cover ‘with sufficient detail’ certain risks of flying the aircraft, leaving the flyers unaware the autopilot would seek to keep control of the helicopter.”
Anyone who thinks I will EVER climb aboard a pilotless airplane or ground vehicle controlled by software is seriously mistaken !! MCAS and now this … NO THANKS !!
Problems occurr when designers attempt to meld “machine piloting” with human piloting.
True autonomous flight control doesn’t have those issues, by definition.
Well, autonomous flight control has other issues, by definition. Not sure what your point is.
I’m wondering what the thinking was behind making a helicopter, of all things, less agile, and using diving as a recovery technique. I wonder if they copied existing airplane software, where high-altitude cruise is a more common mode.
In the most general terms, the point is:
Any time that you divorce accountability from authority, you’re asking for trouble.
In the extant case, the design ceded authority to the “flight director,” but did not hold the FD accountable for flight safety. It dumped that responsibility onto the pilot, who apparently was unaware of the possible consequent outcome.
Autonomous systems avoid this situation, by definition.
Perhaps I missed something, but I have always seen a flight director as something that tells me where to go, nothing more. It would appear that this particular flight director incorporates a hidden (at least for me) automated option that is able to take over from the driver. Terminology is important in that we expect option 1 to have the same effect as option 2 when both have the same name.
Development of that machine was troubled in the software section, Sikorsky was always looking for more software specialists.
It was the first FBW version of the S-92.
Yes, people are confusing ‘flight director’ and ‘autopilot’ – guidance versus control. Perhaps the reports are the source of that confusion, I’d like to read them. Airplane was in VMC at the time, close to the ship.
Just for peoples’ info, this article relates to the Board of Inquiry, which is not the same as the flight safety investigation. The final Flight Safety Investigation Report is supposed to be released today, and should be publicly available. Google “CH148822 FSIR” and you should find it pretty quickly when it’s actually released.
I wasn’t able to find the full report, but the “CH148822 Cyclone – Epilogue” available seems to indicate that primary blame for this crash was down to the inadequate information about aircraft systems being passed on to the pilots, and that pilots should have been trained to disconnect this autopilot system instead of just overriding it for maneuvers. Perhaps saying the aircraft “took over” is a bit of a stretch in this case. The term control bias obfuscates things a bit in the press stories, and there is a brief mention of feed forward in one of them, but from a control systems theory standpoint it could be thought of as the way that in small aircraft autopilot the trim would tend to run away to compensate if you were to hold a control input that causes a deviation while the autopilot is engaged. In this case, the control systems are much more complex, and probably proprietary, so I can’t pry into the control theory of the system itself, and can only speculate as to why a system that obviously can “see” pilot input doesn’t automatically revert to manual or even augmented control during aggressive override. It seems at face value that an autopilot which doesn’t automatically disconnect when it is aggressively overridden is a systems design oversight, but without understanding of the purpose of the system it’s not possible to make a definitive statement. It just raises questions. What is the purpose of this feed forward behavior during maneuvering flight? Is this behavior meant to be a safety fallback like Auto-GCAS? If so why would it prioritize airspeed over altitude in a helicopter, where airspeed does not really matter much in most situations? (no stall, only concerns of translational lift and directional stability)