Autopilot/Servo hard over possibility

[RVDan]

As I am installing my servos, I was wonderig what the maximum speed of the servos are and whether or not the pilot could stop a pitch hard-over before it became critical.  The Vans RV series airplanes are somewhat sensitive in pitch, and at cruise speeds one can easily exceed the structural design limits with a quick motion of the stick. 
From my work certifying airplanes, it got me wondering if there is hardover detection/protection or if the liklihood of a hard over is understood. In the FAA world we assume a hardover can occur and prove that the pilot can react before the pitch deviation becomes critical.  I know we are not certified aircraft but understanding this could improve operational safety.

Thanks for any insight you can give.

 

[dynonsupport]

The servos have the ability to move very quickly, so a pilot would not be likely to be able to react. This is a requirement to really fly a light, sensitive airplane in turbulence.

However, this is mitigated by many parts of the design of the servo.

The servo is a stepper motor. This means it requires a complex series of changing currents in order to move at all. This means that the microprocessor inside must actively move the motor. Single point failures like a transistor burning out and shorting lead to the servo not moving at all, not running away like may happen with a DC motor. Thus, since software is the primary thing that can cause an uncommanded move, there are multiple checks in the system to verify that the servo software is doing what is expected. If anything goes awry, it just turns off.

Another advantage of stepper motors is that the servo can only deliver so much torque before it "breaks out" and cannot move the sick any farther. The user sets this torque limit. Because any safe plane has an increasing stick force per G, the servo just flat out doesn't have the ability to displace the stick enough to cause enough G loading to be an issue. Even if everything in the system is trying to move the servo, it just doesn't have the strength.

Finally, the primary rule in the AP software is "don't pull the wings off." The very first thing the AP checks is if the G load is between a very narrow range (0.5 to 1.5G if I remember right). If you're outside that range, all the AP ever tries to do is unload the plane, no matter what the altitude, attitude, or airspeed.

 

[RVDan]

Thanks for the info. It sounds like failures would be benign, and if something unpredicted happens that failures are not benign, G monitoring is a mitigating gate keeper for structural safety. Good thinking on Dynon's part.