A number of our group have written me privately in response to my prior note about the Legacy canopy problem. Together we have given it a lot of thought, so here I will summarize thoughts, ideas, and concerns all in one place, and ask somebody/some group (LOBO comes to mind) in the USA to take the lead in a suggested corrective action program.
We have lost two Legacy aircraft in Australia in less than two months, one having a definite oscillating canopy problem, and the other looking suspiciously the same, but with fewer good witness reports. I think we are up to six fatalities attributable in some way to open canopy difficulties. The current situation suggests more may be inevitable without change.
Theory
Here is an example of what we want: Fly an RV with the canopy unlocked, and it will rise up a few inches at which point the down force from the air blast counters the up force from the gas springs, and the canopy just floats open a few inches staying in one position. The pilot returns to the airport, latches the canopy, and continues on his way chastised by his oversight.
This kind of canopy behavior should be our goal for the Legacy: inherently fail safe. If we can not get inherently fail safe behavior, then we need fail safe add-on mechanisms at work that absolutely prevent the dangerous behavior from occurring.
Because there are reports of canopy oscillations occurring at some flight conditions and in some accident reports, it may be that we have a confluence of mass, spring constants (in gas springs), aerodynamic forces pushing the canopy down against the gas springs, some periodic forcing function (aerodynamic turbulence?) and inadequate damping all conspiring to create a resonant oscillation of canopy up and down. Once started, it can not be stopped.
An oscillating canopy would be hugely distracting and its up and down movements would no doubt badly disrupt the flow over the vertical stabilizer and parts of the horizontal stabilizer. Yaw control would be compromised, and the changing forces on the horizontal stabilizer due to air flow disruption may also cause the plane to oscillate providing the feedback effect which may drive the canopy up and down.
This theory is consistent with anecdotal evidence of the Geraldton crash where the canopy was seen to be substantially elevated and the airplane skewed sideways rather than making a coordinated turn in an attempt to return to the airport.
If resonant oscillation is the problem arising from a spring mass (canopy) system with periodic excitation, then engineers in the group will recognize that if we can not remove the exciting forces (aerodynamic), we can apply lots of damping to kill the oscillation and maintain a stable condition. In theory, this could be obtained by substituting new gas springs having air/oil working fluid like a nose strut. The damping orifice and oil viscosity are selected to create a lot of viscous drag when the canopy is moving thereby creating the damping needed.
If theory is correct, we could go directly to a fail safe solution: a canopy that will not rise excessively and then go into destabilizing oscillations that doom the pilot to a bad outcome. Use of heavily damped gas springs would be a simple bolt-in solution.
If the oscillation theory can not be proved, then a secondary fail safe mechanism is needed.
With this overview, let's evaluate possible solutions. From this vantage point I see at least two action pathways to pursue, and quickly before somebody else gets killed.
Solutions
Some have incorporated safety switches that illuminate warning lights or auditory alarms or EFIS warning messages if the canopy is not correctly seated. Given that an error in indication (failure to alarm) could lead to fatal results, one builder added redundancy with dual switches.
All of this is a vast improvement over having nothing, but in my view is inadequate because it is not yet inherently fail safe. If a switch or connection fails, you are toast. Such arrangements are dependent on correct positioning and setting of switches and latches. I am unfamiliar with Legacy latches, but it is conceivable that one could construct a latch system that closes the canopy adequately to trip the switch. Then perhaps with some wear over the years, the latch could release without warning and when air loads are applied allowing the canopy to jump up. For this reason, switches and bells and whistles are an improvement, but are NOT good enough. Remember, it is a life or death matter.
If we can establish that highly damped gas struts were up to the job, that would be inherently fail safe as long as the springs and damping were up to snuff. Adding a safety switch is then a nice and helpful warning feature, but not essential.
If one can not control the oscillation any other way, then a fail safe secondary safety latch is needed like the hood latch on your car. I understand there are objections to an ugly, centrally located spring-loaded safety catch, not the least of which is that in the event of a crash for some other reason, rescuers may not know how to open both the primary latches (which must be marked) and then the secondary latch. A counter argument is that if the canopy only pops up 1.5-2 inches when the primary latch is released, it quickly becomes self evident where the safety latch is located, and a quick inspection would disclose that just pushing it forward will release the canopy. I leave it to others to judge this.
Another proposal is to use an inertial reel and belt arrangement presumably fastened to the center rear of the canopy and bulkhead immediately beneath, and set to let the canopy come up only slowly, and then lock if the canopy tries to accelerate upward. One correspondent reported riding with another pilot who has something similar, but with no inertial reel. He reported it is impossible to ignore the strap not being locked down when it is blowing around in the cockpit during taxiing. However, same concern: what about rescuers during a crash incident?
Proposal
Given the tragic loss of life and severity of the problem, I propose a dual track program which I suggest LOBO leads and coordinates given the skill of its management and members and location in the middle of the community in the USA.
1) Oscillation tests. We DO NOT want to test by opening canopy in flight. Rather, I suggest the following. Two people in the airplane, on the ramp, brakes locked, one managing brakes and throttle, and the other pushing up on the canopy against the air blast that tries to close the canopy pushing against the air springs. Adjust to different power settings (say 2000 RPM, then 2100, 2200, etc) and continue with periodic pushes up adjusting the frequency of pushing to see if one can find and excite an unstable oscillating regime. Yes this is way short of a flight test, and yes, it will not induce variable downloads on the tail which would wiggle the airframe up and down worsening the problem. But it would be safe. Careful observation from outside observers (hopefully with video cameras) could watch canopy behavior as well as search for variable down load on the tail if the canopy starts to oscillate up and down. Imagine putting a post immediately behind the trailing edge of the elevator with some marks to measure displacement, and see what happens.
If these tests uncovered a regime of canopy oscillation, we would not have a smoking gun, but a pretty good outline of what the gun looks like. With some measurement of spring constants and canopy mass and moment of intertia one can construct a simple spring mass model and check to see if it predicts the frequency of oscillation. With that model, one can then calculate the critical damping required to kill the oscillation, and go on to order test springs with damping coefficients that have MORE than the critical level. Retest, and then perhaps we may have a fail safe solution. Full testing that included flight would be risky, but may not be required if we can get some good test and vibration engineers working the problem that end up satisfied with the model and results. If it works, we have a bolt-in solution that is fail safe.
2) In parallel, assume that the oscillation theory can NOT be ground verified. Flight testing is too risky. So the second pathway is plan B: a fail safe latching or restraint system. So far we have spring loaded hood latch designs to consider and inertia belt constraints tuned up for the application. Other ideas may arise.
A) Develop and ventilate as many ideas as can be found.
B) Evaluate among the options and select the best approach measured against some objective criteria including effectiveness, complication, cost, difficulty of installation, etc.
C) Design, build, test, evaluate a prototype, prepare a brief report and distribute to the community. Let lots of owners have a review for evaluation and gather additional suggestions. Revise based on suggestions.
D) Collect deposits, manufacture parts to retrofit the fleet, and then chase up all Legacy owners for retrofit of safety hardware (latches or improved high damping gas springs, assuming they can be shown to work).
Hopefully concerned operators will take up the challenge and make progress on both pathways. Owners should be VERY concerned given that there is a loaded shot gun pointed at your head every time you take off. Some may still want to practice denial and brush it off. They will likely be weeded out of the gene pool.
I suggest a smart, thoughtful, and well informed course of action, and I put the challenge to LOBO to push it forward, and if not, then a group of volunteers.
And with that I leave it to you. I have done all I can to get things underway.
I do not want to read more accident reports.
Fred Moreno in far off Western Australia