bubbers44

I read his book and though I agree making powerless landings would help your confidence level in a situation like Sully's he doesn't credit it to his success.

Linktrained

HN39
Thank you for the corrections on French gliding licences. ( I did say "used..." I should have added that this was in the early 1950s. Things change...) I held a Brevet D, there was no question of a licence, then, as an option or a requirement at three National Centres.

It would be reasonable to suppose that PF WAS quite experienced as a glider pilot.

On three different Fight Engineered aircraft that I flew, it was usual for the pilot flying that leg, (now called PF) to have his hand forward of the throttles until V1, so that he could cut the power quickly. For the rest of the flight the F/E would control the power following verbal orders, "Zero boost", "30 inches " or "300 Torque", depending on type. If a constant powered approach was made then this would be something similar to a glide approach ( but with that constant power - and never below a certain figure, to allow for a low overshoot.)

Lonewolf_50

Conf: I apologize for the poor explanation. It is only the last (fourth) stage of degradation that takes the boost cylinder our of the AFCS servo package (perhaps more like "direct law) while the previous three work you to something more like varoius ALT laws, with SAS off being closer to Alt 2 or Alt 2 B in terms of flight control sensitivity.

Again, a very difficult to make comparison, but the issue with " you have to fly more manually" and "it will feel very different" is the issue at hand, not precisely the detail of which system has run amok.

I admit that I was being a bit apples to oranges.

DozyWannabe

Could well be - it's a dim and distant memory, but I was distinctly told that the maximum attitudes were computed and held at the limit before transmission to the flight surfaces rather than the other way round (which makes sense as it's a far less process bandwidth-intensive way of doing it).

CONF might be right and the THS might be an exception (I still haven't got to the bottom of the sim behaviour), but I do know that the general design was to hold attitude with all flight surfaces available rather than put a hard limit on the flight surfaces themselves.

TTex600

Slight change of direction.

On the 320, an ECAM Instructing the pilots to perform UAS procedures is displayed after a pitot failure.

If the system can come to that logical conclusion, could it not also make a reliable determination of plugged pitot's?

If the answer is buried in another string, please point me there.

DozyWannabe

What kind of determination? That there has been a problem with the pitot tubes, or an attempt to ascertain which of them is correct?

The problem with the latter is that you have three data sources - enough for a quorum, but limited in what can be applied. Earlier in the threads it was pointed out that were two to fail simultaneously, a risk is run of the systems interpreting the failed pair as correct and voting out the one that's still working. Now - the chances of this happening are miniscule, but it limits what can be done with that data.

Do you have to hand the ECAM message to which you refer?

Thanks.

TTex600

Doesn't really matter. If the system can sense a pitot problem, would it not be prudent to suggest the UAS procedure? Remember, the UAS procedure does not demand action as long as safety of flight is not affected, so applying it can only help.


ANTI ICE Capt and FO Pitot is the ECAM.

Edit: I should have not asked the question in the way I did. I was trying to ask why the ECAM couldn't suggest the UAS procedure in a pitot failure.

DozyWannabe

@TTex600 - with you.

OK, so if I've got this right that ECAM message relates to the failure of the anti-ice system on the pitot tube rather than the pitot tube itself. Being an internal systems failure it can be easily determined which of the three, or which combination of the three have failed.

A blocked pitot tube scenario involves a failure from outside the system, so it cannot reliably monitor where the failure is. Having the ECAM suggest or instruct UAS procedure might be technically feasible, but I'd be inclined to worry about edge cases, such as a false indication scenario or a point in the flightpath where a strict interpretation of UAS procedure might be inadvisable.

OK465

I would think you could conduct an entire flight using UAS procedures.

mm43

@ Dozy,

I would have thought that a comparison of change in relative differences between the Inertial and Air data sources would give a reliable indication of single or multiple pitot failures, be they external or internal.

All to do with what you "trust".

DozyWannabe

Possibly, but there are times when it's better than others to do so - remember we're talking edge cases here.

One thing I should have said is that ECAM is there to help the flight crew diagnose technical problems and occasionally suggest remedies to those technical problems - it was never intended as a guide to how the aircraft should be flown.

@mm43 - Feasibly, but how far would you trust it? Remember that the inertial sensors could have problems simultaneously... As a "computer guy" I'd still be more inclined to trust a human pilot with a pitch/power chart.

Peter H

Obviously it could suggest the UAS procedure. In hindsight it does look like a better option (to a non-pilot).

I suspect that it doesn't suggest the UAS procedure because nobody anticipated common mode pitot failures. Nor thought about their implications after they started to happen.

Personally I think that the warning could/should be given even earlier in the process, when the computer first recognised that a pitot failure may have occurred [*]. I think you might gain a few tens of seconds that way.

... during which time it might be a good idea if the pilots were encouraged to disengage the autopilot, until they can see that all is well. I doubt that autopilots should be relied on in situations where UAS may occur.

* I suspect that there is some intentional delay in the process. Not least to smooth over transient failures when the plane has just "flown through a puddle" and overloaded the pitots.

andianjul

The voting logic as described makes sense, unless as postulated two pitots block simultaneously and the remaining good pitot is out-voted by the logic. However, this approach is decidedly simplistic and I propose that it’s possible that the explanation of the voting system lacks a thorough knowledge of the low-level workings of the system. I do not possess such knowledge, however, if I were to design an air-speed sensing system one of the features (the design of which has been possible and therefore available to aviation designers/engineers virtually since the invention of the transistor) that I would incorporate is ‘signature’analysis. Basically, the electrical ‘signature’ of a valid signal from any pitot that is being impacted by air molecules will appear decidedly different to the ‘signature’ from a blocked pitot. Essentially, the signal from the blocked pitot will lack the ‘noise’ of the unblocked pitot. Sure, the block pitot can yield data, albeit invalid, and may function more as an altimeter than a speed sensor; but the absence of the minutia of the electrical information from the transducer that is being bombarded by air molecules is something for which the designers can easily test and its absence should inform the system to preclude the data from the ‘known’ blocked pitot. Then the notion of simultaneously blocked pitots being used to out-vote a functioning pitot is rendered moot.

bubbers44

OK, I agree, all they had to do was hold about 2.5 degrees nose up and hold altitude because the altimiter worked. Maintain cruise power and fly out of the precipitation.

However I don't think either of these pilots knew how to hand fly. That was the problem. Cost analysis says hire the new guys cheap because this is an automatic airplane. You don't need real pilots.

Lyman

@ andianjul...

"However, this approach is decidedly simplistic and I propose that it’s possible that the explanation of the voting system lacks a thorough knowledge of the low-level workings of the system."

precisely...

The time to initiate a pilot cue inre suspect ias is when the initial sensing is suspect, not after the data is displayed as a product (airspeed).

+1 for the man from Australia...

RR_NDB

Hi,

This paper is from the design group:

" By Joelle Barthe
Flight Operations Engineer

Published on SafetyFirst #5
December 2007

1 Introduction

Unreliable speed is one of the difficul situations that a pilot has to face. Once the failure has been identified, a procedure, based on pitch angles and thrst settings, will assist the pilot in safely flying the aircraft.

But the main difficulty is to rapidly detect an unreliable speed situation. Reaction time is crucial, since the aircraft may stall and overspeed conditions could cause aircraft damage.

The effects of pitot probes obstruction on ground

It intended to make ground and flight crew more sensitive to the consequences of obstructed probes, and to prevent take-off with unriliable speed.

But once airborne, how can the crew handle an unreliable speed situation?

This article is based on A320/A330/A340 design. Cockpit effects, identification and troublshooting, remains similar for wide body aircraft and A380, with some specificities covered in the operational documentation.

2 Effects and consequences in the cockpit

Water, ice, dust, ashes, etc. may pratially or totally block pitot probes and static ports. Equally,tubes misconncected to the Air Data Modules (ADM), plastic covers not removed from probes, insect nest, radome damage, may lead to enrroneous pressure measurements.

The consequences of this erroous pressure information, once used by the ADRs, and/or the standby instruments, are the computation and the display of unreliable speed and/or altitude for all users.

Erroneous speed or altitude indications can be suspected, among others, in the following cases:

- Speed discrepancy (between ADR 1, 2, 3 and standby indication),
- The flutuction of the Indicated Air Speed or of the Pressure Altitude.
- Abnormal correlation between basic flight parameters (IAS, attitude, pitch, thrst, climb rate),
- abnormal AP/FD/ATHR behaviour,
- STALL and OVERSPEED warnings or FLAP RELIEF on ECAM that are in contradiction with ar least one of the indicated airspeeds,
- Inconsistency between radio altitude and pressure altitude,
- Impossibility of extending the landing gear by the normal landing gear system.

Nevertheless, it should be emphasized that identifying an unreliable speed indication is not wlways obvious: no single rule can be givien to conclusively identify all possible erroneous indications and the display of contradictory information may confuse the flight crew. Pilots should therefore be aware of unreliable speed symptoms and consequences.

Depending on the effected probe, i. e. pitot probe os static port, differente indications in the cockpit will become unreliable. Therefore the crew should be aware that some of the usual cues to fly could be unreliable as indicated:




3 Identification and Handling of Unreliable Speed situations

Airbus has developed procedures and guidelines to help crews identify and handle an unreliable speed situation.

The Volume 3 of the FCOM and QRH provide the UNRELIABLE SPEED INDIC / ADR CHECK PROC procedure.

In addition, Airbus has developed training material in the Flight Crew Training Manual ( FCTM, available for A320/A330/A340/A380). The FCTM provides information about the causes and consequences of unreliable ADR computations. It also provides information on how to apply the UNRELIABLE SPEED INDIC / ADR CHECK PROC of the QRH.

An interative trainin tool, the e-Briefing, is also available on https://w3.airbus.com/ in the Flight Operations community, under ther heading "Safety and Operational materials".

4 - Procedures

As soon as a doubt about airspeed indication arises, or a relevant ECAM alert is triggered (relative to ADRs failure or discrepancy for instance), the UNRELIABLE SPEED INDICATION/ADR CHECK PROC procedure should be applied by the crew, following this sequence:

1) If the safe conduct of the flight is affected, APPLY THE MEMORY ITEMS, i. e. fly a pitch with TOGA or CLB thrust,

2) If the safe conduct of the flight is not affected, or once the memory items have been applied, LEVEL OFF, if necessaru, and start TROUBLESHOOTING,

3) If the affected ADR can be identified, fly with the remaining ADR.

4) If the affected ADR cannot be identified or all airspeed indications remain unreliable, FLY WITH PITCH/THRUST REFERENCES.

4.1 Memory Items

If the safe conduct of the flight is affected, the flight crew applies the memory items: theses allow "safe flight conditions" to be rapidly established in all flight phases (take-off, clim, cruise) and aircraft configurations (weight and slats/flaps). The memory items apply more particularly when a failure apprears just after take-off.
Once the target pitch attitude and thrust values have been stabilized at or above minimum safe atltitude, or when the safe conduct of the flight is nor affected, the flight crew enter the 2nd part of the QRH procedure: level off the aircraft and perform troubleshooting.

4.2 Troubleshooting and isolation

The table provided in the QRH gives the pitch (º) and thrust (%N1) to be applied to level off the aircraft according to its weight, altitude and configuration, along with flying technique advices.
In situations where most primary flight data are erroneous, some indications may stil remain correct and should consequentely be used to help the crew stabilize the flight path. This is the case for the Flight Path Vector (FPV), reliable if the static ports are not blocked, and for the GPS altitude displayed on the MCDU, when GPS is installed.

When the flight path is stabilized, the flight crew will start the troubleshooting, keeping in mind that sometimes two or even all three ADRs might provide identical but erroneous data (e.g. due to icing conditions, flight in volcanic ashes, etc).Therefore, do not instinctivelu reject an ADR that is suspected to be affected.


If the troubleshooting procedure enables the crew to identify the affected ADRs, then a normal situation can be. resumed.

But if the affected ADR cannot be identified, or all ADRs are affected, then the flight crew will fly without speed reference, using the pitch and thrust tables.

4.3 Flying using pitch/thrust tables

First, the crew has to switch OFF two ADRs and keep one ADR ON, to keep the Stall Warning Protection.
Then, the crew will [bold] fly the aircraft without speed references, using pitch (º) and thrust (%N1) settings.

To fly the aircraft using pitch and thrust settings, the crew will find in the QRH the tables relative to each phase of flight: Climb, Cruise, Descent and Approach, talking into account the aircraft weight, configuration and altitude. With theses tables, the crew will be able to safety land the aircraft.

5 Back UP Speed Scale (BUSS)

In order to dedrease the crew workload in case of unreliable speed, Airbus has developed the Back-UP Speed Scale (BUSS) that replaces the pitch and thrust table. The BUSS is optional on A320/A330/A340. It is basic on A380, being part of the ADR Monitoring functions.

This indication is based on angle of atack (AOA) sensor information, and is therefore not affected by erroneous pressure measumements.

The BUSS comes with a new ADIUR standar (among other new system standards), where the AOA information is provided through the IRs and nor through the ADRs. This enables selecting all ADRs off without loosing the STALL WARNING PROTECTION.
The AOA information provides a guidance area in place of the speed scale. When the crew selects all ADRs OFF, then:

- The Back-Up Speed Scale replaces the PFD speed scale on both PFDs,

- GPS Altitude replaces the Altitude Scale on both PFDs.

The Back-Up Speed Scale then enables to fly at a safe speed, i. e. above stall speeds, by adjusting thrust and pitch.
The BUSS will be displayed once all ADRs are switched OFF. Therefore, on aircraft that have the BUSS, when the flight crew cannot identify the faulty ADR(s) when performing the troubleshooting, or when all ADRs are affected, the flight crew will switch OFF ADRs, and will fly the green area of the BUSS.

However, if the safe conduct of the flight is affected, the memory items must still be applied before troubleshooting.
As the BUSS is associated to the ADR monitoring funcitions, some unreliable speed situations can be automatically detected (e. g. new ECAM warning "NAV ADR 1+2+3 FAULT"), and some ECAM procedures will lead to the BUSS activation by requesting to switch OFF all ADRs.


6 Conclusion

An unreliable speed situatio may be difficult to identify, due to the multiple scenarios that can lead to it. Therefore, training is a key element: indeed the flight crew's ability to rapid detected the abnormal situation, and to correctely handle it, is cricial.

In case of any doubt, the pilot should apply the pitch/thrust memory items, and then refer to the QRH to safely fly the aircraft, and to positively determine the faulty source(s) before eliminating it (them).

In addition, to further assit the pilot in detecting the failure and safely fly the aircraft, Airbus has developed the BUSS, which provides a safe flying range indication.

Finaly, to reduze the probally of experiencing unreliable speed situations, on-ground actions, such as comprehensive maintenance and through pre-flight exterior inspection, should be stressed. "

Lonewolf_50

In Re RR NDB's post of a 2007 discussion of Unreliable Airspeed in the Airbus family ...
Did the gent in the right seat interpret "safe conduct of the flight" to mean "don't overspeed the aircraft?" There have been a number of estimates that a concern of his was overspeed, and wanting to not do so.
The crew never got into the logic tree of methodical trouble shooting that got to this decision point, if their lack of discussion on "which ADR is out at this point" is an indicator.

Anyone at AF have a handle on how to train for this? Some lawyers are probably contemplating villas in St Tropez, betting on the answer being no.

WHICH memory items? The ones for TOGA and nose up?

Granted, as has been discussed over and over, most succinctly by PJ2 but also by others, at their flight level, pitch and power for level flight is what was called for, to allow them time to trouble shoot and work through the systems faults. But what was the pilot trained for, and what was his most recent training scenario regarding this malfunction?

This takes us back to question 1, which is what the guy at the controls believed the risks to be to the flight.

RR_NDB

Worse than that is complete loss of SA due (partially) misleading info presented by the System to a (non properly trained) crew after erratic and inconsistent data contaminated System

My rationale simply is:

Delegate to the crew the task (as per Airbus SAS) is an error. Using proven DSP techniques an A/C subsystem may warn on impending UAS. And deterministically inform of an important issue.

I posted several times this earlier

DSP and Signature analysis comment by andianjul:

DozyWannabe

Do you think you could meet the reliability requirements? Remember that adding complexity adds potential points of failure.

RetiredF4

Is this an honest question in relation to technical feasability or in relation to beancounters available assets?

Just remeber, the moon landing was 43 years ago.