The Adverse Effects of Unrealistic Simulator Scenarios

The “TOTAL PITOT BLOCKED” failure is available on simulators. This failure simulates a simultaneous obstruction of both the inlet and drain holes of a Pitot probe. As a consequence, the measured total pressure remains at a constant value corresponding to the total pressure measured at the time of the total obstruction. 

The ADR (Air Data Reference) computes the airspeed from
the difference between the Total Pressure (Pt measured by the Pitot tube) and
the static pressure (Ps measured by the static pressure ports).

CAS = f (Pt-Ps)

3 ADR are installed
on Airbus aircraft, each of them using its own Pitot tube and static pressure
ports

A computed airspeed that varies with altitude

In the case of full Pitot blockage, at low altitude,
when the aircraft climbs, the airspeed is computed wrongly based on the difference
between the constant total pressure trapped inside the Pitot tube at the time
of the obstruction and the current static pressure which is decreasing with
increasing altitude.  Therefore, when the
aircraft climbs, the measured airspeed is permanently wrong and more and more
overestimated. 

The simultaneous dual TOTAL PITOT BLOCKED failure consists in introducing, in a short term, the TOTAL PITOT BLOCKED failure on 2 Pitot probes (For example CAPT Pitot AND F/O Pitot).

This failure scenario provides a negative training and must not be used as explained here after.

The Electrical Flight Control System (EFCS) permanently monitors the
3 Airspeeds information delivered by the 3 ADRs. When the Airspeed information
delivered by one of the 3 ADRs is detected different from the 2 others, the
EFCS rejects the corresponding ADR that will no longer be used by the EFCS
system.

In the case of a simultaneous dual TOTAL PITOT BLOCKED simulated
failure, the 2 corresponding ADR deliver wrong but consistent airspeed
information while the third ADR delivers correct but single airspeed
information. The EFCS cross comparison monitoring will therefore reject the correct
airspeed information and keeps the two wrong but consistent airspeeds.

Therefore, during this whole unreliable airspeed event,
the normal flight control law remains unduly active and computed from erroneous
airspeed information.

An erroneous computed airspeed increase and an undue
activation of the High Speed protection until the High Angle of Attack
protection activates

If the dual TOTAL PITOT BLOCKED failure is set on Captain
and F/O sides at low altitude after takeoff, when the aircraft climbs, this
leads to a consistent and increasing overestimation of the airspeed delivered
on CAPT and F/O sides and used by the EFCS system.

As a consequence, the aircraft remains in normal law
and the high speed protection will unduly activate when these 2 wrong but
consistent airspeeds exceed V_MO/M_MO.

The high speed protection therefore activates wrongly
and commands permanently an increasing pitch-up movement that the flight crew
cannot counteract even with a full forward side-stick input.

This leads to a genuine increasing Angle of Attack (AoA)
that will eventually result in the activation of the high Angle-of-Attack
protection (as the high AoA protection has priority on High Speed protection).
The high AoA protection will command a pitch down movement of the aircraft as
long as the AoA remains above the AoA protection activation threshold.

Then either the aircraft exceeds the threshold that activates the abnormal attitude flight control law, or the high speed protection and the AoA protection alternatively activates. This results in large pitch oscillations with high speed protection becoming active again when the AoA becomes back below the high AoA protection activation threshold.

A dual TOTAL PITOT BLOCKED is not realistic

Such simultaneous dual failure mode with permanent and consistent dual airspeed increase (decrease) when the aircraft climbs (descends) with a resulting undue activation of the flight envelope protections has never been reported in service.

Multiple Pitot obstructions can never occur exactly at the same time and can never have permanently the same obstruction characteristics along the time. This is fundamental because multiple Pitot obstructions will undoubtedly lead to airspeed discrepancy detected by the flight control system which, in this case, will reject the erroneous airspeed information and associated ADR and revert to alternate law.

In addition, a permanent dual “TOTAL PITOT BLOCKED” failure all along the climb will undoubtedly generate confusion to the trainees. It will together jeopardize their understanding of aircraft systems, of the behavior of flight control laws and flight envelope protections and of the operational consequences of air data failures:

• It leads to keep the normal laws and associated protections active while they are computed with erroneous airspeed.
• It leads to an undue activation of the High Speed protection. The subsequent uncontrollable and dynamic aircraft pitch-up is a very negative physical experience.
• It leads to an unrealistic alternative activation of the High Speed protection and the AoA protection which does not allow understanding of the behavior of the protections and even create some confusion in the way the protections work.

Identically, if the permanent dual “TOTAL PITOT BLOCKED” is introduced at high altitude when the aircraft descends, it remains unduly in normal law based on the two more and more underestimated but consistent airspeeds. Despite the very low speeds displayed to the flight crew, the High AoA protection will never activate as the AoA remains (correctly) below the activation threshold of the protection.

The aircraft is in climb. A dual total Pitot blockage failure is set on captain and first officer sides.

While the aircraft is climbing, the erroneous captain’s and first officer’s speeds increase and reach V_MO/M_MO with the triggering of the Overspeed warning. Then the AP disconnects and the High Speed Protection unduly activates, the aircraft pitch-up, the flight crew tries to counteract with full forward sidestick input, without success. To recover, the flight crew is trained to switch off two ADRs to revert to alternate law and then to manage the aircraft trajectory.

Such scenario leads to the following questions:

• How many pilots were trained that way?

It is likely that many pilots have potentially been trained that way if we refer to the questions we received from operators and to an article published in an online aviation magazine: « Recently, we have been able to train for uncontrollable nose up pitch, with the same actions –the ones of OEB48 and OEB49- required for the recovery, which at least gets us to think (rapidly) about disabling the protections in order to regain control »,

• What should be the reaction of the flight crew in this situation?

The combination of the speed discrepancy (between ADR1, 2, 3 and standby indications) and of the abnormal correlation between the basic flight parameters (as for example the IAS increases whereas there is an important nose-up pitch), is a condition for the application of the UNRELIABLE AIRSPEED INDICATIONS procedure of the QRH. The “UNRELIABLE AIRSPEED INDICATIONS” FCTM chapter provides a description of the potential symptoms that the flight crew must have in mind to be able to detect this situation early and apply the procedure.

In this example of training scenario, the flight crew remains passive while facing an unreliable airspeed situation. This is negative training. Indeed, the pilots should be trained to take action if things do not go as expected and apply the adequate procedure.

• What is the pilot’s experience during this scenario?

This scenario can create confusion in the mind of the trainee considering that it includes a number of potentially conflicting cockpit effects: unreliable speed indication situation, overspeed, activation of the HSP, application of OEB48&49 Abnormal V Alpha Prot immediate actions… 

The fear of a potential non-controllable aircraft pitch-up could remain engraved in the trainee’s memory. As a consequence, it will create a complete loss of trust in High Speed and High AoA protections. 

• How to avoid negative training?

A dual “TOTAL PITOT BLOCKED” failure must not be used for your training scenario. 

Do not create confusion between UNRELIABLE AIRSPEED INDICATIONS procedure / Overspeed / OEB 48&49 immediate actions. 

Unrealistic and striking scenarios create fear and loss of trust for long time.

For the reasons explained here above, Airbus decided to remove, the possibility to simulate a dual total Pitot blockage from the simulators. Operators will then have to modify their simulators in accordance. 

The single FULL PITOT blocked failure will remain available. It can be used in combination with another type of Pitot failure in order to simulate a multiple airspeed failure. It can be combined with an AIRSPEED CHANNEL FAULT or an INLET PITOT BLOCKAGE (or a PARTIAL PITOT BLOCKAGE). However, the use of a dual “INLET PITOT BLOCKAGE” should be preferred.

Most of the Pitot
probes issues encountered in-service are obstruction of the Pitot probe inlet
only. This is typically what happens in the case of a Pitot obstruction due to
ice crystals.

Therefore, if the INLET PITOT BLOCKAGE (or a PARTIAL
PITOT BLOCKAGE) is available on your simulator, it is advised to use it.

INLET PITOT BLOCKAGE failure

In case of inlet Pitot obstruction, the pressure
delivered by the Pitot will be the local static pressure measured through the
drain holes instead of the Total pressure. In this case the airspeed will be
computed from the difference between the pressure measured though the drain
holes of the Pitot probe and the pressure measured through the static pressure ports.
Therefore at the time of the inlet obstruction, the measured airspeed will drop
abruptly and will remain at low value as long as the inlet obstruction exists.

A dual INLET PITOT BLOCKAGE can be used as a more
realistic scenario of multiple airspeeds failure.

Airbus recommends to use positive training in the spirit of Evidence Based Training and to demonstrate the effectiveness of the protections to reinforce the flight crew’s confidence in them.

Training is powerful when it is appropriate. That is why it is crucial to develop realistic scenarios with the support of the updated Operations Training Transmissions (OTT) and/or its associated Flight Crew Training Standard (FCTS).

The competencies are based on knowledge, skill and attitude, but crew confidence in aircraft systems is also essential. This confidence can be built-up only with an adequate training which properly replicate the actual aircraft behavior.