Avidyne DFC90 and Garmin GFC700 autopilots, and behaviour with a frozen pitot tube

Well, an A330 has three (didn’t help AF447) but my Q was re e.g. the EFD1000.

I thought it was re “any of these glass avionics have two pitot tubes”.

A normal SEP with either Avidyne, Aspen or Garmin glasscockpit will have
- 1 pitot or 2
- 1 or 2 ADC
- 1 or 2 AHRS systems
With the pitot freezing in a single ADC installation you have no redundancy there, but you do have the Attititude from the AHRS, so actually can fly pitch and power, and you always have the mechanical backup instruments, but without speed. You could still use GS as a backup, but actually pitch and power should be sufficient to get out of IMC.

JasonC wrote:

One if the FSI simulator emergencies was using the mechanical backups to decide which ADC was providing false information. … Same applies to attitude. You have three independent sources. Follow two.

That’s interesting as it implies that the AHRS (GRS77?) sources can indeed generate false attitude indications, that can only be identified by the pilot taking the “best 2 out of 3” including the standby. Is there anything documented anywhere by Garmin that acknowledges that this scenario is possible? My argument/theory earlier was that the use of GPS/ADC assistance by the AHRS should allow integrity checking and always a red-cross rather than a false attitude indication, as it effectively allows the G1000 to do its own “best 2 out of 3” cross-checking internally (gyros+accelerometers+speed/heading).

This failure scenario:

http://www.flyingmag.com/avionics-gear/instrumentaccessories/garmin-outlines-fix-g1000-display-loss

Led to loss of attitude indication, but not a false attitude indication.

Peter, you would need both your pitot tube and the GPS to fail simultaneously to lose attitude indication. An iced over pitot on its own would not cause loss of attitude so dual pitots are not required for a dependable and safe attitude indication.

Of course, if you have dual air data computers you may as well have them connected to different pitots as per Jason’s post. But you still have redundancy in the attitude system without.

One scenario for a pitot failure is severe icing and then if you have two they will probably both be iced up anyway and you’ll be back to relying on GPS.

Interesting discussion of failure modes in G1000. You can if you have a two ADC and AHRS system display either on the PFD should one fail.

Link

@ortac, your post is an exercise in reductio ad absurdum

It is certainly good to compute some sort of figure of merit about the reliability of some data, and present it to the user. It is very bad if this number is used to gate the information, i.e. draw X instead of say attitude information if the figure of merit crosses some threshold.

It should not be difficult to understand that it is still better to have possibly unreliable attitude information over having no attitude information at all.

You cannot simply ignore software errors, and even worse, specification problems. This data comparison function is the most complex. You need to set limits, and there will always be cases where the limits are too tight and other cases where the limits will not be tight enough.

ortac wrote:

With gyros+accelerometers only, how would you detect a miscompare of data between the two in the event of one of them being faulty?

The typical setup is 3 axis angular velocity, 3 axis linear acceleration, and 3 axis magnetometer sensors. That’s already 9 measurements. You output only 3 variables (pitch, roll and yaw angles). This already provides redundancy.

But again, I’m not per se against comparing data and presenting a figure of merit, but I’m very much against this figure of merit being used to hide information. Some mechanical gyros have flags that pop into view but do not obstruct the actual gyro card. This system has worked for decades. I don’t see why this cannot be done on a digital screen, why there the flag (X) has to obscure the gyro card.

ortac wrote:

It is trivial to think of failure scenarios where a mechanical AI would give false indications.

Such as? Last time I had a mechanical gyro failing it was very obvious that something was wrong.

Flyer59 wrote:

A failure if the AHRS is very, very rare.
I have actually not heard of one in the Cirrus/Avidyne fleet.

I’ve had one, in flight, with a G1000. Fortunately it was in VMC, cruise, and the turn-coordinator based KAP140 autopilot happily kept the aircraft right side up while I was groping for the checklists. Before I had time to do anything, the AHRS restarted itself and was functional again about one minute later. Our avionics guy searched for info and found that this was a known issue with the G1000 software. It turned out we didn’t have the most recent version and updating should prevent the problem from recurring.