Peter wrote:
I would not necessarily assume these corner cases are well known.
I wouldn’t call it a “corner case” if you have a system in your aircraft that could send you into a terminal spiral dive if airspeed indication fails or pitot is blocked (which would not be an emergency w/o such a system). Reminds of the Boeing Max disaster where pilots also didn’t know how the system reacts.
Esp. in Cirrus aircraft – that prides oneself of its transition training – it simply would be ridiculous if pilots don’t know this by heart! What is a transition training – or any familiarization – for if it doesn’t include the specific failure modes of the installed avionics?
That is by the way not only referring to ASI/pitot failure: As any pilot of an AP and or electric trim equipped plane should know, how an elevator runaway feels and which fuse to pull in case, everyone needs to know the failure modes of such envelope protection electronics…
Well, obviously I agree with you that a pilot should know this, and know how to recognise it, but I have known, and flown with, many many pilots, over nearly 20 years, and some are “tech anoraks” but most are not. Most airline pilots are not tech wizards, either. For example, to take a much simpler case, all Skydemon users that I’ve flown with didn’t understand the full details of how to configure it, how it behaves in various scenarios, etc. Yeah… that statement usually leads to a severe beating on the UK sites 
Re this actual point (failed airspeed) I asked one owner and he didn’t know. Also nothing is readily found on google. Google doesn’t get access to COPA (it being behind a paywall login) so maybe it came up in there, and if it has then one of the many Cirrus owners who do post here could advise us.
Malibuflyer wrote:
no pilot of a (…) plane with this feature does post here
Peter wrote:
Here one owner mentions that the underspeed protection uses the stall warner and is thus immune from a pitot failure,
The plane I fly the most has an S-Tec 3100. I’m fairly sure that underspeed protection just uses IAS, not corrected for flap position, nor for angle of bank, climb/descent angle, nor anything like that. FWIIW, the autopilot blares an “airspeed, airspeed” warning at each landing. It was changed in a firmware update that the plane doesn’t have yet, that if the plane is in APP mode, but has been disconnected (assuming that is for landing), it won’t anymore issue that warning.
While I don’t know for 100% sure, my expectation is that with a blocked pitot, the underspeed protection will just pitch down, and the pilot has to detect that and disconnect to autopilot.
I wonder whether the “underspeed protection uses stall warner” is exclusive to G1000/GFC700 aircraft, or if the the GFC500/GFC600 also feature that. Just a guess, but I expect not, be it only for the reason to keep installation easier.
A key difference between the S-Tec 3100 and the Garmin autopilots is that the envelope protection is active (actually exerting force on the controls) only when the AP is active (engaged). Not when it is merely in ready state (then you get only aural warnings). In the Garmin ones, it is on “all the time”. I wonder if you have to pull the AP circuit breaker to get rid of it if it misbehaves.
the underspeed protection will just pitch down, and the pilot has to detect that and disconnect to autopilot.
That’s an interesting point. The King APs disconnect when pitch or roll go past certain values. But where you have a more sophisticated autopilot offering envelope protection, and especially the Cirrus “blue button” which obviously needs a much more resilient autopilot engagement, they can’t be doing that.
And all these assume the pitot system keeps working.
It seems there are two implementations of underspeed: stall warner based (Cirrus) and pitot airspeed based (others). The former should be safe from a pitot failure but won’t protect against a pilot induced overspeed in that situation. The latter will just pitch down if airspeed data is lost and will know nothing about it, and that is more interesting. I can see why Cirrus chose the stall warner method 
(I’ve never flown a plane with Garmin underspend protection – but hopefully I will in not so distant future when Garmin finally certifies the GFC-600 for the Malibu…)
Underspeed protection by stall warning causes some interesting questions:
- Stall-Warning kicks in quite late. Therefore an underspeed protection based on it would require very rapid control inputs. Sounds like not the optimal situation
- Must be an GFC-700 exclusive design anyways: From what I understand from GFC-600 manual, there is no electric connection between stall warner and GFC (would be difficult to achieve anyways as I don’t think there is any electrical standard for stall warning indication…)
- From a safety design POV it would be interesting that two safety features doing basically the same things are so closely connected. This is very litte redundancy…
More generally speaking: My impression is, that unfortunately many pilots negligently underestimate the complexity of avionics in modern airplanes and therefore undertrain themselves when familiarizing with a new type.
The whole point about that infamous EASA-EFIS endorsement is not that it is different to follow an electronic AI than an mechanical AI but that failure modes are so different. Everyone makes fun about that old “If static line gets blocked destroy the VSI glass” rule in case of an EFIS but only very few make sure they understand all their failure modes – that old Apsens kill you in IMC if pitot gets blocked is only the tip of the iceberg…
In a Cirrus you can hold down the autopilot disconnect button on your yolk to override the autopilot and envelope protection. When I did my EASA IR annual flight review this was actually tested as part of a runaway trim failure. You can also disable it through the menus but this is an override instantly at your fingertips (thumb actually!)
Why is there an assumption that underspeed protection will pitch down if airspeed data from ADC is lost. I think that is almost certainly not going to happen. I can see that a blocked pitot could cause an underspeed protection to activate but even then you can just override with the autopilot disconnect switch.
I have never heard of underspeed protection build around the stall warner.
It is above; see this post. Maybe it is wrong? It would be a crude way to do it, for sure.
A sudden loss of pitot pressure could be disregarded by the system but a gradual loss will look just like, ahem, a loss of airspeed
You can override any autopilot but only in time. What happens if you don’t notice it? What do envelope protection systems in GA do if the pitot ices up?
It looks airspeed based to me. You either need to use airspeed adjusted for flap config and icing state or AOA.
JasonC wrote:
It looks airspeed based to me.
The second page of the document you included explicitly states that the stall warning will trigger pitch down-action by the autopilot.
