The Adverse Effects of Unrealistic Simulator Scenarios

Source: Airbus Safety First URL: https://safetyfirst.airbus.com/the-adverse-effects-of-unrealistic-simulator-scenarios/ Published: 2019-06-19 Magazine Issue: 2019-06 Category: Flight Ops, angle, angle-of attack, AoA, HSP, pitot, protection, speed, training PDF: Original PDF

---

TRAINING

The use of unrealistic failure scenarios during simulator training can lead to negative training. This article describes the « TOTAL PITOT BLOCKED » failure that is available in simulators. It explains why simultaneous and permanent dual « TOTAL PITOT BLOCKED » in climb or descent phase leads to negative training.

THE “TOTAL PITOT BLOCKED” FAILURE

The “TOTAL PITOT BLOCKED” failure is available on simulators. This failure simulates a simultaneous obstruction of both the inlet and drain holes of a Pitot probe. As a consequence, the measured total pressure remains at a constant value corresponding to the total pressure measured at the time of the total obstruction.

Illustration of the “TOTAL PITOT BLOCKAGE” simulated failure

Effect of the “Total Pitot Blocked” failure on the airspeed computation

The ADR (Air Data Reference) computes the airspeed from the difference between the Total Pressure (Pt measured by the Pitot tube) and the static pressure (Ps measured by the static pressure ports).

CAS = f (Pt-Ps)

3 ADR are installed on Airbus aircraft, each of them using its own Pitot tube and static pressure ports.

A computed airspeed that varies with altitude

In the case of full Pitot blockage, at low altitude, when the aircraft climbs, the airspeed is computed wrongly based on the difference between the constant total pressure trapped inside the Pitot tube at the time of the obstruction and the current static pressure which is decreasing with increasing altitude. Therefore, when the aircraft climbs, the measured airspeed is permanently wrong and more and more overestimated.

Example of the effect of the “TOTAL PITOT BLOCKAGE” simulated failure on the airspeed computation when in climb

TRAINING

USE OF A DUAL “TOTAL PITOT BLOCKED” FAILURE SCENARIO: A NEGATIVE TRAINING

The simultaneous dual TOTAL PITOT BLOCKED failure consists in introducing, in a short term, the TOTAL PITOT BLOCKED failure on 2 Pitot probes (For example CAPT Pitot AND F/O Pitot).

This failure scenario provides a negative training and must not be used as explained here after.

Effects of a dual “TOTAL PITOT BLOCKED” failure

The normal fl ight control law remains unduly active and uses erroneous but consistent airspeed information

The Electrical Flight Control System (EFCS) permanently monitors the 3 Airspeeds information delivered by the 3 ADRs. When the Airspeed information delivered by one of the 3 ADRs is detected different from the 2 others, the EFCS rejects the corresponding ADR that will no longer be used by the EFCS system.

In the case of a simultaneous dual TOTAL PITOT BLOCKED simulated failure, the 2 corresponding ADR deliver wrong but consistent airspeed information while the third ADR delivers correct but single airspeed information. The EFCS cross comparison monitoring will therefore reject the correct airspeed information and keeps the two wrong but consistent airspeeds.

Therefore, during this whole unreliable airspeed event, the normal fl ight control law remains unduly active and computed from erroneous airspeed information.

An erroneous computed airspeed increase and an undue activation of the High Speed protection until the High Angle of Attack protection activates

If the dual TOTAL PITOT BLOCKED failure is set on Captain and F/O sides at low altitude after takeoff, when the aircraft climbs, this leads to a consistent and increasing overestimation of the airspeed delivered on CAPT and F/O sides and used by the EFCS system.

As a consequence, the aircraft remains in normal law and the high speed protection will unduly activate when these 2 wrong but consistent airspeeds exceed VMO/MMO.

The high speed protection therefore activates wrongly and commands permanently an increasing pitch-up movement that the fl ight crew cannot counteract even with a full forward side-stick input.

This leads to a genuine increasing Angle of Attack (AoA) that will eventually result in the activation of the high Angle-of-Attack protection (as the high AoA protection has priority on High Speed protection). The high AoA protection will command a pitch down movement of the aircraft as long as the AoA remains above the AoA protection activation threshold.

Then either the aircraft exceeds the threshold that activates the abnormal attitude fl ight control law, or the high speed protection and the AoA protection alternatively activates. This results in large pitch oscillations with high speed protection becoming active again when the AoA becomes back below the high AoA protection activation threshold.

effects of a DUAL “TOTAL PITOT BLOCKAGE” simulated failure in climb

An unrealistic scenario that creates negative training

A dual TOTAL PITOT BLOCKED is not realistic

Such simultaneous dual failure mode with permanent and consistent dual airspeed increase (decrease) when the aircraft climbs (descends) with a resulting undue activation of the fl ight envelope protections has never been reported in service.

Multiple Pitot obstructions can never occur exactly at the same time and can never have permanently the same obstruction characteristics along the time. This is fundamental because multiple Pitot obstructions will undoubtedly lead to airspeed discrepancy detected by the fl ight control system which, in this case, will reject the erroneous airspeed information and associated ADR and revert to alternate law.

In addition, a permanent dual “TOTAL PITOT BLOCKED” failure all along the climb will undoubtedly generate confusion to the trainees. It will together jeopardize their understanding of aircraft systems, of the behavior of fl ight control laws and fl ight envelope protections and of the operational consequences of air data failures:

• It leads to keep the normal laws and associated protections active while they are computed with erroneous airspeed.

• It leads to an undue activation of the High Speed protection. The subsequent uncontrollable and dynamic aircraft pitch-up is a very negative physical experience.

• It leads to an unrealistic alternative activation of the High Speed protection and the AoA protection which does not allow understanding of the behavior of the protections and even create some confusion in the way the protections work.

TRAINING

Identically, if the permanent dual “TOTAL PITOT BLOCKED” is introduced at high altitude when the aircraft descends, it remains unduly in normal law based on the two more and more underestimated but consistent airspeeds. Despite the very low speeds displayed to the flight crew, the High AoA protection will never activate as the AoA remains (correctly) below the activation threshold of the protection.

An example of negative simulator training scenario

The aircraft is in climb. A dual total pitot blockage failure is set on captain and first officer sides.

While the aircraft is climbing, the erroneous captain’s and first officer’s speeds increase and reach VMO/MMO with the triggering of the Overspeed warning. Then the AP disconnects and the High Speed Protection unduly activates, the aircraft pitch-up, the flight crew tries to counteract with full forward sidestick input, without success. To recover, the flight crew is trained to switch off two ADRs to revert to alternate law and then to manage the aircraft trajectory.

Such scenario leads to the following questions:

How many pilots were trained that way?

It is likely that many pilots have potentially been trained that way if we refer to the questions we received from operators and to an article published in an online aviation magazine: « Recently, we have been able to train for uncontrollable nose up pitch, with the same actions –the ones of OEB48&49- required for the recovery, which at least gets us to think (rapidly) about disabling the protections in order to regain control ».

What should be the reaction of the flight crew in this situation?

The combination of the speed discrepancy (between ADR1, 2, 3 and standby indications) and of the abnormal correlation between the basic flight parameters (as for example the IAS increases whereas there is an important nose-up pitch), is a condition for the application of the UNRELIABLE AIRSPEED INDICATIONS procedure of the QRH. The “UNRELIABLE AIRSPEED INDICATIONS” FCTM

chapter provides a description of the potential symptoms that the flight crew must have in mind to be able to detect this situation early and apply the procedure.

In this example of training scenario, the flight crew remains passive while facing an unreliable airspeed situation. This is negative training. Indeed, the pilots should be trained to take action if things do not go as expected and apply the adequate procedure.

What is the pilot’s experience during this scenario?

This scenario can create confusion in the mind of the trainee considering that it includes a number of potentially conflicting cockpit effects: unreliable speed indication situation, overspeed, activation of the HSP, application of OEB48/49 Abnormal V Alpha Prot immediate actions…

The fear of a potential non-controllable aircraft pitch-up could remain engraved in the trainee’s memory. As a consequence, it will create a complete loss of trust in High Speed and High AoA protections.

How to avoid negative training?

A dual “TOTAL PITOT BLOCKED” failure must not be used for your training scenario.

Do not create confusion between UNRELIABLE AIRSPEED INDICATIONS procedure / Overspeed / OEB48/49 immediate actions.

Unrealistic and striking scenarios create fear and loss of trust for long time.

UPDATE OF THE SIMULATOR PACKAGE

Removal of the possibility to use a dual TOTAL PITOT BLOCKED failure

For the reasons explained here above, Airbus decided to remove, the possibility to simulate a dual total Pitot blockage from the simulators. Operators will then have to modify their simulators in accordance.

The single FULL PITOT blocked failure will remain available. It can be used in combination with another type of Pitot failure in order to simulate a multiple airspeed failure. It can be combined with an AIRSPEED CHANNEL FAULT or an INLET PITOT BLOCKAGE (or a PARTIAL PITOT BLOCKAGE). However, the use of a dual “INLET PITOT BLOCKAGE” should be preferred.

The INLET PITOT BLOCKAGE: A more realistic simulated failure

Most of the Pitot probes issues encountered in-service are obstruction of the Pitot probe inlet only. This is typically what happens in the case of a Pitot obstruction due to ice crystals.

Therefore, if the INLET PITOT BLOCKAGE (or a PARTIAL PITOT BLOCKAGE) is available on your simulator, it is advised to use it.

TRAINING

INLET PITOT BLOCKAGE failure

In case of inlet Pitot obstruction, the pressure delivered by the Pitot will be the local static pressure measured through the drain holes instead of the Total pressure. In this case the airspeed will be computed from the difference between the pressure measured though the drain holes of the Pitot probe and the pressure measured through the static pressure ports. Therefore at the time of the inlet obstruction, the measured airspeed will drop abruptly and will remain at low value as long as the inlet obstruction exists.

A dual INLET PITOT BLOCKAGE can be used as a more realistic scenario of multiple airspeeds failure.

How to create positive training?

Airbus recommends to use positive training in the spirit of Evidence Based Training and to demonstrate the effectiveness of the protections to reinforce the flight crew’s confidence in them.

Training is powerful when it is appropriate. That is why it is crucial to develop realistic scenarios with the support of the updated Operations Training Transmissions (OTT) and/or its associated Flight Crew Training Standard (FCTS).

The competencies are based on knowledge, skill and attitude, but crew confidence in aircraft systems is also essential. This confidence can be built-up only with an adequate training which properly replicate the actual aircraft behavior.

CONTRIBUTORS:

Panxika CHARALAMBIDES Incident/Accident Investigator Product Safety

Gilbert SAVARY

Head of Flight Operations Support and Training Standard pilots group

A “TOTAL PITOT BLOCKED” failure simulates a simultaneous obstruction of both the inlet and drain holes of a Pitot probe. The use of a dual and permanent “TOTAL PITOT BLOCKED” is an unrealistic scenario that has never been encountered in service. It leads to keep inappropriately the normal laws and associated protections available whereas they are computed with wrong and consistent speeds. This clearly jeopardizes the understanding of aircraft systems, flight control laws and may alter the trust in flight envelope protections that are acting wrongly in such context.

If the dual and permanent failure is simulated during the climb phase, it will generate an undue activation of the high speed protection and subsequent uncontrollable and dynamic aircraft pitch-up.

Training consisting in requesting flight crew to switch off two ADRs to revert to alternate law in such scenario is clearly negative training.

Therefore the dual “TOTAL PITOT BLOCKED” failure must not be used and Airbus has decided to remove from simulators the possibility to simulate it.

Safety fi rst, #28 June, 2019. Safety first is published by Airbus S.A.S. - 1, rond point Maurice Bellonte - 31707 Blagnac Cedex/France. Publisher and Editor: Yannick Malinge, Chief Product Safety Officer. Concept Design by Airbus Multi Media Studio 20190588. Reference: X00D16031905 Issue 28. Photos by H. Goussé, Jing, P. Pigeyre.

---

中文译文

TRAINING

在模拟机训练中使用不切实际的故障场景可能导致负面训练效果。本文描述了模拟机中可用的”TOTAL PITOT BLOCKED”（总皮托管阻塞）故障，解释了为什么在爬升或下降阶段同时且持续地出现双侧”总皮托管阻塞”会导致负面训练。

“TOTAL PITOT BLOCKED”故障

“总皮托管阻塞”故障在模拟机中可用。该故障模拟皮托管探头的入口孔和排放孔同时堵塞的情形。因此，测得的总压保持在堵塞时刻测得的总压值不变。

“TOTAL PITOT BLOCKAGE”模拟故障示意图

”总皮托管阻塞”故障对空速计算的影响

ADR（大气数据基准）通过总压（Pt，由皮托管测量）与静压（Ps，由静压孔测量）的差值计算空速。

CAS = f (Pt-Ps)

空客飞机上安装了3套ADR，每套使用独立的皮托管和静压孔。

计算空速随高度变化

在完全皮托管堵塞的情况下，当飞机在低空爬升时，空速基于堵塞时被困在皮托管内的恒定总压与当前随高度增加而减小的静压之间的差值错误计算。因此，当飞机爬升时，测得空速持续错误且越来越高估。

“TOTAL PITOT BLOCKAGE”模拟故障对爬升时空速计算影响的示例

TRAINING

使用双侧”总皮托管阻塞”故障场景：负面训练

同时双侧TOTAL PITOT BLOCKED故障是指在短时间内对2个皮托管（例如机长皮托管和副驾驶皮托管）引入TOTAL PITOT BLOCKED故障。

此故障场景会产生负面训练效果，不应按以下方式使用。

双侧”总皮托管阻塞”故障的影响

正常飞行控制律不恰当地保持激活状态，并使用错误但一致的空速信息

电气飞行控制系统（EFCS）持续监控3个ADR提供的空速信息。当3个ADR中任意一个提供的空速信息与另外两个不同时，EFCS将拒绝该ADR，该ADR将不再被EFCS系统使用。

在同时双侧TOTAL PITOT BLOCKED模拟故障的情况下，2个相应的ADR提供错误但一致的空速信息，而第三个ADR提供正确但唯一的空速信息。因此，EFCS交叉比较监控功能将拒绝正确的空速信息，保留两个错误但一致的空速。

因此，在整个不可靠空速事件期间，正常飞行控制律不恰当地保持激活状态，并基于错误的空速信息进行计算。

错误的计算空速增加以及高速保护的过度激活，直至高迎角保护激活

如果在起飞后低空对机长侧和副驾驶侧设置双侧TOTAL PITOT BLOCKED故障，当飞机爬升时，将导致机长侧和副驾驶侧提供的、被EFCS系统使用的空速出现一致且持续的高估。

因此，飞机保持在正常法则下，当这2个错误但一致的空速超过VMO/MMO时，高速保护将被过度激活。

高速保护因此被错误激活，并持续指令越来越大的抬头运动，飞行机组即使使用全推侧杆输入也无法抵消。

这导致真实的迎角（AoA）持续增加，最终将导致高迎角保护激活（因为高迎角保护优先级高于高速保护）。高迎角保护将指令飞机低头运动，只要AoA保持在高迎角保护激活阈值以上。

随后，要么飞机超过激活异常姿态飞行控制律的阈值，要么高速保护和迎角保护交替激活。当迎角再次降至高迎角保护激活阈值以下时，高速保护将再次激活，导致大幅度俯仰振荡。

双侧”TOTAL PITOT BLOCKAGE”模拟故障在爬升中的影响

造成负面训练的虚假场景

双侧 TOTAL PITOT BLOCKED 状态不切实际

在飞机爬升（下降）时，双侧同时发生皮托管阻塞导致空速永久且一致地增大（减小），并由此异常触发飞行包线保护功能——此类同时性双侧失效模式在服役中从未有过报告。

多个皮托管阻塞不可能恰好同时发生，也不可能在全程中保持完全一致的阻塞特性。这一点至关重要，因为多个皮托管阻塞必然会导致飞行控制系统探测到空速不一致，从而拒绝错误的空速信息及相关 ADR，并切换至备用法则。

此外，爬升全程中持续的双侧”TOTAL PITOT BLOCKED”故障无疑会给受训者造成困惑。它将从根本上干扰学员对以下方面的理解：飞机系统、飞行控制法则与飞行包线保护的工作原理，以及空数据失效的运行后果：

• 导致正常法则及相关保护在基于错误空速计算的情况下仍然保持激活状态。
• 导致高速保护异常激活。随之产生的无法控制且动态的飞机自动抬头是一种非常消极的物理体验。
• 导致高速保护与迎角保护以一种不切实际的替代方式激活，这不仅无法帮助理解保护功能的工作机制，反而会造成对保护功能运作方式的困惑。

培训

同样地，如果在飞机下降的高空阶段引入持续的双侧”TOTAL PITOT BLOCKED”故障，飞机仍会基于两个越来越被低估但保持一致的空速维持在正常法则中。尽管飞行机组看到的空速极低，但高迎角保护永远不会激活，因为迎角（正确地）保持在保护的激活阈值以下。

负面模拟机训练场景示例

飞机处于爬升状态。设置双侧总皮托管阻塞故障——同时作用于机长侧和副驾驶侧。

随着飞机爬升，错误的机长和副驾驶空速不断增加，直至达到 VMO/MMO 并触发超速警告。随后自动驾驶仪脱接，高速保护异常激活，飞机自动抬头，飞行机组尝试以最大前推侧杆输入进行对抗，但未能成功。为恢复正常状态，飞行机组被训练需要关闭两个 ADR 以切换至备用法则，然后手动控制飞机轨迹。

此类场景引出了以下问题：

有多少飞行员接受过此类训练？

如果参照我们收到的来自运营商的问题以及一篇发表于航空在线杂志的文章，《最近，我们得以进行不可控机头向上俯仰的培训，采用的措施——OEB48&49 中要求的那些——正是恢复控制所需的措施，这至少促使我们（迅速）思考需要关闭保护以重新获得控制权。》，那么很可能有许多飞行员曾接受过此类训练。

飞行机组在此情况下应如何反应？

速度不一致（ADR1、2、3 与备用指示之间）以及基本飞行参数之间的异常关联（例如空速增加而机头却有大幅上仰）组合在一起，即构成执行 QRH 中 UNRELIABLE AIRSPEED INDICATIONS（空速指示不可靠） 程序的条件。FCOM “UNRELIABLE AIRSPEED INDICATIONS” 章节提供了飞行机组必须牢记的潜在症状描述，以便能够及早识别这种情况并执行相应程序。

在上述训练场景示例中，面对不可靠空速状况，飞行机组始终处于被动状态。这属于负面训练。事实上，飞行员应接受训练以便在情况未按预期发展时主动采取行动，执行正确的程序。

飞行员在此场景中的体验如何？

此场景可能会在受训者心中造成困惑，因为它包含大量可能相互冲突的驾驶舱效应：不可靠空速指示、超速告警、高速保护激活、执行 OEB48/49 “异常 V Alpha 保护”紧急动作……

对潜在不可控飞机自动抬头俯仰的恐惧可能会深深烙印在受训者的记忆中。由此，将导致对高速保护和高迎角保护的完全信任丧失。

如何避免负面训练？

双“全皮托管阻塞”失效不得用于训练场景。

请勿在不可靠空速指示程序/超速/OEB48/49紧急动作之间制造混淆。

不切实际且触目惊心的场景会在很长时间内造成恐惧和信任丧失。

模拟机数据包更新

移除使用双全皮托管阻塞失效的可能性

基于上述原因，空客决定从模拟机中移除模拟双全皮托管阻塞的可能性。运营商需据此修改其模拟机。

单点全皮托管阻塞失效仍将可用。它可与其他类型的皮托管失效结合使用，以模拟多空速失效。可与空速通道故障或进口皮托管阻塞（或部分皮托管阻塞）结合使用。然而，应优先使用双“进口皮托管阻塞”。

进口皮托管阻塞：更真实的模拟失效

实际运营中遇到的大多数皮托管问题仅是皮托管进口堵塞。这通常是因冰晶导致的皮托管堵塞所发生的情况。

因此，如果您的模拟机上有进口皮托管阻塞（或部分皮托管阻塞）功能，建议使用它。

培训

进口皮托管阻塞失效

在皮托管进口堵塞的情况下，皮托管提供的压力将通过排水孔测量到的局部静压，而非全压。在这种情况下，空速将通过皮托管探头排水孔测得的压力与静压端口测得的压力之间的差值计算得出。因此，在进口堵塞发生时，测得的空速将急剧下降，并在进口堵塞持续期间保持较低值。

双进口皮托管阻塞可用作多空速失效的更真实场景。

如何创建正面训练？

空客建议按照循证培训的理念使用正面训练，并展示保护系统的有效性，以增强飞行机组对其的信心。

培训在其适当的时候才具有强大的力量。正因如此，在更新的运营培训传输（OTT）和/或其相关的飞行机组培训标准（FCTS）的支持下开发真实场景至关重要。

能力建立在知识、技能和态度之上，但飞行员对飞机系统的信任也至关重要。这种信心只能通过适当的培训来建立——这种培训能够正确复制实际飞机行为。

贡献者：

Panxika CHARALAMBIDES 事故/事故调查员 产品安全

Gilbert SAVARY

飞行运营支持与培训标准飞行员组负责人

“全皮托管阻塞”失效模拟皮托管探头进口和排水孔同时堵塞。使用双且持续性的“全皮托管阻塞”是一种在实际运营中从未遇到的非真实场景。它会导致不正常地保持正常法则及相关保护可用，而实际上这些法则是基于错误但一致的速度计算得出的。这显然会危及对飞机系统、飞行控制法则的理解，并可能改变对在此情况下错误运作的飞行包线保护功能的信任。

如果在爬升阶段模拟双且持续性失效，将产生高速保护的过度激活，并导致后续无法控制的飞机自动低头。

在这种情况下要求飞行机组关闭两个ADR以恢复备用法则的训练属于明显的负面训练。

因此，双“全皮托管阻塞”失效不得使用，空客已决定从模拟机中移除模拟此失效的可能性。

Safety first, #28 2019年6月。Safety first由空中客车公司出版 - 1, rond point Maurice Bellonte - 31707 Blagnac Cedex/法国。出版商兼编辑：Yannick Malinge，产品安全首席官。概念设计由空客多媒体工作室 20190588。参考编号：X00D16031905 第28期。照片来源：H. Goussé、Jing、P. Pigeyre。