This is quite a problem. The loss of the autopilot is a serious issue anyway and the loss of the autopilot in an RVSM aircraft is much worse because it cannot be legally flown by hand at RVSM levels. You may have two G600s installed but the Garmin STC does not allow more than one of them to drive the autopilot, so if you lose one you have a problem; there is no backup.
I don’t think this TBM had envelope protection. It was an early TBM850, non-G1000, fitted with two G600s, and probably still having the KFC325 autopilot which was fitted to all the earlier TBMs.
This discussion is a great reminder why airplanes with steam gauges may be the much better solution for GA than fancy EFIS which start failing due to a relatively benign error point.
Loss of airspeed in today’s airliners almost always cause severe incidents up to crashes. Nice example was the recent exploits of a S7 A321 which took off in Madagan and had to handfly 4 hours to Irkutsk after they did not de-ice properly and got their airspeeds into a twist when water leaked from the windshields onto the probes. This kind of thing is when protections turn into enemies. Kakophonic alarm sounds which can’t be silences plus protections which will wrestle the control from you are a massiv danger in this environment. And seeing how some pilots even defend this is a bit of a Stockhom syndrome.
The fact that some PFD’s simply fail if one out of serveral inputs such as IAS fails is unacceptable in my view and I regard it as wrong that these avoinics got certified this way. Aspen has corrected this with the Max, but actually should upgrade all units for free, as a simple one failure point puts you into a much worse situation than in a 1960ties steam cockpit where you simply carry on.
The ideal solution would be to get 3 IAS Sources, like most airliners have, all of which completely isolated from each other. 3 because if one fails, you get a majority of 2 to show correct. Same goes for Attitude indicators. Same goes for altitude. But of course, this is not feasible in many GA planes. Also what would be helpful is an independent AOA indication.
I’ve tried to sort it in my plane which has the original Aspen by a) having a vaccum horizon as a backup and b) a Dynon D1 as a further backup. If I loose airspeed, I have the vaccum horizon plus the Dynon to replace the Aspens attitude information. If I loose static (and with it altitude) I have the Dynon plus the GNS430 showing GPS altitude.
As for IAS, @PilotDAR is absolutely right, all that really can replace IAS is flying and feeling out the airplane.
I know someone who bought a Commander 115 (quite rare in Europe) from a long haul airline pilot. It had five attitude indicators, not sure if it met @Mooney_Driver level of redundancy but it was a nice aircraft.
Mooney_Driver wrote:
This discussion is a great reminder why airplanes with steam gauges may be the much better solution for GA than fancy EFIS which start failing due to a relatively benign error point.
Not sure if I agree:
Related to Autopilots, I’m not a ware of a single “steam gauge” GA autopilot that can switch between two independent attitude references. Therefore loss of the attitude reference driving the AP is always causing a loss of the AP. For all other instruments the “digital” solution is typically more reliable in the first place, an error is typically easier to identify (one of biggest risk with “steam gauges” is that you follow an indication that looks right but is wrong) and redundancy is typically cheaper to achieve.
Yes, the “unusual failure modes” are a risk, but they are exactly that: unusual. If you had flown with EFIS for 40 years and now would be behind a steam panel with unreliable altitude information, would you really think about breaking the glas would change something? For sure not if you are not used/trained to it.
Therefore the risk associated with EFIS is not so much the technology but more us pilots who naively think “it is all the same but electronic”. A very careful familiarization with the failure modes and potential remedies is absolutely required for every new piece of avionics.
And I assume that questions “if you loose GPS, what else do you loose in your panel” is absolutely standard in any proficiency check.
And I assume that questions “if you loose GPS, what else do you loose in your panel” is absolutely standard in any proficiency check
The problem is mostly a pilot one, it can be sorted while playing in X-Plane with another guy putting emergencies, it’s worth understanding all failure modes but it’s unhealthy to get swamped with backups redundancies without clear thinking process, in emergencies things has to stay simple (plus one has to accept huge degradation in instrument flying accuracy)
How ready you are “to survive” hand flying on turn coordinator, compass, handheld horizon, radio, moving map? I am not talking about flying ILS200 or RVSM to 0.1nm & 10ft, just being able to walk away from it
The other things is people put all their trust in some rather very marginal engineering, they lose sight of the fact that under that smooth reassuring facade of avionics, they are still putting themselves and family lives on mercy of that marginal design and install, then become complacent and probably take more risk than they can handle when the system fails….
The first thing FO in AF447 said when St Elmo flash hit their screens and O3 smell on dark night IMC before getting into turbulence, “heureusement que c’est un A330…on a pourtant les moteurs” (an automated aircraft with powerful engines seems to reassure more, go figure!)
It had five attitude indicators, not sure if it met @Mooney_Driver level of redundancy but it was a nice aircraft.
The Q is whether any of them were inter-dependent, and whether more than one could drive the autopilot.
For example I have two Sandel EHSIs which can be switched to a “reversionary AI” mode, but they both work from the same ARINC429 pitch and roll data from the SG102 AHRS. Nothing prevents you installing two SG102s but very few people will do that especially as there is no legal way to drive an AP from this data.
I’m not a ware of a single “steam gauge” GA autopilot that can switch between two independent attitude references.
Legally that may be true but only because nobody can be bothered to certify a change to the AP AFMS comprising of a “switch”. I have spoken to various people in the business about this. None could be bothered and the result of this attitude is that the whole avionics scene has been handed to Garmin on a dinner plate. And still there is no solution, a GFCx00 will still stop working if you lose “airdata”, or pitch and roll specifically.
Technically it is absolutely possible.
Presumably if you have 2 × IFD540/550 then you lose nothing because these boxes are not “PFDs”?
The key to avoiding this mess is to not have the AP pitch/roll source using any form of airdata. So how does the TBM G600 installation manage to mess this up?
Peter wrote:
The key to avoiding this mess is to not have the AP pitch/roll source using any form of airdata. So how does the TBM G600 installation manage to mess this up?
Might be that the term “air data” is a bit ambiguous in that context: The Garmin GAD43 is not an airdate computer but more of a universal (autopilot) interface providing the required data for the AP – esp. including the conversion from the digital AHRS data to the analogue signals the AP needs.
If the GAD breaks, the AP loses its entire data input in a G600 installation – it’s like if the AP-Computer itself fails.
Yes.
I reckon what Garmin did is they have either bought-in or built an AHRS module. This outputs pitch/roll/yaw (heading) data via some serial stream, which knowing Garmin may be CAN. They would not use ARINC429 for internal use, especially if they want to stop others building compatible interfaces (ARINC429 is pretty well documented and leaves an anticompetitive player little scope for proprietary hacks; they would probably have to use one of the standard packets and then encrypt the payload which is typically a ~24 bit integer).
And the GAD43 converts this serial stream into an LDVT emulation; the KI256 contains an LVDT for pitch and an LVDT for roll, and if you can emulate these, which is hardly rocket science for anybody good in analog electronics, you can emulate a KI256 (well there is the flight director to do also, plus the display of the “horizon”, which is trivial if the product has a colour LCD on the front, say 256×256 pixels).
And I think Aspen did the same, with the EA100 (which according to UK’s then biggest avionics shop packs up regularly). The avionics business has people moving around and the same people pop up in different places and approach problems the same way – even if it is crap (e.g. the Eaton pressure switch in retractables) 
That TBM incident showed a “GAD43 fault” and a “loss of TAS” fault. The GAD43 is a complicated box with enough connector pins to fill a long IM, so maybe the GAD43 fault was caused by some lack of input to it.
Nice example was the recent exploits of a S7 A321 which took off in Madagan and had to handfly 4 hours to Irkutsk after they did not de-ice properly and got their airspeeds into a twist when water leaked from the windshields onto the probes
How exactly did that happen? Sounds like a humongous design flaw to me.
LeSving wrote:
How exactly did that happen? Sounds like a humongous design flaw to me.
Still investigating, but allegedly the wrong (cheaper) type of deicing fluid was used, so the aircraft was already not OK during the takeoff.
