Flight deck automation and flight control technology, coupled with
excellent systems reliability and redundancy, allow flight crews
to easily control their airplanes from takeoff to touchdown regardless
of outside visibility. However, if an anomaly occurs, the complex
systems that automate, control, and display information in modern
flight decks can produce erroneous or insufficient information.
When faced with the resulting uncertainties, flight crews must determine
what information is reliable and what information should not be
used in order to make the proper decisions.
Unfortunately, safety data show that not all flight crews have
satisfactorily handled situations caused by erroneous flight instrument
information. During the past 10 years, more than 300 accidents and
incidents have been reported as a result of erroneous flight deck
information, including problems with pitot-static probes and air
data computers. Several fatal accidents that involved erroneous
flight instrument information and six incidents resulting from lost
or erratic air data occurred in 1996 alone. Investigations of these
events indicate that, with proper preparation, the flight crews
involved in these events probably could have prevented them.
In addition to accident and incident case studies (see
below), examples of information that can help flight crews prepare
to react to such events include
instrument system design.
and static anomalies.
anomaly recognition and recovery techniques.
operations manual procedures.
1. FLIGHT INSTRUMENT
Compared to the number of commercial airplane departures each year,
the rate of instrument and system anomalies is very low. The fact
that they occur infrequently can contribute to the "startle"
factor flight crews experience, leaving them uncertain about how
to respond to the anomaly. In addition, as airplane systems have
evolved and become more complex, the amount of integrated flight
information they provide to flight crews increases. In general,
reliability and integrity have improved, but the number of system
functions and interactions has also increased. Technology has also
made it possible to offer more precise information to flight crews.
The evolution and underlying design principles of instrument systems
are discussed in the following chronology: pre-1967, 1969, 1982,
and 1994 to present.
Only captain and first officer primary flight instruments, but no
standby instruments, were installed on early Boeing commercial airplanes
The two artificial horizons (attitude indicators) are powered by
analog signals from remotely located vertical gyros. Both gyros
are lost if all the main airplane generators fail. Because of this,
the U.S. Federal Aviation Administration required a third, panel-mounted
gyro instrument to be installed in the center of the instrument
panel on later models. The third gyro is ac powered by a static
inverter that receives its dc power from the main airplane battery.
indicators and altimeters directly receive pitot and static pressure
information from left and right pitot probes and static pressure
from two pairs of flush-mounted static ports . These indicators
require electrical power only for lighting.
The altimeters and airspeed indicators were initially the same as
the all-pneumatic type used in the 707 but were shortly replaced
by a servo-pneumatic type (fig.
2). This type can operate in either of two modes: central air
data computer (CADC) mode or all-pneumatic (backup) mode.
and airspeed indicators were normally driven by analog signals from
their respective CADCs (fig. 1).
The CADC added compensation for static source errors; if they lost
power, however, the instruments reverted to the less precise, all-pneumatic
mode. This generation of airplanes also integrated the static ports
into pitot-static probes.
the 747-200 evolved to all-electrical air-data instruments driven
only by CADCs, with no pneumatic backup. At that time a third standby
airspeed indicator and altimeter were added. These additional standby
instruments were all-pneumatic and became the standard for all Boeing
airplanes designed after 1969 and before the 777 in 1994 (fig.
With the development
of inertial navigation systems (INS), a new source of information
for the captain and first officer attitude indicators was available.
The standby attitude indicator power source remained ac from an
inverter, powered by the airplane battery.
This generation was the first to use the cathode ray tube electronic
flight instrument system. The information for the attitude director
indicator (ADI) is supplied by the all-digital ring-laser INS. The
air data instruments remained round-dial type and all-electrical,
but they now received their information from digital air data computers
through digital data buses. Additionally, an airspeed tape became
available as an option on the electronic ADI. The standby attitude,
airspeed, and altimeter systems are the same as the earlier generation
design. Some later generation airplanes (e.g., the 767) use the
combined pitot and static probes and some (e.g., the 757) use flush-mounted
The primary source for attitude, airspeed, and altitude is the air
data inertial reference unit (ADIRU) (fig.
4). The attitude and air data signals are formatted for display
by the airplane information management system. The ADIRU design
differs from the traditional left-right system partitioning. The
ADIRU is a single, fault-tolerant, high-integrity data source for
both primary flight displays (PFD). The ADIRU uses multiple redundant
inertial sensors for computing attitude and also selects a best
altitude and airspeed from three pitot and static pressure sources.
As a result it provides a single set of data for both the captain
and first officer, eliminating cross-channel splits.
The pitot and
static pressures are measured by small air data modules (ADM) located
as close as possible to the respective pressure sources. The ADMs
transmit their pressures to the ADIRU through data buses. In the
highly improbable event that the ADIRU totally fails, a secondary
attitude air data reference unit (SAARU) provides comparable attitude
and air data to both PFDs. The SAARU also supplies standby attitude
directly to an electronic standby horizon instrument. The standby
airspeed indicator and altimeter, both electronic, receive pitot
and static pressure from the standby ADMs. This design ensures that
displayed data are immune to any first and most second failures
of their respective sensors or pressure probes.
PITOT AND STATIC ANOMALIES
Notwithstanding numerous improvements, the pitot probes and static
ports remain critical sources for flight deck information. It is
vital to protect these sources from contamination and prevent the
consequences of a blocked pitot or static system. Both sources are
used for multiple flight deck indications, such as displayed altitude
and displayed airspeed.
is directly related to static pressure, corrected for the current
barometric setting. At sea level, for each inch of mercury decrease
in static pressure, altitude increases roughly 1,000 ft. In contrast,
displayed airspeed is related to the difference between total pressure
and static pressure (Pt - Ps).
This difference, called dynamic pressure, roughly increases with
the square of the airspeed; that is, as the airspeed doubles, the
dynamic pressure quadruples.
two scenarios demonstrate the effect on displayed altitude and airspeed
during takeoff and climb if the flight crew receives faulty sensed
plugged pitot probes.
plugged static pressure ports.
Completely plugged pitot probes.
If the pitot probe is plugged, its sense line likely contains air
trapped at a pressure equal to that of the field elevation static
pressure. During the takeoff roll, therefore, the sensed dynamic
pressure remains zero and the airspeed instrument remains pegged
at its lower stop. If the flight crew does not reject the takeoff,
the pitot pressure remains plugged at field-elevation pressure as
the airplane climbs, but the static pressure begins to drop. The
altimeter operates almost correctly during the climb. However, the
resulting sensed dynamic pressure causes the airspeed indicator
to come alive seconds after liftoff. Regardless of the actual climb
speed of the airplane, the faulty airspeed indication continues
to increase as altitude increases, until the airspeed catches up
to the correct value. The indicated airspeed continues to increase
through the correct value as the airplane climbs. The VMO
speed can appear to be exceeded. Additionally, an overspeed warning
can be triggered. If the pilot flying trusts the faulty airspeed
indicator because of the temptation early in the climb to believe
that some movement means the indicator has begun to operate normally,
the pilot flying is in grave danger of increasing pitch, reducing
thrust, or both to reduce the erroneous indicated airspeed. This
could cause the airplane to exceed its stall angle of attack, though
the stall warning system, which is driven by angle of attack, should
continue to function normally.
plugged static pressure ports.
During the takeoff roll, both the altimeter and the airspeed indicator
operate correctly. After liftoff, assuming the trapped static pressure
is that of the field elevation, the altimeter indication remains
at the field elevation. With respect to airspeed, the sensed dynamic
pressure fails to increase as rapidly as it should during climb
because of the trapped static pressure. Therefore, if the airplane
actually climbs at a constant speed, the airspeed indication decays,
reaching the lower end indication. If the captain relies on the
airspeed indicator for proper information, the typical response
will be to reduce the pitch attitude to maintain the erroneous airspeed,
possibly causing the airplane to exceed its airspeed limitations.
Complicating this situation is the fact that the overspeed warning
does not operate if connected to the same erroneous airspeed source.
of the pitot or static systems rarely occurs. However, many anomalies
are associated with partial blockages of parts of the systems. Incident
and accident reports identified several reasons for these anomalies,
- Pitot probe
covers not removed.
- Pitot or static
- Hoses leaking.
- Water trapped
- Pitot probes
blocked by volcanic ash.
- Radome damaged.
- Airplane icing.
- Static ports
covers not removed.
- Pitot probes
or static ports blocked by insects.
The ability to
predict the effects of a partial blockage is hindered when anomalies
occur during different phases of flight, the amount of blockage
differs, or blockage corrects or appears to correct itself. Tables
1 and 2 describe what flight deck information is or is not reliable
during pitot or static system anomalies. The information is not
SYSTEM ANOMALY RECOGNITION AND RECOVERY TECHNIQUES
Regardless of the nature of erroneous flight instrument indications,
some basic actions are key to survival. The longer erroneous flight
instruments are allowed to cause a deviation from the intended flight
path, the more difficult recovery will be. Some normal procedures
are designed, in part, to detect potential problems with erroneous
flight instruments to avoid airplane upsets. Examples are the 80-kn
call on takeoff and callouts for bank angle exceedances. In some
cases the flight crew may need to recover the airplane from an upset
condition: unintentional pitch greater than 25 deg nose high or
10 deg nose low, bank angle in excess of 45 deg, or flying at airspeed
inappropriate for conditions. As the condition deteriorates, it
becomes more dynamic and stressful. This stress increases the difficulty
flight crews experience in determining, believing, and adjusting
to using the correct instruments and ignoring the faulty instruments.
Regardless of the situation, good communication between crewmembers
is essential, and several basic actions are paramount:
an unusual or suspect indication.
- Keeping control
of the airplane with basic pitch and power skills.
- Taking inventory
of reliable information.
- Finding or
maintaining favorable flying conditions.
- Getting assistance
- Using checklists.
Recognizing an unusual or suspect indication.
A crewmember should advise the other crewmember immediately if a
problem is suspected. Crewmembers should confirm indications by
cross-checking instruments with each other to identify which instruments
are reliable, including standby instruments, inertial data, and
radio altimeter data. Both crewmembers should be suspicious of each
otherís instruments while together confirming the operating instruments.
Crewmembers should maintain the standard callouts normally used
and organize subsequent callouts to take into account instrument
scan changes and diminished capability.
of the airplane with basic pitch and power skills.
Maintaining reasonable airplane control with normal pitch and power
settings is the most important and fundamental activity when confronted
with erroneous flight instruments. All troubleshooting should be
done later. Crewmembers should cross-check all attitude instruments
for accuracy, and set wings level with pitch and thrust appropriate
for the desired flight conditions. If in descent when the anomaly
occurs, the pilot flying should arrest descent and level off or
climb to a safe altitude. If a climb is desired, the pilot flying
should set a nominal pitch attitude and power setting that will
sustain the climb. If a turn is necessary because of hazards, the
crew should first cross-check all indications, remember INS heading,
and turn to a heading that allows for vertical deviations. These
basic steps should create valuable time needed to correctly interpret
erroneous flight information.
inventory of reliable information.
Standard pitch and power settings for common phases of flight are
described in the operations manual. They should be noted during
training and normal flight segments, especially if a crewmember
is new to an airplane type. If confronted with unreliable instruments,
crewmembers should err on the safe side. For example, they should
opt for a shallower climb and some excess speed rather than risk
approaching a stall condition. The crew should also use other airplane
speed clues that provide additional information about the speed
situation, such as high-speed flap rumble, airplane buffeting, airspeed
noise, and engine power. Opposing clues could also be present; in
two of the accidents discussed in the sidebar, the crew experienced
simultaneous stick shaker with buffeting and overspeed warnings.
This can be confusing until pitch and power are assessed and the
situation is better understood. An 8- to 10-deg pitch at a medium
altitude with appropriate climb thrust setting could provide a solution
for these confusing situations. All crewmembers should be familiar
with the unreliable airspeed charts and what is recommended in typical
phases of flight.
or maintaining favorable flying conditions.
One of the historic keys to success in situations caused by erroneous
flight information is finding daylight visual conditions. No accidents
involving unreliable airspeed on large commercial airplanes have
occurred when their crews managed to find or remain in daylight
visual conditions. Penetration into instrument meteorological conditions
greatly increases the potential for a controlled flight into terrain
accident; get visual and stay visual, if possible. If this is not
possible, the crew should climb and proceed to good weather. Good
instrument approach facilities and familiarity with the airport
are not good substitutes for visual conditions. Accidents have occurred
with many hours of fuel on board because the flight crew tried to
return to the departure airport under instrument conditions. Attempts
at nighttime approaches and landings, such as that in the 1996 accident
in Lima, Peru (see below), increase problems
and the complexity of the return. Daylight visual conditions help
considerably when dealing with control issues. The crew should seek
a minimal degree of difficulty during descent, approach, and landing.
If it is necessary to fly several hours to achieve visual conditions,
the crew should do so.
assistance from others.
After maintaining control with pitch and power and having a plan
for daylight visual conditions, the crew should seek help from air
traffic control (ATC). Most ATC facilities have groundspeed readouts
and general knowledge of the winds. With access to wind information
from ATC, other nearby airplanes, or forecast or reported data,
it is possible to determine true airspeed, which should be close
to indicated airspeed below 5,000 ft elevation. Unfortunately, most
radar systems rely on airplane transponders for airplane altitude
data, and airplane transponders use the airplane altimeter as a
source for this information. Therefore, if the airplane altimeter
is unreliable, ATC receives erroneous information from the transponder.
This fact was not understood in the accident in Peru and contributed
significantly to the confusion. For vertical planning purposes,
ATC can assist in maintaining headings away from such hazards as
high terrain. In the right circumstances and conditions, other airplanes
may be able to fly close enough to assist with approximate altitude
and airspeed, another reason to seek daylight visual conditions.
Company dispatch may be able to help with emergency coordination,
weather information, and technical assistance.
Before beginning an approach, it is important to assess the instruments.
The crew should not trust instruments that previously provided suspect
information; an intermittent problem or condition may make it appear
to be normal. Relying on instruments that are suspect or that have
failed has led to hull loss. The crew should discuss the cross-check
to be used and what assistance is expected from the pilot not flying.
They should identify alternatives for backup in case of future confusing
indications. They should also go to the checklist and review items
related to the problem, then create and test a plan. Sometimes a
practice approach at a reasonable altitude will provide information
on instrument accuracy and airplane controllability.
SPECIFIC OPERATIONS MANUAL PROCEDURES
When the airplane
can be controlled using pitch and power, flight crews can use available
checklists to provide critical information. Boeing provides tables
for unreliable airspeed in either the Quick Reference Handbook (QRH)
or volume 3 of the operations manual. These tables give pitch and
power targets for climb, cruise, descent, holding, terminal area
maneuvering, and final approach. Crewmembers should become familiar
with the location and use of these tables to allow for quick and
accurate reference if necessary.
airspeed procedures supplied in the nonnormal section of the QRH
have been expanded significantly for the 747-400, 757, and 767 and
will eventually be expanded for other current-production models.
The procedures contain a reference to indications, which can be
individual discrete indications or engine indication and crew alerting
system (EICAS) messages that basically point out the evidence of
unreliable airspeed/Mach. Other examples of this evidence are provided
in the QRH, such as
- Speed or altitude
information not consistent with pitch attitude and thrust setting.
- Blank or fluctuating
between captain and first officer airspeed displays.
- Amber line
through one or more PFD or ADI flight mode annunciations.
overspeed and stall warnings.
777 system is a complex design that addresses these malfunctions.
With only one bad source or failure, the system automatically switches
away from that source, and the crew will not notice any difference.
This was a primary goal of nonnormal checklists when evaluating
the situation on earlier generation airplanes. With multiple erroneous
sources or internal failures on the 777, the EICAS message NAV AIR
DATA SYS is displayed. The checklist for this message provides the
appropriate crew actions and directs the crew to the unreliable
The next portion
of the checklists contains the recall items, beginning with pitch
attitude and thrust check. This item tells flight crews to check
all attitude instruments and thrust levels to determine which are
working properly if they are not normal for the phase of flight.
If they are not normal, the next step is to positively disengage
the autopilot and autothrottles. The flight directors should also
be turned off to avoid the distraction of erroneous commands. At
that point, establish normal pitch attitude and thrust. These are
recall steps because it is important to first check attitude instruments
and thrust levels. A delay in recognizing a problem and taking corrective
action could result in loss of airplane control.
crews should be aware of the approximate body attitude and thrust
for each flight maneuver. This awareness results from a deliberate
action to observe pitch and power indications during normal flight
operations. Crews can then use tables in the QRH or operations manual
to refine pitch and power when time permits. Only after maintaining
airplane control should crews determine which instruments are giving
false indications. Crews should seek reliable data sources, which
can be quite difficult to find sometimes; situations can occur where
bad instruments look valid and seemingly good indications appear
faulty. Partial blockages or intermittent failures can also create
difficulty, requiring the flight crew to select a different air
data source on some airplanes. The airplane systems can also provide
conflicting warnings, such as an invalid overspeed warning or invalid
inputs to flight directors and autothrottles, and respond undesirably.
Checklist guidance is given for airspeed differences where indications
can be considered unreliable. These different airspeed readings
can vary between models because of system tolerances.
for landing, take into account alternative sources of information
and limitations. Radio altitude is an independent source of altitude
information and is available below 2,500 ft above ground level.
Basic ground proximity warning system (GPWS) warnings should be
considered valid. Look-ahead (terrain avoidance warning systems),
such as enhanced GPWS (EGPWS), should be suspect because the terrain
database alerting warning system uses barometric altitude, which
can be unreliable. In the near future, improvements in EGPWS capability
using a concept called geometric altitude may overcome barometric
altitude system malfunctions. Airspeed judgments may be possible
using a combination of IRS groundspeed and reported winds during
the approach. Global positioning systems can also provide accurate
groundspeed readouts. Raw data from ground-based navigation aids
is available. It is preferable to maintain visual conditions, establish
landing configurations early, and use electronic and visual glide
slope indicators for approach and landing.
accidents related to erroneous flight instrument information
have occurred. These accidents likely happened despite system
reliability, redundancy, and technological advances that have
improved on the capabilities of earlier generation airplanes.
In addition, the flight instruments on newer airplanes provide
more information to flight crews during flight, and that information
is more precise. However, the fact that flight crews are seldom
confronted with erroneous flight instrument information contributes
to these accidents. To overcome the potential problems associated
with infrequent failures and increased system complexity, flight
crews should follow the piloting techniques provided in this
article and the guidance provided in operation manuals when
facing an air data anomaly. Recovery techniques and other procedures
are also available for flight crews to consider when confronted
with erroneous flight instrument information.
AND INCIDENT CASE STUDIES
flight information such as the many and varied symptoms of
pitot-static anomalies can confuse an unprepared flight crew.
Because of the confusion caused by multiple and sometimes
conflicting alerts and warnings, the flight crew may not recognize
an air data error and may fail to respond appropriately. The
following accidents and incidents show what can happen when
a crew is confronted with unreliable or erroneous flight information.
- In December
1974, a Boeing 727 crashed 12 min after takeoff while on
a positioning flight from Buffalo, New York, in the United
States. Three crewmembers were killed and the airplane was
destroyed. The U.S. National Transportation Safety Board
(NTSB) determined that the probable cause of the accident
was flight crew failure to recognize and correct the airplaneís
high angle of attack and low speed stall. The stall was
precipitated by the crewís reaction to erroneous airspeed
indications caused by atmospheric icing blockage of the
pitot probe. The pitot heat switch had not been turned to
the ON position.
- In April
1991, the crew on a large corporate jet survived the following
incident. On the previous leg, the captainís airspeed/Mach
indicator and the standby airspeed/Mach indicator were erratic.
The ground crew was unable to duplicate the problem. The
next leg was at night in visual conditions. It was uneventful
until the crew observed the first officerís airspeed/Mach
indicator begin an uncommanded increase as the airplane
climbed through FL310. Passing FL330, the captainís airspeed
remained steady, but the first officerís airspeed pointer
exceeded "barber pole," and the high-speed aural
clacker activated. The autothrottles were disconnected,
and at that point the captainís airspeed indicator began
to show a decrease in airspeed that coincided with the standby
airspeed/Mach indicator. Because of problems reported on
the previous leg, the crew assumed that the captainís instruments
were faulty. As the first officerís airspeed/Mach indicator
kept increasing, the crew pulled the power back to silence
the clacker, but the first officerís airspeed continued
to increase and the captainís airspeed indicator continued
to decrease. The airplane began to shake, which the crew
assumed was high-speed Mach tuck. At FL340, the pitch was
increased and stick shaker activated. The crew suddenly
realized that they were entering a stall. While performing
stall recovery procedures, they experienced severe vertigo,
spatial disorientation, and confusion over determining the
actual airspeed. Though the clacker was still sounding,
fuel flow, attitude, and N1
were calculated for descent. Appropriate checklists were
run and the circuit breakers were pulled to silence the
clacker. Using calculated attitude and power settings, a
descent, instrument landing system approach, and uneventful
landing were accomplished. Maintenance later confirmed that
the first officerís central air data computer had failed.
- In February
1996, a Boeing 757 crashed after takeoff from the International
Airport of Puerto Plata, Dominican Republic. After climbing
through 7,300 ft, the airplane descended until it crashed
into the Atlantic Ocean about 5 mi off the coast of the
Dominican Republic. All 189 people on board were killed,
and the airplane was destroyed. Data from the cockpit voice
recorder (CVR) and flight data recorder (FDR) indicate that
the airspeeds displayed to the captain during the takeoff
roll were incorrect and that the captain was aware of this
during the takeoff roll. Nevertheless, the captain decided
to continue the takeoff, and the first officer notified
the captain when the airplane reached V1
and Vr. Shortly after
takeoff, the captain commented that his airspeed indicator
had begun to operate, even though it indicated unrealistic
airspeeds. A normal climbout ensued, and the captain engaged
the center autopilot. During the climb, at an altitude of
4,700 ft, RUDDER RATIO and MACH/SPD TRIM advisory messages
appeared on the engine indication and crew alerting system
display unit. For the next several minutes, the crewmembers
discussed the significance of these advisory messages and
expressed confusion about the airspeed. At an altitude of
about 7,000 ft, the captainís airspeed indicator showed
350 kn, and an overspeed warning occurred, immediately followed
by activation of the stall warning system stick shaker.
Flight crew confusion about appropriate airspeed, thrust
setting, and proper pitch attitude was evident as the airplane
stalled, descended, and then crashed. The erroneous readings
from the captainís airspeed indicator are consistent with
a blocked pitot tube. Comments by the first officer recorded
on the CVR suggest that his pitot probe was not obstructed,
and he was seeing correct airspeed indications on his display.
- In October
1996, a Boeing 757 crashed into the Pacific Ocean about
30 mi off the coast of Lima, Peru. The flight crew declared
an emergency immediately after takeoff because of erroneous
airspeed and altitude indications and was attempting to
return to Lima when the accident occurred. Data from the
CVR and FDR revealed that the airspeed and altitude readings
were normal during the takeoff roll. However, as the airplane
began to climb, the flight crew noticed that the airspeed
indications were too low and the altitude indications were
increasing too slowly. Shortly after takeoff, the windshear
warning activated, despite calm wind conditions and no significant
weather activity. The flight crew declared an emergency
and expressed confusion about the airplaneís airspeed and
altitude displays. Analysis of FDR data indicates that the
airplane subsequently climbed to a maximum altitude of approximately
13,000 ft. When the airplane descended, the captainís altitude
and airspeed displays were still erroneous, but at that
point they indicated higher-than-actual conditions. During
descent, the first officerís displayed airspeed slowed to
the point of stall warning stick shaker activation. Meanwhile,
the captainís airspeed read over 350 kn, and the overspeed
warning was sounding. Flight crew confusion about airspeed
and altitude was evident as the airplane continued its final
descent. At impact into the Pacific Ocean, the captainís
flight instruments were reading approximately 9,500 ft and
450 kn. The erroneous indications recorded by the FDR are
consistent with a partial blockage of the captainís static
lessons emerged from the investigations of these events. First,
the effects of flight instrument anomalies appear during or
immediately after takeoff. Second, flight crews must overcome
the startle factor associated with rare anomalous events and
immediately begin to implement specific corrective procedures
and techniques. Finally, flight crews should acquire enough
system knowledge to be able to determine the difference between
valid and faulty display information.
FLIGHT OPERATIONS SAFETY
BOEING COMMERCIAL AIRPLANES GROUP
FLIGHT OPERATIONS SAFETY
BOEING COMMERCIAL AIRPLANES GROUP
BOEING COMMERCIAL AIRPLANES GROUP