Graphic Home Page

Text Only Home Page

Bob McArthur

Deicing/Anti-Icing

Human Factors

Erroneous Flight Instruments

Reader Survey

About Aero

Archives

Search

Field Service

In addition to accident and incident case studies (see below), examples of information that can help flight crews prepare to react to such events include

1. Flight instrument system design.
2. Pitot and static anomalies.
3. System anomaly recognition and recovery techniques.
4. Specific operations manual procedures.

1. FLIGHT INSTRUMENT SYSTEM DESIGN
Compared to the number of commercial airplane departures each year, the rate of instrument and system anomalies is very low. The fact that they occur infrequently can contribute to the "startle" factor flight crews experience, leaving them uncertain about how to respond to the anomaly. In addition, as airplane systems have evolved and become more complex, the amount of integrated flight information they provide to flight crews increases. In general, reliability and integrity have improved, but the number of system functions and interactions has also increased. Technology has also made it possible to offer more precise information to flight crews. The evolution and underlying design principles of instrument systems are discussed in the following chronology: pre-1967, 1969, 1982, and 1994 to present.

Pre-1967.
Only captain and first officer primary flight instruments, but no standby instruments, were installed on early Boeing commercial airplanes (fig. 1). The two artificial horizons (attitude indicators) are powered by analog signals from remotely located vertical gyros. Both gyros are lost if all the main airplane generators fail. Because of this, the U.S. Federal Aviation Administration required a third, panel-mounted gyro instrument to be installed in the center of the instrument panel on later models. The third gyro is ac powered by a static inverter that receives its dc power from the main airplane battery.

The airspeed indicators and altimeters directly receive pitot and static pressure information from left and right pitot probes and static pressure from two pairs of flush-mounted static ports. These indicators require electrical power only for lighting.

1969.
The altimeters and airspeed indicators were initially the same as the all-pneumatic type used in the 707 but were shortly replaced by a servo-pneumatic type (fig. 2). This type can operate in either of two modes: central air data computer (CADC) mode or all-pneumatic (backup) mode.

The altimeters and airspeed indicators were normally driven by analog signals from their respective CADCs (fig. 1). The CADC added compensation for static source errors; if they lost power, however, the instruments reverted to the less precise, all-pneumatic mode. This generation of airplanes also integrated the static ports into pitot-static probes.

Eventually, the 747-200 evolved to all-electrical air-data instruments driven only by CADCs, with no pneumatic backup. At that time a third standby airspeed indicator and altimeter were added. These additional standby instruments were all-pneumatic and became the standard for all Boeing airplanes designed after 1969 and before the 777 in 1994 (fig. 3).

With the development of inertial navigation systems (INS), a new source of information for the captain and first officer attitude indicators was available. The standby attitude indicator power source remained ac from an inverter, powered by the airplane battery.

1982.
This generation was the first to use the cathode ray tube electronic flight instrument system. The information for the attitude director indicator (ADI) is supplied by the all-digital ring-laser INS. The air data instruments remained round-dial type and all-electrical, but they now received their information from digital air data computers through digital data buses. Additionally, an airspeed tape became available as an option on the electronic ADI. The standby attitude, airspeed, and altimeter systems are the same as the earlier generation design. Some later generation airplanes (e.g., the 767) use the combined pitot and static probes and some (e.g., the 757) use flush-mounted static ports.

1994 to present.
The primary source for attitude, airspeed, and altitude is the air data inertial reference unit (ADIRU) (fig. 4). The attitude and air data signals are formatted for display by the airplane information management system. The ADIRU design differs from the traditional left-right system partitioning. The ADIRU is a single, fault-tolerant, high-integrity data source for both primary flight displays (PFD). The ADIRU uses multiple redundant inertial sensors for computing attitude and also selects a best altitude and airspeed from three pitot and static pressure sources. As a result it provides a single set of data for both the captain and first officer, eliminating cross-channel splits.

The pitot and static pressures are measured by small air data modules (ADM) located as close as possible to the respective pressure sources. The ADMs transmit their pressures to the ADIRU through data buses. In the highly improbable event that the ADIRU totally fails, a secondary attitude air data reference unit (SAARU) provides comparable attitude and air data to both PFDs. The SAARU also supplies standby attitude directly to an electronic standby horizon instrument. The standby airspeed indicator and altimeter, both electronic, receive pitot and static pressure from the standby ADMs. This design ensures that displayed data are immune to any first and most second failures of their respective sensors or pressure probes.

2. PITOT AND STATIC ANOMALIES
Notwithstanding numerous improvements, the pitot probes and static ports remain critical sources for flight deck information. It is vital to protect these sources from contamination and prevent the consequences of a blocked pitot or static system. Both sources are used for multiple flight deck indications, such as displayed altitude and displayed airspeed.

Displayed altitude is directly related to static pressure, corrected for the current barometric setting. At sea level, for each inch of mercury decrease in static pressure, altitude increases roughly 1,000 ft. In contrast, displayed airspeed is related to the difference between total pressure and static pressure (Pt - Ps). This difference, called dynamic pressure, roughly increases with the square of the airspeed; that is, as the airspeed doubles, the dynamic pressure quadruples.

The following two scenarios demonstrate the effect on displayed altitude and airspeed during takeoff and climb if the flight crew receives faulty sensed pressure readings:

• Completely plugged pitot probes.
• Completely plugged static pressure ports.

Completely plugged pitot probes.
If the pitot probe is plugged, its sense line likely contains air trapped at a pressure equal to that of the field elevation static pressure. During the takeoff roll, therefore, the sensed dynamic pressure remains zero and the airspeed instrument remains pegged at its lower stop. If the flight crew does not reject the takeoff, the pitot pressure remains plugged at field-elevation pressure as the airplane climbs, but the static pressure begins to drop. The altimeter operates almost correctly during the climb. However, the resulting sensed dynamic pressure causes the airspeed indicator to come alive seconds after liftoff. Regardless of the actual climb speed of the airplane, the faulty airspeed indication continues to increase as altitude increases, until the airspeed catches up to the correct value. The indicated airspeed continues to increase through the correct value as the airplane climbs. The VMO speed can appear to be exceeded. Additionally, an overspeed warning can be triggered. If the pilot flying trusts the faulty airspeed indicator because of the temptation early in the climb to believe that some movement means the indicator has begun to operate normally, the pilot flying is in grave danger of increasing pitch, reducing thrust, or both to reduce the erroneous indicated airspeed. This could cause the airplane to exceed its stall angle of attack, though the stall warning system, which is driven by angle of attack, should continue to function normally.

Completely plugged static pressure ports.
During the takeoff roll, both the altimeter and the airspeed indicator operate correctly. After liftoff, assuming the trapped static pressure is that of the field elevation, the altimeter indication remains at the field elevation. With respect to airspeed, the sensed dynamic pressure fails to increase as rapidly as it should during climb because of the trapped static pressure. Therefore, if the airplane actually climbs at a constant speed, the airspeed indication decays, reaching the lower end indication. If the captain relies on the airspeed indicator for proper information, the typical response will be to reduce the pitch attitude to maintain the erroneous airspeed, possibly causing the airplane to exceed its airspeed limitations. Complicating this situation is the fact that the overspeed warning does not operate if connected to the same erroneous airspeed source.

Total blockage of the pitot or static systems rarely occurs. However, many anomalies are associated with partial blockages of parts of the systems. Incident and accident reports identified several reasons for these anomalies, including

• Pitot probe covers not removed.
• Pitot or static hoses disconnected.
• Hoses leaking.
• Water trapped in lines.
• Pitot probes blocked by volcanic ash.
• Radome damaged.
• Airplane icing.
• Static ports covers not removed.
• Pitot probes or static ports blocked by insects.

The ability to predict the effects of a partial blockage is hindered when anomalies occur during different phases of flight, the amount of blockage differs, or blockage corrects or appears to correct itself. Tables 1 and 2 describe what flight deck information is or is not reliable during pitot or static system anomalies. The information is not model specific.

3. SYSTEM ANOMALY RECOGNITION AND RECOVERY TECHNIQUES
Regardless of the nature of erroneous flight instrument indications, some basic actions are key to survival. The longer erroneous flight instruments are allowed to cause a deviation from the intended flight path, the more difficult recovery will be. Some normal procedures are designed, in part, to detect potential problems with erroneous flight instruments to avoid airplane upsets. Examples are the 80-kn call on takeoff and callouts for bank angle exceedances. In some cases the flight crew may need to recover the airplane from an upset condition: unintentional pitch greater than 25 deg nose high or 10 deg nose low, bank angle in excess of 45 deg, or flying at airspeed inappropriate for conditions. As the condition deteriorates, it becomes more dynamic and stressful. This stress increases the difficulty flight crews experience in determining, believing, and adjusting to using the correct instruments and ignoring the faulty instruments. Regardless of the situation, good communication between crewmembers is essential, and several basic actions are paramount:

• Recognizing an unusual or suspect indication.
• Keeping control of the airplane with basic pitch and power skills.
• Taking inventory of reliable information.
• Finding or maintaining favorable flying conditions.
• Getting assistance from others.
• Using checklists.

Recognizing an unusual or suspect indication.
A crewmember should advise the other crewmember immediately if a problem is suspected. Crewmembers should confirm indications by cross-checking instruments with each other to identify which instruments are reliable, including standby instruments, inertial data, and radio altimeter data. Both crewmembers should be suspicious of each other’s instruments while together confirming the operating instruments. Crewmembers should maintain the standard callouts normally used and organize subsequent callouts to take into account instrument scan changes and diminished capability.

Keeping control of the airplane with basic pitch and power skills.
Maintaining reasonable airplane control with normal pitch and power settings is the most important and fundamental activity when confronted with erroneous flight instruments. All troubleshooting should be done later. Crewmembers should cross-check all attitude instruments for accuracy, and set wings level with pitch and thrust appropriate for the desired flight conditions. If in descent when the anomaly occurs, the pilot flying should arrest descent and level off or climb to a safe altitude. If a climb is desired, the pilot flying should set a nominal pitch attitude and power setting that will sustain the climb. If a turn is necessary because of hazards, the crew should first cross-check all indications, remember INS heading, and turn to a heading that allows for vertical deviations. These basic steps should create valuable time needed to correctly interpret erroneous flight information.

Taking inventory of reliable information.
Standard pitch and power settings for common phases of flight are described in the operations manual. They should be noted during training and normal flight segments, especially if a crewmember is new to an airplane type. If confronted with unreliable instruments, crewmembers should err on the safe side. For example, they should opt for a shallower climb and some excess speed rather than risk approaching a stall condition. The crew should also use other airplane speed clues that provide additional information about the speed situation, such as high-speed flap rumble, airplane buffeting, airspeed noise, and engine power. Opposing clues could also be present; in two of the accidents discussed in the sidebar, the crew experienced simultaneous stick shaker with buffeting and overspeed warnings. This can be confusing until pitch and power are assessed and the situation is better understood. An 8- to 10-deg pitch at a medium altitude with appropriate climb thrust setting could provide a solution for these confusing situations. All crewmembers should be familiar with the unreliable airspeed charts and what is recommended in typical phases of flight.

Finding or maintaining favorable flying conditions.
One of the historic keys to success in situations caused by erroneous flight information is finding daylight visual conditions. No accidents involving unreliable airspeed on large commercial airplanes have occurred when their crews managed to find or remain in daylight visual conditions. Penetration into instrument meteorological conditions greatly increases the potential for a controlled flight into terrain accident; get visual and stay visual, if possible. If this is not possible, the crew should climb and proceed to good weather. Good instrument approach facilities and familiarity with the airport are not good substitutes for visual conditions. Accidents have occurred with many hours of fuel on board because the flight crew tried to return to the departure airport under instrument conditions. Attempts at nighttime approaches and landings, such as that in the 1996 accident in Lima, Peru (see below), increase problems and the complexity of the return. Daylight visual conditions help considerably when dealing with control issues. The crew should seek a minimal degree of difficulty during descent, approach, and landing. If it is necessary to fly several hours to achieve visual conditions, the crew should do so.

Getting assistance from others.
After maintaining control with pitch and power and having a plan for daylight visual conditions, the crew should seek help from air traffic control (ATC). Most ATC facilities have groundspeed readouts and general knowledge of the winds. With access to wind information from ATC, other nearby airplanes, or forecast or reported data, it is possible to determine true airspeed, which should be close to indicated airspeed below 5,000 ft elevation. Unfortunately, most radar systems rely on airplane transponders for airplane altitude data, and airplane transponders use the airplane altimeter as a source for this information. Therefore, if the airplane altimeter is unreliable, ATC receives erroneous information from the transponder. This fact was not understood in the accident in Peru and contributed significantly to the confusion. For vertical planning purposes, ATC can assist in maintaining headings away from such hazards as high terrain. In the right circumstances and conditions, other airplanes may be able to fly close enough to assist with approximate altitude and airspeed, another reason to seek daylight visual conditions. Company dispatch may be able to help with emergency coordination, weather information, and technical assistance.

Using checklists.
Before beginning an approach, it is important to assess the instruments. The crew should not trust instruments that previously provided suspect information; an intermittent problem or condition may make it appear to be normal. Relying on instruments that are suspect or that have failed has led to hull loss. The crew should discuss the cross-check to be used and what assistance is expected from the pilot not flying. They should identify alternatives for backup in case of future confusing indications. They should also go to the checklist and review items related to the problem, then create and test a plan. Sometimes a practice approach at a reasonable altitude will provide information on instrument accuracy and airplane controllability.

4. SPECIFIC OPERATIONS MANUAL PROCEDURES
When the airplane can be controlled using pitch and power, flight crews can use available checklists to provide critical information. Boeing provides tables for unreliable airspeed in either the Quick Reference Handbook (QRH) or volume 3 of the operations manual. These tables give pitch and power targets for climb, cruise, descent, holding, terminal area maneuvering, and final approach. Crewmembers should become familiar with the location and use of these tables to allow for quick and accurate reference if necessary.

The unreliable airspeed procedures supplied in the nonnormal section of the QRH have been expanded significantly for the 747-400, 757, and 767 and will eventually be expanded for other current-production models. The procedures contain a reference to indications, which can be individual discrete indications or engine indication and crew alerting system (EICAS) messages that basically point out the evidence of unreliable airspeed/Mach. Other examples of this evidence are provided in the QRH, such as

• Speed or altitude information not consistent with pitch attitude and thrust setting.
• Airspeed/Mach failure flags.
• Blank or fluctuating airspeed displays.
• Variation between captain and first officer airspeed displays.
• Amber line through one or more PFD or ADI flight mode annunciations.
• Overspeed indications.
• Simultaneous overspeed and stall warnings.

The 777 system is a complex design that addresses these malfunctions. With only one bad source or failure, the system automatically switches away from that source, and the crew will not notice any difference. This was a primary goal of nonnormal checklists when evaluating the situation on earlier generation airplanes. With multiple erroneous sources or internal failures on the 777, the EICAS message NAV AIR DATA SYS is displayed. The checklist for this message provides the appropriate crew actions and directs the crew to the unreliable airspeed table.

The next portion of the checklists contains the recall items, beginning with pitch attitude and thrust check. This item tells flight crews to check all attitude instruments and thrust levels to determine which are working properly if they are not normal for the phase of flight. If they are not normal, the next step is to positively disengage the autopilot and autothrottles. The flight directors should also be turned off to avoid the distraction of erroneous commands. At that point, establish normal pitch attitude and thrust. These are recall steps because it is important to first check attitude instruments and thrust levels. A delay in recognizing a problem and taking corrective action could result in loss of airplane control.

Flight crews should be aware of the approximate body attitude and thrust for each flight maneuver. This awareness results from a deliberate action to observe pitch and power indications during normal flight operations. Crews can then use tables in the QRH or operations manual to refine pitch and power when time permits. Only after maintaining airplane control should crews determine which instruments are giving false indications. Crews should seek reliable data sources, which can be quite difficult to find sometimes; situations can occur where bad instruments look valid and seemingly good indications appear faulty. Partial blockages or intermittent failures can also create difficulty, requiring the flight crew to select a different air data source on some airplanes. The airplane systems can also provide conflicting warnings, such as an invalid overspeed warning or invalid inputs to flight directors and autothrottles, and respond undesirably. Checklist guidance is given for airspeed differences where indications can be considered unreliable. These different airspeed readings can vary between models because of system tolerances.

When preparing for landing, take into account alternative sources of information and limitations. Radio altitude is an independent source of altitude information and is available below 2,500 ft above ground level. Basic ground proximity warning system (GPWS) warnings should be considered valid. Look-ahead (terrain avoidance warning systems), such as enhanced GPWS (EGPWS), should be suspect because the terrain database alerting warning system uses barometric altitude, which can be unreliable. In the near future, improvements in EGPWS capability using a concept called geometric altitude may overcome barometric altitude system malfunctions. Airspeed judgments may be possible using a combination of IRS groundspeed and reported winds during the approach. Global positioning systems can also provide accurate groundspeed readouts. Raw data from ground-based navigation aids is available. It is preferable to maintain visual conditions, establish landing configurations early, and use electronic and visual glide slope indicators for approach and landing.