Published: October 1999

Flight deck automation and flight control technology, coupled with excellent systems reliability and redundancy, allow flight crews to easily control their airplanes from takeoff to touchdown regardless of outside visibility. However, if an anomaly occurs, the complex systems that automate, control, and display information in modern flight decks can produce erroneous or insufficient information. When faced with the resulting uncertainties, flight crews must determine what information is reliable and what information should not be used in order to make the proper decisions.

Unfortunately, safety data show that not all flight crews have satisfactorily handled situations caused by erroneous flight instrument information. During the past 10 years, more than 300 accidents and incidents have been reported as a result of erroneous flight deck information, including problems with pitot-static probes and air data computers. Several fatal accidents that involved erroneous flight instrument information and six incidents resulting from lost or erratic air data occurred in 1996 alone. Investigations of these events indicate that, with proper preparation, the flight crews involved in these events probably could have prevented them.

In addition to accident and incident case studies (see below), examples of information that can help flight crews prepare to react to such events include:

1. Flight instrument system design.
2. Pitot and static anomalies.
3. System anomaly recognition and recovery techniques.
4. Specific operations manual procedures.

1. FLIGHT INSTRUMENT SYSTEM DESIGN

Compared to the number of commercial airplane departures each year, the rate of instrument and system anomalies is very low. The fact that they occur infrequently can contribute to the "startle" factor flight crews experience, leaving them uncertain about how to respond to the anomaly. In addition, as airplane systems have evolved and become more complex, the amount of integrated flight information they provide to flight crews increases. In general, reliability and integrity have improved, but the number of system functions and interactions has also increased. Technology has also made it possible to offer more precise information to flight crews. The evolution and underlying design principles of instrument systems are discussed in the following chronology: pre-1967, 1969, 1982, and 1994 to present.

Pre-1967.
Only captain and first officer primary flight instruments, but no standby instruments, were installed on early Boeing commercial airplanes. The two artificial horizons (attitude indicators) are powered by analogue signals from remotely located vertical gyros. Both gyros are lost if all the main airplane generators fail. Because of this, the U.S. Federal Aviation Administration required a third, panel-mounted gyro instrument to be installed in the centre of the instrument panel on later models. The third gyro is ac powered by a static inverter that receives its dc power from the main airplane battery.

Figure 1. PRE-1967 PITOT/STATIC SYSTEM

The airspeed indicators and altimeters directly receive pitot and static pressure information from left and right pitot probes and static pressure from two pairs of flush-mounted static ports . These indicators require electrical power only for lighting.

1969.
The altimeters and airspeed indicators were initially the same as the all-pneumatic type used in the 707 but were shortly replaced by a servo-pneumatic type (fig. 2). This type can operate in either of two modes: central air data computer (CADC) mode or all-pneumatic (backup) mode.

Figure 2. 1969 PITOT/STATIC SYSTEM

The altimeters and airspeed indicators were normally driven by analogue signals from their respective CADCs (fig. 1). The CADC added compensation for static source errors; if they lost power, however, the instruments reverted to the less precise, all-pneumatic mode. This generation of airplanes also integrated the static ports into pitot-static probes.

Eventually, the 747-200 evolved to all-electrical air-data instruments driven only by CADCs, with no pneumatic backup. At that time a third standby airspeed indicator and altimeter were added. These additional standby instruments were all-pneumatic and became the standard for all Boeing airplanes designed after 1969 and before the 777 in 1994 (fig. 3).

Figure 3. 1982 PITOT/STATIC SYSTEM

With the development of inertial navigation systems (INS), a new source of information for the captain and first officer attitude indicators was available. The standby attitude indicator power source remained ac from an inverter, powered by the airplane battery.

1982.
This generation was the first to use the cathode ray tube electronic flight instrument system. The information for the attitude director indicator (ADI) is supplied by the all-digital ring-laser INS. The air data instruments remained round-dial type and all-electrical, but they now received their information from digital air data computers through digital data buses. Additionally, an airspeed tape became available as an option on the electronic ADI. The standby attitude, airspeed, and altimeter systems are the same as the earlier generation design. Some later generation airplanes (e.g., the 767) use the combined pitot and static probes and some (e.g., the 757) use flush-mounted static ports.

1994 to present.
The primary source for attitude, airspeed, and altitude is the air data inertial reference unit (ADIRU) (fig. 4). The attitude and air data signals are formatted for display by the airplane information management system. The ADIRU design differs from the traditional left-right system partitioning. The ADIRU is a single, fault-tolerant, high-integrity data source for both primary flight displays (PFD). The ADIRU uses multiple redundant inertial sensors for computing attitude and also selects a best altitude and airspeed from three pitot and static pressure sources. As a result it provides a single set of data for both the captain and first officer, eliminating cross-channel splits.

Figure 4. 1994 TO PRESENT PITOT/STATIC SYSTEM.

The pitot and static pressures are measured by small air data modules (ADM) located as close as possible to the respective pressure sources. The ADMs transmit their pressures to the ADIRU through data buses. In the highly improbable event that the ADIRU totally fails, a secondary attitude air data reference unit (SAARU) provides comparable attitude and air data to both PFDs. The SAARU also supplies standby attitude directly to an electronic standby horizon instrument. The standby airspeed indicator and altimeter, both electronic, receive pitot and static pressure from the standby ADMs. This design ensures that displayed data are immune to any first and most second failures of their respective sensors or pressure probes.

2. PITOT AND STATIC ANOMALIES

Notwithstanding numerous improvements, the pitot probes and static ports remain critical sources for flight deck information. It is vital to protect these sources from contamination and prevent the consequences of a blocked pitot or static system. Both sources are used for multiple flight deck indications, such as displayed altitude and displayed airspeed.

Displayed altitude is directly related to static pressure, corrected for the current barometric setting. At sea level, for each inch of mercury decrease in static pressure, altitude increases roughly 1,000 ft. In contrast, displayed airspeed is related to the difference between total pressure and static pressure (PT - PS). This difference, called dynamic pressure, roughly increases with the square of the airspeed; that is, as the airspeed doubles, the dynamic pressure quadruples.

The following two scenarios demonstrate the effect on displayed altitude and airspeed during takeoff and climb if the flight crew receives faulty sensed pressure readings:

• Completely plugged pitot probes.
• Completely plugged static pressure ports.

Completely plugged pitot probes.
If the pitot probe is plugged, its sense line likely contains air trapped at a pressure equal to that of the field elevation static pressure. During the takeoff roll, therefore, the sensed dynamic pressure remains zero and the airspeed instrument remains pegged at its lower stop. If the flight crew does not reject the takeoff, the pitot pressure remains plugged at field-elevation pressure as the airplane climbs, but the static pressure begins to drop. The altimeter operates almost correctly during the climb. However, the resulting sensed dynamic pressure causes the airspeed indicator to come alive seconds after liftoff. Regardless of the actual climb speed of the airplane, the faulty airspeed indication continues to increase as altitude increases, until the airspeed catches up to the correct value. The indicated airspeed continues to increase through the correct value as the airplane climbs. The VMO speed can appear to be exceeded. Additionally, an overspeed warning can be triggered. If the pilot flying trusts the faulty airspeed indicator because of the temptation early in the climb to believe that some movement means the indicator has begun to operate normally, the pilot flying is in grave danger of increasing pitch, reducing thrust, or both to reduce the erroneous indicated airspeed. This could cause the airplane to exceed its stall angle of attack, though the stall warning system, which is driven by angle of attack, should continue to function normally.

Completely plugged static pressure ports.
During the takeoff roll, both the altimeter and the airspeed indicator operate correctly. After liftoff, assuming the trapped static pressure is that of the field elevation, the altimeter indication remains at the field elevation. With respect to airspeed, the sensed dynamic pressure fails to increase as rapidly as it should during climb because of the trapped static pressure. Therefore, if the airplane actually climbs at a constant speed, the airspeed indication decays, reaching the lower end indication. If the captain relies on the airspeed indicator for proper information, the typical response will be to reduce the pitch attitude to maintain the erroneous airspeed, possibly causing the airplane to exceed its airspeed limitations. Complicating this situation is the fact that the overspeed warning does not operate if connected to the same erroneous airspeed source.

Total blockage of the pitot or static systems rarely occurs. However, many anomalies are associated with partial blockages of parts of the systems. Incident and accident reports identified several reasons for these anomalies, including

• Pitot probe covers not removed.
• Pitot or static hoses disconnected.
• Hoses leaking.
• Water trapped in lines.
• Pitot probes blocked by volcanic ash.
• Radome damaged.
• Airplane icing.
• Static ports covers not removed.
• Pitot probes or static ports blocked by insects.

The ability to predict the effects of a partial blockage is hindered when anomalies occur during different phases of flight, the amount of blockage differs, or blockage corrects or appears to correct itself. Tables 1 and 2 describe what flight deck information is or is not reliable during pitot or static system anomalies. The information is not model specific.

Table 1. AVAILABLE RELIABLE INFORMATION.

Table 2. UNRELIABLE INFORMATION.

3. SYSTEM ANOMALY RECOGNITION AND RECOVERY TECHNIQUES

Regardless of the nature of erroneous flight instrument indications, some basic actions are key to survival. The longer erroneous flight instruments are allowed to cause a deviation from the intended flight path, the more difficult recovery will be. Some normal procedures are designed, in part, to detect potential problems with erroneous flight instruments to avoid airplane upsets. Examples are the 80-kt call on takeoff and callouts for bank angle exceedances. In some cases the flight crew may need to recover the airplane from an upset condition: unintentional pitch greater than 25 deg nose high or 10 deg nose low, bank angle in excess of 45 deg, or flying at airspeed inappropriate for conditions. As the condition deteriorates, it becomes more dynamic and stressful. This stress increases the difficulty flight crews experience in determining, believing, and adjusting to using the correct instruments and ignoring the faulty instruments. Regardless of the situation, good communication between crew-members is essential, and several basic actions are paramount:

• Recognising an unusual or suspect indication.
• Keeping control of the airplane with basic pitch and power skills.
• Taking inventory of reliable information.
• Finding or maintaining favourable flying conditions.
• Getting assistance from others.
• Using checklists.

Recognising an unusual or suspect indication.
A crew-member should advise the other crew-member immediately if a problem is suspected. Crew-members should confirm indications by cross-checking instruments with each other to identify which instruments are reliable, including standby instruments, inertial data, and radio altimeter data. Both crew-members should be suspicious of each other's instruments while together confirming the operating instruments. Crew-members should maintain the standard callouts normally used and organise subsequent callouts to take into account instrument scan changes and diminished capability.

Keeping control of the airplane with basic pitch and power skills.
Maintaining reasonable airplane control with normal pitch and power settings is the most important and fundamental activity when confronted with erroneous flight instruments. All troubleshooting should be done later. Crew-members should cross-check all attitude instruments for accuracy, and set wings level with pitch and thrust appropriate for the desired flight conditions. If in descent when the anomaly occurs, the pilot flying should arrest descent and level off or climb to a safe altitude. If a climb is desired, the pilot flying should set a nominal pitch attitude and power setting that will sustain the climb. If a turn is necessary because of hazards, the crew should first cross-check all indications, remember INS heading, and turn to a heading that allows for vertical deviations. These basic steps should create valuable time needed to correctly interpret erroneous flight information.

Taking inventory of reliable information.
Standard pitch and power settings for common phases of flight are described in the operations manual. They should be noted during training and normal flight segments, especially if a crew-member is new to an airplane type. If confronted with unreliable instruments, crew-members should err on the safe side. For example, they should opt for a shallower climb and some excess speed rather than risk approaching a stall condition. The crew should also use other airplane speed clues that provide additional information about the speed situation, such as high-speed flap rumble, airplane buffeting, airspeed noise, and engine power. Opposing clues could also be present; in two of the accidents discussed in the sidebar, the crew experienced simultaneous stick shaker with buffeting and overspeed warnings. This can be confusing until pitch and power are assessed and the situation is better understood. An 8- to 10-deg pitch at a medium altitude with appropriate climb thrust setting could provide a solution for these confusing situations. All crew-members should be familiar with the unreliable airspeed charts and what is recommended in typical phases of flight.

Finding or maintaining favourable flying conditions.
One of the historic keys to success in situations caused by erroneous flight information is finding daylight visual conditions. No accidents involving unreliable airspeed on large commercial airplanes have occurred when their crews managed to find or remain in daylight visual conditions. Penetration into instrument meteorological conditions greatly increases the potential for a controlled flight into terrain accident; get visual and stay visual, if possible. If this is not possible, the crew should climb and proceed to good weather. Good instrument approach facilities and familiarity with the airport are not good substitutes for visual conditions. Accidents have occurred with many hours of fuel on board because the flight crew tried to return to the departure airport under instrument conditions. Attempts at night-time approaches and landings, such as that in the 1996 accident in Lima, Peru (see below), increase problems and the complexity of the return. Daylight visual conditions help considerably when dealing with control issues. The crew should seek a minimal degree of difficulty during descent, approach, and landing. If it is necessary to fly several hours to achieve visual conditions, the crew should do so.

Getting assistance from others.
After maintaining control with pitch and power and having a plan for daylight visual conditions, the crew should seek help from air traffic control (ATC). Most ATC facilities have groundspeed readouts and general knowledge of the winds. With access to wind information from ATC, other nearby airplanes, or forecast or reported data, it is possible to determine true airspeed, which should be close to indicated airspeed below 5,000 ft elevation. Unfortunately, most radar systems rely on airplane transponders for airplane altitude data, and airplane transponders use the airplane altimeter as a source for this information. Therefore, if the airplane altimeter is unreliable, ATC receives erroneous information from the transponder. This fact was not understood in the accident in Peru and contributed significantly to the confusion. For vertical planning purposes, ATC can assist in maintaining headings away from such hazards as high terrain. In the right circumstances and conditions, other airplanes may be able to fly close enough to assist with approximate altitude and airspeed, another reason to seek daylight visual conditions. Company dispatch may be able to help with emergency coordination, weather information, and technical assistance.

Using checklists.
Before beginning an approach, it is important to assess the instruments. The crew should not trust instruments that previously provided suspect information; an intermittent problem or condition may make it appear to be normal. Relying on instruments that are suspect or that have failed has led to hull loss. The crew should discuss the cross-check to be used and what assistance is expected from the pilot not flying. They should identify alternatives for backup in case of future confusing indications. They should also go to the checklist and review items related to the problem, then create and test a plan. Sometimes a practice approach at a reasonable altitude will provide information on instrument accuracy and airplane controllability.

4. SPECIFIC OPERATIONS MANUAL PROCEDURES

When the airplane can be controlled using pitch and power, flight crews can use available checklists to provide critical information. Boeing provides tables for unreliable airspeed in either the Quick Reference Handbook (QRH) or volume 3 of the operations manual. These tables give pitch and power targets for climb, cruise, descent, holding, terminal area manoeuvring, and final approach. Crew-members should become familiar with the location and use of these tables to allow for quick and accurate reference if necessary.

The unreliable airspeed procedures supplied in the non-normal section of the QRH have been expanded significantly for the 747-400, 757, and 767 and will eventually be expanded for other current-production models. The procedures contain a reference to indications, which can be individual discrete indications or engine indication and crew alerting system (EICAS) messages that basically point out the evidence of unreliable airspeed/Mach. Other examples of this evidence are provided in the QRH, such as:

• Speed or altitude information not consistent with pitch attitude and thrust setting.
• Airspeed/Mach failure flags.
• Blank or fluctuating airspeed displays.
• Variation between captain and first officer airspeed displays.
• Amber line through one or more PFD or ADI flight mode annunciations.
• Overspeed indications.
• Simultaneous overspeed and stall warnings.

The 777 system is a complex design that addresses these malfunctions. With only one bad source or failure, the system automatically switches away from that source, and the crew will not notice any difference. This was a primary goal of non-normal checklists when evaluating the situation on earlier generation airplanes. With multiple erroneous sources or internal failures on the 777, the EICAS message NAV AIR DATA SYS is displayed. The checklist for this message provides the appropriate crew actions and directs the crew to the unreliable airspeed table.

The next portion of the checklists contains the recall items, beginning with pitch attitude and thrust check. This item tells flight crews to check all attitude instruments and thrust levels to determine which are working properly if they are not normal for the phase of flight. If they are not normal, the next step is to positively disengage the autopilot and autothrottles. The flight directors should also be turned off to avoid the distraction of erroneous commands. At that point, establish normal pitch attitude and thrust. These are recall steps because it is important to first check attitude instruments and thrust levels. A delay in recognising a problem and taking corrective action could result in loss of airplane control.

Flight crews should be aware of the approximate body attitude and thrust for each flight manoeuvre. This awareness results from a deliberate action to observe pitch and power indications during normal flight operations. Crews can then use tables in the QRH or operations manual to refine pitch and power when time permits. Only after maintaining airplane control should crews determine which instruments are giving false indications. Crews should seek reliable data sources, which can be quite difficult to find sometimes; situations can occur where bad instruments look valid and seemingly good indications appear faulty. Partial blockages or intermittent failures can also create difficulty, requiring the flight crew to select a different air data source on some airplanes. The airplane systems can also provide conflicting warnings, such as an invalid overspeed warning or invalid inputs to flight directors and autothrottles, and respond undesirably. Checklist guidance is given for airspeed differences where indications can be considered unreliable. These different airspeed readings can vary between models because of system tolerances.

When preparing for landing, take into account alternative sources of information and limitations. Radio altitude is an independent source of altitude information and is available below 2,500 ft above ground level. Basic ground proximity warning system (GPWS) warnings should be considered valid. Look-ahead (terrain avoidance warning systems), such as enhanced GPWS (EGPWS), should be suspect because the terrain database alerting warning system uses barometric altitude, which can be unreliable. In the near future, improvements in EGPWS capability using a concept called geometric altitude may overcome barometric altitude system malfunctions. Airspeed judgments may be possible using a combination of IRS groundspeed and reported winds during the approach. Global positioning systems can also provide accurate groundspeed readouts. Raw data from ground-based navigation aids is available. It is preferable to maintain visual conditions, establish landing configurations early, and use electronic and visual glide slope indicators for approach and landing.

Summary Preventable accidents related to erroneous flight instrument information have occurred. These accidents likely happened despite system reliability, redundancy, and technological advances that have improved on the capabilities of earlier generation airplanes. In addition, the flight instruments on newer airplanes provide more information to flight crews during flight, and that information is more precise. However, the fact that flight crews are seldom confronted with erroneous flight instrument information contributes to these accidents. To overcome the potential problems associated with infrequent failures and increased system complexity, flight crews should follow the piloting techniques provided in this article and the guidance provided in operation manuals when facing an air data anomaly. Recovery techniques and other procedures are also available for flight crews to consider when confronted with erroneous flight instrument information.

ACCIDENT AND INCIDENT CASE STUDIES

Erroneous flight information such as the many and varied symptoms of pitot-static anomalies can confuse an unprepared flight crew. Because of the confusion caused by multiple and sometimes conflicting alerts and warnings, the flight crew may not recognise an air data error and may fail to respond appropriately. The following accidents and incidents show what can happen when a crew is confronted with unreliable or erroneous flight information.

• In December 1974, a Boeing 727 crashed 12 min after takeoff while on a positioning flight from Buffalo, New York, in the United States. Three crew-members were killed and the airplane was destroyed. The U.S. National Transportation Safety Board (NTSB) determined that the probable cause of the accident was flight crew failure to recognise and correct the airplane's high angle of attack and low speed stall. The stall was precipitated by the crew's reaction to erroneous airspeed indications caused by atmospheric icing blockage of the pitot probe. The pitot heat switch had not been turned to the ON position.

• In April 1991, the crew on a large corporate jet survived the following incident. On the previous leg, the captain's airspeed/Mach indicator and the standby airspeed/Mach indicator were erratic. The ground crew was unable to duplicate the problem. The next leg was at night in visual conditions. It was uneventful until the crew observed the first officer's airspeed/Mach indicator begin an uncommanded increase as the airplane climbed through FL310. Passing FL330, the captain's airspeed remained steady, but the first officer's airspeed pointer exceeded "barber pole," and the high-speed aural clacker activated. The autothrottles were disconnected, and at that point the captain's airspeed indicator began to show a decrease in airspeed that coincided with the standby airspeed/Mach indicator. Because of problems reported on the previous leg, the crew assumed that the captain's instruments were faulty. As the first officer's airspeed/Mach indicator kept increasing, the crew pulled the power back to silence the clacker, but the first officer's airspeed continued to increase and the captain's airspeed indicator continued to decrease. The airplane began to shake, which the crew assumed was high-speed Mach tuck. At FL340, the pitch was increased and stick shaker activated. The crew suddenly realised that they were entering a stall. While performing stall recovery procedures, they experienced severe vertigo, spatial disorientation, and confusion over determining the actual airspeed. Though the clacker was still sounding, fuel flow, attitude, and N1 were calculated for descent. Appropriate checklists were run and the circuit breakers were pulled to silence the clacker. Using calculated attitude and power settings, a descent, instrument landing system approach, and uneventful landing were accomplished. Maintenance later confirmed that the first officer's central air data computer had failed.

• In February 1996, a Boeing 757 crashed after takeoff from the International Airport of Puerto Plata, Dominican Republic. After climbing through 7,300 ft, the airplane descended until it crashed into the Atlantic Ocean about 5 mi off the coast of the Dominican Republic. All 189 people on board were killed, and the airplane was destroyed. Data from the cockpit voice recorder (CVR) and flight data recorder (FDR) indicate that the airspeeds displayed to the captain during the takeoff roll were incorrect and that the captain was aware of this during the takeoff roll. Nevertheless, the captain decided to continue the takeoff, and the first officer notified the captain when the airplane reached V1 and VR. Shortly after takeoff, the captain commented that his airspeed indicator had begun to operate, even though it indicated unrealistic airspeeds. A normal climbout ensued, and the captain engaged the centre autopilot. During the climb, at an altitude of 4,700 ft, RUDDER RATIO and MACH/SPD TRIM advisory messages appeared on the engine indication and crew alerting system display unit. For the next several minutes, the crew-members discussed the significance of these advisory messages and expressed confusion about the airspeed. At an altitude of about 7,000 ft, the captain's airspeed indicator showed 350 kt, and an overspeed warning occurred, immediately followed by activation of the stall warning system stick shaker. Flight crew confusion about appropriate airspeed, thrust setting, and proper pitch attitude was evident as the airplane stalled, descended, and then crashed. The erroneous readings from the captain's airspeed indicator are consistent with a blocked pitot tube. Comments by the first officer recorded on the CVR suggest that his pitot probe was not obstructed, and he was seeing correct airspeed indications on his display.

• In October 1996, a Boeing 757 crashed into the Pacific Ocean about 30 mi off the coast of Lima, Peru. The flight crew declared an emergency immediately after takeoff because of erroneous airspeed and altitude indications and was attempting to return to Lima when the accident occurred. Data from the CVR and FDR revealed that the airspeed and altitude readings were normal during the takeoff roll. However, as the airplane began to climb, the flight crew noticed that the airspeed indications were too low and the altitude indications were increasing too slowly. Shortly after takeoff, the windshear warning activated, despite calm wind conditions and no significant weather activity. The flight crew declared an emergency and expressed confusion about the airplane's airspeed and altitude displays. Analysis of FDR data indicates that the airplane subsequently climbed to a maximum altitude of approximately 13,000 ft. When the airplane descended, the captain's altitude and airspeed displays were still erroneous, but at that point they indicated higher-than-actual conditions. During descent, the first officer's displayed airspeed slowed to the point of stall warning stick shaker activation. Meanwhile, the captain's airspeed read over 350 kt, and the overspeed warning was sounding. Flight crew confusion about airspeed and altitude was evident as the airplane continued its final descent. At impact into the Pacific Ocean, the captain's flight instruments were reading approximately 9,500 ft and 450 kt. The erroneous indications recorded by the FDR are consistent with a partial blockage of the captain's static ports.

Three valuable lessons emerged from the investigations of these events. First, the effects of flight instrument anomalies appear during or immediately after takeoff. Second, flight crews must overcome the startle factor associated with rare anomalous events and immediately begin to implement specific corrective procedures and techniques. Finally, flight crews should acquire enough system knowledge to be able to determine the difference between valid and faulty display information.

DAVE CARBAUGH
CHIEF PILOT
FLIGHT OPERATIONS SAFETY
BOEING COMMERCIAL AIRPLANES GROUP

DOUG FORSYTHE
MANAGER
FLIGHT OPERATIONS SAFETY
BOEING COMMERCIAL AIRPLANES GROUP

MELVILLE MCINTYRE
TECHNICAL FELLOW
AIRPLANE SYSTEMS
BOEING COMMERCIAL AIRPLANES GROUP

| Top of page | Boeing Home | Boeing Commercial | Contact Aero |
  Aero Copyright © 2003 The Boeing Company. All rights reserved.