Boeing Concern has been expressed regarding the possibility of failures in the VOR/ILS systems on certain models of receivers that would cause raw data deviation information on the ADI, the computer data on the Flight Director bars, and the raw data on the HSI to centre and remain centred with no failure flag in view.
There are four basic means of detecting passive failures of localiser and glideslope deviation signals:
Receiver Monitoring
Some types of receivers employ self monitoring techniques which would result in detection of most failures resulting in misleading information. This would not lead to undetected conditions since the crew would be alerted by the appropriate visual indications of the condition (Instrument Flags).
Instrument Comparator
The standard Boeing 707/727/737 airplanes were offered to the customer with an instrument comparator. Those systems compared the localiser and the glideslope deviation signals being provided for the primary displays and would annunciate (Annunciator lights on main panels or aural) to the flight crew differences between the two systems.
Autopilot
For airplanes having autoland capability, the multi channel design would provide command monitoring and would detect differences between the autopilot channel outputs due to the passive failure of an ILS receiver. When the autoland monitoring system detects a difference, the autopilot will disconnect.
Crew Procedures
While some of the above ways of detecting misleading localiser and/or glideslope deviation will apply to most airplanes, they are not universal. THE ONLY APPROACH TO ENSURED CREW AWARENESS OF MISLEADING INFORMATION IS CREW PROCEDURES.
In addition to the normal crew procedures for cross checking instruments, there are a specific set of standardised call outs in the Boeing Operations Manuals designed to ensure that the airplane is on the correct glide path and course during the approach. The objective of these call outs is to ensure that all crew members are aware of airplane altitude, position and instrument indications.
Assuming that the Pilot Flying (PF) indicator experienced an open line failure, the Pilot Not Flying (PNF) indicator would still be operational. If one of the pilot’s ILS glideslope or localiser bars were to fail (Centred) prior to capture, the fault would be detected immediately after the capture call out. At this call out, the PF is required to verify movement of the bar from the top or side of the display towards centre. If the failure were to occur after capture and centring of the ILS localiser and glide slope indicators (On the PNF side) began to drift off centre while the other (On the PF side) remained centred, this condition would be detected during instrument cross checks required at each of the next three call outs (at the outer marker, 1000 feet and 500 feet). Such indications would include unusual pitch attitude, abnormal vertical speed, incorrect heading, or altitude at the outer marker. After 500 feet above airport elevation, call outs for any deviation from glideslope or localiser are required.
In summary, for reasons as discussed above, we do not believe that an unsafe condition exists following a VOR/ILS system failure if the flight crew follows the recommended operating procedures found in the Boeing Operations Manual.
Boeing Flight Operations Review 25, 24th October 1991