Static port drain lines were left open, causing havoc on check flight
Maintenance blunders keep catching pilots by surprise. Fortunately, the savvy and experienced pilots of a United Parcel Service B747-200 freighter were able to retrieve the situation during a maintenance-related check flight. The object lesson is that when things slip through the metaphorical cracks on the maintenance floor, crews can find themselves suddenly confounded and in deep peril.
The case at hand involves a May 12, 2000, check flight after “C” level maintenance was completed at Dublin, Ireland. An outsourced provider on contract to UPS was doing the work. Details of the case were outlined in the Feb. 6 investigation report of the Irish Air Accident Investigation Unit (AAIU). While the AAIU found that a maintenance error, perpetuated in part by miscommunication (non-communication, more like) during shift turnover, was mostly responsible for the subsequent emergency.
The fact that the outcome was not worse could be attributed to the fact that the pilots and flight engineer in this incident were not an average line fight crew, but a UPS team that worked together frequently performing post-maintenance check flights. That bonding over time helped the teamwork and crew resource management (CRM) on the day of the incident flight.
First, the immediate cause of the pilots’ problem: the static drain ports connected to both the captain’s and first officer’s instruments were left open. Result: both airspeed indicators were under-reading by what the AAIU described as “a significant amount.”
All seemed well on takeoff as the airplane passed through 80 knots. Both pilots’ airspeed indicators were in agreement. All seemed routine, although the takeoff run seemed a mite longer than what would be expected for the airplane’s light weight (no payload).
At an altitude of 800 ft., the first pressurization pack came on line. It was at this point that almost everything started to seem unreliable, because no sooner did the pack activate than the windshear alarm activated. Even though both airspeed indicators were reading the same, the captain thought the speed was too slow. The captain’s suspicion was confirmed by comparing the ASI (airspeed indicator) readings with the ground speed indicated by the aircraft’s inertial navigation system.
Thrust was added to keep the speed up. A few seconds later, the second pressurization pack came on line and another loss of airspeed was observed. More power was added. As the airplane broke through the top of a cloud layer at 1,500 feet, the captain knew for sure that the weather conditions were benign, and could not have been the cause of a windshear alert.
The altimeter kept shifting between the barometric and electric mode, even though they were above the 2,500-foot maximum altitude that the radio altimeter could display. Air traffic control (ATC) passed along the aircraft’s transponder altitude information, as shown on their ground radar, but it corresponded to the altimeter readout in the cockpit, which the captain considered unreliable.
“At this point the commander had no faith in his airspeed indications … he had no idea of his true altitude except that he was staying on top of the clouds,” the AAIU reported. The captain prudently decided to stay out of the clouds. He also was faced with significant handling problems. At power and flaps setting and an indicated airspeed appropriate for climb, the airplane could not maintain height in turns. This was due to the extra drag of the flaps, resulting from flying 65 knots faster than indicated – a disconcerting situation, to say the least. At this point, unable to comply with ATC vectors, he declared an emergency.
Landing, at speed a bit faster than normal, was uneventful, although the check flight crew and technicians aboard were briefed for a possible emergency evacuation. A 39-minute flight plagued by uncertainty.
Since the pitot-static system, which forms the very heart of airspeed and altitude indications, had undergone maintenance before the ill-fated check flight, it was the first system to be examined after landing. Lo and behold, the end caps were found missing from both the captain’s and first officer’s static line drain ports.
What that meant was that the static ports were not measuring static air pressure outside the aircraft, as they are designed to in order to measure altitude (i.e., as static ambient pressure decreases, the airplane’s altitude increases). Nor could the system compare pitot total pressure to static pressure to derive indicated airspeed.
Rather, the open static port drains allowed pressurized air into the lines when the packs came on line. That rapid infusion gave a falsely high reading of air pressure, hence a low reading of both altitude and airspeed. Switching to the alternate (ALT) system would not have helped. As the AAIU noted, “Higher pressure air from the cabin pressurization system would have entered the static system between the ALT static selector valve and the crew’s instruments.”
As for the similar reading of 80 knots on takeoff, of course the instruments agreed, because air pressure inside the airplane was the same as outside, and did not change until the air conditioning system activated during climb.
At the maximum displayed airspeed of 270 knots, the true airspeed was actually 335 knots, giving an under-reading of 65 knots.
As for the unreliable altitude reading, this is a case of what might be called “incestuous amplification.” Not of altitude, but of the problem. When the ATC’s ground radar “paints” the aircraft, the pulse stimulates the airplane transponder to reply with a coded message, which includes altitude. “As the altitude information supplied to the aircraft’s radar transponder was also supplied by the same static source, the altitude displayed in the ATC radar screens was subject to the same error,” the AAIU explained.
What about the bogus windshear warning? It was caused by the sudden loss of indicated airspeed when the pressurization packs came on.
See how this all multiplies for want of two end caps on the drain lines? Therein is the seminal question – how they came to be left off as the airplane was handed over for its post-maintenance check flight. AAIU investigators interviewed all technicians who may have laid a hand on the airplane. No one admitted to leaving the caps off.
What investigators did find was opportunity for maintenance error. The work on the pitot-static system took place over two shifts on the weekend. The second shift was unaware that final checking of the pitot-static system was incomplete. “The lack of organized hand-over meetings at weekends was a major factor in this ineffective handover,” the AAIU report noted. This problem was the subject of a study by Prof. Gary Eiff, head of the Aviation Human Factors Study Team at Indiana’s Purdue University, so it is not unique to this particular operation. In fact, Eiff found that a thorough shift turnover could save operators considerable sums of money while at the same time yielding a marked reduction in maintenance-related errors (see ASW, April 17, 2000).
The work card for completing the leak test was signed off, in the mistaken belief by the outgoing avionics crew manager that a further leak test would be conducted after the IVSI (instantaneous vertical speed indicator) was replaced. However, with self-sealing fittings on the IVSI, no further leak check was required. The avionics crew manager was relatively inexperienced, and did not know this when he certified the initial leak check. “Thus, a safety resource that he believed to be in the system was, in fact, absent,” the AAIU concluded.
The one fortunate circumstance in this concatenation of hazards was the UPS policy to conduct check flights in daylight and not below VFR (visual flight rules) minima.
With the benefit of hindsight, the incident crew thought they would have gotten better static information had they turned off the pressurization packs, and opened the outflow valve to depressurize the aircraft. However, incisive trouble-shooting in the heat of a complex compounded emergency is difficult; pilots’ actions are often constrained by the time available to identify the initiating circumstances. Anonymous maintenance-induced pitot-static errors are akin to a cocked and loaded gun in the hands of child in the next room.
UPS now requires a procedure to pressurize the airplane prior to takeoff for such check flights. The airspeed and altitude instruments should not move. As the AAIU explained, “The procedure checks that the static system is not reading the internal air pressure in the fuselage and thereby ensures that the static drains are sealed.”
In its comments to the AAIU, UPS suggested that an angle of attack (AOA) indicator in the cockpit would have helped. “The AOA provides immediate reference for stall protection in the event there is a failure of both airspeed indicators … It is also more accurate than using target pitch and thrust settings,” UPS suggested. Transport category aircraft are not required to be fitted with AOA indicators, which has been a bone of contention among some in the industry for years (see ASW, Aug. 29, 1999 and Feb. 28, 2000).
While the AAIU did not take a position on an AOA indicator, the investigator in charge of this case, Graham Liddy, offered a few thoughts on the utility of an AOA in such cases:
“It is much easier to give a green arc area in an AOA indicator and to just fly within this arc. In this type of situation, the use of pitch and thrust would require reference to a book [and] finding the graphic. Weight is also a factor to be considered. Thus there is the real possibility of the crew being distracted from the basic requirement in such situations – continue to fly the aircraft. (Emphasis in original)
“In emergencies, crews becoming distracted by other tasks is a real danger. A single point target reference on an AOA indicator helps to prevent this. However, this is only good for a given aircraft configuration and the required AOA is affected by flap and slats position.”
With an AOA, crews undergoing simulator training could at least practice their skills at troubleshooting. Without an AOA, the permutations and combinations of possible pitot- static errors are too numerous to canvass logically in the limited simulator time available.
That said, there may be another option involving design. Later models of the B747-200 and all other Boeing designs since have been fitted with standby instruments (altitude and airspeed) fed by a separate independent static source.
As for those missing end caps amidst a sea of pneumatic plumbing, the use of dayglo flags might have helped to avoid this emergency. Better yet, the drain openings might be fitted with a powerful spring loaded (to closed and sealed) drain cap – once let go, a spring would hold it closed against a gas-seal chamfer, thereby “fool proofing” the system. Ironically, the lines most likely to cause the most havoc were the ones where disconnection was required to discharge condensation from the system.
Consider this final and sobering scenario: with reduced vertical separation minimums (RVSM), an error induced by a system leak can cause an altitude error which in turn can cause a TCAS (traffic alert collision avoidance system) resolution advisory (RA) and/or midair collision hazard in an RVSM environment. It is worth noting that the Mode C transponder altitude reporting will allow ATC radar to pick up pilot deviations from the correct (assigned) flight level, but not a deviation due to an instrument error induced by a leak. The requirement to test pitot-static systems every 24 months for RVSM compliance may be insufficient when one considers that static system plumbing may be routinely disrupted for access to other systems.
(ASW note: the full AAIU report may be viewed at www.aaiu.ie/upload/general/4703-0.pdf . For the Boeing perspective on erroneous flight instruments, see www.boeing.com/commercial/aeromagazine/aero_08/erroneous_textonly.html This paper suggests that the B747-200 was equipped with a standby airspeed indicator and altimeter with a separate static source. The incident airplane preceded this design change and was not fitted with such a third system, the AAIU advised.) >> Eiff, e-mail [email protected]; Liddy, e-mail [email protected]<<
Disconnected at Dispatch
(Unrelated to the UPS event)
“I was changing an electronic component on an aircraft. To remove the component, it was necessary to disconnect the pitot-static lines from an unrelated system. After the electronic component was changed, it was checked and operated normally. However, I failed to re-connect the pitot-static lines, which were in a darkened area, and I dispatched the aircraft with no pitot-static source to some instruments. The aircraft aborted takeoff and ground returned. Lines reconnected. Brain went on walkabout whilst performing a routine component change.”
From: From an anonymous survey participant cited in the 15th Annual Human Factors in Aviation Maintenance Symposium, see www.hf.faa.gov/docs/508/docs/hobbs15.pdf