Maintenance blunders keep catching pilots by surprise. Fortunately, the savvy and experienced pilots of a United Parcel Service (UPS) Boeing 747-200 freighter were able to retrieve the situation during a maintenance-related check flight.
The case at hand involves a May 12, 2000, check flight after C-level maintenance was completed at Dublin, Ireland. An outsourced provider on contract to UPS was doing the work. Details of the case are in the investigation report of the Irish Air Accident Investigation Unit (AAIU).
The outcome was not worse, thanks to the fact that the pilots and flight engineer in this incident were not an average line flight crew, but a UPS team that worked together frequently, performing post-maintenance check flights. That bonding over time helped the teamwork and crew resource management (CRM) on the day of the incident flight.
First, the immediate cause of the pilots’ problem: the static drain ports connected to both the captain’s and first officer’s instruments were left open. As a result, both airspeed indicators were under-reading by what the AAIU described as "a significant amount."
All seemed well on takeoff as the airplane passed through 80 knots. At an altitude of 800 feet, the first pressurization pack came on line. At this point, almost everything started to unravel. No sooner did the pack activate than the windshear alarm set off. Even though both airspeed indicators were reading the same, the captain thought the speed was too slow. The captain’s suspicion was confirmed by comparing the airspeed indicator (ASI) readings with the ground speed indicated by the aircraft’s inertial navigation system.
Thrust was added to keep the speed up. A few seconds later, the second pressurization pack came on line, and another loss of airspeed was observed. More power was added. As the airplane broke through the top of a cloud layer at 1,500 feet, the captain knew for sure that the weather conditions were benign and could not have been the cause of a windshear alert.
The altimeter kept shifting between the barometric and electric mode even though they were above the 2,500-foot maximum altitude that the radio altimeter could display. Air traffic control (ATC) passed along the aircraft’s transponder altitude information, as shown on the ground radar, but it corresponded to the altimeter readout in the cockpit, which the captain considered unreliable.
"At this point the commander had no faith in his airspeed indications. He had no idea of his true altitude except that he was staying on top of the clouds," the AAIU reported. The captain also was faced with significant handling problems, and the airplane could not maintain height in turns. At this point, unable to comply with ATC vectors, the captain declared an emergency.
The landing, at a speed a bit faster than normal, was uneventful.
Since the pitot-static system, which forms the very heart of airspeed and altitude indications, had undergone maintenance before the ill-fated check flight, it was the first system examined after landing. Lo and behold, the end caps were found missing from both the captain’s and first officer’s static line drain ports. In other words, the static ports were not measuring static air pressure outside the aircraft, as they are designed to do in order to measure altitude (i.e., as static ambient pressure decreases, the airplane’s altitude increases). Nor could the system compare pitot total pressure to static pressure to derive indicated airspeed. Rather, the open static port drains allowed pressurized air into the lines when the packs came on line. That rapid infusion gave a false high reading of air pressure, and hence a low reading of both altitude and airspeed.
As for the similar reading of 80 knots on takeoff, of course the instruments agreed because air pressure inside the airplane was the same as outside, and did not change until the air conditioning system activated during climb. At the maximum displayed airspeed of 270 knots, the true airspeed was actually 335 knots, giving an under-reading of 65 knots.
As for the unreliable altitude reading, this is a case that might be called "incestuous amplification." When the ATC’s ground radar "paints" the aircraft, the pulse stimulates the airplane transponder to reply with a coded message, which includes altitude. "As the altitude information supplied to the aircraft’s radar transponder also was supplied by the same static source, the altitude displayed in the ATC radar screens was subject to the same error," the AAIU explains.
What about the bogus windshear warning? It was caused by the sudden loss of indicated airspeed when the pressurization packs came on.
See how this all multiplies for want of two end caps on the drain lines? Therein is the seminal question—how they came to be left off as the airplane was handed over for its post-maintenance check flight. What investigators found was ample opportunity for maintenance error. The work on the pitot-static system took place over two shifts on the weekend. The second shift was unaware that final checking of the pitot-static system was incomplete.
The work card for completing the leak test was signed off, in the mistaken belief by the outgoing avionics crew manager that a further leak test would be conducted after the IVSI (instantaneous vertical speed indicator) was replaced. However, with self-sealing fittings on the IVSI, no further leak check was required. The avionics crew manager was relatively inexperienced and did not know this when he certified the initial leak check. "Thus, a safety resource that he believed to be in the system was, in fact, absent," the AAIU concludes.
The one fortunate circumstance in this concatenation of hazards was the UPS policy to conduct check flights in daylight and not below visual flight rules (VFR) minimums.
With the benefit of hindsight, the incident crew thought they would have gotten better static information had they turned off the pressurization packs and opened the outflow valve to depressurize the aircraft. However, incisive trouble-shooting in the heat of a complex, compounded emergency is difficult. And pilots’ actions are often constrained by the time available to identify the initiating circumstances. Anonymous maintenance-induced pitot-static errors are akin to a cocked and loaded gun in the hands of a child in the next room.
UPS now requires a procedure to pressurize the airplane prior to takeoff for such check flights. The airspeed and altitude instruments should not move. As the AAIU explains, "The procedure checks that the static system is not reading the internal air pressure in the fuselage and thereby ensures that the static drains are sealed."
Later models of the B747-200 and all other Boeing designs since have been fitted with standby instruments (altitude and airspeed) fed by a separate, independent static source. Such is progress.
As for those missing end caps amidst a sea of pneumatic plumbing, the use of Day-Glo flags might have helped to avoid this emergency.
Consider this final and sobering scenario: with reduced vertical separation minimum (RVSM), a system leak can cause an altitude error. This error in turn can cause a midair collision hazard in an RVSM environment. Transponder altitude reporting will allow ATC radar to pick up pilot deviations from the correct (assigned) flight level, but not a deviation due to an instrument error induced by a leak. The requirement to test pitot-static systems every 24 months for RVSM compliance may be insufficient when one considers that static system plumbing may be routinely disrupted for access to other systems.
The lesson: a pitot-static system disconnected at dispatch can be potentially deadly, plunging aircrews into deep peril.
(The full AAIU report may be viewed at www.aaiu.ie/upload/general/4703-0.pdf. For the Boeing perspective on erroneous flight instruments, see www.boeing.com/commercial/aeromagazine/aero_08/erroneous_textonly.html. This Boeing paper suggests that the B747-200 was equipped with a standby airspeed indicator and altimeter with a separate static source. The incident airplane preceded this design change and was not fitted with such a third system.)
David Evans can be reached by e-mail at [email protected].