Uncertain instrument indications are a deceptive threat, but differing pilot response in 2 incidents of pitot blockage led to drastically different outcomes

From the first instrument flight lesson in the RPL syllabus, one of the key tenets of flight in non-visual conditions is, ‘always trust your instruments’. The basis of this is history – sensory illusions have been the cause of countless VFR and IFR fatal accidents. 

However, juxtaposed against this is the immutable fact that instruments, even modern ones, do fail. 

During the early hours of 1 June 2009, Air France Flight 447, an Airbus A330-200, disappeared from radar en route from Rio de Janeiro to Paris while crossing the Atlantic. It never arrived at its destination. Nearly 2 years later and only after the flight recorders were finally recovered, the cause of the accident was determined.

At 2.10 am, ice contamination in the pitot tubes caused unreliable airspeed indications. Detecting the disagreement between airspeed indications, the autopilot and autothrust disconnected, unexpectedly handing control of the 200-tonne aeroplane to the pilot flying, a 32-year-old first officer.

When you’re under the pump, inside the aeroplane, your ability to think rationally quickly diminishes.

Turbulence caused the aircraft to roll, which prompted the pilot, who was startled by the disconnect and unaware of changes to control law sensitivity, to overcorrect. The pilot also raised the nose, causing speed to decay and the aircraft to approach, then enter, a stall. Uncertain as to exactly what was unfolding before them, the crew was unable to identify the stall and take the necessary action to recover prior to crashing. All 228 on board died.

A dark night

In 2020, 22 June was a dark night, with the new moon appearing on just the previous day. At Jandakot Airport in Perth, Fly Doc 607 (call sign FD607), a Royal Flying Doctor Service (RFDS) Western Operations Pilatus PC-12 NG, VH-OWI, was preparing for a flight to Albany to collect a patient. Joining the single pilot on the flight were a doctor and a flight nurse. A SIGMET warned of severe icing en route between 8000 feet and FL190, with the terminal area forecasts at Jandakot and Albany indicating showers of rain and isolated thunderstorms. 

Departing at 2122, FD607 climbed to its cruising level of FL210. About 30 minutes later, the aircraft left FL210 on descent into Albany. After encountering icing conditions passing through FL180, the pilot received an airspeed miscompare – an electronic warning indicating a difference in airspeed exceeding 10 knots between the 2 independent primary flight displays (PFDs). 

Although noting a light dusting of ice on the leading edge, the pilot was unconcerned about icing. The Pilatus PC-12 NG is certified for flight into known and actual icing conditions. The pilot had no indication that any anti-icing systems had failed, including the pitot heat which prevents ice from building up in the pitot. However, given the icing and knowing that severe icing was forecast below the aircraft’s current altitude, the pilot requested a clearance back up to FL230 where the aircraft would be clear of cloud and out of icing conditions.

During the climb, the pilot observed the airspeed, displayed on the left PFD, increasing. This continued throughout the climb, with apparent exceedances of both maximum airspeed and Mach number occurring. The pilot elected to return to Jandakot.

Passing FL210 while still climbing, the pilot reported icing conditions and poor visibility and discontinued the climb. In a further attempt to exit icing conditions, the pilot requested a descent to 8000 feet. A further discrepancy in indicated heading was noted during the return. During the descent into Jandakot, the erroneous airspeed and heading indications resolved and the aircraft landed without incident.

Unreliable airspeed

‘Trust is not the same as faith’
Christopher Hitchens

Just weeks before VH-OWI’s airspeed event, Terry Robinson, a checking captain with RFDS Western Operations, had conducted an operational proficiency check (OPC) with the incident pilot. He first joined the RFDS in 1989, before leaving in 1997 to join CASA as a Flight Operations Inspector. He returned to the RFDS in 2010 to join the training and checking team on the Pilatus PC-12. 

An OPC is a semi-annual check of a pilot’s competency in normal and abnormal operation of the aircraft, but it also serves as a key ongoing training opportunity. ‘Unreliable airspeed is one of my pet subjects during OPCs,’ Robinson says, highlighting one of the key findings in the ATSB report – the incident pilot had received training on unreliable airspeed scenarios.

Robinson provides training about unreliable airspeed in the context of his ‘flight in icing conditions’ course. Icing is a common cause of pitot static blockages and unreliable speed indications. Unreliable airspeed and partial panel are essential components of an instrument rating; however, perhaps less stressed at a training level are the human factors aspects of such incidents. One of the first points he stresses for these types of incidents is, ‘The startle factor is real’.

The startle factor is the physical and mental response to a sudden unexpected stimulus, sometimes known as ‘fight or flight.’ One of my favourite Flight Safety Australia articles, ‘Without warning: the startle factor’, delves into this phenomenon and its role in the tragedy of Air France Flight 447.

Once control is assured, mental resources can be allocated to determining what has happened, without the pressure of the startle factor or a loss of control to recover from. 

In the context of the startle factor, Robinson stresses that pilots need to ‘keep flying that aeroplane’. ‘There’s a golden formula in aviation – power plus attitude equals performance,’ he says. His training on unreliable airspeed focusses on a critical first action: ‘Go to a known power setting and pitch attitude that will give you a known indicated airspeed.’ 

The immediate response to unreliable airspeed is to maintain control with a known power setting and pitch attitude producing known performance, even if indications of that performance are uncertain.

Once control is assured, mental resources can be allocated to determining what has happened, without the pressure of the startle factor or a loss of control to recover from. Robinson’s flight in icing course offers 2 methods of determining whether the information on your pitot static instruments is valid.

First, from your known power setting and pitch attitude, you should have some idea of what to expect in terms of performance. Airspeed or altitude information that drastically differs from what you expect or what your flight manual publishes, is evidently suspect. If you are fortunate enough to have 2 pitot static systems (assumedly with only one unreliable indication), eliminating the erroneous one should be straightforward.

The alternate option is understanding the effect a blockage will have on your pitot static system.

The pitot tube is simply a reading of dynamic pressure. Static ports measure static pressure. Airspeed is determined by subtracting the static pressure from the dynamic pressure. Altitude is determined directly from static pressure. Blockages freeze one of these input pressures.

If we freeze dynamic pressure (a pitot blockage) and increase static pressure (by descending), the result of the equation – dynamic minus static – decreases, causing airspeed to read lower (underread). Vice versa for climbing.

If we freeze static pressure (a static blockage) but keep climbing, the static blockage will result in the altimeter freezing in position – a relatively obvious failure. However, the effect on indicated airspeed is less obvious. We have frozen static pressure but, as we climb, dynamic pressure (measured by the pitot tube) for the same indicated airspeed drops. Again, the result of the equation – dynamic minus static – must decrease, causing airspeed
to read lower (underread).

Of course this is complex enough to consider in the comfort of your living room or aero club lounge, let alone with the pressures of flight. Various acronyms are taught to surmise the outcome, but PUDSUC is commonly taught in flight schools. 

A pitot blockage will cause airspeed to underread on descent (vice versa on climb). A static blockage will cause airspeed to underread on climb (vice versa on descent).

A different outcome

AF447 and FD607 share some obvious parallels. Both incidents occurred at night. Both were caused by flight in icing conditions leading to unreliable airspeed indications. Both crews were faced with unexpected uncertainty. But both had starkly differently outcomes.

The key to the differing outcomes between these 2 incidents was certainty of pilot response. The Bureau d’Enquêtes et d’Analyses – the French equivalent of the ATSB – noted in their report, ‘In the first minute after the disconnection of the autopilot, the aeroplane exited its flight envelope.’ Surprised and startled by an unexpected situation, the crew failed to maintain control, which robbed them of any chance of regaining situational awareness and diagnosing the state their aircraft was in. Tragedy resulted.

In contrast, the pilot of FD607, supported by recent training, was able to confidently respond to the unexpected compromise of their aircraft’s airspeed information. In averting loss of control, the pilot retained capacity to accurately assess what had happened and how to respond.

Robinson has another course he runs with RFDS pilots, ‘Dealing with flight emergencies’. The underlying focus of this course is the human factors aspects of major emergencies, particularly the startle factor. ‘When something like that [FD607’s incident] happens, logical thinking can go out the window,’ he says. ‘When you’re under the pump, inside the aeroplane, your ability to think rationally quickly diminishes.’ 

Better to take 3 seconds and make the right decision, rather than one second and make the wrong decision through panic. 

The course highlights that knowing those initial responses, such as going to a known pitch attitude and power setting for an unreliable airspeed indication, is critical. Equally important is taking the additional seconds to ensure the actions you actually take correspond with the ones you intend to. ‘It is imperative not to rush into action and potentially make the situation worse,’ Robinson says. ‘Better to take 3 seconds and make the right decision, rather than one second and make the wrong decision through panic.’

He says, from there, ‘using a checklist to deal with the issue should go a long way to solving it’. Notwithstanding that, the correct initial actions should buy time and mental capacity to assess the situation and build a picture of what has happened.

Uncertainty, both in instrumentation and operation, is an inherent part of the aviation environment. However, pilot response to that uncertainty is never a given. The AF447 and FD607 incidents underscore the importance of training crews in how to respond, both at a technical and human factors level. Certainty in pilot response is only attained when organisations systemically integrate these as components of their training and checking programs.  

References
Final report on the accident on 1 June 2009 to Airbus A330-203 registered F-GZCP operated by Air France, flight AF447, Rio de Janeiro to Paris.

bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf

Unreliable airspeed indication involving Pilatus PC-12/47E, VH-OWI, near Albany, Western Australia, on 22 June 2020.

atsb.gov.au/publications/investigation_reports/2020/aair/ao-2020-030/