Left Seat: When Backup Systems Lie

It was during the second of three sim sessions in CJ2+ recurrent training that Fred failed the air data computer on my side of the cockpit. At least I think it was the computer. It could have been something wrong with the pitot-static system, but in any case, airspeed, altitude and vertical speed information blanked on the flat-glass primary flight display (PFD). That was only a momentary problem because the push of a button sent air data information from the copilot's side onto my PFD with a display color change to remind me that I was looking at cross-cockpit data.

So far the system was operating exactly as intended. I had lost crucial information necessary for maintaining control, but I didn't have to change my instrument scan to adjust for the failure, or change the way I was using the flight director and autopilot modes. It's nice to have two of everything that is important in the cockpit, I thought.But when you have only two sources of data, you have a coin toss. When two systems disagree, you don't automatically know which to believe. Fred had laid a trap to remind me of just how confusing it can be to believe you have full backup capability when you really don't.

The jet was climbing with the autopilot engaged. The fadec computers were controlling engine thrust, and the autopilot was adjusting pitch to maintain the target airspeed I had selected in the airspeed hold mode. I was now the monitor, something we humans are supposed to be while the airplane and its systems take care of the mundane chores of manipulating the flight controls.

My initial indication that there was a problem was that something just didn't sound right in the sim. The noise level was decreasing. Then I noticed that the airspeed was increasing pretty quickly. I looked at the PFD on the right side and saw the same information. The third little backup PFD in the center of the panel showed identical airspeed, and it was too high.

I was focused on the three airspeed indications that were increasing at an alarming rate, and the Mach limit was approaching fast. Despite the simulator doing its best — just as the actual airplane would — to alert me to a problem by decreasing the volume of the slipstream noise, it took me several seconds to notice the pitch angle displayed on the PFD. It was now nose up, way up. The CJ was flying too slowly, not too fast, as the airspeed indicators showed.

What Fred had done was give me a seemingly innocuous failure of the left-side air data information so that I would select to see right-side data on all three PFDs. Then all it took was a failure several minutes later — probably a frozen pitot tube — on the right side pitot-static system to make all three airspeed displays invalid.

The reality is that I had multiple sources of information that could have told me the approximate airspeed, or at least the airspeed trend, without looking at any of the airspeed indicators. A check of the pitch angle would have told me the airplane could not be accelerating rapidly with the nose up and no change in power. There was a ground speed readout smack in front of me on the PFD, and it was decreasing as the airspeed tape showed a rapid increase. And the angle of attack indication is independent of the air data computers, and it was showing an increase in AOA, not a decrease.

One system was lying, but because the airspeed indication is so fundamental to flying, I was looking at it and believing the indication, instead of wondering why other data didn't agree. Confusion was the result, and more than one accident has been caused by a similar situation in which primary data were wrong while correct-but-contradictory secondary information was ignored.

There is, of course, a hardware solution that avoids this exact issue, and it is used in all larger or more recently certified jets. That is to have a dedicated pitot-static system for the backup instruments. With a third pitot-static system, which cannot be connected to either primary displays, you always have a tiebreaker when one of the two primary systems fail. But if you fly airplanes without at least triple redundancy of instrumentation and systems — as most of us do — there is no hardware solution to such issues. It's up to us, the humans, to diagnose the failure and use all available data to maintain control.

If I had not been able to transfer right-side air data to my PFD after the initial failure, I would have been forced to compensate. I would have had to look at the standby instrument in the center of the panel, or look across the cockpit at the right-side PFD to see airspeed. I would have been on alert and suspicious.

Because I could return everything to normal — except for the display color change — my attitude returned to "everything normal" and my guard was let down. If an engine had failed instead of an air data computer, I could have easily continued the flight in the CJ, but I would have been fully aware of the abnormal situation all the way to the runway. The same would be true if the hydraulic or electrical system had failed. There are always ways to compensate for any system failure in a jet because the rules demand it. But usually the pilots need to consult checklists and adjust their procedures to continue safe flight after a failure.

I am among the most ardent believers in the safety advantages and efficiency improvements of cockpit automation. Terrain and traffic warning systems have prevented who knows how many accidents, but there have to be a lot. Flight directors and autopilots fly perfect approaches every time, and GPS always knows exactly where we are and where the airplane is headed. The modern cockpit is just safer than the rudimentary instruments and systems of years ago.

However, there is a risky gray zone between completely redundant automated systems and the appearance of redundancy, and pilots can be lulled into complacency. Regulators understand this when it comes to approving systems such as fly-by-wire, in which the pilot has no mechanical connection to the flight controls. Every critical element of a fly-by-wire system must be at least triplicate so the outlier can be voted out and ignored by the two other systems if there is a failure. The human pilot isn't called upon to monitor the crucial functions of fly-by-wire. That task is fully automated and continuous.

We used to take it for granted that systems, particularly instruments, can and do fail, and the pilot was the monitor and backup. The key to IFR flying safety was to constantly cross-check the instruments to know what the airplane was doing, and to be alert for the failure of any one primary instrument. Practicing this "partial panel" flying was routine. The bad news is that it's not hard to become confused and disoriented while flying in the clouds, and many pilots have lost control either because they interpreted the instruments incorrectly or because they didn't spot a failed instrument and followed its indications until control was lost.

Modern avionics are so much better and the safety record, particularly in jets, is so unbelievably good that no sane pilot should want to go back to the old days of basic instruments only. But most of us do need to remind ourselves that we are still flying airplanes that do not have total redundancy to automatically handle any instrument failure, or combinations of failures. Backup systems can lie to us, and that creates a trap that is hard to escape.

Many years ago a grizzled avionics design engineer pointed out the hazard of a single-string parallel monitoring system to me this way: "It's like buying a mean dog to bite the burglar. You have a 50-50 shot the dog will bite you instead of the bad guy."

My lesson from the sim session was that, when the mean dog growls, or part of a system fails, don't believe anything is back to normal. Suspicion is an essential element of safe flying.

Aspen Success Story
It's hard to imagine worse market conditions for a new general aviation company than what occurred in 2009, but Aspen Avionics grew its sales in every month of the year.

Aspen makes compact primary flight displays that fit in the panel space vacated by the attitude and heading indicators the system replaces. Aspen was able to offer flat-glass retrofits at a new low price point and began deliveries in 2008 before the economy crashed. I think that it is a remarkable piece of good news that the company could continue to grow its business throughout 2009 when every segment of general and business aviation was hit hard by the recession. Congratulations to Aspen.

Basics Still Sell
Sporty's Pilot Shop released a list of the 20 best-selling products of last year, particularly during the holiday season, and I found some surprises.

The fact that Garmin's super do-almost-everything handheld 696 GPS with XM Weather was at the top of the list was expected. And nobody will be shocked that high-tech headsets from Bose and Lightspeed were favorites. But who would have guessed that the printed volume of the FAA's FAR/AIM and Sporty's digital cockpit timer would be on the list?

Every word of regulation or advice ever uttered by the FAA is available online and is up to date, but the good old printed page is still a top seller. That reinforces my belief that those of us in the print media are not going away. And the digital timer? What's up with that? If you bought the Garmin 696, you know exactly where you are, how far it is to the next fix and how long it will take to get there, and you can also see the time. There are clocks and timers built into almost every piece of avionics, either handheld or installed in the panel. You don't even need to note takeoff time because most GPS systems start the clock when you hit 30 or so knots of groundspeed. But many pilots still want a dedicated clock to time approaches and total flight time.

I know pilots are a conservative lot, and the Sporty's list is one more bit of evidence. We buy high technology like the Garmin 696 or the electronic noise-cancelling Bose or Lightspeed but still want the absolute reliability of a printed FAR/AIM and dedicated timer. Sporty's may want to start offering belt and suspender combinations in its pilot catalog. I bet those would sell.

What Hurts?
Every pilot I know pays attention to aviation safety information and accident data, but I don't know anybody who studies or thinks about what types of injuries pilots and passengers actually suffer. But the New York Times reported on a study that appeared in the December issue of Aviation, Space and Environmental Medicine that attempted to categorize the types of injuries aviation events cause.

The study found that more than 1,000 people a year are hospitalized for aviation-related injuries, and not surprisingly, fewer than 10 percent of those were passengers in commercial aircraft. During the study period that covered the years 2000 through 2005, about 32 percent of the injured were in private airplane accidents, 11 percent in gliders or hang gliders and nearly 30 percent in sky-diving accidents.

The most frequent type of injury, 28 percent, was lower limb fracture. As you can guess, sky divers were the most likely to break a leg. Head injuries and open wounds were also prominent in the study. Just 2.5 percent of the patients had burns, but those accounted for 17 percent of the deaths after hospitalization.

As a pilot I am so devoted to not crashing that I don't spend any time thinking about what types of injuries I'm likely to suffer if I do have an accident. That is apparently a widespread attitude because Susan P. Baker, the lead author of the study, faulted the NTSB and the FAA for not recording the types of injuries suffered in accidents, even though the number of accidents and injuries is carefully recorded.

The study did increase my resolve not to crash, and thus not suffer any type of injury, but more importantly, it confirmed my resolve never to jump out of an airplane unless it is absolutely the last possible avenue of escape. I take the same attitude about sailing, in which I don't plan to abandon ship until I have to step up to reach the life raft.