What is the status of the Australian investigation, concerning the
failure of critical flight data presentations to the pilots, during a B-777 flight from
The investigation of that incident is still
ongoing. The Australian TSB has not as yet, issued a final report
on this incident. The following is my summary of that Preliminary
On August 1, 2005, a Boeing 777-200, which
had departed from Perth, received an EICAS (Engine Indication and Crew Alerting System)
warning of low airspeed, as the plane was climbing through FL (flight level)
380. Simultaneously, the aircraft’s slip/skid indication moved full right,
on the PFD (Primary Flight Display). The PFD speed tape also displayed
contradictory information: that the plane was approaching both
the high speed limit and the low
speed (stall) limit. The aircraft, still connected to the autopilot, pitched up and climbed to approximately FL410
as the airspeed decreased from 270 kts to 158 kts. The stall warning devices also activated.
The PIC (pilot in command) "disconnected the autopilot and lowered the nose of the aircraft. The autothrottle commanded an increase in thrust which the PIC countered by manually moving the thrust levers to the idle position. The aircraft pitched up again and climbed 2,000 ft." The PIC
advised ATC "that they could not maintain altitude and requested a descent and radar assistance. The crew was able to verify with ATC the aircraft speed and altitude."
The PFD indications became accurate again as they were
descending through FL200. The PIC attempted to use both the left and
right autopilots, but had to turn them off after each one produced
undesired command responses. "There were no control difficulties experienced when the aircraft was flown manually, but the autothrottle `arm’ switches remained in the `armed’ position."
ATC radar vectors put the plane in position to
conduct an ILS to R 03 at Perth. When they reached 3,000 ft, the PFD again
began indicating erroneous low airspeed information. The autothrottle
again responded by advancing the thrust levers. Since
the pilot can override that command, simply by manually adjusting those
thrust levers, the plane was able to land safely at Perth.
The FDR (flight data recorder), the CVR (cockpit voice recorder) and the
ADIRU (air data inertial reference unit) were removed from the plane, for
a detailed examination. Under the supervision of the American NTSB, the ADIRU was
shipped to its manufacturer for detailed analysis.
The FDR data confirmed the erroneous acceleration values had been
displayed on the PFDs, as the pilots reported. The ADIRU
produced those erroneous acceleration values and they were used by the PFC
(primary flight computer). As it was designed to do, the PFC compared the information from the ADIRU,
to the information coming from the SAARU (Standby Air Data and Attitude Reference Unit).
That comparison ability enabled the PFC to reduce the severity of the initial pitching motion of the aircraft.
The last comment in that Preliminary Report:
As a result of the occurrence, the aircraft manufacturer issued a Multi Operators Message on 9 August 2005, recommending to all B777 operators that the aircraft should not be flown with an unserviceable SAARU.
That comment perplexes me a bit. Since the SAARU
is an essential redundancy backup component for critical flight
instrument display data, all operators of the B-777 know it is a
required dispatch item for all flights. Why then was it necessary
to remind them that they should not fly the plane without that unit
Additional Q and A:
Q. How could this happen?
A. We don't know yet. The
object of the investigation will be to find an answer to that
question, so that it will not happen again. The preliminary
report states that the erroneous data was coming from the ADIRU.
But as to why the SAARU backup data was not selected and displayed, as
it was designed to do----that remains to be determined. It does
appear that this was not merely a failure of a critical
component. It appears that there might have been some failure of
the backup redundancy system too. But, we don't know for sure at
Q. How many redundancy systems are installed on a
A. As to the critical
flight data displays, which the pilots and autopilot must
have to navigate the plane safely, the ADIRU is the primary system,
and the SAARU is the secondary backup redundancy system. Both
systems access redundancy inputs, such as internal gyros,
accelerometers, air data module inputs (center, right and left
modules), 3 pitot tubes , 2 angle of attack vanes, and 3 static
ports. There is also a:
----Standby attitude indicator, which
displays SAARU attitude.
----Standby airspeed indicator, which
displays airspeed calculated from two standby air data modules (one
pitot and one static), and displays that information in both digital
and pointer readout forms.
----Standby altimeter, which displays
altitude from the standby (static) air data module, in both digital
and pointer readout forms.
----Standby liquid magnetic
"whiskey" compass, which all airplanes have.
The B-777 also has many other essential
redundancy systems, which are not relevant to this particular air
data system failure.
B-777 cockpit panel, showing from left to right: PFD, ND (navigation
display), standby attitude, airspeed and altitude displays (vertical
column), EICAS display & magnetic compass (top of windshield center
Q. How safe is fly-by-wire in general----aren't the pilots fully
dependant on the computer systems, even though there is a lot of redundancy? Is fly-by-wire really more safe than the
conventional systems installed on the 747's or is it just the less weight
safe. Fly-by-wire control systems have been used in military
fighters for many years and in a variety of airliners for up to 17
years. The actual control system of the B-777, like other
fly-by-wire planes, has multiple, independent backup computer modules,
to ensure that any failure will not cause loss of control of the
airplane. The saving of both weight and long term maintenance are
very important design issues, in modern airliners. It is important
to understand, that the air data accuracy
failure, in this Australian incident, had nothing to do with the
fly-by-wire control design. Nearly identical type air
data systems are also found in the B-757, B-767, and the
B-747-400, and those planes do not have fly-by-wire
The inputs from the air
data systems inform the pilots/autopilots what is the
position, speed, acceleration, altitude and attitude of the plane.
With that accurate information,
those pilots/autopilots can then tell the controls what to do, to keep
the plane on the desired navigation course.
redundancy backup systems, which power the fly-by-wire
controls, enable those controls to respond to whatever commands they
receive----from the pilots or the autopilots----which are in turn
responding to air data information presented to them .
Q. How could the pilots land the aircraft as according to reports
the autothrottle system remained armed?
A. Because the
throttles on the Boeing planes are "real" throttles, in the
sense that the engine fuel controllers respond to the mechanical
movement of those throttles, by the pilots. In other words, even
if the autothrottle system cannot be turned off, the pilots can
overpower any automatic movements of those throttles, just by the pilot
holding those throttles in what ever position he wants them.
It is my understanding that
the throttles on Airbus planes are not "real" in that
sense. If the autoflight system on an Airbus plane commands more
engine thrust, but the pilot disagrees, the autoflight computers win the
battle and the pilot pulling the Airbus thrust levers back towards idle,
will not reduce the computer-commanded engine thrust.
If any airbus pilot finds
that not to be an accurate statement (I flew Boeing airliners, but never
any Airbus airliners), then please send me an Email and I will be happy
This is the first time I have ever heard
of this kind of incident on a B-777, which has been in commercial
operation since about 1995. It should be noted that although the
pilots had a real serious problem on their hands, the remaining standby
systems, and the ability of the pilots to fly the plane without
autopilots engaged, proved to be the ultimate backup systems which
enabled a safe outcome.
The key is pilot simulator training.
They learn how to fly their planes, even when most of the usual flight
data information is no longer available and, most importantly, how to
quickly identify when the flight data information being presented, is no
longer to be trusted.
So long as they have some form of attitude
information available, they can successfully fly the airplane to a safe
landing just with a knowledge of what amount of engine power will produce
what kind of speed, in any given configuration. Obviously, the
pilots of that particular B-777, were very well trained.
I will be happy to update this FAQ when
more information from the investigation is made available from the
September 29, 2005
Robert J. Boser
Return to FAQ page