What is the status of the Australian investigation, concerning the failure of critical flight data presentations to the pilots, during a B-777 flight from Perth?

The investigation of that incident is still ongoing.  The Australian TSB has not as yet, issued a final report on this incident.  The following is my summary of that Preliminary report.

On August 1, 2005, a Boeing 777-200, which had departed from Perth, received an EICAS (Engine Indication and Crew Alerting System) warning of  low airspeed, as the plane was climbing through FL (flight level) 380.  Simultaneously, the aircraft’s slip/skid indication moved full right, on the PFD (Primary Flight Display). The PFD speed tape also displayed contradictory information: that the plane was approaching both the high speed limit and the low speed (stall) limit. The aircraft, still connected to the autopilot, pitched up and climbed to approximately FL410 as the airspeed decreased from 270 kts to 158 kts. The stall warning devices also activated.

The PIC (pilot in command) "disconnected the autopilot and lowered the nose of the aircraft. The autothrottle commanded an increase in thrust which the PIC countered by manually moving the thrust levers to the idle position. The aircraft pitched up again and climbed 2,000 ft." The PIC advised ATC "that they could not maintain altitude and requested a descent and radar assistance. The crew was able to verify with ATC the aircraft speed and altitude."

The PFD indications became accurate again as they were descending through FL200. The PIC attempted to use both the left and right autopilots, but had to turn them off after each one produced undesired command responses.  "There were no control difficulties experienced when the aircraft was flown manually, but the autothrottle `arm’ switches remained in the `armed’ position."

ATC radar vectors put the plane in position to conduct an ILS to R 03 at Perth. When they reached 3,000 ft, the PFD again began indicating erroneous low airspeed information. The autothrottle again responded by advancing the thrust levers. Since the pilot can override that command, simply by manually adjusting those thrust levers, the plane was able to land safely at Perth.  

The FDR (flight data recorder), the CVR (cockpit voice recorder) and the ADIRU (air data inertial reference unit) were removed from the plane, for a detailed examination. Under the supervision of the American NTSB, the ADIRU was shipped to its manufacturer for detailed analysis.

The FDR data confirmed the erroneous acceleration values had been displayed on the PFDs, as the pilots reported.   The ADIRU produced those erroneous acceleration values and they were used by the PFC (primary flight computer). As it was designed to do, the PFC compared the information from the ADIRU, to the information coming from the SAARU (Standby Air Data and Attitude Reference Unit). That comparison ability enabled the PFC to reduce the severity of the initial pitching motion of the aircraft.

The last comment in that Preliminary Report:

As a result of the occurrence, the aircraft manufacturer issued a Multi Operators Message on 9 August 2005, recommending to all B777 operators that the aircraft should not be flown with an unserviceable SAARU.

That comment perplexes me a bit.  Since the SAARU is an essential redundancy backup component for critical flight instrument display data, all operators of the B-777 know it is a required dispatch item for all flights.  Why then was it necessary to remind them that they should not fly the plane without that unit operating properly?

Additional Q and A:

Q.  How could this happen? 

A.  We don't know yet.  The object of the investigation will be to find an answer to that question, so that it will not happen again.  The preliminary report states that the erroneous data was coming from the ADIRU.  But as to why the SAARU backup data was not selected and displayed, as it was designed to do----that remains to be determined.  It does appear that this was not merely a failure of a critical component.  It appears that there might have been some failure of the backup redundancy system too.  But, we don't know for sure at this time. 

Q.  How many redundancy systems are installed on a 777?  

A.  As to the critical flight data displays, which the pilots and autopilot must have to navigate the plane safely, the ADIRU is the primary system, and the SAARU is the secondary backup redundancy system.  Both systems access redundancy inputs, such as internal gyros, accelerometers, air data module inputs (center, right and left modules), 3 pitot tubes , 2 angle of attack vanes, and 3 static ports.  There is also a:

----Standby attitude indicator, which displays SAARU attitude. 

----Standby airspeed indicator, which displays airspeed calculated from two standby air data modules (one pitot and one static), and displays that information in both digital and pointer readout forms.  

----Standby altimeter, which displays altitude from the standby (static) air data module, in both digital and pointer readout forms.

----Standby liquid magnetic "whiskey" compass, which all airplanes have.

The B-777 also has many other essential redundancy systems, which are not relevant to this particular air data system failure.

B-777 cockpit panel, showing from left to right: PFD, ND (navigation display), standby attitude, airspeed and altitude displays (vertical column), EICAS display & magnetic compass (top of windshield center post).

 

Q.  How safe is fly-by-wire in general----aren't the pilots fully dependant on the computer systems, even though there is a lot of redundancy? Is fly-by-wire really more safe than the conventional systems installed on the 747's or is it just the less weight issue?

A.  Extremely safe.  Fly-by-wire control systems have been used in military fighters for many years and in a variety of airliners for up to 17 years.  The actual control system of the B-777, like other fly-by-wire planes, has multiple, independent backup computer modules, to ensure that any failure will not cause loss of control of the airplane.  The saving of both weight and long term maintenance are very important design issues, in modern airliners.  It is important to understand, that the air data accuracy failure, in this Australian incident, had nothing to do with the fly-by-wire control design.  Nearly identical type air data systems are also found in the B-757, B-767, and the B-747-400, and those planes do not have fly-by-wire controls.  

The inputs from the air data systems inform the pilots/autopilots what is the position, speed, acceleration, altitude and attitude of the plane.  With that accurate information, those pilots/autopilots can then tell the controls what to do, to keep the plane on the desired navigation course.  

The multiple redundancy backup systems, which power the fly-by-wire controls, enable those controls to respond to whatever commands they receive----from the pilots or the autopilots----which are in turn responding to air data information presented to them .  

Q.  How could the pilots land the aircraft as according to reports the autothrottle system remained armed?

A.  Because the throttles on the Boeing planes are "real" throttles, in the sense that the engine fuel controllers respond to the mechanical movement of those throttles, by the pilots.  In other words, even if the autothrottle system cannot be turned off, the pilots can overpower any automatic movements of those throttles, just by the pilot holding those throttles in what ever position he wants them.  

It is my understanding that the throttles on Airbus planes are not "real" in that sense.  If the autoflight system on an Airbus plane commands more engine thrust, but the pilot disagrees, the autoflight computers win the battle and the pilot pulling the Airbus thrust levers back towards idle, will not reduce the computer-commanded engine thrust.  

If any airbus pilot finds that not to be an accurate statement (I flew Boeing airliners, but never any Airbus airliners), then please send me an Email and I will be happy to correct.  

This is the first time I have ever heard of this kind of incident on a B-777, which has been in commercial operation since about 1995.  It should be noted that although the pilots had a real serious problem on their hands, the remaining standby systems, and the ability of the pilots to fly the plane without autopilots engaged, proved to be the ultimate backup systems which enabled a safe outcome.  

The key is pilot simulator training.  They learn how to fly their planes, even when most of the usual flight data information is no longer available and, most importantly, how to quickly identify when the flight data information being presented, is no longer to be trusted. 

So long as they have some form of attitude information available, they can successfully fly the airplane to a safe landing just with a knowledge of what amount of engine power will produce what kind of speed, in any given configuration.  Obviously, the pilots of that particular B-777, were very well trained.  

I will be happy to update this FAQ when more information from the investigation is made available from the Australian TSB.

Return to FAQ page