Today’s integrated avionics typically depend on electronic systems for their orientation information, part of the avionics’ attitude heading reference system (AHRS). The AHRS deploys some combination of rate gyros and accelerometers, each of which have their own strengths and weaknesses. Many need supplemental information, both as raw data and as a cross-check for accuracy. For navigation. a separate unit typically will include at least one WAAS GPS receiver.
Some additional information is needed: air data, including pressure and temperature, used to help determine how high and how fast the airplane is traveling. For example, airspeed is derived from the pressure difference between the pitot tube and static air. A differential pressure sensor has replaced the mechanical bellows of the old airspeed indicators. Altitude is determined solely from static pressure measurement. Although the sensor technology has changed, the underlying infrastructure—pitot tubes, static port lines—hasn’t. What happens to the integrated flight deck when it senses an old-fashioned problem like a plugged pitot tube?
SYSTEM BLOCK DIAGRAM
One answer can come from looking at your system’s architecture and asking questions. Although we’ll focus on the Garmin G1000 flight instruments block diagram, the same basic principles apply no matter which brand you’re flying. The AHRS is a good place to start since it generates half of the flight-critical data. What are the inputs?
First is the magnetometer, as expected. According to Garmin’s Bill Stone, Senior Business Development Manager, “The AHRS sensors in the G1000 and our other integrated systems utilize three independent sources of overlapping data for aiding and monitoring the MEMS [micro-electro-mechanical-system] sensors in the AHRS; GPS data, air data, and 3D magnetometry. This provides a robust, high-integrity and fault-tolerant solution. Loss of any one of those sensor inputs do not result in degraded attitude determination.” He added that the AHRS would use the air data information if the aircraft was in a GPS-denied service area.
WHAT CAN GO WRONG?
Suppose you don’t have the G1000’s redundancy and only have one GPS and no other velocity information source going into your AHRS. If you lose the single GPS, you also will lose all attitude and heading information. Likewise, a few avionics systems don’t use GPS aiding but rely on air data.
If your block diagram doesn’t show a GPS input to the AHRS but just an air data connection, you could be in for a surprise if the air data computer (ADC) fails. In this case, if the air data fails, you have lost all flight-critical information in one fell swoop. There is no attitude, heading, airspeed, altitude or vertical speed available; instant partial-panel. What can cause loss of air data? The ADC could go belly up, but at least that provides a “flag” to alert you there is an issue. A more dangerous failure not normally flagged is a blocked pitot or static line.
Modern digital integrated avionics systems feature reduced pilot workload…until something fails. An example of this is the Boeing 737 Max. A single stuck AoA vane could cause the maneuvering characteristics augmentation system (MCAS) system to eventually (within tens of seconds) go to full nose-down pitch trim. It was the worst system design error I have seen in my avionics career. Boeing fixed that but still has an overly integrated system. Yes, even in the recertified 737 Max, an AoA failure will cause red Xs to be displayed over the airspeed, altitude, vertical speed and Mach number. There can be a couple of reasons Boeing linked the AoA and air data system.
The first is to provide a more accurate static source error correction (SSEC), and the second is to correct the small error on the pitot tube at a higher angle of attack. (In aircraft that operate in the subsonic Mach region, the static ports develop an error at higher speeds.) The SSEC corrects that error. Business jet systems use a correction based on the Mach number. (In other words, the 737 Max’s SSEC correction did not rely on another system.)
The same “fuzzy thinking” is true for correcting the pitot pressure (total pressure) for the angle of attack. Yes, it can correct for approximately a three percent error, but the problem with that is a failure in the AoA ripples through to now cause the air data instruments to “fail.” In my view, AoA failures should be limited to stall warning/stall protection systems and air data failures should be limited to airspeed instruments and associated flight director modes. System integration is good, but it can be overdone. When integration is overdone, it is difficult for the flight crews to sort out the source of the problem.
UNFLAGGED FAILURES
Common causes of plugged or blocked pitot lines include insects, trapped water or an iced-over pitot tube. The pitot tubes have a drain hole for water, but these can be overwhelmed during a pressure washing or a flight in heavy rain. Additionally, water vapor (think hot, humid air) can enter the probe and condense past the pitot drain hole. That condensate can cause errors in airspeed, due to constriction of the line, or total blockage. The piezoresistive silicon sensors often deployed in this role are more sensitive to moisture than mechanical airspeed indicators. The water trapped in the line is also a concern if it freezes. Many general aviation aircraft have a connection installed at the lowest point in the line. The line can then be opened to drain any water and then resealed. Some Piper models employ a cabin-mounted push-to-activate drain for clearing water from the line.
For the static ports, the usual reason for a blocked line is tape not being removed after painting, waxing the aircraft or maintenance. Water can also enter the static pressure lines, although it is not as frequent as with pitot systems. Usually, light aircraft do not have static port heaters. However, most light aircraft have a method to drain any accumulated water similar to the pitot line.
With today’s integrated avionics systems incorporating envelope protection, be wary of letting the autopilot fly the airplane when the air data information is “squirrelly.” Why? The envelope protection uses the autopilot to control the pitch to prevent a stall or over-speed condition. If the airspeed is erroneous but without a “flag” or invalid indication, the autopilot will assume it is good and still use it. The autopilot will continue to use the erroneous airspeed until you turn off the autopilot or the airspeed goes out of range. I would recommend a “collar” on the autopilot circuit breaker so it can be easily identified and pulled if necessary.
That said, you may not have a choice. A variety of conditions can disable the autopilot, by design. For example, Diamond’s DA40 NG airplane flight manual says the following conditions will automatically disconnect the GFC 700 autopilot:
- Electrical power failure
- Internal autopilot system failure
- AHRS malfunction
- Loss of air data computer information
PLUGGED LINE PRESENTATION
Since a plugged line happens infrequently, there will be a natural startle factor. The startle factor is especially true on takeoff. The pilot flying should habitually check, then announce, “airspeed alive,” during the takeoff roll. However, even though the airspeed has become “alive,” it doesn’t mean everything is fine. If the pitot line is blocked during the takeoff roll and you haven’t picked up on the problem before you lift off, you’ll see low airspeed, which will slowly recover as you climb.
In this case, the pressure sensor will see a constant pressure (field elevation) on the pitot side and a decreasing static pressure as the aircraft climbs. (For every 1000 feet of altitude, the pressure decreases by approximately one inch of mercury.) Therefore, the sensed dynamic pressure and the displayed airspeed will increase as the aircraft climbs. Since the differential pressure is higher than usual, the airspeed will continue to increase as you climb and accelerate past the actual airspeed, moving toward the high-speed limit.
However, if the blockage is in the pitot tube itself, before the small drain hole(s), the airspeed will stay at zero. (The drain hole provides near-static pressure to the pitot side of the pressure sensor). With a blockage limited to the pitot line, the altimeter and VSI will operate normally.
If the static ports are blocked, the airspeed will initially be okay, but the static pressure will not decrease with altitude as it should. Since the air is trapped, the pressure in the static port lines will still indicate the air pressure at the departure airport. If you are climbing normally at a set airspeed, the indicated airspeed displayed will decrease rapidly in the climb. Why?
Assuming you are climbing at a fixed airspeed, the differential pressure between the incoming air (total pressure) and “stuck” static pressure will decrease during the climb. Besides “airspeed alive,” “positive rate” should also be a standard callout. With a plugged static source, you should have noticed the altimeter and VSI haven’t budged after liftoff, but if you concentrate on the airspeed decay and push the nose over to maintain what you think is the proper airspeed, that could be a fatal mistake. Check the airspeed against the pitch and angle of attack indicator.
In the “old days,” a blocked pitot tube was less severe than a blocked static line because the former only affected the airspeed indicator. However, today with integrated avionics’, a blocked pitot tube can affect more than just the displayed airspeed.
Several avionics manufacturers have integrated envelope protection into their avionics systems. If the system detects an airspeed that requires stiffening the pitch-feel or pushing the nose down to prevent stalling or pitching up to prevent overspeed, the system will do that. It’s fine normally, but it isn’t when you have an air data “plumbing” issue. It is difficult for the avionics to detect a blocked pressure line. While it is easy for the avionics to check if the pitot heater is working, checking for a blockage is not. The best the avionics can do is check if the pressure is outside the nominal range. Sophisticated monitoring could be done beyond an out-of-range check, but most heavily monitored electronic systems have had more issues with the monitors than with the system itself.
There are a few interactive pitot/static system simulators available online. These allow you to block the pitot, static and drain holes alternately and then climb or descend. It’s a lot safer than experimenting on your aircraft. It also allows the selection of the alternate static source.
One such simulator can be found at luizmonteiro.com, pictured at right. It’s worthwhile to experiment with it to appreciate the “confusing” information caused by a simple blocked line. When you use the simulator, run the cursor along the baseline to simulate gaining airspeed during the takeoff roll before climbing.
WHAT DO I DO NOW?
If you get into such a situation, there is a lot to think about. Determining what information is correct and what is erroneous will require good systems knowledge. There have been many accidents caused by incorrect airspeed information (e.g., Air France Flight 447).
First, don’t jump to conclusions or fixate on one instrument. What other information can you use to determine what is false and what is true? An angle of attack indicator (sensor-based, not derived) is worth its weight in gold in this situation.
You should also know, from memory, the appropriate pitch and power settings for that phase of flight. You should then check the current pitch and power versus what is displayed on the air data instruments. Unless you have already gotten into an unusual attitude, don’t get wild with pitch or power changes beyond what is normal for that phase of flight.
With a plugged static line, in a non-pressurized aircraft, you can switch to the alternate static source that vents to the cabin. There will be some error in the altitude due to the difference between the inside cabin pressure and the outside pressure, but it should be manageable.
ATC HELP
If you are having a problem with the static pressure line, don’t make the mistake of thinking ATC can tell you the aircraft’s altitude. The source of the altitude for the transponder (what ATC sees) is from the same static port as your altimeter. It doesn’t matter if the transponder gets its pressure altitude from an “altitude encoder” or an air data module/computer. The pressure is from the same static source. The controller can help by giving you your groundspeed, but if you have a plugged static system, the altitude they show will match what you see in the cockpit. No help there. Switch to your alternate static source. Where ATC can help is vectoring you to VMC conditions.
Having erroneous airspeed and altitude and possibly losing the attitude information on the PFD is a serious situation. If in VMC, stay in VMC; do not enter IMC. If already in IMC, work with ATC to vector you to visual meteorological conditions. You might think, “I’m fine; I can fly using the standby instruments,” but an upset or turbulence can make things very demanding and having a good visual reference helps immensely.
EPILOGUE
More and more avionics systems are incorporating safety enhancements to protect pilots from themselves. However, what happens when a sensor fails and the pilot isn’t overspeeding or stalling the aircraft? It is imperative to study and understand the systems, whether flying a Cessna 172 or a TBM 900.
Bob Teter is a retired CFI who also had a design/flight test career with some of the biggest names in avionics.
