Boeing Changes 737 Wiring, Checklists After Airspeed Incidents

[1stspotter]

Boeing has made changes to its Boeing 737 pitot tube heating systems and checklists following an incident report by the Irish Air Accident Investigation Unit (AAIU).

That report, published Dec. 19, details a serious incident in which the crew of a Ryanair Boeing 737-800 on an instrument arrival to the Riga Airport in Latvia in snow and ice conditions on Jan. 7, 2012, experienced divergent airspeed indications and other warnings, including an extended stick shaker activation, with no annunciation of the pitot heater short circuit that was the root cause of the problem.

During the investigation, Ryanair told the AAIU that it had experienced 20 events of unannounced pitot heat failures on its 737-800s in 2012 alone, and that the issue was a “fleet-wide problem” that has occurred on all makes of 737 next-generation aircraft.

“[Ryanair] informed the Investigation that it and other operators had brought the failure of the pitot probe heater warning system to the attention of [Boeing],” the report says. “It stated that [Boeing] had consulted with the Federal Aviation Administration (FAA) and the European Aviation Safety Agency (EASA) who agreed in 2011 that the current rate of unannounced pitot probe heater failures met the FAR 25 requirements and that it was not therefore a safety of flight issue.”

continue here
Boeing Changes 737 Wiring After Airspeed Incidents (http://www.aviationweek.com/Article.aspx?id=/article-xml/awx_12_26_2013_p0-650287.xml&p=1)

[PEI_3721]

“It stated that [Boeing] had consulted with the Federal Aviation Administration (FAA) and the European Aviation Safety Agency (EASA) who agreed in 2011 that the current rate of unannounced pitot probe heater failures met the FAR 25 requirements and that it was not therefore a safety of flight issue.”

With hindsight, the authorities’ attitudes do not inspire confidence in the safety process particularly from a systematic view, which requires consideration of the conjunction of small or apparently unrelated factors in accidents.
The failure rate of probe heaters per se is one convenient measurement (data), but a heater failure in ice/IMC, where the probability of a multiple failure is equally likely and thus reversion to stand-by speed / procedures could represent a significant change in risk. Systems thinking (joined up thinking) might enable ‘data’ to become realistic safety information.

To state that this is ‘not a safety of flight issue’ is glib; at least there should be an acknowledgment of the change of risk, and then explain how it might be mitigated. The judgement given here is another case of ‘the crew will manage’; but if they cannot – blame and train. Whereas a reassessment of the risks and assumptions, a major event might be avoided by identifying critical operational scenarios where a failure would be a high risk issue.

Just because a system meets the requirements does not infer safety; there is a process of continuing airworthiness requiring reporting and assessment – which in this incident (and others) the operator complied with, but apparently the FAA glossed over.
Latent failures are (undetectable) hazards; there may be similarities here with a latent failure of the configuration warning system cf MD 80 Madrid, a previously approved system under grandfather rights yet improvements were available. Then there was AF447 !

Also, do the “two cases where both engines simultaneously experienced a thrust instability event” (http://www.aviationweek.com/Article.aspx?id=/article-xml/awx_02_08_2013_p0-547025.xml), reflect similar single-channel safety thinking?

[stator vane]

The ship of state moves rather leisurely?

[RAT 5]

that the current rate of unannounced pitot probe heater failures met the FAR 25 requirements and that it was not therefore a safety of flight issue.”

I suspect they did the usual assessment of failures/X000 sectors and decided it was within the acceptable parameters of risk. How do they arrive at these figures? How do they know the crews will be able to cope? Considering the number of events where crews have plunged a perfectly good a/c into the ground, even when visual, it beggars belief that they can be so smug and adopt such a blasé attitude. This conclusion, even, was after the Air France A330 stall due to pitot heater failure. Amazing. Usually it takes a smoking hole to arrest this kind of thinking, yet it did not. I can well imagine that some crews, especially in this reduced cockpit experience age accompanied with reduced basic hand doing skills and awareness, would be very hard pressed to handle such a failure with calm aplomb. What if the failure was dual?
I've spoken to pilot friends in various B737 companies and they've heard nothing of these failures, yet RYR say they've had quite a few. I can then assume others have too. Has there been an increase in basics skills recurrency as a consequence? Doubt it.

[Heads Up]

I think the point that perhaps has been missed is that report refers to 'unannounced' pitot probe failures that result from partial heater failures. That means that there are no obvious cues for the crew apart from the PFD annunciations.

[RAT 5]

By that I presume you mean there is an odd IAS indication, but not an associated Pitot heater light malfunction. Again, considering the level of basic flying skills we hear about, this is not a matter to be taken so lightly. The dependance on automation, and the belief that with all the back ups very little critical can go wrong, then these subtle failures which require the pilot to be the back-up are more worrying than this blasé dismissal gives them credit for. Or am I mis-reading something here.

[Denti]

How do they arrive at these figures? How do they know the crews will be able to cope? Considering the number of events where crews have plunged a perfectly good a/c into the ground, even when visual,

While that is true, the cases, where crews coped with those issues and nothing ever popped up on avherald or in the newspaper, because nothing really happened, might be much higher. They certainly are in my company as we never lost an aircraft to an ASI malfunction although quite a few happened.

Regulators usually do have those figures and can therefore make a much more informed decision than us Monday quarterbacks that only get a very limited data set. I do not say that that decision is always correct, just that a lot more data is available to those making those decisions than it is to us.

[Aluminium shuffler]

The earlier responses of the FAA and EASA demonstrate perfectly how they are managed by bureaucrats, accountants and lawyers, with no apparent useful input from anyone with operational flight experience. Both are unfit for purpose, keen on their roles to "promote" aviation, but both unkeen on properly regulating it.

[PEI_3721]

Without a pitot-heat alert, the crew need sharp awareness of the aircraft’s flight path in order to detect an ‘unreliable airspeed’ failure. There may be an ADC (speed) comparator alert (if fitted), and if so it might be possible to identify an erroneous system by comparing values amongst the three airspeed displays.
However, does the 737 have three pitots, or is the standby instrument fed from one of the two main system pitots? Even with three independent systems, what probability is there that two pitots will ice up at the same time resulting in the choice of airspeed shown on the two erroneous displays?

Modern safety management requires that incidents are investigated in depth – paying attention to small changes; several failures in the same system and all due to the same cause is not a small change. Furthermore, with the subjectivity in determining the failure, then these reports must flag-up a safety warning.
The industry may not have ‘lost’ a 737 due to this so far, but how long are we prepared to wait for an event which with hindsight could tell us that the decision to carry-on as normal was wrong.
This situation requires foresight - foresight is about the changing patterns of risk before failure and harm occurs.

[Aluminium shuffler]

The 737NG does have three separate pitot heads on the nose for the two ADIRUs and the standby ASI (in addition to the two on the fin for the Elevator Feels Shift and Stall Management Yaw Damper systems) and also independent unheated cross linked static port pairs (one on each side) for the ADIRUs and the standby instruments.

[tdracer]

I have no direct knowledge of the system or failures in question, and I don't work 737, but this how the system works:


During the certification of an airplane, the airframer will perform, for each system, an FHA or SSA (Failure Hazard Analysis or System Safety Analysis - basically the same thing and the terms tend to be used interchangeable).
This analysis looks at the known or potential failure modes of the system in question, the probability of failure, and the effect of that failure. These affects are then grouped based on the 'severity':
Minor: Slight reduction in functional capabilities or safety margins
Major: Significant reduction in functional capabilities or safety margins
Hazardous: Large reduction of functional capabilities or safety margins, possible serious injury or fatality to a small number of passengers
Catastrophic: Hull loss and/or multiple fatalities
For example, in my area, a single engine shutdown or loss of thrust control is typically Major, although an uncontrolled overspeed or uncontained rotor burst can be Hazardous or catastrophic (depending on the flight phase). The risk classifications are based on expert analysis and historical data/past experience, and agreed to by the FAA/EASA specialists (and trust me, getting an FMEA/FHA FAA or EASA approved is not a rubber stamp)


There are 'acceptable' average probability numbers associated with each - Minor is 10-3/hr., Major is 10-5/hr., Hazardous is 10-7/hr. and Catastrophic is 10-9/hr.


As long as the fleet experience is in line with or better than those fault probability numbers, the risk is deemed acceptable (which isn't the same as saying action isn't needed to correct a chronic problem, just that it's not considered a significant safety issue).


This of is all covered in FAR/CS 25.1309 and the associated advisory circulars.

[roulishollandais]

Amazing. Usually it takes a smoking hole to arrest this kind of thinking, Probably the limit is reached. Managers think that Courts will not unlessly state as understanding nothing. They fear they will have to pay and to be sent in jail. They are opening three umbrellas.

[safetypee]

Although the certification and continued airworthiness processes are well proven, they remain probabilistic. The industry enjoys a high level of safety, but still suffers rare serious accidents. Safety solutions for these require new or alternative ways of looking at safety. These views involve a systems approach – organisational / systematic thinking for scenarios where there may be many contributing factors, which in isolation meet requirements, but in coming together in specific situations result in an accident.

A ‘resilient’ approach requires focus on small signals and continuous checks on the safety processes for any change – a drift form the norm, or operating with a smaller safety margin.
In isolation a pitot failure may only be a minor airworthiness issue (just a probability), but the number of occurrences, although not actually expected (reality), are accepted (probability). However the events still warrant a check as a ‘small signal’ – something may have changed.
These events also provide opportunity to check the airworthiness process – mechanical systems are rated as probability, but if the defences (after the failure) increasingly depend on human activity, probability is less applicable. The choice of action/inaction becomes a judgement often based on assumptions ("it’s not significant – the crew will manage"). Thus first test your assumptions; second publish and test them in mitigation.

With hindsight the assumption that all pilots can fly without airspeed, and in all normal circumstance because the appropriate training had been given, and that it will be correctly recalled and used, might be questionable after AF447.

What lessons might hindsight provide for the industry in the event of a 737 pitot incident?
Were the certification and airworthiness processes adequate, or the assumptions valid. We can question, check, and test those items now, before it’s too late, but this requires a new way of thinking for the regulatory agencies – Resilience (www.eurocontrol.int/eec/gallery/content/public/document/other/conference/2009/safety_r_and_d_Munich/Resilience_engineering.pdf) and From Safety 1 to Safety 2. (www.skybrary.aero/bookshelf/books/2437.pdf)
Eurocontrol are looking for a new direction, new ways of thinking, but are the FAA and EASA considering similar activities?