You’re basking in the glow of your high-tech primary flight display and make a slight attitude correction to level the wings. The bank hadn’t even resulted in a heading change because you caught it so quickly.
But the wings don’t level. In fact, you seem to be turning even more now. So you bank more—and realize you’re turning faster in the wrong direction. Snap your attention to the backup AI; it’s also banked, but opposite the PFD. You level the wings using the backup AI and the heading holds steady, but way off course.
About this time, a message pops-up suggesting you cross-check your attitude due to possible AHRS failure—and ATC calls with, “Say heading?” And to yourself you say, “Oh, $#^%.”
Where’s My X?
I’ve seen AHRS failure in a GA airplane exactly once. I was focused outside the window in VMC, so the first thing I noticed was that the blue-and-orange background display simply went black. Airspeed, altitude, heading and other information trucked happily on. As did I, because it was a beautiful day, and I was blissfully confident the checks and balances of the glass panel had worked exactly as the engineers anticipated and the marketing folks had advertised.
A friend of mine with an Avidyne Entegra system had a slightly different experience. He was practicing approaches is VMC just for fun. He was alone, so he wasn’t under a hood. The day was clear and quiet as he was vectored on a base leg to the ILS Runway 29 into Portland, Maine.
The first thing he noticed was that the attitude display was simply wrong. With a perfect horizon outside the airplane, it was easy to see the AI was listing to one side. With safety never in doubt, he proceeded with the approach. Being a clear day and sans safety pilot, he wasn’t concentrating on the PFD. A glance to the backup AI showed he still had an attitude indicator if it became necessary.
Intercepting the localizer meant turning into the setting sun; the glare was overpowering. This made ignoring the giant—but incorrect—artificial horizon much more difficult and seriously disorienting. In addition, the airspeed, altitude, and HSI he needed to follow the approach were on that same PFD so he had to read those while disregarding the tilting horizon behind them—an undertaking that was far more difficult than he imagined.
The confusion was compounded by a heading that couldn’t be correct. Remember that he had a digital HSI, so the incorrect heading made it appear he was 30 degrees off the inbound course and about to blow through the localizer. In reality, the runway was straight off the nose. The crosswind component calculated on the display, which was a regular reference item on instrument or visual approaches, was comically impossible.
Only then did the “Crosscheck attitude” warning appear on the PFD. Granted, this was probably only minutes into the actual failure, but certainly not before there was time for ample confusion. A warning that the autopilot was inoperative also came up, but he was hand flying. What if this had been in low IMC, or the autopilot had been coupled when things started going haywire? That’s the stuff of which nightmares are made.
Just before an uneventful landing, the HSI vanished, replaced by a big, red X. Luckily, it all worked out without incident. He even got these photos for us.
Need a Bigger Sticky Note
Ignoring an incorrect attitude display is more difficult than you might think. A handy little IFR tool back in the days of round gauges was to use a sticky note to cover any offending instrument with a quick slap. A folded dollar bill might also do the trick in a pinch.
Imagine, if you can, you’re centered on final, with wings confirmed level with the standby AI, tracking right down the pipe, and the entire horizon image behind all your instruments is leaning to the left, along with that large, bright primary AI in the middle. In this PFD failure there was no way to remove the faulty attitude display without losing other critical information. Covering or turning off the screen would remove primary airspeed, altitude, heading and the CDIs. Granted, heading eventually failed as well in this case, but another failure mode on some systems might not.
Therefore, if you’re a glass-panel pilot you must be ready to fly with conflicting information on your PFD unless you want to give up the whole thing. Don’t count on red Xs appearing right away, or at all, even if that’s the behavior claimed in the book. Software engineers are professionals, but not clairvoyants. They’ll program the systems for foreseeable failures. A weird combination of events that gives false positives could well go undetected because it was not foreseen—otherwise there would be software to prevent it or warnings in the manual.
Real World Practice
The moral to this story is a big, fat “Now what?” How do you prepare for what by definition you don’t expect?
In lieu of a great answer, here’s a decent one: Start with the failure modes you should expect but probably aren’t practicing. Some are easy. Full PFD failures can be replicated in flight by dimming displays (or using a whole pad of sticky notes). This at least keeps you competent on just removing the vexing display completely and carrying on.
Watch for the spider web of connections. For example, if heading is lost on your PFD, your MFD may switch from heading-up to track-up or north-up. Traffic and lightning displays will also likely fail. What if it’s a GPS failure? Does your MFD automatically switch to GPS 2 or does that particular failure require you to detect it and manually switch over? If your MFD reverts and becomes a PFD, what information is now hidden or unavailable? On a G1000, you now have a tiny map and flight plan display. Practice with that enough and you’re never at a loss for finding critical information. But, if you never practice with that, you could be in for an unpleasant shot of adrenalin someday.
Some dependencies may surprise you. Many PFDs, including Garmin and Dynon, need either a valid GPS or air-data input for their attitude display to work. (Avidyne does not.) Aspen displays require valid pitot-static data for proper attitude, although a planned upgrade will allow attitude information to survive a pitot-static failure.
Also think about alternate sources for the lost information. If you’re used to using track over the ground on your PFD (a pink diamond on G1000 displays or a white dashed line on Avidyne), you might not have TRK as a field any more on your MFD or other GPS displays. Can you find that in a pinch? How about the CDI display on your GPS itself? When was the last time you used it for navigation?
Your head position and motion is physically different. Cirrus pilots stare at their knees, while G1000 pilots get a CFII’s cramped neck from flying gauges halfway across the cockpit. G500 and Aspen pilots could be looking at any combination of places for information. All that hunting around can lead to vertigo.
Don’t count on an iPad to save you here, either. Integrating a heads-up display from a portable as a backup takes practice. It’s also a great source of vertigo if the iPad is in your lap. I know because my first bungled practice flight using the iPad for attitude information forced me to step out of the airplane right after landing just to keep my lunch.
The perfect practice environment would be a simulator, of course. My experience is that there are two problems here. Commonly available simulators that use virtual avionics such as home sims or the Redbirds, replicate the real avionics and cockpits with enough fidelity to practice catching the errors, but not all the strategies for coping. Sims with real avionics and actual cockpit layouts aren’t available to most pilots, especially for aftermarket installations like a G500 or Aspen system.
There is one bit of practice you can do in your own aircraft every time you fly. Call it, “The Lost Art of Cross Check.” While I’ve had only one AHRS failure, I’ve lost three conventional attitude indicators and one vacuum pump that took both the AI and heading indicator. Two of those failures were in actual IMC.
This bred a healthy mistrust of metal gyros that I should apply more actively to their digital brethren. I cross check instruments with glass panels… almost never. But my friend’s experience proves I need to make that a new habit, particularly during critical phases of flight when I’m already task saturated and the window to recognize and recover is small.
Prepping for the Unexpected
One pilot’s experience on one avionics installation doesn’t mean this is a potential failure mode of your avionics. However, you must remember that real equipment in real skies sometimes displays the indecency of failing in unprecedented ways. Even if a failure is detected and handled as engineered, it’s not what you expected and is rife with surprise consequences.
The takeaway is that it’s worth digging into the actualities of your own setup and remaining as prepared as practical. Even if that just means carrying a few pads of sticky notes.
Jeff Van West is a freelance aviation writer and trainer trying not to become a paranoid old fart who mistrusts all new technology. He already talks to himself. Or maybe that’s just Bluetooth.
Avidyne Comments
Today’s glass panels are amazingly reliable. Failures seldom occur, but they do occur as witnessed by the flight outlined in the article. To gain further understanding of the system’s behavior, Avidyne analyzed the system performance. Their findings and conclusions should serve as fodder for careful thought by anyone using an EFIS in general aviation, regardless of manufacturer.
Avidyne concluded that the behavior of the system was as expected when encountering this failure. They went on to explain how their Entegra system checks itself, but all manufacturers’ systems have similar integrity checks.
Avidyne told us that each sensor reading is tested for reasonability. If a sensor, for example, that is reporting normal flight suddenly sends data at the end of its range, that reading is suspect and will usually raise a flag.
Just as an astute pilot is always cross-checking the instruments, the system also cross-checks the sensors. For example, if the attitude sensors show a coordinated turn, but the heading isn’t changing, either the bank or heading data is incorrect and, as in this case, a “Crosscheck attitude” message is displayed.
However, messages aren’t instantaneous. Error detection has buffers to prevent transient false alarms, while still providing meaningful detection of actual errors. Until a failure mode is fully detected by the system, anomalous readings may only be accompanied by the message—as happened in the article—so the pilot can sort out good readings from bad ones. The goal, of course, is to avoid blanking out accurate data. Clearly, this is a fine line to walk and each manufacturer has their own thresholds, but with the same goals.
EFIS internal diagnostics and cross checks do not relieve the pilot of the responsibility to assure accurate data. With all the information available to the EFIS, the pilot sill has more information (particularly control inputs) and is better equipped to determine the proper response.
If the pilot is constantly cross checking the EFIS with the backups, any failure like this should be a non-event. But few of us do that. We trust the information in front of us until we have reason to suspect it through messages or anomalous responses of the aircraft. It’s usually only then that we consult the backups. Avidyne’s analysis shows it took 30 seconds before the system posted the “Check attitude” warning in this event. If it took the pilot a remarkably short 10 seconds to recognize the failure—20 seconds before the system did—that 10 seconds of following bad attitude information could produce a significant upset. If the autopilot were on, the situation would likely be worse.
Bottom line here is that these sophisticated, capable systems with advanced internal diagnostics can still fail and the pilot must be constantly alert for problems—just like when flying conventional gyros and instruments. —FB
