Unreliable altitude indications, Boeing 737-476SF, ZK-TLJ, 167 km west of Meekatharra Airport, Western Australia, on 10 June 2022

Executive Summary

What happened

On 10 June 2022, the flight crew of a Boeing 737-476SF freight aircraft, registered ZK-TLJ, noted a 340 ft discrepancy between the captain’s and first officer’s altitude when operating in reduced vertical separation minimum airspace after departing Perth Airport, Western Australia. They had also observed an airspeed and Mach number difference, but this was within the manufacturer’s stipulated limits. The aircraft was descended, and the flight crew completed the Quick Reference Handbook - Airspeed Unreliable procedure. It was determined that the first officer’s instruments were reliable for a return to Perth. After landing, ground crews found foreign residue adhered to the lower surfaces of all 4 pitot-static probes.

What the ATSB found

The ATSB established that, during an engine ground run 2 days prior to the incident, the pitot‑static probe covers were not removed, and the automatic pitot heat was not isolated as required by the ground run procedures checklist. As a result, the covers melted onto the probes. Although cleaned, residue remained on the probe surfaces, which had the potential to compromise the accuracy of the pitot-static instruments in-flight. It was also established that pitot‑static probe covers made from polyvinyl chloride material were used, which increased the risk of the covers melting onto the probes if left on during engine operation.

Air traffic control were not advised of the altitude discrepancy of 340 ft, which exceeded the maximum allowed altimetry system error for reduced vertical separation minimum airspace of 200 ft. Therefore, adequate vertical separation with other aircraft could not be assured by air traffic control.

What has been done as a result

The maintenance organisation has undertaken several procedural initiatives to reduce the likelihood of melted pitot-static probe covers in the future. The most notable being the use of high temperature resistant Kevlar™ covers replacing the extant polyvinyl chloride covers. They have also ensured that checklists are readily available, and the safety briefing conducted at the start of each day discusses threat and error management, and local hazards.

Safety message

Aircraft barometric air data sensing instrumentation components are extremely sensitive to damage and disruption. This incident highlights the importance of maintaining a high level of attention to damage and contamination when working on, and inspecting these components, particularly on aircraft certified to operate in reduced vertical separation minimum airspace. Where there is doubt, the probes should be removed and tested by an approved facility. Further, it demonstrates the need to appropriately action and complete checklists, and for flight crew to advise air traffic control of altimetry system errors.

The investigation

The occurrence

On 10 June 2022, an Airwork Boeing Company 737 aircraft, registered ZK-TLJ, was being operated as a freight service from Perth via Port Hedland, Western Australia to Christmas Island. On board were the captain as pilot monitoring, first officer (FO) as pilot flying,[1] an avionics licenced aircraft maintenance engineer (LAME), and load master.

At about 0951 Western Standard Time,[2] the aircraft departed Perth on climb to the designated cruising altitude of flight level (FL)[3] 330, operating in reduced vertical separation minimum (RVSM)[4] airspace. As the FO’s altimeter passed FL 320, the FO called ‘one to go’ in reference to the approaching designated cruise altitude. The captain noted that the call was made early according to their altimeter reading.

The aircraft levelled off at FL 330 (33,000 ft) using the FO’s altimeter coupled to autopilot B.[5] At that time, the flight crew noted the captain’s altimeter displayed 32,660 ft. They also noted differences between the captain’s and FO’s indicated airspeed and Mach number of 265 kt and 269 kt, and 0.745 M, and 0.762 M, respectively.

The flight crew, in discussion with the LAME and Airwork maintenance watch, decided to return to Perth for maintenance. At this stage, they assessed that the aircraft was overweight for a direct return and landing at Perth, so they decided to continue on the current heading and carry out troubleshooting to determine the accuracy of the altimeters. The Quick Reference Handbook (QRH) Airspeed Unreliable procedure was consulted to determine the validity of the displayed airspeed and altitude. The procedure makes use of a table, which required the aircraft to descend to FL 300, the flight crew to set the aircraft pitch attitude and Mach indications against the aircraft weight and adjust the engine N₁[6] speed to achieve level flight. By comparing the values displayed against the known configuration, the accuracy of the instruments could be assessed.  

An air traffic control (ATC) clearance was requested and provided for a descent to FL 300 and the flight crew completed the QRH procedure. They determined that the FO’s instruments were reliable, and the remainder of the flight was conducted using those instruments.

The flight crew notified ATC that they required a return to Perth for ‘operational reasons’, and a clearance was provided. On descent into Perth, the flight crew noted that the altitude discrepancy on their altimeters began to decrease until about 10,000 ft, from which point they provided consistent indications. The aircraft landed at Perth without further incident.

Post-flight inspection

After landing at Perth, engineering staff inspected the 4 combined pitot-static probes and found residue on all 4 probe surfaces (Figure 1). All of the probes were subsequently removed, and the pitot‑static lines were flushed with nitrogen. This was carried out in accordance with the manufacturer’s maintenance procedures, which did not require a sample of any debris to be collected and analysed. Therefore, the presence of debris in the pitot-static system was not determined.

The probes were replaced with serviceable items, the system was tested, assessed serviceable, and the aircraft returned to service. The pitot-static probe covers onboard the aircraft were also inspected and found to have had a temporary repair applied to them (Figure 1).

Figure 1: Pitot-static probe and covers

Source: Airwork, annotated by the ATSB

Pitot-static system

The pitot-static system is a set of air pressure-sensitive instruments used to measure an aircraft’s airspeed and altitude. Erroneous altimetry indications can be induced by a partial or full blockage of the static air pressure sensing system, or by turbulent air over the static pressure sensing ports.[7] Static pressure sensing instruments are carefully designed to minimise the risk of turbulent air over the sensing ports, however a small amount of contamination or damage to the ports, or area surrounding the ports, can result in turbulent air and a reduction in instrumentation accuracy.

The 737-476SF has 4 combined pitot-static probes fitted to the nose of the aircraft, 2 alternate flush static ports for the standby altimeter, and connecting tubing. The pitot-static lines are self‑draining, and where this is impractical, drain traps are provided. The pitot-static probes are independently connected to the 2 independent air data computers (ADC1 and ADC2), which convert the barometric pitot-static pressures into a digital signal to be displayed on the captain and FO altitude, airspeed, and Mach instruments. The pitot-static probes are electrically heated to prevent the formation of ice on the probes which can disrupt or block the normal flow of air.

In April 2021, the aircraft was made compliant with United States Federal Aviation Administration airworthiness directive[8] 2019-09-10. This required completion of Boeing alert service bulletin SB737-30A-1064, which modified the pitot heat system to energise automatically on engine start to avoid inadvertent flight into icing conditions with pitot-static heat off. The system senses the engine running using the low oil pressure switch on either engine.

Pitot-static probe covers

Pitot-static probe covers are used to provide protection from contamination when on the ground. Covers were not routinely fitted to the aircraft during turn around inspections, except in locations where an increased risk of contamination existed. The covers generally travelled with the aircraft and were fitted and removed by ground crew as required. The covers were to be fitted during extended periods on the ground.

The aircraft maintenance organisation had substituted the Boeing recommended Kevlar™[9] pitot‑static probe covers with locally manufactured items, made from a commercially available polyvinyl chloride material. The Kevlar™ covers were specifically designed to withstand high temperature associated with the inadvertent application of pitot-static heat, without causing damage to the pitot-static probes.

Ground maintenance

On 8 June 2022, a scheduled engine wash was conducted on the right engine by Airwork maintenance personnel, assisted by contract maintenance personnel, at Brisbane Airport. The maintenance personnel comprised of a certifying LAME, a participating LAME, and an AME under supervision. The contract maintenance personnel operated the ground support equipment.

The engine wash procedure required several dry motors[10] of the engine for the introduction of the detergent solution and rinse, followed by operation of the engine at idle for 10 minutes.

The operator’s internal investigation established that the task was completed in stages, alternating between the certifying LAME and the participating LAME. Further, there was limited communications between the LAMEs, and they performed the task from memory without reference to the Airwork 737-300/400 ground run procedures checklist. This checklist required the pitot‑static covers to be removed, and the pitot-static heat circuit breakers to be opened to disable the heat system, prior to motoring or starting the engine.

Following completion of the wash, the participating LAME noticed that all 4 pitot-static probe covers had remained fitted during the dry motor and engine run operations, which resulted in the covers melting onto the probes. The covers were subsequently removed, and the tubes were cleaned using a plastic scraper, a scouring pad and solvent. A detailed visual inspection was carried out on the probes, and they were assessed serviceable. The aircraft was returned to service on 9 June 2022 and completed about 11.5 hours of flying over 7 sectors with no reported incidents, prior to the flight on 10 June 2022.

The damaged covers were hung on a board with a note describing the incident and that replacement covers had been ordered. Later that day, another engineer saw the covers, and put flame proof tape on them so that they could be reused until the replacements arrived.

ATSB examination

The 4 probes were sent to the ATSB’s technical facilities in Canberra for detailed examination. That examination identified varying amounts of foreign residue adhered to the lower surface of all 4 pitot-static probes. The right upper and lower probes presented with foreign object debris in the pitot drain ports. The source of this debris could not be determined.

The depth of the residue varied between almost none on the right upper probe, to a maximum of about 0.4mm in an uneven, rippled profile on the right lower probe (Figure 2). An internal examination was not conducted.

Figure 2: Pitot-static probe residue

Source: ATSB

Recorded information

Quick Access Recorder (QAR) data from the incident and previous flights was analysed by Boeing and the ATSB. By design, the QAR only recorded data from ADC1, which precluded the direct reading of the FO’s altitude indications. However, the QAR also recorded altitude data from the traffic alert and collision avoidance system,[11] which was acquired from the selected transponder. On the incident flight the transponder was set to acquire data from ADC2. From this the FO’s altitude indications were able to be indirectly determined.

The analysed data for the 7 flights between Brisbane and Perth showed minor discrepancies between the captain’s and FO’s altimeter during climb and descent, but no notable discrepancy in cruise flight was recorded. It could not be determined from this data if the transponder/ traffic alert and collision avoidance system was selected to acquire data from ADC1 or ADC2 during these flights. The recorded magnitude of the climb and descent altimetry error was small and unlikely to be noticed by flight crews. The source of these errors could not be determined from the recorded data and could have resulted for various reasons not linked to the ground maintenance incident on 8 June 2022.

The incident flight analysis showed that the FO’s altimeter indicated a higher reading than the captain’s, varying between 300 ft and 390 ft, throughout the cruise portion of the flight.  Information regarding the reported airspeed and Mach number discrepancy could not be obtained from the recorded data due to the ADC limitation described above. Using the values provided by the flight crew, the discrepancy was within the 20 kt or 0.030 M requirement specified in the QRH, for the airspeed indicators to be considered reliable.

Reduced vertical separation minimum airspace

The aircraft’s transponder was manually selected to use data from either ADC1 or ADC2. The altitude information passed from the selected ADC to the transponder was also used by ATC and the aircraft’s traffic alert and collision avoidance system to monitor aircraft altitude and maintain safe vertical separation between other aircraft.

During the incident flight, the aircraft was operating in reduced vertical separation minimum airspace (RVSM), which was between FL 290 and FL 410. In RVSM airspace, vertical separation is reduced from 2,000 ft to 1,000 ft. Aircraft are required to meet specified minimum accuracy requirements for airspeed and altitude, as well as a specific RVSM minimum equipment list, prior to being approved to fly in RVSM airspace. Flight crews are also required to closely monitor the altimeters for agreement prior to entering and throughout flight in RVSM airspace.[12] If there is a disagreement of greater than 200 ft and the flight crew believe that one of the primary altimeters is functioning normally, they must couple the autopilot to that altimeter and notify ATC ‘For information, operating on one primary altimeter only’.[13]

According to the International Civil Aviation Organization,[14] altimetry system errors may occur for various reasons including from damage to the pitot-static system. These faults can send incorrect data to ATC and the traffic alert and collision avoidance system, as well as the aircraft’s altimeters. In turn, this could result in a breakdown of vertical separation and increase the risk of collision, as depicted in Figure 3, if the error is not detected by the flight crew and reported to ATC.

Figure 3: Altimetry system error risk

Source: International Civil Aviation Organization

Altitude discrepancy

The FO’s call of 1,000 ft remaining until the assigned cruising altitude of FL330 differed from what was observed at that time by the captain on their respective altimeter. Likewise, after reaching that altitude, a 340 ft discrepancy was also identified between the FO’s and captain’s altimeters. This was consistent with the recorded flight data, which showed about the same discrepancy at the top of climb. The discrepancy varied during cruise flight between about 300–390 ft and always maintained a FO’s altimeter high indication. At the time, the flight was operating with a reduced vertical separation of 1,000 ft between other aircraft.

While the flight crew also identified slight differences between the indicated airspeeds and Mach numbers, these were within the manufacturer’s stipulated error limits for flight as stated in the Quick Reference Handbook.

Plastic pitot covers

The aircraft manufacturer recommended the use of Kevlar™ pitot-static probe covers as this material could withstand the high temperatures associated with the automatic operation of the pitot heat system at engine start if the covers were inadvertently left fitted. However, the operator had sourced locally made polyvinyl chloride covers, which were less resistant to heat. This increased the risk of the covers melting onto the probes if left on during engine operation.

Covers not removed prior to maintenance

The Airwork 737-300/400 ground run checklist required the removal of the pitot‑static probe covers and isolation of the pilot heat system. However, the operator reported that the checklist was not used when performing the scheduled engine wash 2 days prior to the incident flight. Rather, maintenance personnel completed the task by memory. This resulted in the pitot-static probe covers not being removed and the pitot-static heat circuit breakers not being opened prior to engine motoring and start. The risk of performing a maintenance error was potentially exacerbated by the maintenance personnel carrying out the task in alternating stages, with limited communication between them, as reported by the operator. As a result, the covers melted, and residue was deposited onto all 4 pitot-static probes.

Pitot-static probe residue

After identifying that the pitot-static probe covers had melted, the probes were cleaned and a visual inspection performed, before being returned to service. However, a post-incident inspection of the probes and the ATSB’s examination found residue from the covers remained on the probe surfaces.

Despite this, the analysis of the QAR data showed a stable altimetry system error extending back to the 7 flights after the engine wash. Further, the 7 flights had been completed between the wash and the incident flight with no reported altitude discrepancies from flight crews. Although the decision to not replace the pitot-static probes increased the risk of error resulting from turbulent air over the static pressure sensing ports, the QAR data did not demonstrate a link between the remaining residue and the incident flight.

Altimetry error in RVSM airspace

Consistent with the recorded data, the flight crew noted a 340 ft altitude discrepancy when at FL 330. If the primary altimeters diverged by greater than 200 ft when operating in RVSM airspace, ATC were to be notified. While the captain notified ATC that they required a descent and a subsequent return to Perth for operational reasons, they did not advise them of the discrepancy. This was based on the flight crew’s understanding that they had established the FO’s altimeter was accurate.

Altimetry system errors not only result in erroneous indications to the flight crew, but the protection systems afforded by ATC and the aircraft’s traffic alert and collision avoidance system can also be degraded. Therefore, it is important that flight crews advise ATC of any errors so ATC can assure adequate vertical separation exists with other aircraft.

From the evidence available, the following findings are made with respect to the unreliable altitude indications involving Boeing 737-476SF, ZK-TLJ, about 167 km west of Meekatharra Airport, Western Australia on 10 June 2022.

Contributing factors

Other factors that increased risk

Safety action by Airwork

Airwork advised that they have taken the following safety actions:

• Changed all pitot-static probe covers to Boeing ‑approved recommended covers that are made of heat resistant material (Kevlar™).
• They will release a safety statement after every potential safety occurrence as an interim measure prior to the completion of a formal internal investigation.
• This occurrence will be included in the Airwork engineering human factors training course.
• Airwork engineers conduct safety briefing at the start of the day to identify hazards/risks and control measures to prevent harm. The form used for the briefing was reviewed and additional information was included, providing guided cues for discussions regarding threat and error management, and local hazards.
• Ensured that checklists are readily available to use before the commencement of engine ground runs.
• Reviewed the change and risk management processes when there is an airworthiness directive.
• Published a safety alert around the importance of submitting a safety report as soon as practicable after an event has occurred.
• Published a safety alert to engineers and all staff about the importance of using checklists.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• captain
• Airwork safety and engineering personnel
• Boeing Aircraft Company
• recorded flight data
• Bureau of Meteorology
• Airservices Australia.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the flight crew
• Airwork
• United States National Transportation Safety Board 
• New Zealand Transport Accident Investigation Commission
• Boeing Aircraft Company
• Civil Aviation Safety Authority.

Submissions were received from:

• Airwork
• Boeing Aircraft Company
• the flight crew.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.