Post Mortem

Well what a clusterfailure that was. Imagine if that vacuum and indication failure had all happened over the course of once turbulent flight in night IMC across the mountains. Suction failures are extremely dangerous. The suction-driven instruments are central to the instrument scan and experiments and studies of actual accidents show that they have a very high chance of killing you. The "ninety percent" figure sometimes quoted is misleading: accidents attributed to vacuum failures (about three per year in the US) result in fatalities 90% of the time. That's because there aren't many ways to crash an airplane due to spatial disorientation without it being deadly. More than ten percent of pilots who experience vacuum failure in IMC do get out alive, but I'm not going to guarantee I would be one of the survivors.

Here's what a vacuum failure can look like.

The gyrating blue and black instrument is the attitude indicator. It won't necessarily look that energetic in a failure. Its slide to one side or the other may look exactly like a functional instrument indicating a real wing drop, prompting the pilot to bank and pitch in an attempt to return the aircraft to straight and level flight. The pilot must fly by the turn coordinator, the tippy little white symbolic airplane at bottom left. It indicates rate of turn, not bank angle, so doesn't respond as instantaneously to changes in attitude.

I had difficulty identifying the failed vacuum system because its own indication system did not work properly. When I felt that the heading indicator was not working properly, I suspected the vacuum system, but the indicator lied to me, telling me the system was okay. When I shut down an engine, the associated vacuum failure indication appears immediately, leading me to believe that the same thing would happen in the case of a real suction failure. The two vacuum pumps are in two different engines, had widely separated serial numbers and had been installed by different people at different times. I had never heard of one vacuum pump failing and taking out another one.

If an electric instrument has a power loss, it immediately throws up a flag, so I know not to trust it. There is no failure indicator on the heading indicator or attitude indicator and without other reference, it is really easy to follow the dying instrument. The autopilot tried to follow it, too. With TWO failing vacuum pumps, there was no pressure differential across the shuttle valve to pull the autopilot out of the system. Flying across the mountains to the FBO where company has shipped the replacement pumps, I have post-it notes over the failed instruments, still the only indication, apart from their unresponsiveness, that they are not working. When practicing flying on instruments, if the pilot can see the real horizon, even a little, the task is much easier. Even if you try to ignore it, you subconsciously draw on a lifetime of doing what your species does: visually determining which way up you are. While it's easy to design an indicator that is invisible until electrical power is removed from it, I guess it's harder to calibrate one to not enough suction. Maybe it could depend on gyro rpm. This FAA document claims that "attitude indicators with failure warning flags are available in newer model aircraft and are slowly making their way into the general aviation fleet as retrofits," but I think they may be talking about replacing vacuum-driven AIs with electric ones.

The cause of the double failure is eventually determined to be poorly-installed air-oil separators. Oil was able to enter the dry vacuum pumps and damage the vanes. I'm not sure if the indication issue was because it was a gradual failure, or because oil got in the indicator, too. It is all functional now, but now the vacuum pumps are in phase, which makes me nervous, because that airplane has flown about 900 hours since that happened, and I'm back in it. This article seems to think that vacuum pumps fail every 500 hours or so, but our mandated time between overhaul is definitely 1000 h.

Are there one or two Ns in "Brokenness"?

I start the engines the next day to do some VFR work. As the engines fire up, the engine start checklist directs my eyes to the tachometer, then the oil pressure, and to the suction gauge. The suction gauge indicates that the right vacuum pump has died. Okay! That sort of explains the zombie heading indicator, and means that I've snagged the wrong instrument. I should have not written it up while it was questionable. The laws don't allow me to write, "never mind, it's not broken after all," which is why there are so many airplanes flying around with sort of broken stuff. As soon as it's written down, it grounds or restricts the airplane. As I understand it, only a maintenance engineer is allowed to correct a pilot's mistaken snags.

Fortunately, the effect of the unserviceability is the same, as I'm not allowed to conduct IFR flights with only one vacuum pump working, and we're in the north in the summer, so "night" is virtually non-existent. What's weird, though, is that the reason there are two vacuum pumps, is that one is supposed to be able to serve as a back up. Either suction pump on its own is supposed to be sufficient to run both the attitude indicator and heading indicator. I'm supposed to be able to safely complete an IFR flight with one suction pump failed. Come to think of it, the autopilot is not supposed to engage if only one vacuum pump is operating, to ensure that there is sufficient suction to run the essential instruments. The autopilot is still working, although a little half-heartedly, as the heading indicator is still sluggish. So is the attitude indicator. The shuttle valve that is supposed to disable the autopilot must have failed, so the autopilot is remaining on line, leaving not enough suction for the heading indicator and attitude indicator. I turn off the autopilot, but it doesn't help much.

After a few hours the heading indicator and attitude indicator are both completely useless. Weirdly, the autopilot will still engage. (I keep forgetting and snapping it on when I want to look something up or open a Clif Bar to eat). But it will attempt to follow the slowly toppling attitude indicator. Pretty scary, really. How far would it roll the airplane? That's not in the manual.

In the old days, there were no heading indicators or attitude indicators or autopilots. The turn and bank instrument and the compass were all you had for staying right side up, and if the former died, it was just the compass, which has all kinds of errors or lag and lead. The old bush pilot trick for letting down through an overcast was to do so on a heading of south. On south, if you bank at all, the compass will immediately swing around, even before the heading has changed, especially at high latitudes. I try this at the end of the flight, because my destination is pretty close to due south of my position. It's pretty hard. Try it sometime.

As I taxi in at the end of the flight the suction gauge indicates that the second vacuum pump has failed. Well this would make a fair amount of sense: the pressure differential between the working and failed vacuum pumps is what is supposed to throw the shuttle valve to disconnect the autopilot. And obviously if they have both failed I can't expect the suction instruments to work properly.

Company has already made arrangements to ship a vacuum pump to a maintenance shop a few hours flight away, so now they will ships two vacuum pumps, and we will head there on the next flight.

Death Rates

I'm IFR in the flight levels on a clear VMC day. The IFR part means I'm following a set of rules and procedures ("Instrument Flight Rules") designed for pilots of aircraft in weather conditions that don't allow them to navigate by looking out the window. The flight levels part means I'm flying above about 18,000'. In Canada the "transition altitude," between altitudes designated by the local air pressure and those altitudes designated by a universal standard pressure setting, is 18,000'. One never flies at 18,000', but instead sets the altimeter to 29.92 and flies at flight level 180. I don't know how our transition level was determined. Our highest mountain is about 19,000', so it wasn't set relative to that. VMC is "Visual Meteorological Conditions," that is weather that permits navigation just by looking out the window.

So why am I IFR in VMC? Because in Canada everyone operating in the flight levels is required to do so under an IFR clearance. It's a safety regulation. I have to fly only as directed and cleared by ATC, in order to ensure separation from all other aircraft. And I'm up this high because this is where I need to work. There's only half as much air pressure up here as at sea level, which means only half as much oxygen per breath, so I'm wearing a mask that provides me with supplemental oxygen. The masks do a great job of that. Testing my blood oxygen level always shows me at 98 or 99% saturation, the same level I get sitting on my chesterfield at home. (The tester looks at my blood by shining a light through my fingernail: it doesn't take a blood sample). Only problem is that in providing a tight seal around my face and being secured to my head underneath my headset, the mask give me no opportunity to eat or drink during the flight. Air before food.

The mask also interferes with the seal between my headset earpieces and my ears, so it's a little noisier with the mask on. Even noisier when my noise cancelling cuts out because my headset batteries died. I'm not sure if the noise cancelling "works harder" to keep up, or if it has the same battery consumption regardless of the ambient noise, and this is just coincidence. I use rechargeable batteries, which when they are new last about fifty hours in the airplane before they die, but after many cycles have shorter lives. I have numbered all my rechargeables and track how long each set (the headset takes two AAs) lasts before it dies. When they can't go a full flight, they get retired to a plastic baggie in my kitchen. Eventually they will go to recycling, when I figure out where to recycle rechargeables. They last pretty well: there are only six batteries in the retirement baggie and I've been using rechargeables in my headset and flashlights for at least eight years.

I change batteries and then notice I'm off my heading. The autopilot has disconnected. I must have hit the button. I reset it and then turn to a new heading, but something doesn't look right. The GPS says I'm going where I want to be, but the heading indicator is way off. I reset it to the compass, and it follows for a while, but soon loses interest again. The heading indicator is powered by two engine driven vacuum pumps, one of which I reported close to needing replacement a few days ago. The suction gauge shows slightly less of a vacuum than ideal, but in the green range and no less than it has for a few weeks. The other part of the instrument shows both vacuum pumps on line. The attitude indicator, powered by the same system, still appears to be working. Legally I'm required to inform ATC of the failure of a heading indicator. I do so, and they seem confused. No, it isn't affecting my operation at all. I'm using an electronic guidance system, and I will be landing at an airport that I'll be able to see sixty kilometres away. I don't need it for the flight. Maybe people don't routinely comply with that regulation anymore.

Before I land, the stupid thing comes back to life. Charming. I'm far from base, but I call maintenance so they can order one, or pull one out of another plane or something for when I come back. They don't have any troubleshooting tips for a zombie heading indicator. It's working now, but it's not reliable, so I snag it. That is, I write in the journey log that it is not operating correctly. This will limit our operations to day VFR (the looking out the window counterpart of IFR) only, which is a huge pain in the neck, because it prevents me from continuing the work above FL180, even though its effect on safety is negligible. I have had transient problems with equipment that never recur, but usually they hint at trouble and then throw a full failure if ignored. I think I've only seen simple heading indicators (as opposed to the more expensive and complex HSI) fail twice before in about 7000 hours of flying. And one was a simple fix, turned out that there was an installation error that had made a screw come loose. I wonder if the suction line is leaking or blocked or something. Nothing I can do about it, anyway.