Incident Overview
On 10 June 2022, the flight crew of a Boeing 737-476SF freight aircraft, registered ZK-TLJ, observed a 340 ft discrepancy between the captain's and first officer's altitude while operating in reduced vertical separation minimum (RVSM) airspace after departing Perth Airport, Western Australia. They also noted an airspeed and Mach number difference, but this was within the manufacturer's stipulated limits. The aircraft was descended, and the crew completed the Quick Reference Handbook - Airspeed Unreliable procedure. They determined that the first officer's instruments were reliable for a return to Perth. After landing, ground crews found foreign residue adhered to the lower surfaces of all four pitot-static probes.
Investigation Findings
The Australian Transport Safety Bureau (ATSB) established that, during an engine ground run two days prior to the incident, the pitot-static probe covers were not removed, and the automatic pitot heat was not isolated as required by the ground run procedures checklist. As a result, the covers melted onto the probes. Although cleaned, residue remained on the probe surfaces, which had the potential to compromise the accuracy of the pitot-static instruments in-flight. The ATSB also found that pitot-static probe covers made from polyvinyl chloride (PVC) material were used, which increased the risk of the covers melting onto the probes if left on during engine operation.
Air traffic control (ATC) were not advised of the altitude discrepancy of 340 ft, which exceeded the maximum allowed altimetry system error for RVSM airspace of 200 ft. Therefore, adequate vertical separation with other aircraft could not be assured by ATC.
Maintenance Errors
The aircraft manufacturer recommended the use of Kevlar pitot-static probe covers, as this material could withstand high temperatures from the automatic pitot heat system. However, the operator had sourced locally made PVC covers, which were less heat-resistant. This increased the risk of melting if the covers were left on during engine operation.
The Airwork 737-300/400 ground run checklist required removal of pitot-static probe covers and isolation of the pilot heat system. However, the operator reported that the checklist was not used when performing the scheduled engine wash two days prior to the incident. Maintenance personnel completed the task by memory, resulting in the covers not being removed and the pitot-static heat circuit breakers not being opened before engine motoring and start. The risk of error was potentially exacerbated by maintenance personnel carrying out the task in alternating stages with limited communication.
Residue and Altimetry Error
After identifying that the covers had melted, the probes were cleaned and visually inspected before being returned to service. However, a post-incident inspection and ATSB examination found residue from the covers remained on the probe surfaces. Despite this, analysis of quick access recorder (QAR) data showed a stable altimetry system error extending back to seven flights after the engine wash. Those seven flights were completed with no reported altitude discrepancies. Although the decision not to replace the probes increased the risk of error from turbulent air over the static pressure sensing ports, the QAR data did not demonstrate a link between the remaining residue and the incident flight.
The altitude discrepancy varied during cruise between about 300–390 ft, with the first officer's altimeter always indicating higher. The flight crew noted a 340 ft discrepancy at FL330. While the captain notified ATC of a descent and return to Perth for operational reasons, they did not advise of the discrepancy, based on their understanding that the first officer's altimeter was accurate.
Aftermath
The maintenance organisation undertook several procedural initiatives to reduce the likelihood of melted pitot-static probe covers in the future. The most notable was the use of high temperature resistant Kevlar covers to replace the PVC covers. They also ensured that checklists are readily available, and the safety briefing conducted at the start of each day discusses threat and error management, and local hazards.