Detecting system malfunctions

This element is the synthesis hub for systems risk: the detection that surfaces a failure, the management that turns it into a decision, and the automation discipline that keeps the tools from becoming traps. The systems themselves live in the systems element (K1); the per-failure indications and procedures live in the failure-response element (K2); the decision tempo and the severity matrix live here.

Detection is what makes management possible; management is what makes detection useful. Automation amplifies whichever side you're stronger on — and exposes the other FAA-H-8083-2.

detection

Scanning is active, not passive. Eyes go to gauges on a schedule, not on a hunch — and the schedule is what makes the difference between catching a failure at minute one and catching it at minute thirty.

Failures arrive through three channels.

• Instruments — engine instruments first (oil pressure and temperature, ammeter, fuel quantity, suction on a 6-pack), cycled every few minutes in cruise and more often in high-workload phases. Then the flight instruments on whatever cycle is appropriate for the rules being flown.
• Senses — engine note, vibration, smell, control feel. The first cue is often a sense, not a gauge; a faint roughness or a hint of burning insulation shows up before the instrument moves.
• Annunciators — warning lights or CAS messages on glass. Designed to be unmissable; if one is lit, treat it as truth until cross-checked.

The hardest failures to catch are silent failures — slow drift in a gauge that's still legal, a gyro precessing a few degrees an hour, a fuel imbalance that grows over a leg, a battery slowly losing capacity behind a functioning alternator. None of them trigger an annunciator and none of them startle the routine scan. The mitigation is periodic full sweeps — a deliberate, slower pass across every gauge, looking at trend and not just absolute value — plus cross-referencing related instruments. Oil pressure and oil temperature together; ammeter and suction together; airspeed and altitude trend together.

The number one detection killer is distraction. Passengers, radio congestion, programming the GPS, reading a chart. The mitigation isn't to never be distracted — it's to redirect attention back to the scan on a known interval as soon as the distraction resolves. The glass cockpit reduces the missed-detection rate by surfacing failures as CAS messages, but it introduces alarm fatigue and a "the system would tell me" trap. Annunciators help; they do not replace the scan.

management

Detection without a decision framework is just observation. Management starts the moment a failure is recognized and answers three questions: how serious is it, what do I do right now, and where am I landing.

First principle, before anything else: aviate, navigate, communicate — in that order, always. Fly the airplane, navigate to a safe outcome, then tell ATC.

Severity sorts every failure into one of four buckets.

• Minor — system degraded but airworthy and not safety-critical. A burned-out landing light, a secondary radio dead, a single nav source out with redundancy available. Continue with awareness; note for maintenance after the flight.
• Moderate — system significantly impaired but the airplane remains flyable. Alternator failure in VMC, vacuum pump failure in VMC with the turn coordinator working, a primary nav source out when GPS backup is available. Divert to a suitable airport, land sooner rather than later, declare if conditions warrant.
• Serious — failure threatens continued safe flight. Oil pressure loss, electrical fire, smoke in the cockpit, control jam, engine roughness that does not resolve. Land at the nearest suitable airport, declare an emergency.
• Catastrophic — engine failure, fire that will not extinguish, structural failure. Forced landing wherever you can put it down.

The same failure can sit in different buckets depending on conditions: an alternator failure at noon over a Class D destination is moderate; an alternator failure at night in IMC over mountains is serious. The bucket is set by what the failure plus the environment costs you, not by the name of the failure.

Declaring is a tool, not a confession. Mayday-mayday-mayday for distress (imminent danger requiring immediate assistance); pan-pan-pan for urgency (safety concern not immediately threatening). Declaring buys priority handling, vectors to the nearest suitable, equipment standing by, and freedom from most regulations under 14 CFR 91.3 to handle the situation as the PIC judges necessary §91.3. The bar is lower than most pilots think — there is no penalty for declaring and not needing the assistance, and a large penalty for not declaring when you should have.

Picking a site: nearest suitable that supports your situation. Runway over field over water. A tower field with rescue services beats a longer single-strip if the time is comparable. Human factors: stress narrows attention, workload eats the scan, passengers fill the cockpit. The mitigation is deliberate slowdown — request a delay vector, brief the passenger to be quiet, complete each step as written. Behind the airplane is a state to fix, not a debt to pay. The POH is the authority on the procedures themselves §91.9, and the AFH walks the technique of running them under stress FAA-H-8083-3.

automation

Automation is a tool whose backup is your manual proficiency. Three traps and three disciplines.

The traps. Mode confusion — the autopilot is in a different mode than you believe (vertical speed when you wanted altitude hold, heading select when you wanted GPS steering). The cue is the airplane doing something you didn't expect. GPS over-reliance — you can't say where you are without looking at the screen. Programming substitution — operating the box becomes the task and flying becomes a side activity.

The disciplines. Verify before executing — select a mode, look at the flight-mode annunciation, confirm it matches what you asked for. Verbalize and verify. Brief the next leg — before each waypoint or altitude change, name what the autopilot is about to do so a deviation from intent is detectable. Disconnect, fly, reprogram — if the airplane does something unexpected, disconnect the autopilot first, hand-fly back into the box, then reprogram during a low-workload phase. Reprogramming with the autopilot still engaged after surprise behavior is how mode confusion compounds into loss of control.

The underlying principle: the more capable the automation, the less recent your manual practice tends to be — and the more brittle the system becomes when it eventually demands your hands. Hand-fly portions of every flight, especially approaches. The autopilot is a tool. Tools require maintenance, and the maintenance is your attention and your skill.

worked examples

Scenario 1 — slow oil-pressure drift caught on the cruise scan.

Cruising at 6,500 in good VFR, a routine scan catches the oil pressure half a needle below where it was an hour ago — still in the green. Detection win: this is exactly what the periodic scan is for. Cross-check oil temperature: climbing slightly. Both gauges agree; the loss is real and progressing.

Severity: serious — the trend is the signal, not the absolute number. The slope says the pressure will leave the green soon and the engine will follow. Reduce power to minimum for level flight, declare to ATC, request the nearest suitable airport, land before the gauge leaves the band entirely. Decision: land NOW even though the gauge is still legal. The trend-catching scan plus the per-failure procedure (K2) plus the systems mental model (K1) — three pieces of the same job.

Scenario 2 — autopilot in vertical speed during a re-cleared descent.

Cleared from cruise to 5,000, you set vertical speed 1,500 fpm down. Mid-descent ATC steps you back up briefly, then re-clears you to 5,000. You reset the altitude window — but the flight-mode annunciation still reads V/S, not altitude hold. The airplane keeps descending past 5,000.

Detection: the altimeter tape unwinding through the cleared altitude. The annunciator on the PFD told you what was happening; you have to look. Disconnect the autopilot, hand-fly back to 5,000, then re-engage with altitude hold confirmed on the FMA. Tell ATC. Decision: disconnect first, fly the airplane, then reprogram — never the other way around. Mode confusion plus button-pushing is the loss-of-control sequence; disconnect-fly-reprogram is the discipline that breaks it.