Flight Warning and Alerting Systems

A modern airliner monitors hundreds of parameters, and at any moment several may be abnormal. A flight warning system (FWS) turns that stream into something a crew can act on: it detects the condition, decides how urgent it is, draws the pilots' attention with lights and sounds in proportion to that urgency, and tells them what is wrong. Its most important job is ranking, because two alarms of equal volume leave the crew to work out priorities at the worst possible time.

The same principles run from the red warning lights of older aeroplanes to the electronic crew alerting displays of current types, and they are written into certification: CS 25.1322 in Europe and 14 CFR 25.1322 in the United States set the alert levels and their colours. Exam questions draw on both the generic rules and the Boeing and Airbus implementations.

Warning system philosophy

EASA training texts divide the alerts into three groups: engine and airframe system malfunctions; aerodynamic limits, such as altitude alerting, overspeed and stall warning; and external hazards, such as terrain (see GPWS and TAWS) and other aircraft (see ACAS/TCAS).

An alert must first attract attention, so master lights are placed near the centre of each pilot's scan. It must then show urgency, through colour and sound, and identify the problem. An aural warning is required whenever the pilot must take over control, because a light cannot be relied on when the pilot is looking elsewhere; the autopilot disconnect warning is the classic case. The stall adds a tactile warning, the stick shaker.

Boeing states the colour logic simply: red lights, in the pilots' primary field of view, mark conditions requiring immediate attention; amber lights, conditions requiring timely attention; blue lights, status such as power availability or valve position.

Warning, caution and advisory levels

The alert levels are defined by the response they demand:

Boeing's EICAS calls them level A, B and C. Warnings are red with master warning lights and an aural such as the fire bell; cautions are amber with master caution lights and a tone; advisories are also amber but indented one space, with no lights or sound. The CANCEL switch removes cautions and advisories from the display, never warnings, and RECALL brings them back. A message disappears by itself when its condition ends.

Airbus's ECAM uses levels 3, 2 and 1, plus advisories and memos. Level 3 is a red warning with a continuous repetitive chime and the flashing MASTER WARN light; level 2 an amber caution with a single chime and a steady MASTER CAUT light, the relevant system page appearing automatically; level 1 an amber message with no chime or light, typically a loss of redundancy. An advisory calls up the system page and makes the drifting parameter pulse green. A level 3 alert always takes priority over a level 2, and a level 2 over a level 1.

View full schematic

Master warning and master caution

The master warning and master caution lights are the attention-getters, one pair on the glareshield in front of each pilot. On the A320, pressing MASTER WARN silences the aural warning, except for some warnings such as overspeed and stall, and pressing MASTER CAUT extinguishes the light. The emergency cancel pushbutton stops a warning's aural for as long as the failure lasts, but cancels a caution for the rest of the flight, so Airbus restricts it to spurious master cautions; holding the recall button for more than three seconds brings cancelled alerts back.

The Boeing 737 has red FIRE WARN lights with a fire bell, and amber MASTER CAUTION lights beside the system annunciator panels, which name the system at fault, such as FUEL, for the systems on the forward and aft overhead panels and the fire panel. Pushing MASTER CAUTION extinguishes both master lights and the annunciators and resets the system for the next fault. Pushing an annunciator panel recalls the stored conditions; all twelve system lights should illuminate, and any fault still present stays lit. Some single faults in redundant systems, "simple faults", are stored without lighting MASTER CAUTION and appear only on recall.

Central warning panel and FWS

Older aeroplanes grouped the warning lights on a central warning panel, arranged in a logical order and repeated by a master warning light near the centre of scan. Electronic displays replaced it: EICAS first flew on the Boeing 757 and 767, and ECAM on the Airbus A310.

A modern FWS has three parts. Its inputs are hundreds of sensors plus the ground proximity and collision avoidance systems; its processing is done by one or two flight warning computers (FWCs); its outputs are the master lights, the messages on the display and the aural alerts. The A320's two FWCs generate the alert messages, memos, aural alerts and synthetic voice messages; they take red warning data directly from the aircraft sensors and the rest through two system data acquisition concentrators.

The FWC also decides when not to speak. It divides each flight into ten phases, and during the critical ones most warnings and cautions are inhibited: a T.O INHIBIT memo is displayed in phases 3 to 5 and LDG INHIBIT in phases 7 and 8. The reasoning is that most failures do not affect the aeroplane's ability to continue a take-off or landing, while an alert at that moment would only distract.

Aural alert prioritisation

When several aural alerts compete, the system lets the most time-critical one through. EASA training texts give the aural alert prioritisation as:

1. stall (stick shaker or pusher activity inhibits all synthetic voice alerts);
2. windshear;
3. GPWS or TAWS;
4. ACAS/TCAS.

The Boeing 737 applies this with inhibitions: all TCAS alerts are inhibited by GPWS and windshear warnings; an actual windshear warning inhibits the look-ahead terrain and radio altitude alerts; and the runway awareness callouts rank below any GPWS alert (see windshear and microbursts).

The sounds themselves carry meaning. The 737 has a clacker for overspeed, a warning tone for autopilot disengagement, an intermittent horn for the take-off configuration and cabin altitude warnings, a steady horn for the landing gear, a fire bell and synthetic voice for ground proximity. The A320 uses a continuous repetitive chime for red warnings, a single chime for cautions, the cavalry charge for autopilot disconnection, a cricket with the voice "STALL", a C chord for the altitude alert and a triple click for a downgrade of landing capability.

Sharing a sound can be fatal. On the 737 the cabin altitude and take-off configuration warnings use the same intermittent horn. In 2005 the crew of Helios Airways Flight 522 took the cabin altitude warning for a configuration warning and did not put on their oxygen masks; both pilots were incapacitated by hypoxia (see decompression).

Genuine, nuisance and false warnings

Training texts, starting from GPWS, sort alerts into three kinds:

• Genuine: the system works to its specification and the hazard is real.
• Nuisance: the system works to its specification, but the crew is flying an accepted, safe procedure, for example a known approach over rising terrain.
• False: a fault in the system produces a warning that is not in accordance with its specification.

Nuisance alerts matter because a crew that hears too many learns to doubt them. Designers suppress them where the condition is expected: weight-on-wheels logic disconnects the stall warning on the ground, the altitude alert is inhibited on the glideslope, and a GPWS flap inhibit switch silences the flap alert when a non-standard landing flap is planned. Crews are required to report every GPWS alert so that operators can analyse them. In flight the rule is the opposite of doubt: a warning is treated as genuine until proven otherwise. EASA training texts have a ground proximity warning answered at once with wings level and a maximum-gradient climb, the cause being looked for afterwards; the climb may be stopped early only by day in clear visual conditions, with the cause identified and the terrain plainly no threat.

Take-off configuration warning

The take-off configuration warning (TOCW) catches a take-off attempted with the aeroplane not set up for it. Certification requires it: CS 25.703 and 14 CFR 25.703 call for a take-off warning system that gives an aural warning in the early part of the take-off roll. It is armed on the ground and sounds when the thrust levers are advanced for take-off. On the 737 it sounds an intermittent horn, with a red TAKEOFF CONFIG light, if:

• the trailing edge flaps are not between 1 and 25, or the leading edge devices not in take-off position;
• the speed brake lever is not DOWN, or a spoiler control valve is open;
• the parking brake is set;
• the stabiliser trim is outside the take-off range.

Other types add flight control locks, doors or, on the E190-E2, flaps disagreeing with the setting entered in the FMS. The A320 shows CONFIG messages on the ECAM, and its T.O CONFIG pushbutton simulates take-off power so that the crew can test the configuration before lining up, a "T.O CONFIG NORMAL" memo confirming it. Some warnings, such as the parking brake, trigger only with actual take-off power.

The warning is the last defence, not the first. At Detroit in 1987 (Northwest Airlines Flight 255) and at Madrid in 2008 (Spanair Flight 5022), both McDonnell Douglas MD-82s (DC-9-82), the flaps and slats were not set for take-off, the crews did not catch it with their checklists, and the take-off warning did not sound.

Altitude alerting system

An altitude alerting system helps prevent level busts (see level bust). In EU commercial air transport, CAT.IDE.A.140 requires it on turbojet aeroplanes and on turbine propeller aeroplanes with a maximum certificated take-off mass above 5,700 kg or more than nine passenger seats; it must alert the crew when approaching the preselected altitude and, at least aurally, when deviating from it. In the United States 14 CFR 91.219 requires an altitude alerting system or device on turbojet aeroplanes, and it is part of the minimum equipment for RVSM airspace.

The altitude preselect is the altitude set in the autopilot panel window, which the autopilot captures and the alerter watches.

The A320's alert is a C chord, cancelled by selecting a new altitude or pressing MASTER WARN. EASA training texts give the Airbus alerting band as 750 ft before the selected level and 250 ft of deviation from it, against 900 ft and 300 ft for Boeing. On the Boeing 747-400 a deviation is an EICAS caution, ALTITUDE ALERT, with master caution lights and a beeper.

The alerter only watches the number it is given. A wrongly set altitude, or a capture mode that was never armed, defeats it, so crews cross-check the cleared altitude and the FMA after every change; the 737 FCOM, for example, requires the pilot to verify that each value selected on the mode control panel appears on the flight instruments. Mode S enhanced surveillance downlinks the selected altitude to controllers, who can then catch a wrong setting before it becomes a level bust (see transponder and SSR).

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.