Preparing Flight Crews to Face Unexpected Events

It was the crew’s first sector of the day departing from London Gatwick for Glasgow. From the weather reported for Glasgow Airport, they were expecting turbulent conditions with cross-wind of approximately 26 knots and a wet runway.

The First Officer’s Probe Heat Computer was inoperative prior to the departure from Gatwick and so the aircraft was operated under an MEL for the flight to Glasgow. The MEL procedure required the crew to select the Air Data selector to [FO ON 3] and set the ADR2 pushbutton switch to [OFF] prior to entering icing conditions. Icing conditions were expected during the flight, and so the ADR2 was set to [OFF] before the departure. The procedure also states that when the ADR2 has been switched [OFF], the ADR2 must remain set to [OFF] for the remainder of the flight (fig.1).

(fig.1)
Application of MEL 30/31/01B for First Officer’s Probe Heat Computer (PHC) inoperative.
Instructions are to select the AIR DATA to [F/O ON 3] and set the ADR2 pushbutton switch to OFF prior to entering icing conditions.

After an uneventful flight from Gatwick, the crew reported turbulent conditions on the approach into Glasgow. They disconnected both auto-pilots while crossing one-thousand feet. The Captain was the pilot flying. Upon reaching 850 feet a reactive WINDSHEAR warning was triggered for 15 seconds.

The crew evaded the WINDSHEAR and then conducted the go-around as per standard operating procedures. However in the same instant the FMA became blank, the Flight Director (FD) bars disappeared from the Primary Flight Displays (PFD) and were replaced by the red [FD] flag (fig.2). The characteristic speed information were also no longer displayed on either PFD, and were replaced by the red [SPD LIM] flag, which was displayed at the bottom of the airspeed scale. The only information displayed on the airspeed scales were the current speed and the speed bug.

(fig.2)
Primary Flight Display.
[FD] and [SPD LIM] flags are displayed in red text. They respectively indicate the loss of Flight Director bars and the characteristic speed information.

Additionally, two ECAM messages with the associated single-chime and master caution indicated they lost the Auto-Throttle (ATHR) as well as the rudder travel limitation functions. As shown in Figure 3, the ECAM messages indicated were the AUTO FLT ATHR OFF and AUTO FLT RUD TRV LIM SYS amber messages (fig.3).

As illustrated in (fig.4), the combination of the windshear, chimes and alerts created a startle effect on the crew. With the increased workload, the crew missed the AUTO FLT RUD TRV LIM SYS ECAM warning and hence did not apply the associated procedure shown on the ECAM display (fig.3).

(fig.3) Ecam messages ‘AUTO FLT ATHR OFF’ and ‘AUTO FLT RUD TRV LIM SYS’. Associated operating procedure to reset FAC 1 & 2 displayed with master caution and single chime.

In retrospect, if the crew had applied the procedure displayed on the ECAM they would have reset FAC1 and FAC2, and recovered all of the functions previously lost. However, on the climb from 1900 feet through to 2300 feet, during the slats and flaps retraction, three VFE (maximum allowable airspeed with flaps extended) OVERSPEED warnings sounded within 20 seconds. At the time of the second VFE triggering, the crew switched the ADR2 to [ON], which was not part of the operating procedure but resulted in the characteristic speeds and rudder travel limiter function being available again in the FAC2. This also made the Flight Director (FD2) available and it reengaged automatically on both PFD as it was still selected. Similarly the auto-thrust (ATHR) was also now available and later reengaged by the crew.

The crew successfully conducted the remainder of the flight and landed safely. Overall, the crew handled this difficult situation well, performing efficient Crew Resource Management (CRM), and applying back-to-basics in flying attitude and thrust to manage the go around phase.

(fig.4) Combination of conditions and events which caused a startle effect.

easyJet and Airbus conducted a joint investigation into this event. Analysis of the Digital Flight Data Recorder (DFDR) showed a significant discrepancy between the AOA1 and AOA3 measurements at the same time that the WINDSHEAR alert was triggered. Why did the measured AOA3 increase significantly more than the AOA1 at that time? What are the consequences of this?

This aircraft is fitted with three Angles of Attack probes that deliver three separate Angle of Attack measurements, so called AOA1, AOA2 and AOA3. The sensor vanes delivering AOA1 and AOA2 measurements are located symmetrically on the left and right sides of the aircraft close to the horizontal axis of symmetry. As illustrated in (fig.5), these locations give them a low sensitivity to sideslip.

The AOA3 is located below the aircraft’s horizontal axis of symmetry. This position makes it more susceptible to sideslip because it is mainly exposed to the part of the lateral airflow which flows below the aircraft (fig.5). This is why the crosswind gust that occurred at the same time as the triggering of the WINDSHEAR alert caused there to be a discrepancy between the measured deflections of the AOA1 and AOA3 sensor vanes.

(fig.5) Lateral wind gusting across the fuselage during sideslip. AOA3 is more sensitive to sideslip deflection, when compared to AOA1 and AOA2, due to its position below the horizontal symmetry axis of the aircraft.

• In the Flight Augmentation Computers (FAC)

Both FAC1 and FAC2 monitor certain ADR parameters, and in particular they monitor the AOA by performing a cross-comparison monitoring of all three AOA measurements provided by their respective ADR (refer fig.6). In this event, where the applied MEL procedure called for the ADR2 to be switched to [OFF], the FACs were only monitoring for a difference between the measured values of AOA1 and AOA3.

The discrepancy between AOA1 and AOA3 measurements at the time of crosswind gust led to AOA1 and AOA3 ADR parameters being rejected by both FACs. When one ADR parameter is rejected by the FAC monitoring, then all parameters of its corresponding ADR are also rejected. Therefore, ADR1 and ADR3 were rejected by both FAC1 and FAC2. Consequently, there was now no ADR information available in either FAC.

In this condition, both FAC were no longer capable of computing the characteristic speeds, the FD bars, the auto-thrust, auto-pilot or rudder travel limiter function.

(fig.6) Simplified schematic diagram showing the system configurations for ADR1, ADR2 and ADR3 with the cross-comparison monitoring of ADR by FAC1 and FAC2 in a normal configuration.

• In the Elevator & Aileron Computers (ELAC)

The sudden AOA3 increase had no consequences in the ELAC because the ELAC’s monitoring is slightly different to the FAC one due to different architecture. Therefore data from both ADR1 and ADR3 remained valid in the ELAC, and normal laws including all flight envelope protections, continued to be computed throughout the flight.

• On both PFD

The fact that ADR1 and ADR3 were rejected in FAC1 and FAC2 had no impact on the display of ADR parameters on the primary flight displays (PFD). Indeed, as the ADR1 and ADR3 were selected on the Captain’s and First Officer’s sides respectively, the current speed, Mach and altitude parameters delivered by these computers were respectively displayed on both the Captain’s and First Officer’s PFD until the end of the flight.

At the time of the second VFE overspeed warning, the crew switched the ADR2 to [ON]. This led ADR2 parameters to be available again for functions computation in FAC2. Therefore the characteristic speeds, the rudder travel limiter function, the Flight Director (FD2) and the auto-thrust (ATHR) became available again from channel 2.

However, the autopilot remained unavailable since FAC2 had only information from one ADR available.

easyJet continues to learn from events like the one analyzed in this article in order to prepare its pilots to face unexpected events and manage situations to have a safe outcome. It has a specific structure that it has put in place for managing remote bases and this reinforces the dissemination of safety, technical and training materials. Through the development of its “Just” culture, crews have confidence to report events so that their experience can be shared.

Practicing manual flying in various conditions and to use automation appropriately

easyJet recommends that all of its pilots regularly disengage the automation and practice their manual flying skills in various weather conditions. It is at the pilot’s discretion to choose when to fly without the auto-pilot or without auto-pilot and auto-thrust. easyJet places emphasis on using automation appropriately to reduce workload, and for the crew to fly manually when they feel they have the right conditions to do so without reducing their overall capacity. Manual handling skills are further reinforced in the easyJet simulator sessions.

The aim of encouraging regular practice of manual flying skills, both on the aircraft and in the simulators, is to ease the management of any unexpected events that could lead to less aircraft automation being available. Additionally, this reinforces the confidence of the pilots in their manual flying capabilities, which can help them to minimize the startle effect from unexpected events. In the flight described in this article, it was evident that the Captain was confident to manually fly the aircraft in the turbulent conditions on the approach into Glasgow as he disconnected the auto-pilot from one-thousand feet.

Encouraging the reporting of events to share the lessons learned and enhance safety

easyJet promotes a “Just Culture” for reporting events, which ensures that they can be objectively resolved and with a standardized recorded outcome. The reporting of an event by the crew and the subsequent investigation allows easyJet to collect all of the relevant facts in order to accurately rebuild the scenario. The aim is to share these experiences with other pilots, and to recognize positive behaviors that the crew exhibited when faced with a rare and unpredictable event. For easyJet, a “Just culture” means that when their crews are capably acting with their best intentions, to the capacity of their knowledge and experience levels, they can perform their responsibilities without the worry of an inconsistent reproach from the easyJet management.

Role of the Base Standards Captains in supporting event reporting and knowledge sharing amongst the pilots at a remote base

For the pilots who are located at bases away from the easyJet headquarters, a network of Base Standards Captains (BSCs) are in place. These BSCs distribute new procedures into each base in the easyJet route network, to ensure the procedures and other safety related changes are understood and adopted.

A BSC will carry out regular performance monitoring and standards assessments to ensure the continued capabilities of all pilots operating in their base. All of easyJet’s BSCs are line training Captains who are embedded within the day to day front line operation and therefore are best placed to engender a supportive atmosphere at the base in which pilots can operate, share their experiences and report events, or seek out knowledge if required.

Enhancement of training with the lessons shared from event reports to train for outcomes rather than from specific tasks

easyJet invests significantly in providing both remedial and supportive training packages for all of its crew and has over 10 years’ experience in using Alternative Training and Qualification Program (ATQP). This has provided more effective, operations specific training packages. The packages are designed using data from both industry wide and specific company safety events, as well as statistical analysis of data in order to identify additional areas that need to be trained.

With over 400,000 sectors a year flown across the fleet, easyJet has a rich stream of internal flight data to analyze. Their training team can define additional training priorities based on what they see in both the operations and in simulator sessions. They also draw upon the available industry information, including the lessons learned and recommendations from accident and incident reports. These are made available to all easyJet pilots for review.

The easyJet system is designed to “train for outcomes” rather than for specific scenarios. It includes training for upset recovery in normal law and multiple training cases for unreliable airspeed, which are opportunities to emphasize importance of “pitch and thrust” flying. All of the easyJet pilots are immersed in this training philosophy.

Reinforcing safety of operations though training enhancements

easyJet’s training highlights the importance of crews going back-to-basics to ensure a positive outcome for the safety of their flights, and the importance of efficient Crew Resource Management (CRM) when facing unexpected events.

For the event described by this article, it was clear for the First Officer as the pilot monitoring that his priority was to closely monitor the parameters, and in particular to always remain aware of the aircraft pitch attitude and bank angle during the go-around phase. The Captain as the pilot flying followed the standard operating procedures and applied back-to-basics attitude and thrust flying with the priorities to “Fly, Navigate and Communicate”. This allowed them to manage the situation and have a positive outcome to this startle effect event.

It is impossible to train every pilot in scenarios that will cover every potential threat. However, easyJet believes that by training their crews to ‘manage outcomes’ and to manage complex failures as a team for events, such as upset recovery or unusual attitude, they get an enhanced safety benefit across their entire fleet for all of their customers and crews.

The example of the easyJet event shows how a well-trained crew working in just-culture managed a challenging situation that had not been trained before. easyJet has practiced the UK CAA’s ‘Advanced Training & Qualification Programme’ (AQTP) for several years. The described event demonstrates the merits of this competency based training system compared to the conventional task based training philosophy.

Evidence Based Training (EBT) takes the concepts of the FAA’s Advanced Qualification Program (AQP) and EASA’s ATQP program further by structuring recurrent assessment and training according to evidence-based priorities, based on a comprehensive analysis of safety and training data from a wide variety of sources1. EBT was introduced by EASA in 2016 by ED Decision 2015/027/R for recurrent training.

Airbus is a strong supporter of EBT and has started to include EBT elements in its pilots’ type rating courses, even if it is not yet mandated by regulation.

The Airbus A350 Type Rating courses have been the first to receive EBT elements, making them competency and not task centered. EBT places emphasis on scenario-based training, adding the ‘surprise’ element, and particularly focusing on the most critical training topics identified by EBT2. One of these critical training topics is the Go-Around, which was found through analysis of data from multiple operational and training sources to be a procedure with operational risks. The data indicated that crews may face challenges when conducting a Go-Around3. These findings highlighted to industry the need to raise flight-crew skills in performing Go-Arounds, through more and different training types.

Accordingly, starting with the A350, Airbus has intensified Go-Around training to cover a much broader scope. Besides training the still necessary one-engine inoperative manoeuvres, the training also assigns the following:

• “Unexpected” go-arounds
• Go-arounds from various altitudes different from MDA/DH
• Go-arounds with relatively low gross weight, combined with low MISAP level off altitudes
• Go-arounds in VMC with revisions to the (managed) flight path (“Join visual downwind”)

Type Rating training will receive a major revamp when the new EASA regulation currently under design will introduce EBT for the type training phase. This step beyond ICAO DOC 9995 can be expected for 2018.