The cargo compartment smoke warning came as a surprise. This was a heavy-weight take-off, well above maximum landing weight and the aircraft was not even through a thousand feet above ground level (AGL). Air Traffic Control were informed of the intention to return immediately.

The ECAM (Electronic Centralised Aircraft Monitoring) actions that were displayed were actioned accordingly, with both fire agents being discharged into the aft cargo compartment. The red warning light, however, stayed ominously illuminated. Passing 1500 feet AGL, with an Auto Pilot (AP) engaged, the crew started the acceleration and clean-up process.

As the Pilot Flying (PF) I called for ‘Flaps Zero’ there was another loud ‘ping’ and the Master Caution illuminated, with a new ECAM stating that the leading-edge slats had failed in the take-off position.

The PF had the presence of mind to select the current airspeed, to prevent the AP and auto-thrust system exceeding the maximum speed for slats extended, before calling for the Pilot Monitoring (PM) to complete the latest ECAM actions.

In between all this was the need to position the aircraft through radar vectors onto a final approach for the active runway, and the requirement to brief the senior cabin crew member to prepare for a passenger evacuation immediately after landing.

Despite that damned smoke indication remaining illuminated, there were several procedures that had to be completed before the approach could be commenced. The slat issue had some important calculations and set-up to be done. If done in the wrong sequence, the abnormal approach speeds would be incorrect, with dire consequences for the landing. Following this would be the Slat / Flap Jammed Checklist.

Then there was that over-weight landing checklist, as this was an A320, which has no fuel dump system.

That cargo fire was still active…how long before it penetrated the cabin? No idea, but best the aircraft lands ASAP

It took nine minutes of frantic checklist activity before the crew announced to ATC that they were ready for the approach. On the hand-over to the Tower frequency, the crew were informed that emergency services were being positioned near the runway, and to continue the approach.

Fox Tango (FT) Lead was also on the tower frequency. This vehicle co-ordinates the other emergency response vehicles and is meant to assist in the event of a passenger evacuation on the runway.

Sod’s Law is never far away in these situations.

FT Lead had to make the call that an over-zealous fire-tender driver had managed to get his large vehicle stuck on the soft shoulder of the runway, effectively blocking it.

ATC had no choice but to tell the stricken aircraft on short final to go-around. There would now be vectors for the parallel runway, if, of course, that still-burning cargo compartment didn’t bring the aircraft down…

Thank goodness this was being played out in a Level D Airbus simulator.

Should I really be saying ‘thank goodness’? I’m not too sure.

The nature of simulator training for transport category aircraft has much changed over the past 22 years that I have been flying the big jets. Crew Resource Management and other ‘soft skill’ aspects have come to the fore and have, through the shift to competency based training, enabled a better teaching and understanding of the emphasis we place on the hard skills.

The scenario I have described above has not been a part of any LOE (Line Orientated Evaluation) or even LOFT (Line Orientated Flight Training) that I have conducted in a simulator.

Re-looking at this particular sequence of events, it is patently obvious that it is somewhat unrealistic in terms of the sequence of failures and the way these failures would hugely affect the required decision-making process of the crew, due to the massive time pressure.

The aircraft was heavy, which immediately brings in an additional checklist if an immediate return is required.

Any inextinguishable fire warning has to be the single biggest pressure-cooker in the cockpit. The chance of fudging subsequent procedures is high, vastly affecting the outcome of the exercise. On top of that comes a completely unrelated failure of the slats, which is not necessarily hugely difficult in terms of procedure, but said procedure has to be executed correctly to ensure the appropriate configuration and approach speeds are used.

If the additional checklist for landing with slats or flaps jammed is omitted either due to mental ram capacity being exceeded, or through choice due to extreme time constraints, any form of a go-around would undoubtedly go awry, as the non-standard configuration requires very specific actions and airspeeds on the part of the crew.

Thus, the scenario that forces a go-around.

As a training exercise with plenty of time available in the simulator and with a suitable de-briefing afterwards, there is probably a lot of value in this scenario, as it covers much of the complex failure combinations of ECAM actions, STATUS page use (this is a list of how broken the aircraft is following a failure) and multiple paper checklists.

The process of getting the sequence of events correct is an exercise in itself – never mind the time pressure and possibly the most complex go-around procedure available to Airbus aircraft.

As an evaluation, I would say this is too much, and it would result in potential sub-standard procedural performance by the crew, and a parting impression of simulator training being difficult, unreasonable and unpleasant.

So why contemplate such a ‘lesson’ plan?

Generation Three aircraft (Boeing 738, for example) and Generation 4 (Airbus, B787) have such comprehensive design and engineering features that a single failure of even a critical system is generally a non-event. Having said that, the Boeing 737 MAX has proven to be exactly contrary to this design and engineering philosophy, that a single failure source causes the loss of an aircraft…but I digress.

The requirement for certified redundancy has caused a dilemma for the designers of type rating skills tests and recurrent validation programs.

This coupled with the acknowledgement of the need for ‘startle factor’ of the crew, means things have to happen in multiples to both assess procedural proficiency under duress, as well as to create a situation that decisive leadership and decision-making leads to the point of a logical, and safe conclusion. 

Our present re-current program is, as always, designed around both Airbus’ requirements of specific systems to be highlighted, as well as current safety trends encountered out there on the line, to be part of the plan. 

Systems for this cycle are Electrical Power, Indicating and Recording, and Information Systems. 

The first one is a biggie, as the Airbus is very much an electrical beast and one can cause havoc with failures of this system alone. The last two are less critical, and even multiple failures of display screens or information sources, while catching the undivided attention of the crew, would be unlikely to lead to complex decision making. 

One of the events noted from normal line flights has been that of Overspeed – specifically when encountering adverse weather conditions that result in a sustained exceedance of the maximum Mach number, or Mmo, at high altitude. Thus, on this cycle we are required to reinforce the correct recovery procedure in this regard. 

Generally, all recurrent sessions consist of two simulator sessions on separate days. Day One is training and practice of certain scripted events (where we do the Mmo event), and Day two is the scenario evaluation (LOE), and then the low visibility revalidation requirements. 

Each instructor is required to develop their own LOE scenario in isolation of each other, simply to prevent a purely scripted scenario being anticipated by the crew. The positives of this is some form of startle factor, the negatives being a possibly non-uniform assessment tool. 

To counter the latter, there is a mandatory points system in place for creating each scenario. This attempts to ‘even out’ the complexity of each LOE. 

My scenario, and the logic behind it, is as follows: 

The flight is operating from Livingstone, Zambia, back to Johannesburg. The crew have a technician on board as per our out-station requirements. 

During start up, the Auxiliary Power Unit (APU) has an Auto Shut-down event as the first engine completes its start cycle. This causes multiple spurious ECAM warnings as the second engine start valve has no air pressure. Once this has been sorted out, some basic decision making is required. 

Can we go without an APU? What needs to be done to be legal? The requirement to consult the Minimum Equipment List is mandatory, and in some instances missed. The technician needs to placard the inoperative APU in the cockpit, if procedures are correctly followed. 

A non-normal cross-bleed engine start is now required, and this is a read-and-do procedure from the iPad. This process uses bleed air from the running engine to start the other engine. Once two normal engine starts are accomplished, a review and summary of the situation should be done in terms of risk management. 

During taxi-out, as is typical of African ATCs, the departure clearance is received, and I just so happen to give a routing that would take the aircraft straight into a giant thunderstorm, south of Victoria Falls airport. This is simple to manage and is there purely to add to distractions during departure. 

After getting airborne and changing frequencies to Vic Falls approach, I would fail the AC Buss 1. This is a significant failure in such an electrically dependant aircraft, and all sorts of cunning stunts happen as it automatically reconfigures the power source for the AC Essential Buss to take power from AC Buss 2. 

After the loss of the Auto Pilot, and reconfiguration of cockpit displays, everything is recoverable except Auto Thrust, leaving a relatively serviceable aircraft. 

However… 

Upon careful examination of the aircraft status it becomes apparent that we are down to a single AC electrical source, as Generator 1 is isolated with the loss of AC Buss 1, and the APU is inoperative from start up in Livingstone. This leaves us one step away from Electrical Emergency Configuration, which is not a happy place to be. 

This involves the entire aircraft electrical system being powered by the RAT – Ram Air Turbine, which is a wind-powered hydraulic pump that pops out near the left main landing gear leg and pressurises the Blue Hydraulic circuit. An Emergency Generator couples into this hydraulic circuit, and produces a paltry 5 KVA, which is just enough to power the absolute minimum systems required to get the aircraft back on the ground. 

Should the crew assess the loss of normal redundancy correctly and divert to Vic Falls or back to Livingstone using our latest Decision Making Model (DMM), that’s pretty much the end of the LOE. 

Should the decision be taken to continue on a single generator, I of course provide an overheat of the remaining generator drive system (IDG), which forces the disconnection of this IDG, and electrical pandemonium ensues as we enter Electrical Emergency Configuration. 

This gets fairly close to the first scenario I sketched at the beginning of this article and is a difficult situation to manage well. The point is to manage the risk so as to not get there in the first place. 

It is relevant to point out that there have to be three major failures, all unrelated, to get into this situation. Such is the engineering redundancy of modern aircraft. Therefore, an unlikely and highly improbable situation. 

So why do this? 

There is certainly value to the traditional “engine bursts into flames and land immediately” scenario, but not a huge amount of the soft skills become involved. These are: leadership and teamwork, decision making, workload management, communication and situational awareness. 

There is a balance between providing a challenging situation that calls for all resources available to be used by the crew and having a ridiculously over-loaded situation that brings out the worst in some individuals and leaves a lasting negative experience of recurrent training. 

I am certainly not a human behavioural expert by any means. Luckily, we do have a lot of excellent input available from this area, and it is becoming increasingly involved in this extremely important part of airline pilot development. 

Having said all that, here’s to never seeing that ‘Black Swan’ event in my or any reader’s career. 

58 Comments

  1. I’ve been browsing online more than 4 hours today, yet I never found any interesting article like yours.
    It’s pretty worth enough for me. Personally, if all site owners
    and bloggers made good content as you did, the net will be a
    lot more useful than ever before.

Leave a Reply

Your email address will not be published. Required fields are marked *