All Documents | PDF version

Chapter 9. Power plant

Table of Contents

9.1. Dual engine failure
9.2. Single Engine failure
9.3. Single engine operation
9.4. Engine relight in flight
9.5. Engine stall
9.6. Engine tailpipe fire
9.7. High engine vibration
9.8. Low oil pressure
9.9. High oil temperature
9.10. Oil filter clog
9.11. Fuel filter clog
9.12. Uncommanded reverser pressurisation
9.13. Reverser unlocked in flight
9.14. EIU fault
9.15. N1/N2/EGT overlimit
9.16. N1/N2/EGT/FF discrepancy
9.17. Start valve fault
9.18. Start faults
9.19. Ignition faults
9.20. Thrust lever angle sensor faults
9.21. FADEC faults

9.1. Dual engine failure

Airbus have recently (2018) introduced two new checklists for handling the Dual Engine Failure scenario:

  • The QRH.AEP.MISC EMER LANDING ALL ENG FAILURE checklist was introduced in response to the Hudson incident. It is designed to be a critical set of actions to be taken to configure the aircraft for a forced landing or ditching when unable to maintain altitude after loss of thrust near to the ground. EasyJet reproduces this checklist on the back of the normal checklist for easy access.

  • The QRH.AEP.ENG ALL ENG FAIL checklist. This replaces the QRH.AEP.ENG ENG DUAL FAILURE – FUEL REMAINING and QRH.AEP.ENG ENG DUAL FAILURE – NO FUEL REMAINING checklists for some airframes. Associated with this new checklist is the new ENG ALL ENGINES FAILURE ECAM procedure which replaces the ENG DUAL FAILURE ECAM on airframes with newer FWC modification levels.

The first of these new checklists is pretty straightforward and is discussed in Section 2.5, “Ditching” and Section 2.6, “Forced landing”.

The second is more complex. At first glance it appears to be a sensible attempt to move the branch point of “is a relight possible” from checklist title into a checklist decision tree. It does also, however, introduce a fairly fundamental philosophical change: where the ENG DUAL FAILURE (EDF) checklist almost immediately proceeds to windmill relight attempts, the ALL ENGINES FAILURE (AEF) checklist waits until inside the windmill relight envelope before doing so. Since this is below FL250 for CEO and below FL270 for NEO and starter assisted relight attempts will commence at FL200 (for both engine types), a much shorter duration of windmill start attempts occurs under the new regime. An explanation for this change in philosophy has been requested via the easyJet Technical Manager, and these notes will be updated once a response is received.

The EDF/AEF ECAMs may not be triggered under some circumstances. All the associated QRH checklists, therefore, include all steps provided by these ECAMs; indeed, after a few initial items the ECAMs simply refer to their associated QRH procedure.

Dual Engine Failure can be broken down into three main issues: Emergency Electrical configuration, a Green and Yellow Dual hydraulics failure and a requirement for a suitable airport within a relatively limited range. Slow depressurisation may also become an issue.

The Emergency Electrical configuration is dealt with first. The RAT is deployed and the emergency generator is brought online with the EMER ELEC PWR MAN ON pb (this should happen automatically, but is backed up with the manual action) and FAC 1 is recycled to regain rudder trim and display of characteristic speeds. Communications will be restricted to VHF1, HF1 and ATC1. If the APU is available, the electrical issues will be almost completely mitigated once it can be started from the emergency generator at FL250.

The “suitable airport” issue is then addressed by initiating a diversion. Rough rules of thumb: from normal cruise levels a range of around 80nm is available, and you really want at least a 3000m runway. Take account of descent winds, airport elevation and available runway directions when selecting an airport.

The Green and Yellow hydraulic failure aspect is interesting in that the checklists make no attempt to bring the Yellow Electric pump online once electrical power is available from the APU. This certainly works in the simulator, giving a full complement of hydraulics for the approach and landing (although gravity gear extension is still probably the way to go). Again an explanation has been requested via the easyJet Technical Manager, and these notes will be updated once a response is received.

The ideal outcome would be to get at least one engine relit. In some scenarios such as complete fuel exhaustion, this is not going to be an option. The EDF checklists account for this by providing FUEL REMAINING and NO FUEL REMAINING flavours. The AEF checklist takes the more generalised approach of a single checklist with an “engine relight can/cannot be attempted” fork. Relights come in “windmill” or “starter assisted” varieties. Windmill relights require relatively high speeds (300kt/M.77 for CEO, 270kt/M.77 for NEO) and will thus reduce gliding range: gliding range is 2½nm per 1000ft at green dot speed, reducing to 2nm per 1000ft at windmill relight speeds. Since starter assist is only available below 20,000ft, attempting windmill starts will cost up to 10nm of gliding range. On the flip side, there are a lot of advantages to windmill starts: start attempts can be made simultaneously for both engines and the APU is not required so start attempts can be commenced much earlier.

Windmill relights require flying at optimum relight speed, with the thrust levers at idle, the engine masters on and the ENG MODE selector set to IGN. If relight has not occurred after 30 seconds, the combustion chambers are ventilated by selecting both the engine masters off for 30 seconds before turning them both on again to initiate a fresh attempt.

Starter assisted relights require bleed air from the APU. Starting of the APU from the emergency generator is restricted to below FL250, and starter assisted starts are restricted to below FL200. Since windmilling is not required, airspeed should be reduced to green dot while attempting starter assisted relights. The APU bleed can only provide for one engine starter at a time, and wing anti-ice must be off during the attempt. Ensure the APU bleed is on, the thrust levers are at idle and the the ENG MODE SEL in set to IGN, then turn one engine master off for 30s and then back on. If unsuccessful turn that master back to off and repeat the process with the other engine. The master switch for an engine should be off for at least 30s between attempted relights of that engine.

If a landing must be made without power, the EDF recommends CONF 3 and the AEF recommends CONF 2 (flaps will be unavailable if yellow hydraulics have not been reinstated, so this amounts to the same configuration). Vapp is available in each of the checklists; it will always be at least 150kt to prevent RAT stall. The gear is available with gravity extension. If only blue system hydraulics are available, the stabilizer will be frozen once engine driven hydraulics are lost and elevator trimming will cease with transition to direct law at gear extension. Therefore, for easier handling the gear extension should ideally be delayed until CONF 3 and Vapp are reached. If ditching, do not extend the gear.

If an airfield can be reached, arrange to be inbound on the runway centerline at 4nm and 2400ft aal (giving a 6° glide to the threshold) with CONF 1, S speed and gear up. To help achieve this, for a clean aircraft, the following rules of thumb apply:

  • A standard one minute leg holding pattern loses 8000ft and an orbit loses 4000ft. Thus for every 15 seconds outbound in a holding pattern, approximately 1000ft is lost.

  • Wings level, 400ft is lost per nm.

For the segment inbound from 4nm, macro adjustment of glide path is available through the timing of gear and slat deployment (CONF 1, S speed, gear up gives about a 4½° glide; CONF 3, 150kt, gear down gives about a 7½° glide), then micro adjustment is available from temporarily increasing speed above Vapp. If necessary, disregard slat limiting speeds. It is better to land fast then long.

If an airfield cannot be reached, refer to Section 2.5, “Ditching” or Section 2.6, “Forced landing” as appropriate.

[ENG DUAL FAILURE, QRH AEP.ENG, FCOM PRO.AEP.ENG, FCTM PRO.AEP.ENG]

9.2. Single Engine failure

Defined as a rapid decrease in EGT, N2 and FF, followed by a decrease in N1. The crew must determine whether the engine has been damaged or whether a simple flame-out has occurred. Indications of damage are loud noises, significantly increased vibration or buffeting, repeated or uncontrollable engine stalls or abnormal post-failure indications (e.g. hydraulic fluid loss, zero N1 or N2 etc.).

Firstly, the ignitors are turned on to protect the remaining engine and to confirm an immediate relight attempt. The thrust lever of the failed engine is then moved to idle (PF moves the lever after confirmation from PNF). If the FADEC hasn’t relit the failed engine within 30 seconds of the failure, it is shut down with the master switch. If damage is believed to have occurred, the associated fire button is pushed and, after 10 seconds, agent 1 discharged.

If it is believed that the engine is undamaged, a relight can be considered. The relight procedure is fairly long and highly unlikely to be successful; do not delay diversion and landing by attempting a relight. Also note that a relight attempt will erase FADEC troubleshooting data.

If there is vibration and/or buffeting, attempt to find an airspeed and altitude combination that minimizes the symptoms.

Refer to Section 9.3, “Single engine operation” if unable to relight the engine.

[ENG 1(2) FAIL, FCOM PRO.AEP.ENG]

9.3. Single engine operation

The most pressing issue is that a single engine bleed cannot support wing anti-ice and two packs. With the crossbleed valve selector in the normal AUTO position, the crossbleed valve is effectively synchronised to the APU bleed valve[30] and thus will most probably be closed; wing anti-ice, if it is in use, will be operating asymmetrically. If a fire button has been pushed, its associated side of the pneumatic system will be locked out and thus the only option is to turn the wing anti-ice off. PRO.NOR.SUP.AW “Minimum Speed with Ice Accretion” provides mitigation of icing in the event of inoperative wing anti-ice. If both sides of the cross bleed system are available, the cross bleed valve can be manually opened at a cost of 1200ft to the single engine gross ceiling. With the cross bleed valve open, wing anti-ice is available, but one of the packs must be turned off[31] whenever it is used.

The remaining engine must be safeguarded. To this end, continuous ignition should be selected.

A fuel imbalance may develop. Fuel imbalance limitations are detailed in FCOM LIM.FUEL. If the outer tanks are balanced, once the fuller inner tank contains less than 2250kg, fuel balance will never be limiting. Since this first occurs with approximately 5900kg of fuel remaining, fuel balancing due to balance limitations will generally not be required. Fuel may, however, still need to be crossfed to prevent fuel starvation of the remaining engine. Balance this concern against feeding your live engine the same fuel that was feeding your failed engine when it stopped working.

TCAS should be selected to TA to avoid unflyable climb RAs.

If a reverser is unlocked with associated buffet, speed should be limited to 240kt. See Section 9.13, “Reverser unlocked in flight” for more details of this scenario.

If the remaining engine is operated at maximum power with the aircraft at low speed (e.g. responding to windshear) it is possible that directional control may be lost before the flight computer protections apply. Be cautious about reducing speed below VLS on one engine.

The main systems lost are the generator, bleed and hydraulic pump associated with the engine. Other systems may be lost depending on the reason for the shutdown. The APU can be used to replace the lost generator and, providing the left side of the pneumatic system is available and isolated (i.e. cross bleed valve closed), provide pressurisation through pack 1, thus giving additional margin for the go-around. The BMCs automatically close the engine bleeds when the APU bleed valve is opened, so it is not necessary to manually turn them off to achieve this additional go-around margin. Note, however, that the APU cannot support wing anti-ice.

Approach and landing will be fairly normal. The main provisos are

  • Full flap should only be selected once descending on the glidepath; if a level off is required, the landing should be CONF3 [QRH AEP.ENG “OEI – Straight in approach”].

  • Only Cat 3 Single is available due to the loss of the ability to split the electrical system.[QRH OPS]

  • On A319s, the autopilot cannot fly FINAL APP, NAV/VS or NAV/FPA approaches. All modes are available for manual flight with flight directors. [FCOM LIM.AFS.GEN]

  • If flying manually, consider using manual thrust to better anticipate the rudder inputs required by thrust changes. Also consider setting rudder trim to zero at a late stage of the approach.[FCTM PRO.AEP.ENG]

[ENG 1(2) SHUT DOWN, FCOM PRO.AEP.ENG]

9.4. Engine relight in flight

A graph showing the in flight relight envelope is provided in section AEP.ENG of the QRH. The ceiling is 27000 ft. Automatic start is recommended, but crew action is required in case of abnormal start.

To prepare for the start, ensure the affected engine master switch is turned off and the affected thrust lever is at idle. Select ignition on the engine mode selector and open the cross bleed. If it is anticipated starter assist may be required, ensure wing anti ice is selected off.

To begin the start sequence, select the affected master switch on. The FADEC will determine whether starter assist is required and will open the start valve as needed. Both ignitors are energised as soon as the master switch is turned on, and the HP fuel valve opens at 15% N2. Closure of the start valve and de-energisation of the ignitors occurs at 50% N2 as normal. Light off must occur within 30 seconds of fuel flow initiation. If uncertain about successful relight, move the thrust lever to check for engine response. The START FAULT ENG STALL ECAM may be disregarded if all other parameters are normal.

[QRH AEP.ENG, FCOM PRO.AEP.ENG]

9.5. Engine stall

A stall is indicated by abnormal engine noise, flame from the engine exhaust (and possibly inlet in extreme cases), fluctuating performance parameters, sluggish thrust lever response, high EGT and/ or rapid EGT rise when the thrust lever is advanced.

A variety of FADECs are fitted within the easyJet fleet. The earlier FADECs do not trigger an ECAM warning if N2 is above idle, whereas the later FADECs are more capable. The FCTM warns that all FADECs may fail to detect engine stalls in some cases. Crew must therefore be ready to diagnose engine stalls on the basis of the above symptoms and apply the QRH procedures where necessary.

If an engine stall occurs on the ground, shut the engine down.

When an engine stall occurs in flight, the response is airframe specific. For the earlier FADECs, if an ECAM is triggered, the engine is simply shut down. In all other cases (no ECAM triggered on earlier FADECs; later FADECs) an attempt is made to contain the stall without shutting down the engine. The affected thrust lever is retarded to idle and the engine parameters checked. If the engine parameters remain abnormal, the engine is shut down. If, however, the parameters return to normal, stall margin is increased by turning on anti-icing[32] and the thrust levers are slowly advanced. If the stall recurs, the engine can be operated at low thrust settings, otherwise it can be operated normally.

[ENG 1(2) STALL, QRH AEP.ENG, FCOM PRO.AEP.ENG]

9.6. Engine tailpipe fire

An internal engine fire may be encountered during engine start or shutdown. It will either be seen by ground crew or may be indicated by EGT failing to decrease after the master switch is selected off.

Start by getting the engine to a known state by ensuring the man start button is selected off and the affected engine master is selected off.

The concept is to blow the fire out by dry cranking the engine. It is therefore essential that the fire button is not pressed, as this will remove external power from the FADEC and prevent dry cranking. Firstly, a source of bleed air must be available to power the starter. Possibilities, in order of preference, are the APU, the opposite engine or a ground air cart. If using the opposite engine, the source engine bleed must be on, the target engine bleed should be off, the cross bleed should be opened and thrust increased to provide 30 psi of pressure. If using ground air, both engine bleeds should be off and the cross bleed opened. Once high pressure air is available, select the engine mode selector to crank and select the man start button to on. Once the fire is extinguished, select the man start button off and the engine mode selector to normal.

As a last resort, external fire suppression agents may be used. They are, however, highly corrosive and the engine will be a write off.

[QRH AEP.ENG, FCOM PRO.AEP.ENG]

9.7. High engine vibration

The ECAM VIB advisory (N1≥6 units, N2≥4.3 units) is simply an indication that engine parameters should be monitored more closely. High VIB indications alone do not require the engine to be shut down.

High engine vibration combined with burning smells may be due to contact of compressor blade tips with associated abradable seals.

If in icing conditions, high engine vibration may be due to fan blade or spinner icing. The QRH provides a drill to shed this ice, after which normal operations can be resumed.

If icing is not suspected and if flight conditions permit, reduce thrust so that vibrations are below the advisory level. Shut down the engine after landing for taxiing if vibrations above the advisory level have been experienced.

[QRH AEP.ENG, FCOM PRO.AEP.ENG]

9.8. Low oil pressure

The sources for the gauge on the ECAM ENG page and the ECAM warning are different. If there is a discrepancy between the two, a faulty transducer is the most likely cause and the engine can continue to be operated normally. If both sources agree, the engine should be shut down by retarding its thrust lever and selecting its master switch off and the after shutdown procedure applied (see Section 9.3, “Single engine operation”).

[ENG 1(2) OIL LO PR, FCOM PRO.AEP.ENG]

9.9. High oil temperature

It may be possible to reduce oil temperature by increasing engine fuel flow.

If oil temperature exceeds 155°C or exceeds 140°C for 15 minutes, the engine must be shut down.

[ENG 1(2) OIL HI TEMP, FCOM PRO.AEP.ENG]

9.10. Oil filter clog

If a warning occurs during a cold engine start with oil temperature <40°C, the warning may be considered spurious. The oil filter features a bypass mechanism, so there is no immediate problem.

[ENG 1(2) OIL FILTER CLOG, FCOM PRO.AEP.ENG]

9.11. Fuel filter clog

No immediate crew action required. I assume there is some sort of bypass mechanism, but this isn’t apparent from the FCOM.

[ENG 1(2) FUEL FILTER CLOG, FCOM PRO.AEP.ENG]

9.12. Uncommanded reverser pressurisation

There are two valves that prevent pressure reaching the thrust reverser actuators at an inopportune moment, plus a third that commands direction of movement. The most upstream of these, controlled by the SECs, prevents any hydraulic pressure reaching the Hydraulic Control Unit (HCU) when the thrust levers are not in the reverse quadrant. If this protection is lost, the correct operation of the HCU should keep the doors properly stowed. An HCU malfunction, however, could result in an in-flight reverser deployment. If flight conditions permit, idle thrust should be selected on the affected engine.

It is unclear from the FCOM whether the ECAM indicates pressure has reached the directional solenoid valve and hence that the reverser door jacks are pressurised, albeit in the closed direction, although the existence of the REV ISOL FAULT ECAM indicates that this is probably the case.

[ENG 1(2) REV PRESSURIZED, FCOM PRO.AEP.ENG]

9.13. Reverser unlocked in flight

If one or more reverser doors are detected as not stowed in flight, the associated FADEC will automatically command idle on the affected engine. This should be backed up by setting the thrust lever to idle.

A warning without associated buffet is likely to be spurious. In this case limit speed to 300kt/M.78, keep the engine running at idle and expect to make a normal single engine approach and landing.

If there is buffet, shut the engine down and limit speed to 240kt. Full rudder trim may be required. The ECAM will provide one of two approach procedures depending on how many doors are detected as not stowed:

  • If all 4 doors are not stowed on CEO or the reverser is deployed on NEO, it will be a flap 1 landing, with approach speed VREF+55kt slowing to VREF+40kt below 800ft. Gear should only be deployed once landing is assured.

  • Otherwise, it will be a flap 3 landing at VREF+10kt for CEO or VREF+15kt for NEO.

[ENG 1(2) REVERSE UNLOCKED, FCOM PRO.AEP.ENG]

9.14. EIU fault

The Engine Interface Unit (EIU) receives data from the engine start system, the auto-thrust system, the LGCIUs, the air conditioning controller and the engine anti ice system and feeds it to its related FADEC. Thus loss of the EIU leads to loss of auto-thrust, reverser, idle control (defaults to approach idle) and start for the affected engine. If engine anti ice is used, the ignitors must be manually selected.

If an engine fails whilst its associated EIU is inoperative, the usual ECAM messages will not be generated. The failure can still be diagnosed from the system pages and an appropriate drill can be actioned from the FCOM.

[ENG 1(2) EIU FAULT, FCOM PRO.AEP.ENG]

9.15. N1/N2/EGT overlimit

If the overlimit is moderate, the associated thrust lever can be retarded until the overlimit ceases, and the flight may be continued normally.

If the overlimit is excessive, the engine should generally be shut down. If there are over-riding factors precluding a shut down, the engine may be run at minimum required thrust.

[ENG 1(2) N1/N2/EGT OVERLIMIT, FCOM PRO.AEP.ENG]

9.16. N1/N2/EGT/FF discrepancy

The system can detect a discrepancy between actual and displayed values of N1, N2, EGT and fuel flow. This is indicated by an amber CHECK beneath the affected parameter. Attempt to recover normal indications by switching from DMC1 to DMC3. If this fails, values can be inferred from the opposite engine.

[ENG 1(2) N1(N2)(EGT)(FF) DISCREPANCY, FCOM PRO.AEP.ENG]

9.17. Start valve fault

If a start valve fails open, remove bleed sources supplying the faulty valve. If on the ground, turn off the MAN START button if used, and shut the engine down with its master switch.

If the start valve fails closed, it may be that insufficient pressure is reaching it. Try opening the cross bleed and turning on the APU bleed.

On the ground, a start may still be possible with manual operation of the start valve.

[ENG 1(2) START VALVE FAULT, FCOM PRO.AEP.ENG]

9.18. Start faults

Start faults include ignition faults (no light off within 18 seconds of ignition start), engine stalls, EGT overlimit (>725°C) and starter time exceedance (2 mins max).

On the ground, nearly all starts are auto starts. In this case the FADEC will automatically abort as needed. It will then automatically carry out the required dry crank phase and make further attempts. Once the FADEC gives up, an ECAM message will instruct the crew to turn off the relevant engine master. If the fault was a stall due to low pressure, consider another automatic start using cross bleed air.

If a manual start is attempted, the crew must monitor the relevant parameters (the FADECs will provide some passive monitoring) and, if necessary, abort the start by turning the engine master and man start button off. The crew must then carry out a 30 second dry crank phase manually. Note that this is not mentioned in the relevant supplementary procedure, nor are the relevant lines displayed on the ECAM. It is probably worth having FCOM PRO.AEP.ENG handy when carrying out manual starts.

Following an aborted start in flight, the engine master should be turned off for 30 seconds to drain the engine. A further start attempt can then be made.

If the electrical power supply is interrupted during a start (indicated by loss of ECAM DUs) turn the master switch off, then perform a 30 second dry crank.

If a fuel leak from the engine drain mast is reported, run the engine at idle for 5 minutes. If the leak disappears within this time the aircraft may dispatch without maintenance action.

[ENG 1(2) START FAULT, FCOM PRO.AEP.ENG, EOMB 2.3.8.1]

9.19. Ignition faults

Each engine has two ignitors. If both fail on a single engine, avoid heavy rain, turbulence and, as far as possible, icing conditions.

[ENG 1(2) IGN FAULT, FCOM PRO.AEP.ENG]

9.20. Thrust lever angle sensor faults

Each thrust lever has two thrust lever angle (TLA) sensors.

Failure of one sensor only leads to a loss of redundancy; the proviso is that it must have failed in a way that the system can positively detect.

More difficult is when the sensors are in disagreement. In this case, the FADEC makes the assumption that one of the sensors is accurate and provides a default thrust setting based on this assumption:

  • On the ground, if neither sensor is in a take-off position, idle power is commanded. If one sensor is in take-off position and the other is above idle, take-off thrust is commanded. This leaves the completely conflicted case of one sensor at take-off and the other at idle or below; the FADEC selects idle power as the best compromise.

  • In flight, once above thrust reduction altitude the FADEC will assume that the largest TLA, limited to CLB, is correct. The autothrust can then manage the thrust between idle and this position. For approach (slats extended), as long as both TLAs indicate less than MCT, thrust is commanded to idle.

If both TLA sensors fail, the FADEC again goes for sensible defaults. On the ground, idle thrust is set. In flight, if the thrust was TO or FLEX at the time of failure, this setting will be maintained until slat retraction, whereupon CLB will be selected. If the thrust was between IDLE and MCT, CLB will be selected immediately. As soon as slats are deployed, IDLE is commanded; this remains the case even for go-around. Autothrust will manage thrust between IDLE and CLB whenever CLB is assumed.

[ENG 1(2) THR LEVER DISAGREE, ENG 1(2) THR LEVER FAULT, ENG 1(2) ONE TLA FAULT, FCOM PRO.AEP.ENG]

9.21. FADEC faults

The FADECs have two redundant channels; loss of a single channel does not generally require crew action. Single channel FADEC faults during start may be considered spurious on successful application of the reset procedure detailed in FCOM PRO.AEP.ENG

If both channels of a FADEC are lost, the thrust lever should be set to idle. Engine indications will be lost. If all other parameters are normal (check all ECAM system pages), the engine can be left running. Otherwise, shut it down.

If a FADEC overheats, reducing engine power may reduce temperature in the ECU area sufficiently to prevent shutdown. If on the ground the engine must be shut down and the FADEC depowered.

[ENG 1(2) FADEC A(B) FAULT, ENG 1(2) FADEC FAULT, ENG 1(2) FADEC HI TEMP, FCOM PRO.AEP.ENG]



[30] The exception is that the crossbleed won’t open if a bleed air duct leak is detected except during engine start.

[31] It will need to be pack 1 in Emergency Electrical config; otherwise it will generally be the pack on the dead engine side.

[32] The new QRH procedure for the NEO requires wing anti-ice be turned on whereas that for the CEO requires engine anti-ice be turned on, but both then go on to mention that stall margin is increased by turning on both, albeit at a cost of increased EGT. The old QRH procedure did turn on all relevant anti-icing. I have requested more information and will update this section when I get a response.