The entire easyJet ﬂeet has, thankfully, now been upgraded such that the various eng dual failure checklists are no longer applicable. Where plenty of time is available, the response to failure of both engines is now supported by the eng all engines failure ecam and the eng all eng fail qrh procedure. For Hudson-like events, the qrh misc emer landing all eng failure checklist (also available on the back of the normal checklist) should be used. Note that the qrh misc ditching and qrh misc forced landing checklists are for engines operative landings and are therefore not applicable; engine inoperative ditching and forced landing are incluced in the eng all eng fail qrh procedure.
The eng all engines failure ecam actions ensure that emergency electrical power is online and that the aircraft is optimally set up for an immediate windmill relight (300kt/M0.77 for ceo, 270kt/M0.77 for neo, thrust levers idle). apu start is suggested if below fl250, although this may be spurious if fuel is exhausted or the apu is otherwise unavailable. For the ceos, a fac1 reset is also actioned in order to recover pfd characteristic speeds and rudder trim; this does not appear to be necessary for the neos. The ecam then suggests a diversion and hands oﬀ to the qrh procedure. The qrh includes the ecam actions, so it can be used directly if the ecam is unavailable.
Due to lack of engine bleeds, a slow depressurisation will likely be occuring. Since it would be easy to miss excess cabin altitude warnings, donning an oxygen mask may be a sensible precaution. ram air can be used once below fl100 with diﬀerential pressure <1psi.
For the diversion, as a rough rule of thumb, from normal cruise levels any airﬁeld within 80nm should be reachable with suﬃcient height remaining to position for a glide approach. You really want at least a 3000m runway, although if you can get the apu supporting normal electrics and the yellow electrical hydraulic pump it may be possible to make do with less. Take account of descent winds, airport elevation and available runway directions when selecting an airport.
There are two main bifurcations in the procedures, dependent on whether there is any chance of restarting an engine in the ﬁrst case, and whether an emergency landing will be made on water or land in the second.
Where relight is feasible, parallel windmill start attempts may be attempted once below fl2701 (or below fl250 on some airframes), and sequential starter assisted start attempts may be made once below fl200, provided that the apu bleed is available. The windmill start attempts consist of selecting ign on the eng mode sel, turning both engine masters oﬀ for 30 seconds to ventilate the combustion chambers, then turning them both back on, repeating the cycle if unsuccessful. Starter assisted start is much like the normal engine start procedure: turn both masters oﬀ for 30 seconds, ensure eng mode sel ign, pneumatic pressure is available to the starter and wing anti-ice is oﬀ, then turn one of the masters on. If the engine fails to start, turn that master oﬀ, and try the other one, ensuring 30 seconds of combustion chamber ventilation between each attempt. When making starter assisted start attempts, speed should be reduced to green dot to achieve maximum glide range; if windmill starts are required below fl200 (e.g. due lack of apu), suitable speeds can be found in the eng relight qrh checklist.
Where relight is not a possibility, speed should be reduced to green dot to maximise glide range and available time. At windmill relight speeds, available range is 2nm per 1000ft, wheras at green dot it is 2½nm per 1000ft. If available, the apu should still be started at fl250 in order to provide normal electrics and pressurisation.
The Green and Yellow hydraulic failure aspect of the dual engine failure is interesting in that the checklists make no attempt to bring the Yellow Electric pump online once electrical power is available from the apu. The rationale for this has three parts: ﬁrstly, there are branches of the failure where the yellow electric pump will not be available, such as if the apu was inop, and accounting for these cases in the checklists would over-complicate them; secondly, the engine driven pumps continue to provide hydraulic pressure for some time due to windmilling; and lastly, the ecam will eventually recognise the dual hydraulic failure and request the pump be turned on, and the checklist does encourage you to clear the ecam alerts and status if suﬃcient time is available.
The problem with this is that you will likely have given up on the ecam by the time it makes this suggestion. In general, then, if you recognise that the yellow electric pump is available, turn the ptu oﬀ (see Section 13.1) and turn the yellow pump on. You will, of course, still need to gravity extend the gear, as the green system will not be recovered, but with blue from the rat and yellow from the electric pump, your stopping ability is greatly enhanced.
The recommended conﬁgurations are conf 2, gear up for ditching and conf 2, gear down for forced landing. VAPP is available in each of the checklists; it will always be at least 150kt to give a 10kt margin against rat stall. The gear is available with gravity extension. If the yellow hydraulics have not been reinstated with the electric pump the stabilizer will be frozen once engine driven hydraulics are lost and elevator trimming will cease with transition to Direct Law at gear extension. Therefore, it may be advantageous to delay gear extension until conf 2 and VAPP are reached in this case. A pitch attitude of 11° with minimal vertical speed is suggested for ditching.
If an airﬁeld can be reached, arrange to be inbound on the runway centerline at 4nm and 2400ft aal (giving a 6° glide to the threshold) with conf 1, S speed and gear up. To help achieve this, for a clean aircraft, the following rules of thumb apply:
For the segment inbound from 4nm, macro adjustment of glide path is available through the timing of gear and slat deployment (conf 1, S speed, gear up gives about a 4½° glide; conf 3, 150kt, gear down gives about a 7½° glide), then micro adjustment is available from temporarily increasing speed above VAPP. If necessary, disregard slat limiting speeds. It is better to land fast then long.
[ eng dual failure, qrh aep.eng, fcom pro.aep.eng, fctm pro.aep.eng ]
Deﬁned as a rapid decrease in egt, n2 and ff, followed by a decrease in n1. The crew must determine whether the engine has been damaged or whether a simple ﬂame-out has occurred. Indications of damage are loud noises, signiﬁcantly increased vibration or buﬀeting, repeated or uncontrollable engine stalls or abnormal post-failure indications (e.g. hydraulic ﬂuid loss, zero n1 or n2 etc.).
Firstly, the ignitors are turned on to protect the remaining engine and to conﬁrm an immediate relight attempt. The thrust lever of the failed engine is then moved to idle (pf moves the lever after conﬁrmation from pnf). If the fadec hasn’t relit the failed engine within 30 seconds of the failure, it is shut down with the master switch. If damage is believed to have occurred, the associated ﬁre button is pushed and, after 10 seconds, agent 1 discharged.
If it is believed that the engine is undamaged, a relight can be considered. The relight procedure is fairly long and highly unlikely to be successful; do not delay diversion and landing by attempting a relight. Also note that a relight attempt will erase fadec troubleshooting data.
If there is vibration and/or buﬀeting, attempt to ﬁnd an airspeed and altitude combination that minimizes the symptoms.
Refer to Section 10.3 if unable to relight the engine.
[ eng 1(2) fail, fcom pro.aep.eng ]
The most pressing issue is that a single engine bleed cannot support wing anti-ice and two packs. With the crossbleed valve selector in the normal auto position, the crossbleed valve is eﬀectively synchronised to the apu bleed valve2 and thus will most probably be closed; wing anti-ice, if it is in use, will be operating asymmetrically. If a ﬁre button has been pushed, its associated side of the pneumatic system will be locked out and thus the only option is to turn the wing anti-ice oﬀ. pro.nor.sup.aw minimum speed with ice accretion provides mitigation of icing in the event of inoperative wing anti-ice. If both sides of the cross bleed system are available, the cross bleed valve can be manually opened at a cost of 1200ft to the single engine gross ceiling. With the cross bleed valve open, wing anti-ice is available, but one of the packs must be turned oﬀ3 whenever it is used.
The remaining engine must be safeguarded. To this end, continuous ignition should be selected.
A fuel imbalance may develop. Fuel imbalance limitations are detailed in fcom lim.fuel. If the outer tanks are balanced, once the fuller inner tank contains less than 2250kg, fuel balance will never be limiting. Since this ﬁrst occurs with approximately 5900kg of fuel remaining, fuel balancing due to balance limitations will generally not be required. Fuel may, however, still need to be crossfed to prevent fuel starvation of the remaining engine. Balance this concern against feeding your live engine the same fuel that was feeding your failed engine when it stopped working.
tcas should be selected to ta to avoid unﬂyable climb ras.
If a reverser is unlocked with associated buﬀet, speed should be limited to 240kt. See Section 10.13 for more details of this scenario.
If the remaining engine is operated at maximum power with the aircraft at low speed (e.g. responding to windshear) it is possible that directional control may be lost before the ﬂight computer protections apply. Be cautious about reducing speed below VLS on one engine.
The main systems lost are the generator, bleed and hydraulic pump associated with the engine. Other systems may be lost depending on the reason for the shutdown. The apu can be used to replace the lost generator and, providing the left side of the pneumatic system is available and isolated (i.e. cross bleed valve closed), provide pressurisation through pack 1, thus giving additional margin for the go-around. The bmcs automatically close the engine bleeds when the apu bleed valve is opened, so it is not necessary to manually turn them oﬀ to achieve this additional go-around margin. Note, however, that the apu cannot support wing anti-ice.
Approach and landing will be fairly normal. The main provisos are:
[ eng 1(2) shut down, fcom pro.aep.eng ]
A graph showing the in ﬂight relight envelope is provided in section aep.eng of the qrh. The ceiling is 27000 ft. Automatic start is recommended, but crew action is required in case of abnormal start.
To prepare for the start, ensure the aﬀected engine master switch is turned oﬀ and the aﬀected thrust lever is at idle. Select ignition on the engine mode selector and open the cross bleed. If it is anticipated starter assist may be required, ensure wing anti ice is selected oﬀ.
To begin the start sequence, select the aﬀected master switch on. The fadec will determine whether starter assist is required and will open the start valve as needed. Both ignitors are energised as soon as the master switch is turned on, and the hp fuel valve opens at 15% n2. Closure of the start valve and de-energisation of the ignitors occurs at 50% n2 as normal. Light oﬀ must occur within 30 seconds of fuel ﬂow initiation. If uncertain about successful relight, move the thrust lever to check for engine response. The eng start fault and eng stall ecams may be disregarded if all other parameters are normal.
[ qrh aep.eng, fcom pro.aep.eng ]
A stall is indicated by abnormal engine noise, ﬂame from the engine exhaust (and possibly inlet in extreme cases), ﬂuctuating performance parameters, sluggish thrust lever response, high egt and/ or rapid egt rise when the thrust lever is advanced.
A variety of fadecs are ﬁtted within the easyJet ﬂeet. The earlier fadecs do not trigger an ecam warning if n2 is above idle, whereas the later fadecs are more capable. The fctm warns that all fadecs may fail to detect engine stalls in some cases. Crew must therefore be ready to diagnose engine stalls on the basis of the above symptoms and apply the qrh procedures where necessary.
If an engine stall occurs on the ground, shut the engine down.
When an engine stall occurs in ﬂight, the response is airframe speciﬁc. For the earlier fadecs, if an ecam is triggered, the engine is simply shut down. In all other cases (no ecam triggered on earlier fadecs; later fadecs) an attempt is made to contain the stall without shutting down the engine. The aﬀected thrust lever is retarded to idle and the engine parameters checked. If the engine parameters remain abnormal, the engine is shut down. If, however, the parameters return to normal, stall margin is increased by turning on anti-icing4 and the thrust levers are slowly advanced. If the stall recurs, the engine can be operated at low thrust settings, otherwise it can be operated normally.
[ eng 1(2) stall, qrh aep.eng, fcom pro.aep.eng ]
An internal engine ﬁre may be encountered during engine start or shutdown. It will either be seen by ground crew or may be indicated by egt failing to decrease after the master switch is selected oﬀ.
Start by getting the engine to a known state by ensuring the man start button is selected oﬀ and the aﬀected engine master is selected oﬀ.
The concept is to blow the ﬁre out by dry cranking the engine. It is therefore essential that the ﬁre button is not pressed, as this will remove external power from the fadec and prevent dry cranking. Firstly, a source of bleed air must be available to power the starter. Possibilities, in order of preference, are the apu, the opposite engine or a ground air cart. If using the opposite engine, the source engine bleed must be on, the target engine bleed should be oﬀ, the cross bleed should be opened and thrust increased to provide 30 psi of pressure. If using ground air, both engine bleeds should be oﬀ and the cross bleed opened. Once high pressure air is available, select the engine mode selector to crank and select the man start button to on. Once the ﬁre is extinguished, select the man start button oﬀ and the engine mode selector to normal.
As a last resort, external ﬁre suppression agents may be used. They are, however, highly corrosive and the engine will be badly damaged.
[ qrh aep.eng, fcom pro.aep.eng ]
The ecam vib advisory (n1≥6 units, n2≥4.3 units) is simply an indication that engine parameters should be monitored more closely. High vib indications alone do not require the engine to be shut down.
High engine vibration combined with burning smells may be due to contact of compressor blade tips with associated abradable seals.
If in icing conditions, high engine vibration may be due to fan blade or spinner icing. The qrh provides a drill to shed this ice, after which normal operations can be resumed.
If icing is not suspected and if ﬂight conditions permit, reduce thrust so that vibrations are below the advisory level. Shut down the engine after landing for taxiing if vibrations above the advisory level have been experienced.
[ qrh aep.eng, fcom pro.aep.eng ]
The sensors for the gauge on the ecam eng page and the ecam warning are diﬀerent. If there is a discrepancy between the two, a faulty transducer is the most likely cause and the engine can continue to be operated normally. If both sources agree, the engine should be shut down by retarding its thrust lever and selecting its master switch oﬀ and the after shutdown procedure applied (see Section 10.3).
[ eng 1(2) oil lo pr, fcom pro.aep.eng ]
It may be possible to reduce oil temperature by increasing engine fuel ﬂow.
If oil temperature exceeds 155°C or exceeds 140°C for 15 minutes, the engine must be shut down.
[ eng 1(2) oil hi temp, fcom pro.aep.eng ]
If a warning occurs during a cold engine start with oil temperature <40°C, the warning may be considered spurious. The oil ﬁlter features a bypass mechanism, so there is no immediate problem.
[ eng 1(2) oil filter clog, fcom pro.aep.eng ]
No immediate crew action required. I assume there is some sort of bypass mechanism, but this isn’t apparent from the fcom.
[ eng 1(2) fuel filter clog, fcom pro.aep.eng ]
There are two valves that prevent pressure reaching the thrust reverser actuators at an inopportune moment, plus a third that commands direction of movement. The most upstream of these, controlled by the secs, prevents any hydraulic pressure reaching the Hydraulic Control Unit (hcu) when the thrust levers are not in the reverse quadrant. If this protection is lost, the correct operation of the hcu should keep the doors properly stowed. An hcu malfunction, however, could result in an in-ﬂight reverser deployment. If ﬂight conditions permit, idle thrust should be selected on the aﬀected engine.
It is unclear from the fcom whether the ecam indicates pressure has reached the directional solenoid valve and hence that the reverser door jacks are pressurised, albeit in the closed direction, although the existence of the eng rev isol fault ecam indicates that this is probably the case.
[ eng 1(2) rev pressurized, fcom pro.aep.eng ]
If one or more reverser doors are detected as not stowed in ﬂight, the associated fadec will automatically command idle on the aﬀected engine. This should be backed up by setting the thrust lever to idle.
A warning without associated buﬀet is likely to be spurious. In this case limit speed to 300kt/M.78, keep the engine running at idle and expect to make a normal single engine approach and landing.
If there is buﬀet, shut the engine down and limit speed to 240kt. Full rudder trim may be required. The ecam will provide one of two approach procedures depending on how many doors are detected as not stowed:
[ eng 1(2) reverse unlocked, fcom pro.aep.eng ]
The Engine Interface Unit (eiu) receives data from the engine start system, the auto-thrust system, the lgcius, the air conditioning controller and the engine anti ice system and feeds it to its related fadec. Thus loss of the eiu leads to loss of auto-thrust, reverser, idle control (defaults to approach idle) and start for the aﬀected engine. If engine anti ice is used, the ignitors must be manually selected.
If an engine fails whilst its associated eiu is inoperative, the usual ecam messages will not be generated. The failure can still be diagnosed from the system pages and an appropriate drill can be actioned from the fcom.
[ eng 1(2) eiu fault, fcom pro.aep.eng ]
If the overlimit is moderate, the associated thrust lever can be retarded until the overlimit ceases, and the ﬂight may be continued normally.
If the overlimit is excessive, the engine should generally be shut down. If there are over-riding factors precluding a shut down, the engine may be run at minimum required thrust.
[ eng 1(2) n1/n2/egt overlimit, fcom pro.aep.eng ]
The system can detect a discrepancy between actual and displayed values of n1, n2, egt and fuel ﬂow. This is indicated by an amber check beneath the aﬀected parameter. Attempt to recover normal indications by switching from dmc1 to dmc3. If this fails, values can be inferred from the opposite engine.
[ eng 1(2) n1(n2)(egt)(ff) discrepancy, fcom pro.aep.eng ]
If a start valve fails open, remove bleed sources supplying the faulty valve. If on the ground, turn oﬀ the man start button if used, and shut the engine down with its master switch.
If the start valve fails closed, it may be that insuﬃcient pressure is reaching it. Try opening the cross bleed and turning on the apu bleed.
On the ground, a start may still be possible with manual operation of the start valve.
[ eng 1(2) start valve fault, fcom pro.aep.eng ]
Start faults include ignition faults (no light oﬀ within 18 seconds of ignition start), engine stalls, EGT overlimit (>725°C) and starter time exceedance (2 mins max).
On the ground, nearly all starts are auto starts. In this case the fadec will automatically abort as needed. It will then automatically carry out the required dry crank phase and make further attempts. Once the fadec gives up, an ecam message will instruct the crew to turn oﬀ the relevant engine master. If the fault was a stall due to low pressure, consider another automatic start using cross bleed air.
If a manual start is attempted, the crew must monitor the relevant parameters (the fadecs will provide some passive monitoring) and, if necessary, abort the start by turning the engine master and man start button oﬀ. The crew must then carry out a 30 second dry crank phase manually. Note that this is not mentioned in the relevant supplementary procedure, nor are the relevant lines displayed on the ecam. It is probably worth having fcom pro.aep.eng handy when carrying out manual starts.
Following an aborted start in ﬂight, the engine master should be turned oﬀ for 30 seconds to drain the engine. A further start attempt can then be made.
If the electrical power supply is interrupted during a start (indicated by loss of ecam dus) turn the master switch oﬀ, then perform a 30 second dry crank.
If a fuel leak from the engine drain mast is reported, run the engine at idle for 5 minutes. If the leak disappears within this time the aircraft may dispatch without maintenance action.
[ eng 1(2) start fault, fcom pro.aep.eng, eomb 220.127.116.11 ]
Each engine has two ignitors. If both fail on a single engine, avoid heavy rain, turbulence and, as far as possible, icing conditions.
[ eng 1(2) ign fault, fcom pro.aep.eng ]
Each thrust lever has two thrust lever angle (tla) sensors.
Failure of one sensor only leads to a loss of redundancy; the proviso is that it must have failed in a way that the system can positively detect.
More diﬃcult is when the sensors are in disagreement. In this case, the fadec makes the assumption that one of the sensors is accurate and provides a default thrust setting based on this assumption:
If both tla sensors fail, the fadec again goes for sensible defaults. On the ground, idle thrust is set. In ﬂight, if the thrust was to or flex at the time of failure, this setting will be maintained until slat retraction, whereupon clb will be selected. If the thrust was between idle and mct, clb will be selected immediately. As soon as slats are deployed, idle is commanded; this remains the case even for go-around. Autothrust will manage thrust between idle and clb whenever clb is assumed.
[ eng 1(2) thr lever disagree, eng 1(2) thr lever fault,
eng 1(2) one tla fault, fcom pro.aep.eng ]
The fadecs have two redundant channels; loss of a single channel does not generally require crew action. Single channel fadec faults during start may be considered spurious on successful application of the reset procedure detailed in fcom pro.aep.eng.
If both channels of a fadec are lost, the thrust lever should be set to idle. Engine indications will be lost. If all other parameters are normal (check all ecam system pages), the engine can be left running. Otherwise, shut it down.
If a fadec overheats, reducing engine power may reduce temperature in the ecu area suﬃciently to prevent shutdown. If on the ground the engine must be shut down and the fadec depowered.
[ eng 1(2) fadec a(b) fault, eng 1(2) fadec fault,
eng 1(2) fadec hi temp, fcom pro.aep.eng ]
1Note that this is diﬀerent from the old eng dual failure checklist, where windmill start attempts were tried immediately, even if outside the relight envelope.
2The exception is that the crossbleed won’t open if a bleed air duct leak is detected except during engine start.
3It will need to be pack 1 in Emergency Electrical conﬁg; otherwise it will generally be the pack on the dead engine side.
4The new qrh procedure for the neo requires wing anti-ice be turned on whereas that for the ceo requires engine anti-ice be turned on, but both then go on to mention that stall margin is increased by turning on both, albeit at a cost of increased egt. The old qrh procedure did turn on all relevant anti-icing. I have requested more information and will update this section when I get a response.