The entire easyJet fleet has, thankfully, now been upgraded such that the various eng dual failure checklists are no longer applicable. Where plenty of time is available, the response to failure of both engines is now supported by the eng all engines failure ecam and the eng all eng fail qrh procedure. For Hudson-like events, the qrh misc emer landing all eng failure checklist (also available on the back of the normal checklist) should be used. Note that the qrh misc ditching and qrh misc forced landing checklists are for engines operative landings and are therefore not applicable; engine inoperative ditching and forced landing are included in the eng all eng fail qrh procedure.
The eng all engines failure ecam actions ensure that emergency electrical power is online and that the aircraft is optimally set up for an immediate windmill relight (300kt/M0.77 for ceo, 270kt/M0.77 for neo, thrust levers idle). apu start is suggested if below fl250, although this may be spurious if fuel is exhausted or the apu is otherwise unavailable. For the ceos, a fac1 reset is also actioned in order to recover pfd characteristic speeds and rudder trim; this does not appear to be necessary for the neos. The ecam then suggests a diversion and hands off to the qrh procedure. The qrh includes the ecam actions, so it can be used directly if the ecam is unavailable.
Due to lack of engine bleeds, a slow depressurisation will likely be occuring. Since it would be easy to miss excess cabin altitude warnings, donning an oxygen mask may be a sensible precaution. ram air can be used once below fl100 with differential pressure <1psi.
For the diversion, as a rough rule of thumb, from normal cruise levels any airfield within 80nm should be reachable with sufficient height remaining to position for a glide approach. You really want at least a 3000m runway, although if you can get the apu supporting normal electrics and the yellow electrical hydraulic pump it may be possible to make do with less. Take account of descent winds, airport elevation and available runway directions when selecting an airport.
There are two main bifurcations in the procedures, dependent on whether there is any chance of restarting an engine in the first case, and whether an emergency landing will be made on water or land in the second.
Where relight is feasible, parallel windmill start attempts may be attempted once below fl2701 (or below fl250 on some airframes), and sequential starter assisted start attempts may be made once below fl200, provided that the apu bleed is available.
The windmill start attempts consist of selecting ign on the eng mode sel, turning both engine masters off for 30 seconds to ventilate the combustion chambers, then turning them both back on, repeating the cycle if unsuccessful.
Starter assisted start is much like the normal engine start procedure: turn both masters off for 30 seconds, ensure eng mode sel ign, pneumatic pressure is available to the starter and wing anti-ice is off, then turn one of the masters on. If the engine fails to start, turn that master off, and try the other one, ensuring 30 seconds of combustion chamber ventilation between each attempt. When making starter assisted start attempts, speed should be reduced to green dot to achieve maximum glide range; if windmill starts are required below fl200 (e.g. due lack of apu), suitable speeds can be found in the eng relight qrh checklist.
Where relight is not a possibility, speed should be reduced to green dot to maximise glide range and available time. At windmill relight speeds, available range is 2nm per 1000ft, wheras at green dot it is 2½nm per 1000ft. If available, the apu should still be started at fl250 in order to provide normal electrics and pressurisation.
The Green and Yellow hydraulic failure aspect of the dual engine failure is interesting in that the checklists make no attempt to bring the Yellow Electric pump online once electrical power is available from the apu. The rationale for this has three parts: firstly, there are branches of the failure where the yellow electric pump will not be available, such as if the apu was inop, and accounting for these cases in the checklists would over-complicate them; secondly, the engine driven pumps continue to provide hydraulic pressure for some time due to windmilling; and lastly, the ecam will eventually recognise the dual hydraulic failure and request the pump be turned on, and the checklist does encourage you to clear the ecam alerts and status if sufficient time is available.
The problem with this is that you will likely have given up on the ecam by the time it makes this suggestion. In general, then, if you recognise that the yellow electric pump is available, turn the ptu off (see Section 13.1) and turn the yellow pump on. You will, of course, still need to gravity extend the gear, as the green system will not be recovered, but with blue from the rat and yellow from the electric pump, your stopping ability is greatly enhanced.
The recommended configurations are conf 2, gear up for ditching and conf 2, gear down for forced landing. VAPP is available in each of the checklists; it will always be at least 150kt to give a 10kt margin against rat stall. The gear is available with gravity extension. If the yellow hydraulics have not been reinstated with the electric pump the stabilizer will be frozen once engine driven hydraulics are lost and elevator trimming will cease with transition to Direct Law at gear extension. Therefore, it may be advantageous to delay gear extension until conf 2 and VAPP are reached in this case. A pitch attitude of 11° with minimal vertical speed is suggested for ditching.
If an airfield can be reached, a glide approach and landing will need to be flown. Successful execution requires a good understanding of A320 family glide performance and navigational techniques for track mileage adjustment. I have provided a web browser based tool at https://aeftt.hursts.org.uk to help develop these skills. A discussion of methods can be found via the “Background Information” button in the main menu of this tool.
[ eng dual failure, qrh aep.eng, fcom pro.aep.eng,
fctm pro.aep.eng ]
Defined as a rapid decrease in egt, n2 and ff, followed by a decrease in n1. The crew must determine whether the engine has been damaged or whether a simple flame-out has occurred. Indications of damage are loud noises, significantly increased vibration or buffeting, repeated or uncontrollable engine stalls or abnormal post-failure indications (e.g. hydraulic fluid loss, zero n1 or n2 etc.).
Firstly, the ignitors are turned on to protect the remaining engine and to confirm an immediate relight attempt. The thrust lever of the failed engine is then moved to idle (pf moves the lever after confirmation from pnf). If the fadec hasn’t relit the failed engine within 30 seconds of the failure, it is shut down with the master switch. If damage is believed to have occurred, the associated fire button is pushed and, after 10 seconds, agent 1 discharged.
If it is believed that the engine is undamaged, a relight can be considered. The relight procedure is fairly long and highly unlikely to be successful; do not delay diversion and landing by attempting a relight. Also note that a relight attempt will erase fadec troubleshooting data.
If there is vibration and/or buffeting, attempt to find an airspeed and altitude combination that minimizes the symptoms.
Refer to Section 10.3 if unable to relight the engine.
[ eng 1(2) fail, fcom pro.aep.eng ]
The most pressing issue is that a single engine bleed cannot support wing anti-ice and two packs. With the crossbleed valve selector in the normal auto position, the crossbleed valve is effectively synchronised to the apu bleed valve2 and thus will most probably be closed; wing anti-ice, if it is in use, will be operating asymmetrically. If a fire button has been pushed, its associated side of the pneumatic system will be locked out and thus the only option is to turn the wing anti-ice off. pro.nor.sup.aw minimum speed with ice accretion provides mitigation of icing in the event of inoperative wing anti-ice. If both sides of the cross bleed system are available, the cross bleed valve can be manually opened at a cost of 1200ft to the single engine gross ceiling. With the cross bleed valve open, wing anti-ice is available, but one of the packs must be turned off3 whenever it is used.
The remaining engine must be safeguarded. To this end, continuous ignition should be selected.
A fuel imbalance may develop. Fuel imbalance limitations are detailed in fcom lim.fuel. If the outer tanks are balanced, once the fuller inner tank contains less than 2250kg, fuel balance will never be limiting. Since this first occurs with approximately 5900kg of fuel remaining, fuel balancing due to balance limitations will generally not be required. Fuel may, however, still need to be crossfed to prevent fuel starvation of the remaining engine. Balance this concern against feeding your live engine the same fuel that was feeding your failed engine when it stopped working.
tcas should be selected to ta to avoid unflyable climb ras.
If a reverser is unlocked with associated buffet, speed should be limited to 240kt. See Section 10.13 for more details of this scenario.
If the remaining engine is operated at maximum power with the aircraft at low speed (e.g. responding to windshear) it is possible that directional control may be lost before the flight computer protections apply. Be cautious about reducing speed below VLS on one engine.
The main systems lost are the generator, bleed and hydraulic pump associated with the engine. Other systems may be lost depending on the reason for the shutdown. The apu can be used to replace the lost generator and, providing the left side of the pneumatic system is available and isolated (i.e. cross bleed valve closed), provide pressurisation through pack 1, thus giving additional margin for the go-around. The bmcs automatically close the engine bleeds when the apu bleed valve is opened, so it is not necessary to manually turn them off to achieve this additional go-around margin. Note, however, that the apu cannot support wing anti-ice.
Approach and landing will be fairly normal. The main provisos are:
[ eng 1(2) shut down, fcom pro.aep.eng ]
A graphic showing the envelope for in-flight relight is provided in section abn.eng of the eqrh.
Automatic start abort is not available — crew action is required in the highly likely event of an abnormal start. Indications of abnormal start include exceedance of n2 or egt limits and no engine light up within 30 seconds of fuel flow increasing. Additionally, for the neo, n2 should be greater than 50% within 70 seconds of starting the attempt. It may be necessary to check the engine’s response to thrust lever movement to confirm a successful relight.
neo engines may exhibit a rapid egt increase to below egt limit; this is normal and start should not be aborted unless the egt limit is actually exceeded.
A spurious eng 1(2) start fault - eng stall may occur during in-flight start of some ceo engines — a note towards the bottom of the airframe specific eqrh checklist discriminates. Check all engine parameters are normal before disregarding.
To abort a start, simply turn off the engine’s master switch; at least 30 seconds should elapse before another attempt is made in order to ventilate the combustion chambers.
To prepare for the start attempt, ensure the affected engine master switch is turned off and the affected thrust lever is at idle. Select ignition on the engine mode selector and open the cross bleed. If it is anticipated starter assist may be required, ensure wing anti ice is selected off.
To begin the start sequence, select the affected master switch on. The fadec will determine whether starter assist is required and will open the start valve as needed.
[ qrh abn.eng, fcom pro.aep.eng ]
A stall is indicated by abnormal engine noise, flame from the engine exhaust (and possibly inlet in extreme cases), fluctuating performance parameters, sluggish thrust lever response, high egt and/ or rapid egt rise when the thrust lever is advanced.
A variety of fadecs are fitted within the easyJet fleet. The earlier fadecs do not trigger an ecam warning if n2 is above idle, whereas the later fadecs are more capable. The fctm warns that all fadecs may fail to detect engine stalls in some cases. Crew must therefore be ready to diagnose engine stalls on the basis of the above symptoms and apply the qrh procedures where necessary.
If an engine stall occurs on the ground, shut the engine down.
When an engine stall occurs in flight, the response is airframe specific. For the earlier fadecs, if an ecam is triggered, the engine is simply shut down. In all other cases (no ecam triggered on earlier fadecs; later fadecs) an attempt is made to contain the stall without shutting down the engine. The affected thrust lever is retarded to idle and the engine parameters checked. If the engine parameters remain abnormal, the engine is shut down. If, however, the parameters return to normal, stall margin is increased by turning on anti-icing4 and the thrust levers are slowly advanced. If the stall recurs, the engine can be operated at low thrust settings, otherwise it can be operated normally.
[ eng 1(2) stall, qrh aep.eng, fcom pro.aep.eng ]
An internal engine fire may be encountered during engine start or shutdown. It will either be seen by ground crew or may be indicated by egt failing to decrease after the master switch is selected off.
Start by getting the engine to a known state by ensuring the man start button is selected off and the affected engine master is selected off.
The concept is to blow the fire out by dry cranking the engine. It is therefore essential that the fire button is not pressed, as this will remove external power from the fadec and prevent dry cranking. Firstly, a source of bleed air must be available to power the starter. Possibilities, in order of preference, are the apu, the opposite engine or a ground air cart. If using the opposite engine, the source engine bleed must be on, the target engine bleed should be off, the cross bleed should be opened and thrust increased to provide 30 psi of pressure. If using ground air, both engine bleeds should be off and the cross bleed opened.
Once high pressure air is available, select the engine mode selector to crank and select the man start button to on.
When the fire is extinguished, select the man start button off and the engine mode selector to normal.
As a last resort, external fire suppression agents may be used. They are, however, highly corrosive and the engine will be badly damaged.
[ qrh aep.eng, fcom pro.aep.eng ]
The ecam vib advisory (n1≥6 units, n2≥4.3 units) is simply an indication that engine parameters should be monitored more closely. High vib indications alone do not require the engine to be shut down.
High engine vibration combined with burning smells may be due to contact of compressor blade tips with associated abradable seals.
If in icing conditions, high engine vibration may be due to fan blade or spinner icing. The qrh provides a drill to shed this ice, after which normal operations can be resumed.
If icing is not suspected and if flight conditions permit, reduce thrust so that vibrations are below the advisory level. Shut down the engine after landing for taxiing if vibrations above the advisory level have been experienced.
[ qrh aep.eng, fcom pro.aep.eng ]
The sensors for the gauge on the ecam eng page and the ecam warning are different. If there is a discrepancy between the two, a faulty transducer is the most likely cause and the engine can continue to be operated normally. If both sources agree, the engine should be shut down by retarding its thrust lever and selecting its master switch off and the after shutdown procedure applied (see Section 10.3).
[ eng 1(2) oil lo pr, fcom pro.aep.eng ]
Both engine oil and IDG oil are cooled by heat exchange with fuel. The neo additionally has an oil to air heat exchanger. The FADEC primarily controls engine oil temperature and fuel temperature by modulating the amount of fuel bypassed back to the tanks.
An ecam advisory occurs when oil temperature reaches 140°C. The advisory suggests that if oil temperature increase followed a thrust reduction, increasing thrust may contain the problem. It also suggests that it might be an IDG cooling issue; again, if at low speed increasing the engine speed may help, or, if at high speed, you can try reducing the generator load or disconnecting the IDG.
The eng 1(2) oil hi temp ecam is triggered if oil temperature exceeds 155°C or exceeds 140°C for 15 minutes. On the ceo the engine is simply shut down. On the neo an attempt is made to reduce the temperature by reducing thrust, and only if this is unsuccessful is the engine shut down. At time of writing (November 2023) the ecam actually presented by the fwc on the neo is incorrect — the correct procedure is currently being promulgated as an ofp attachment.
[ eng 1(2) oil hi temp, fcom pro.aep.eng ]
If a warning occurs during a cold engine start with oil temperature <40°C, the warning may be considered spurious. The oil filter features a bypass mechanism, so there is no immediate problem.
[ eng 1(2) oil filter clog, fcom pro.aep.eng ]
No immediate crew action required. I assume there is some sort of bypass mechanism, but this isn’t apparent from the fcom.
[ eng 1(2) fuel filter clog, fcom pro.aep.eng ]
There are two valves that prevent pressure reaching the thrust reverser actuators at an inopportune moment, plus a third that commands direction of movement. The most upstream of these, controlled by the secs, prevents any hydraulic pressure reaching the Hydraulic Control Unit (hcu) when the thrust levers are not in the reverse quadrant. If this protection is lost, the correct operation of the hcu should keep the doors properly stowed. An hcu malfunction, however, could result in an in-flight reverser deployment. If flight conditions permit, idle thrust should be selected on the affected engine.
It is unclear from the fcom whether the ecam indicates pressure has reached the directional solenoid valve and hence that the reverser door jacks are pressurised, albeit in the closed direction, although the existence of the eng rev isol fault ecam indicates that this is probably the case.
[ eng 1(2) rev pressurized, fcom pro.aep.eng ]
If one or more reverser doors are detected as not stowed in flight, the associated fadec will automatically command idle on the affected engine. This should be backed up by setting the thrust lever to idle.
A warning without associated buffet is likely to be spurious. In this case limit speed to 300kt/M.78, keep the engine running at idle and expect to make a normal single engine approach and landing.
If there is buffet, shut the engine down and limit speed to 240kt. Full rudder trim may be required. The ecam will provide one of two approach procedures depending on how many doors are detected as not stowed:
[ eng 1(2) reverse unlocked, fcom pro.aep.eng ]
The Engine Interface Unit (eiu) receives data from the engine start system, the auto-thrust system, the lgcius, the air conditioning controller and the engine anti ice system and feeds it to its related fadec. Thus loss of the eiu leads to loss of auto-thrust, reverser, idle control (defaults to approach idle) and start for the affected engine. If engine anti ice is used, the ignitors must be manually selected.
If an engine fails whilst its associated eiu is inoperative, the usual ecam messages will not be generated. The failure can still be diagnosed from the system pages and an appropriate drill can be actioned from the fcom.
[ eng 1(2) eiu fault, fcom pro.aep.eng ]
If the overlimit is moderate, the associated thrust lever can be retarded until the overlimit ceases, and the flight may be continued normally.
If the overlimit is excessive, the engine should generally be shut down. If there are over-riding factors precluding a shut down, the engine may be run at minimum required thrust.
[ eng 1(2) n1/n2/egt overlimit, fcom pro.aep.eng ]
The system can detect a discrepancy between actual and displayed values of n1, n2, egt and fuel flow. This is indicated by an amber check beneath the affected parameter. Attempt to recover normal indications by switching from dmc1 to dmc3. If this fails, values can be inferred from the opposite engine.
[ eng 1(2) n1(n2)(egt)(ff) discrepancy, fcom pro.aep.eng ]
If a start valve fails open, remove bleed sources supplying the faulty valve. If on the ground, turn off the man start button if used, and shut the engine down with its master switch.
If the start valve fails closed, it may be that insufficient pressure is reaching it. Try opening the cross bleed and turning on the apu bleed.
On the ground, a start may still be possible with manual operation of the start valve.
[ eng 1(2) start valve fault, fcom pro.aep.eng ]
Start faults include ignition faults (no light off within 18 seconds of ignition start), engine stalls, EGT overlimit (>725°C) and starter time exceedance (2 mins max).
On the ground, nearly all starts are auto starts. In this case the fadec will automatically abort as needed. It will then automatically carry out the required dry crank phase and make further attempts. Once the fadec gives up, an ecam message will instruct the crew to turn off the relevant engine master. If the fault was a stall due to low pressure, consider another automatic start using cross bleed air.
If a manual start is attempted, the crew must monitor the relevant parameters (the fadecs will provide some passive monitoring) and, if necessary, abort the start by turning the engine master and man start button off. The crew must then carry out a 30 second dry crank phase manually. Note that this is not mentioned in the relevant supplementary procedure, nor are the relevant lines displayed on the ecam. It is probably worth having fcom pro.aep.eng handy when carrying out manual starts.
Following an aborted start in flight, the engine master should be turned off for 30 seconds to drain the engine. A further start attempt can then be made.
If the electrical power supply is interrupted during a start (indicated by loss of ecam dus) turn the master switch off, then perform a 30 second dry crank.
If a fuel leak from the engine drain mast is reported, run the engine at idle for 5 minutes. If the leak disappears within this time the aircraft may dispatch without maintenance action.
[ eng 1(2) start fault, fcom pro.aep.eng, eomb 2.3.8.1 ]
Each engine has two ignitors. If both fail on a single engine, avoid heavy rain, turbulence and, as far as possible, icing conditions.
[ eng 1(2) ign fault, fcom pro.aep.eng ]
Each thrust lever has two thrust lever angle (tla) sensors.
Failure of one sensor only leads to a loss of redundancy; the proviso is that it must have failed in a way that the system can positively detect.
More difficult is when the sensors are in disagreement. In this case, the fadec makes the assumption that one of the sensors is accurate and provides a default thrust setting based on this assumption:
If both tla sensors fail, the fadec again goes for sensible defaults. On the ground, idle thrust is set. In flight, if the thrust was to or flex at the time of failure, this setting will be maintained until slat retraction, whereupon clb will be selected. If the thrust was between idle and mct, clb will be selected immediately. As soon as slats are deployed, idle is commanded; this remains the case even for go-around. Autothrust will manage thrust between idle and clb whenever clb is assumed.
[ eng 1(2) thr lever disagree, eng 1(2) thr lever fault,
eng 1(2) one tla fault, fcom pro.aep.eng ]
The fadecs have two redundant channels; loss of a single channel does not generally require crew action. Single channel fadec faults during start may be considered spurious on successful application of the reset procedure detailed in fcom pro.aep.eng.
If both channels of a fadec are lost, the thrust lever should be set to idle. Engine indications will be lost. If all other parameters are normal (check all ecam system pages), the engine can be left running. Otherwise, shut it down.
If a fadec overheats, reducing engine power may reduce temperature in the ecu area sufficiently to prevent shutdown. If on the ground the engine must be shut down and the fadec depowered.
[ eng 1(2) fadec a(b) fault, eng 1(2) fadec fault,
eng 1(2) fadec hi temp, fcom pro.aep.eng ]
1Note that this is different from the old eng dual failure checklist, where windmill start attempts were tried immediately, even if outside the relight envelope.
2The exception is that the crossbleed won’t open if a bleed air duct leak is detected except during engine start.
3It will need to be pack 1 in Emergency Electrical config; otherwise it will generally be the pack on the dead engine side.
4The new qrh procedure for the neo requires wing anti-ice be turned on whereas that for the ceo requires engine anti-ice be turned on, but both then go on to mention that stall margin is increased by turning on both, albeit at a cost of increased egt. The old qrh procedure did turn on all relevant anti-icing. I have requested more information and will update this section when I get a response.