Using airline simulators to their full extent

[Centaurus]

I have just read the book 'All Four Engines Have Failed' by author Betty Tootell. Published in 1985, her book tells the story of British Airways Flight BA009 a Boeing 747 en route London to India, Malaysia, Australia and New Zealand that encountered volcanic ash from Mount Galunggung an actice volcano in Indonesia. At the time the aircraft was cruising at 37,000 feet. The date of the incident was 24th June 1982. The author was a passenger on that flight. and it was nightime when the first signs of the incident occurred with the weather radar showing no returns.

No. 4 engine suddenly failed followed soon after by No. 2 engine surging. Then No. 1 and No. 3 engines surged virtually simultaneously. The captain told the first officer to declare an emergency, ordered the four-engine failure drill and concentrated on flying the Boeing 747 totally without engine power. He had practiced a four-engine failure in the airline's Boeing 747 simulator some months earlier but this was in earnest.

The aircraft had descended from 37,000 feet before the flight crew were able to start one engine and had already turned towards the sea in preparation for a ditching. At 13,500 feet the flight crew managed to relight a second engine followed soon after by relighting the remaining engines. The captain announced he would be diverting to Jakarta and fifteen minutes later a safe landing was made.

In her book, the author stated "To the flight deck crew the rehearsal of four-engine failures in the aircraft's simulator would doubtless take on a new significance. Perhaps they would be thankful that British Airways was one of the very few airlines in the world, before the encounter with Mt Galunnggung to include a simulated four-engine failure drill as part of its regular ongoing training programme."

During my service in the Royal Australian Air Force I flew the four-engine Lincoln bomber aircraft on long range maritime survelllance. Much of this was at night. There were no simulators in the1950's but we still practiced simulated ditching at night by dropping flame floats and making a flare path to ditch on. At night especially this would be on instruments. On reaching short final we would go around again. Thankfully our skills at this were never required.

In later years I flew Boeing 737's over Central and South Pacific regions, much of it being over water at night. While we had access to Boeing 737 simulators little thought was given by management to practice at loss of all engines. In any case, while the Boeing flight crew training manual of that era published procedures for loss of all engines, it assumed that a relight would be successful and the procedure stopped there. But what, you may ask, if neither engine could be started and you would have to ditch?. Hard luck chum - there was no procedure on how to ditch a 737.

This scribe is far beyond retiring age so am not familiar with current airline flight operations manuals. But I do wonder if these manuals cover not only loss of all engines but the worst case of the flight crew unable to start any engines and the inevitability of forced landing into land or sea. Or is the latter considered most unlikely and therefore simulator training for those events regarded as unnecessary?

[the_stranger]

While not flying on a 4 engine aircraft, I have done multiple simulated (volcano related) all engine failures, both with (some) recovery and a forced landing.

Personally I don't find them too useful, apart from the exercise in a severely time restricted emergency and the crew communication associated.

In a training environment where the amount of possible training is always finite, volcano related failures are low on my list as useful, I'd rather train more plausible issues which we as a group, seem to screw up more often.

[Uplinker]

I think it would be useful. I did it once as an F/O, but that was only because we had some time left and the Captain I was with wanted to try the exercise and had written out his own checklist for all engine failure at lower level. (It worked).

Things such as unreliable speed, speed disagree, AF447 frozen PITOTs etc also really need to be practised. Going through such critical drills, and reading the ECAM and QRH in such a situation is much easier if the situation has been seen and gone through before, rather than just reading about it in a book.

[FullWings]

In a training environment where the amount of possible training is always finite, volcano related failures are low on my list as useful, I'd rather train more plausible issues which we as a group, seem to screw up more often.Agreed. We are transitioning to full EBT and almost on the last LPC/OPC ever, so sim sessions are the most relevant I’ve ever seen them. Stuff like NPAs, rejected landings, TCEs, runway excursions, ATC issues, etc. which we need to deal with in real life.

It would be nice to practice some proper glide approaches but what would you cut out of the recurrent training to incorporate them? Also, the scenarios have to be somewhat curated to avoid negative training, IMO. At this point the advice I would give is to spend some time thinking about what you might do and how you might do it in the extremely unlikely event of a total power loss. Know the performance of the aircraft: what kind of glide can you get out of it and how steep/shallow an approach you can make and still get in using all the controls available? It’s energy management which all airline pilots should at least be competent at, which is the generic bit. For a specific failure, like the BA38, the actions required to make it survivable change every 30s depending exactly where during the approach you have the issue, so not that great as a training exercise.

[bugged on the right]

Did this as part of Tristar conversion. One armed paper hanger territory but I have never come out of the box feeling so satisfied.

[West Coast]

Did this as part of Tristar conversion. One armed paper hanger territory but I have never come out of the box feeling so satisfied.

Didn’t the Tristar have all 3 go quiet for a short while?

Edit: found it. https://en.wikipedia.org/wiki/Eastern_Air_Lines_Flight_855

[dss3000]

I think it would be useful. I did it once as an F/O, but that was only because we had some time left and the Captain I was with wanted to try the exercise and had written out his own checklist for all engine failure at lower level. (It worked).

Things such as unreliable speed, speed disagree, AF447 frozen PITOTs etc also really need to be practised. Going through such critical drills, and reading the ECAM and QRH in such a situation is much easier if the situation has been seen and gone through before, rather than just reading about it in a book.
If people were hearing this more often maybe we would train more in the areas we are bound to find ourselves in. Say it LOUDER

[john_tullamarine]

There's no simple answer when one considers the reality of commercial constraints on access to simulators. However, from my own, now dated, sim training/checking on the 737, there is a useful value in having a truncated all engine failure and glide so that the pilot actually sees what sort of glide performance exists. Far better and sticks much better in the mind than reading about it or being briefed on it.

Having said that I, near invariably, was able to manage the sim program progress to allow us some playtime in the final sessions to look at these sorts of odd ball situations where there was a stick and rudder value to be had.

[BuzzBox]

Having said that I, near invariably, was able to manage the sim program progress to allow us some playtime in the final sessions to look at these sorts of odd ball situations where there was a stick and rudder value to be had.

My experience has been that simulator sessions are now so chock-full of "stuff" there's barely enough time to get it all done, let alone allow for a bit of playtime at the end.

[blind pew]

The VC10 had a all gone quiet episode before the 747 when engines with a severe case of Delhi Belly incorrectly completed the leaving the panel checklist in a rush to drop his trousers and turned all fuel pumps off. IIRC he got a gong for managing to get the fans going whilst the boys up front struggled with the elrat and hyrat with very little control and no yaw damper for the first few minutes whilst the 10 started to Dutch roll.
We had some instruction in 1978 with regard to ditching and the limited controls which included sea state, waves and swell but can’t recall if it included the sim. Bergerie would know if his memory is still working. Think the incident is on the VC10 page.
ps Thanks Phil..shows that I am loosing it somewhat..

[Bergerie1]

Indeed, Yes. There were two VC10 incidents that I know of:-
https://vc10.net/History/incidents_and_accidents.html#5y-ada_fuelstarvation
https://vc10.net/History/incidents_and_accidents.html#G-ASGL%20Fuel%20starvation%20incident%201974

All engine failure can occur for a number of reasons, for example:- fuel mismanagement as shown above; fuel contamination; icing (either in the fuel or in the engines); volcanic ash as in the BA 747 over Indonesia and KLM 747 at Anchorage; and, of course, simply running out of fuel. I am sure readers can think of other examples.

I remember, at a management meeting in BA, the twin engine flight managers deriding those of us on 747s for retaining the all engine failure drill in our simulator syllabus, saying it was unnecessary on a four engine aircraft. Only a few months later, Eric Moody and crew had their well known incident in volcanic ash. Even though the systems did not respond in exactly the same way as in the simulator, I am sure that the sim exercise they had done not so long before would have helped them.

The whole crew did a magnificent job that day.

[Centaurus]

This comment from a colleague of mine copied in part with his permission.
Quote:
"An interesting read …I think you are optimistic re 10 minutes to descend for 35,000’ to sea level, and make a ditching …

However, I do agree, and often in the Jumbo, I used to raise this question on the flight deck, in the middle of my watch, coming across the Pacific, early am hours … and suggested the other crew member would walk me through the sequence, with a confirmed belly locker fire .. so not only did we have the normal fire warning, but the cabin crew then complained about the cabin floor being hot .. and becoming hotter … and you have four good engines! So right now, we are sitting in air-conditioned comfort, and if .. I say if, we are lucky, 20 minutes or less from now, we maybe sitting in a life raft in the middle of the Pacific … it's a huge mental bridge to walk over … SA airways lost a Combi to this failure on main deck aft ( Combi) .. they did not make it to sea level ..

You have projected max 20 minutes, from positive ID of fire, to aircraft coming apart .. 20 minutes max … I doubt anyone could make the plunge, decelerate and get the hell into the water within that time frame .. and I could only imagine the cabin mess, even prior to touchdown ( i use this word loosely) .. I agree, it should be discussed, perhaps at length … simulator time is expensive ..

Losing two or three or four … for Why! Volcanic ash for sure .. preference is to shut them down prior to them shutting down un-aided … once clear of ash, you maybe able to restart engines which are not seriously damaged .. but who shuts down operating engines. . .. ..
Over to you .. just throwing thoughts out there.
Unquote

[WHBM]

Stories about 1930s-50s BOAC skipper O P Jones being away from his seat in the cruise when somehow all the mags were knocked off, and all four engines stopped. And he just said nonchalantly "Strangely quiet, isn't it" before striding firmly forward to address things. Every version of the story has variances, but presumably the actual incident happened.

[sudden twang]

Heard bar talk of a 777 instructor who with a spare 10 mins at the end of a sim session offers
“ a zero jeopardy challenge” double eng fail clean fully established on the ILS 07 HKG he/she provides a bit of advice and you park on the gate with a marshaller. Sounds like a fun confidence booster.

[safetypee]

OP
"Or is the latter considered most unlikely and therefore simulator training for those events regarded as unnecessary?"

Judgement is required. Safety involves minimising the risk of harm, thus training should relate to risk, which involves probability.
The risk from the highly improbable, unforeseeable - unimaginable situations requires a different approach to safety management than those identified for training.
Thus most training has to be based on identifiable hazards, previous events.

Multiple engine failures have occurred, but the certification view is that the aircraft - and crew, should be able to fly for a limited period sufficient to restart engines to achieve a safe landing. Other than that - serendipity.
The training need is to maintain flight control and relight engines, often in unspecified exceptional circumstances (volcanic ash, ice crystals, damage).

However, we are biased by the highly salient, the most memorable or well publicised heroic events; yet the probability of encountering those again, and particularly of achieving a safe outcome is sufficiently low not to to be trained for. Furthermore the crew actions in the 'successes' may be non-standard, or even 'violations' which would not be tolerated in training.

See ‘operational safety domains’ page 11. Paries
Who also identifies the priorities for training - 'cognitive competencies' (page 15), which currently "are a side product of the training rather that its central target. Even when ‘abnormal’ operations are addressed as such, the training considerably lacks realism." Page 16

How might these competencies be trained; in simulation, or otherwise?

Paries; 'Lessons from the Hudson', https://www.researchgate.net/profile/Jean-Paries/publication/291268264_Lessons_from_the_Hudson/links/60808ea0907dcf667bb5abf7/Lessons-from-the-Hudson.pdf?origin=publication_detail

"To be able to properly transfer acquired knowledge and know-how from a specific context to a different one."
- - -
"Knowledge is the antidote to fear.” “… being risk savvy requires a basic knowledge of our intuitive psychology as well as an understanding of statistical information.”
'Risk Savvy: How to Make Good Decisions' Gerd Gigerenzer

Lessons from the Hudson https://www.dropbox.com/scl/fi/cul5c06mtquqrbih0yhal/Lessons-from-the-Hudson-Paries.pdf?rlkey=cqtcfrg8demrpj7ccedda3c87&dl=0
,

[Bergerie1]

Let me expand on the issue of an all-engine failure, and on the 747 in particular. In 1982, I was the flight training manager of the British Airways 747 flight. At a previous flight training mangers’ meeting, in order to save money by removing unnecessary training exercises, I had to defend the need for still practising the all-engine failure drill, despite it being a remote possibility. I did so for several reasons, not only to demonstrate the symptoms that might be experienced and to practise the engine re-light drills, but, even more importantly, to think about and discuss the prioritisation of the actions and decisions required by the crew.

The priorities, in my view (and remember I am now way out-of-date!) are:- (1) fly the aircraft; (2) diagnose the cause; (3) try to re-start the engines, and (4) consider how best to prepare for a ditching or crash landing.

Item 1. The captain probably has to fly using only those instruments powered by the battery bus. He may also have control problems such as dutch-roll, as in one of the VC10 incidents I mentioned earlier. He also has to decide the best speed to fly – max range, max endurance and/or engine re-light speed.

Item 2 and 3. The engineer will be trying to diagnose the cause while simultaneously carrying out the appropriate drills with the co-pilot. Both will be fully occupied with little time to spare. How should they prioritise these activities?

Item 4. The captain will be starting to think about possible outcomes, trying to balance the priorities of which speed is best for the circumstances, how long and/or how far he might be able to glide, and what kind of landing/ditching may ensue.

In the BA 38 accident at LHR, there was hardly any time to think, let alone diagnose the problem. The captain made an almost instant non-standard decision which was right.

In the BA 009 incident, the captain had time but was faced with a number of additional problems – the failure of the co-pilot’s oxygen mask, unusal symptoms and, on the approach to Jakarta, being unable to see the runway properly because of the abraded windscreen.

The symptoms were not the same as those demonstrated in the simulator, and they were fortunate that the engines went into some kind of sub-idle condition which left the autopilot still useable. Altogether, the three crew members were both extremely lucky and extremely capable.

But, so far as simulators are concerned, real life is very rarely the same, nevertheless, the training does help in providing some kind of framework on which to work.

Seven years later a KLM 747 suffered a similar volcanic ash incident when descending into Anchorage!!

[Discorde]

Although written several years ago for the B757/767 bits of this may still be relevant to these and other types (including dead-stick landings):

How to do well in the sim (https://www.steemrok.com/howtodowellv4.pdf)

[Discorde]

This aide-memoire was designed to be folded in half and laminated. When leaving the flight deck for any reason in the cruise I would ask the F/O to clip it to his control wheel with the first side visible - 'just in case'. I would also open the QRH at the Rapid Depress checklist and leave it on the centre console as the F/O would be running the checklist solo (with self in the loo breathing O2 from a drop down).

The CB references were to isolate continuous false warnings to remove distraction.

B757/767 En Route Emergencies (https://www.steemrok.com/engmalfv4.pdf)

[waito]

In a training environment where the amount of possible training is always finite, volcano related failures are low on my list as useful

Because these are rare events?

A colleague of mine flew back (as pax) from Canary islands when the volcano of the western island (La Gomera?) spew. I checked their routing when she told me, and they were departing quite close to the danger area announced on that day. western winds. She was quite annoyed when I told about the dangers, which I impressively learned at...

Simulator training I was able to observe in 2020. The airline crosses at least 3-4 Volcanoes suspected to erupt any time. And boy, what a combination of serious issues with a vast amount of decisions and checklists.

So it's not rare enough to ignore, and it's as bad of a workload that having it trained at least once gives the crew some confidence and structure to master it.

Apart from CRM strengthening, I thought it also refreshes all engine out Scenarios. At least when some engines can recover.

OTOH, volcanic ash includes some subproblems in one session, like pitot probes clocked, engine restart, engine out subsystem handling, manual landing with very restricted visibility. Anything else?

[bugged on the right]

Didn’t the Tristar have all 3 go quiet for a short while?

Edit: found it. https://en.wikipedia.org/wiki/Eastern_Air_Lines_Flight_855
Our scenario was climbing into a cloud of volcanic ash like the BA job.

[Tiger pork]

Nowadays, sims are expensive and work 24/7,365. 4 hour sim sessions are the norm and even a 10 minute break can be frowned upon or discarded due to the pressure to complete the syllabus segment. There is little scope to include items of "interest" such as all/multiple engine failures with relights, volcanic ash penetration procedures, ditching protocols etc.
However, the regulators still have their say by apportioning a disproportionate amount of time to V1 cuts, Engine out Missed approaches, complex engine out escape routes, stalling clean, landing config and high altitude. ( when was the last time..or ever, you had an engine failure at V1?? ).
When one conflates the cutbacks and trimming of sim sessions for conversions, the amount of pragmatic and flight operational relevant items can get very thin, within the scheme of approaching the skills test or qualifying to type PC.
Accounting and aviation have never been good bedfellows, though up till now, safety and its relevance in simulator practiced procedures, still has a place...but for how long ?

[waito]

Losing two or three or four … for Why! Volcanic ash for sure .. preference is to shut them down prior to them shutting down un-aided … once clear of ash, you maybe able to restart engines which are not seriously damaged .. but who shuts down operating engines. . .. ..


The procedure I have observed in the Sim (see my earlier post, type was 747-400) was to immediately reduce engines to idle, and descent accordingly while u-turning.

Engines idle reduces the temperature and so the melting process of the ash particles onto the turbine section especially. That gives a good chance to save some engines from ultimate damage.

I am not a pilot, so get confirmation by pro's.

[BuzzBox]

The procedure I have observed in the Sim (see my earlier post, type was 747-400) was to immediately reduce engines to idle, and descent accordingly while u-turning.

Engines idle reduces the temperature and so the melting process of the ash particles onto the turbine section especially. That gives a good chance to save some engines from ultimate damage.

I am not a pilot, so get confirmation by pro's.

Yes, the procedure for Boeing and Airbus aircraft is to reduce thrust to idle (if conditions allow) and to exit the ash cloud as quickly as possible, usually via a 180° turn. Deliberately shutting the engines down runs the risk of not being able to get them started again.

[Global Aviator]

Talking of all engine out -

https://en.m.wikipedia.org/wiki/Garuda_Indonesia_Flight_421

Not just volcanic ash.

[punkalouver]

Yes, the procedure for Boeing and Airbus aircraft is to reduce thrust to idle (if conditions allow) and to exit the ash cloud as quickly as possible, usually via a 180° turn. Deliberately shutting the engines down runs the risk of not being able to get them started again.
There is also increasing bleed to increase stall margins(if i remember correctly).

Let me expand on the issue of an all-engine failure, and on the 747 in particular. In 1982, I was the flight training manager of the British Airways 747 flight. At a previous flight training mangers’ meeting, in order to save money by removing unnecessary training exercises, I had to defend the need for still practising the all-engine failure drill, despite it being a remote possibility. I did so for several reasons, not only to demonstrate the symptoms that might be experienced and to practise the engine re-light drills, but, even more importantly, to think about and discuss the prioritisation of the actions and decisions required by the crew.

The priorities, in my view (and remember I am now way out-of-date!) are:- (1) fly the aircraft; (2) diagnose the cause; (3) try to re-start the engines, and (4) consider how best to prepare for a ditching or crash landing.

Item 1. The captain probably has to fly using only those instruments powered by the battery bus. He may also have control problems such as dutch-roll, as in one of the VC10 incidents I mentioned earlier. He also has to decide the best speed to fly – max range, max endurance and/or engine re-light speed.

Item 2 and 3. The engineer will be trying to diagnose the cause while simultaneously carrying out the appropriate drills with the co-pilot. Both will be fully occupied with little time to spare. How should they prioritise these activities?

Item 4. The captain will be starting to think about possible outcomes, trying to balance the priorities of which speed is best for the circumstances, how long and/or how far he might be able to glide, and what kind of landing/ditching may ensue.

In the BA 38 accident at LHR, there was hardly any time to think, let alone diagnose the problem. The captain made an almost instant non-standard decision which was right.

In the BA 009 incident, the captain had time but was faced with a number of additional problems – the failure of the co-pilot’s oxygen mask, unusal symptoms and, on the approach to Jakarta, being unable to see the runway properly because of the abraded windscreen.

The symptoms were not the same as those demonstrated in the simulator, and they were fortunate that the engines went into some kind of sub-idle condition which left the autopilot still useable. Altogether, the three crew members were both extremely lucky and extremely capable.

But, so far as simulators are concerned, real life is very rarely the same, nevertheless, the training does help in providing some kind of framework on which to work.

Seven years later a KLM 747 suffered a similar volcanic ash incident when descending into Anchorage!!

I would add near the beginning to turn toward a best suitable landing area(unless there isn't one or you happen to be well above it). I believe there has been an all engine out scenario where this was not attempted until later on and then they were out of range(possibly the CRJ dual flameout at its service ceiling and a military Global Express in Afghanistan(if I remember correctly).

[Bergerie1]

punkalouver, Thanks, you are absolutely right, I should have added 'navigate'. And there are many more things that have to be thought about in a high stress situation and in a finite time, but I wasn't thinking only of volcanic ash. That was the whole point of the exercise and the discussion afterwards.

[BoeingDriver99]

A huge amount of time is wasted in full motion simulators. Never gonna change so why waste time thinking about it?

The absurdity of much modern airline flight training is underlined for me every time I go in the box and see the fire glove. It’s the simulated fire glove.

Probably made by the manufacturer, costs a ridiculous amount, has absolutely zero functionality, as a result is impossible to use, therefore is never used in any scenario.

Why not just put a glove there? :hmm:

[blue up]

Single Engine GA in a 747-400 was always fun.

[ZFT]

A huge amount of time is wasted in full motion simulators. Never gonna change so why waste time thinking about it?

The absurdity of much modern airline flight training is underlined for me every time I go in the box and see the fire glove. It’s the simulated fire glove.

Probably made by the manufacturer, costs a ridiculous amount, has absolutely zero functionality, as a result is impossible to use, therefore is never used in any scenario.

Why not just put a glove there? :hmm:
Similar to the stupid replica (not dummy) fire extinguishers and O2 Masks some TDMs fit .

[the_stranger]

Why not just put a glove there? :hmm:
Because it's probably gone in two weeks. For whatever reason.

[BoeingDriver99]

Because it's probably gone in two weeks. For whatever reason.

You are not wrong there :ooh:

[Centaurus]

Re dummy fire extinguishers and asbestos gloves in simulators reminded me of an event of many years ago when a Pacific Island 737 landed at Tarawa, Kiribati. In those days passenger restraint items kept in the cabin included pair of handcuffs and a baton. As passengers were disembarking, a local islander leapt up the airstairs and bursting into the cockpit lashed out at the captain and F/O with his fists. As both pilots were still strapped in doing cockpit checks, it was difficult for them to defend themselves. Fortunately a passenger about to leave the aircraft grabbed the lunatic from behind and with the help of the F/O who had managed to undo his safety harness, threw the islander down the airstairs.

Security in the form of two local coppers waiting at the foot of the stairs, took him by the hand and led him away without a struggle. Later back at home base, the chief pilot sporting a bruise on his head changed the rules and had the restraint equipment moved from the cabin to the cockpit saying it was useless in the cabin if someone got into the cockpit..

In court to explain his actions, the islander explained to the local beak that his house built of wood and palm tree fronds and situated close to the perimeter of the airport, had been blown over on several occasions by jet blast from departing 737's doing a 180 to line up for take off. Enough was enough, so he had decided to have a go at the next arriving crew. The beak sympathised with his plight and no charges were laid.

Dummy restraint systems in the cockpit of simulators. I am sure rare items indeed.

[Alpine Flyer]

Current EASA rules regarding volcanic ash require that operators who might have ash encounters due to to operation in proximity to volcanoes do risk assessment and mitigation which for us resulted in a dual-engine flameout on the sim (with automatic relight after leaving the ash cloud). In over 30 years I recall one training where a dual engine flameout without restart was practiced and maybe a few instances where we tried that on extra time (e.g. Hudson River scenario at home base). Most successful results required some non-checklist "cheating" by starting the APU to improve controllability and regain speed brakes.

There was at least one instance of a forced landing due to dual engine failure on the ILS into Munich by an Austrian Fokker 70 around 20 years ago. While it was a landing to walk away from the result might have been different at another location.

Evidence Based Training allows to do away with routine sim items that pilots demonstratedly handle well and introduce stuff that has rarely been trained under previous rules. E.g. we might not have to demonstrate the ability to preside over an autoland Cat 3 with and without go-around and every type of approach we're authorised to perform during every session. This has freed time for some real-world training with less of a time corset.