There are a broad range of possible engine malfunctions in the 777, some of which are clearly annunciated ([] ENG FAIL, [] ENG EEC MODE, [] ENG OIL PRESSURE, etc) – others that manifest only through EICAS (or other) engine indications. For the most part, the occurrence of an EICAS annunciated checklist in the B777 leads pretty clearly to the Memory Items or the Checklist for that annunciation.

But for Engine Malfunctions – not always …

In Short:

  • With the changes to the Boeing QRH of circa 2006; engine failure analysis became much, much simpler.
  • In addition, the instances of being required to run memory items for engine malfunctions (whether at low altitude or elsewhere) was significantly reduced.
  • While subtle – these changes were actually a paradigm shift in the way we handled engine malfunctions (hence it took us a year or so to get our heads around it).
  • This Procedure/Technique has now been adopted by several major International 777 operators.

 

Engine Malfunctions – Which Checklist?

A Jet Engine is a complex beast, and many common failures result from a breakdown of elements of that complex system, with a result that ranges from a small impact on the ability of the engine to produce thrust or maintain parameters within limits, to the sudden irrevocable seizing of one or more of the spinning components of the engine. There are a a number of engine malfunctions which result in a clearly annunciated checklist that the pilot accepts as given and completes – but many engine malfunctions require you to choose between one of the following.

[] ENG FAIL
– an annunciated checklist;
– appears on EICAS when the Engine Speed is below a minimum idle value;
– indicates that EECs have given up on relighting (fuel/ignitors) the engine, and closed both the Engine and Spar Fuel Valves;
– allows for the possibility of an engine re-start (which the other checklists do not).

[] Eng Lim/Surge/Stall
– is an un-annunciated checklist, which means the condition statement(s) can be considered memory items since you need to know them from memory in order to know to call for the checklist (like all un-annunciated checklists);
– covers a variety of not-so-serious engine malfunctions such as an Engine Stall, various loss of engine control malfunctions such as Engine Surge, and the various Limit Exceedances of the engine’s operating parameters (rotor speed, temperature, etc);
– covers the scenario where a loss of engine thrust control has occurred, where thrust lever movement does not result in the appropriate engine thrust change;
– the Memory Items reduce thrust on the affected engines (as low as idle) but do not shut the engine down;
– By implication – this checklist is usually only called for when the engine is running (no EICAS [] ENG FAIL)

[] Eng Svr Damage/Sep
– another un-annunciated checklist (with a much shorter condition statement to remember);
– deals with more severe engine malfunctions where the engine is (severely) damaged or has separated;
– the Memory Items reduce thrust to idle, turn off fuel/hydraulics and otherwise “secures” the engine;
– also deals with the case where high airframe vibration remains after the engine has been secured.

There are a number of other failures that we can leave outside this article, because there’s no real diagnosis required … such as …

[] FIRE ENG
– if you see this, you’re running the memory items to fight the fire.

[] ENG OIL PRESS
– there may be exceptions – but usually you run the checklist, and typically shut down the engine. See Engine Oil Pressure – a Simulator Scenario.

… etc.

So, returning to the original problem – when you have an engine malfunction, how do you decide which checklist/memory items to run?

Reviewing all Engine Indications – the Traditional Approach

Prior to (about 2006) – the traditional approach to diagnosing an engine malfunction was to review the EICAS instrument stack (as well as potentially external indications) and use those indications against the condition statements of the three checklists to identify which one was the best match.

For reference – the original Engine Malfunction Checklists (and their conditions statements) are shown here.

Typically this technique was taught as follows:

  1. Start with the annunciated EICAS messages (eg: “EICAS ENGINE FAIL LEFT and TAC“)
  2. Then move onto the Engine Indications (N1, N2, [N3], Fuel Flow, Oil Temp/Pressure/Quantity and Engine Vibration indications). While some PMs would call out all the indications, a better approach was to highlight exceedances and other unusual indications that led towards a diagnosis (eg: “Ok, the N1 is spinning, EGT is High, N2 is Frozen, Oil Pressure is Low, Engine Vibration is a 3“)
  3. Other external factors – Yaw/Rudder; Airframe Vibration; Light (night time) and Sound from the affected engine can also provide useful (and in the case of Airframe Vibration, determinative) indications of the malfunction – but were often give scant attention at this stage of the failure.

Sounds simple enough, doesn’t it? But as usual, the devil is in the details.

It’s a Busy Time for a Complicated Procedure

Firstly – engine indications themselves can be pretty complex. Apart from the basic nine indications, instrument indications such as EGT can show abnormally (for the thrust required) low; abnormally high; show an exceedance – or that an exceedance has occurred but is not occurring now. Take that aspect and apply it to the N1/N2/N3 – where the rotor can also indicate Zero (frozen) or missing (such as in a separation) – and you have a pretty complex set of indications.

Seeing all this and not only analysing it correctly, but communicating it clearly to the Pilot Flying (who is, unsurprisingly, busy flying the plane with an engine failure shortly after takeoff low to the ground) in such a way that the PF can meaningfully confirm your analysis – is a neat skill that only comes with practice and good, clear documentation. When you take the breadth and depth of the scope of 777 operations throughout the world – it’s a big ask.

Memory Items are a RISK

Secondly – the implementation of this technique more often led to more occasions of running checklist memory items than was strictly speaking required. Depending on what your definition of “Severe Damage” or even just “Damage” was – if the engine was seized (Zero on the N1, N2, or N3) – you ran the Engine Severe Damage/Separation memory items – even if the engine was essentially failed ([] ENG FAIL on EICAS) and shut down already.

In principle, securing a malfunctioning engine by memory at low altitude should not be a safety risk for a well trained crew. In practice – running memory items un-necessarily at low altitude to secure an engine is a flight safety risk. It kills people. This was one of the prime motivators for the change in the Boeing QRH Engine Malfunction condition statements. There have been plenty of examples before and since of aircraft that got into trouble running memory items at low altitude – and all Instructors have seen it go wrong in the simulator.

The New Paradigm – Two (Simple) Questions

Actually it’s not quite this simple. The new paradigm (technique) consists of a mix of basic EICAS Prioritisation and a clarification of some basic axioms that we always knew, but perhaps we were not considering.

Note that this process begins AFTER the crew have identified that they have some kind of Engine Problem (“Engine Problem“) – as a result of the Pilot Flying calling for the Pilot Monitoring to “Identify the Failure.”

1. Look at what you have NOW.

When you are analysing the status of the aircraft/engine after a malfunction – look at what you have now – not what occurred during the failure. There are a number of situations where this concept is actively encouraged during NNMs.

  • Hydraulic Failures? – let the systems settle down (fluid/pressure loss) to see what you’re left with before rushing in and running checklists that may be soon be replaced as the aircraft sorts out what has gone on during the onset of the malfunction.
  • Similarly with electrical failures – sit on your hands and wait for the final state of the EICAS instead of rushing in and dealing with the non-normals that result when an electrical system malfunctions.

So – when it comes to engine failures …

  • Sure, the EGT exceeded with a stalling/surging engine approaching V1 during the takeoff roll – but now that you’re at 400 ft and been asked to “Identify the Failure” – and it’s not exceeding or otherwise miss-behaving now. So why would you want to run a NNM Checklist/Memory Items?
  • Ok, so there was a loud bang and engine/airframe vibration when the engine failed at 39,000 ft – but your priority was Fly The Aircraft – so you chose to maintain flight-path control, initiate a drift down and fire off an ATC call. That sorted – now you’re back and been asked to “Identify the Failure” – there’s no vibration now, no abnormal noises, [] ENG FAIL on EICAS (so the engine is shut down). So do you need to respond now to engine malfunction indications that are no longer present? Deal with what’s in front of you NOW – not what you think you remember from a while ago.

In short – when being asked to “Identify The Failure” – look at what you have now – not what came with the initial malfunction, and didn’t persist once the EECs had dealt with the failure for you.

2. Start with the EICAS Messages

The 777 is an EICAS driven aircraft. That’s drummed into us time and time again. So let’s start there. Read the messages, all of them or at least the highest level ones. For the worst of failures, with multiple systems, multiple messages, some summation might be called for. EICAS prioritises messages (Warnings vs Cautions vs _Advisories) – so why shouldn’t you? But make sure your PF is getting the picture of what’s wrong.

Then ask yourself two questions.

3. The Two Questions

A. Is the engine still running? (best recognised through [] ENG FAIL on EICAS)
B. Is there Airframe Vibration?

This latter point is crucial. Engine Vibration (as indicated on the EICAS VIB display) in an of itself is not a determinative factor in engine malfunction analysis. But (Unusual) Airframe Vibrations combined with Unusual Engine Indications is textbook [] Eng Svr Damage/Sep.

Armed with the answer to these two (pretty simple) questions – you can now choose your checklist. Onto … The Flow Chart.

The Flow Chart

Before you get on your high horse – no I don’t pull this out in flight. No, it’s not laminated and stowed under the dash. It’s a training tool to illustrate what is actually a very simple procedure/technique.

For more detail on how this Procedure/Technique is used and the implications of the steps in the flowchart – see the training video in the link at the top. But briefly:

EICAS [] ENG FAIL  – YES.

If the engine is NOT running (EICAS [] ENG FAIL):

  • if you have Airframe Vibration, secure the engine through [] Eng Svr Damage/Sep Memory Items;
  • otherwise run [] ENG FAIL checklist at the appropriate time.

Note that this engine is already shut down. The memory items are unlikely to have a meaningful impact on the Airframe Vibration; but the Engine Severe Damage/Separation checklist attempts to assist with that later on.

EICAS [] ENG FAIL  – NO.

If the engine is still running (no EICAS [] ENG FAIL] – then it comes down to an Airframe Vibration severity question:

  • If the Vibration is negligible or not significant to Flight Safety / Flight Path control (such as you might get with a Stalling or Surging engine) – run the [] Eng Lim/Surge/Stall memory items. You are choosing here NOT to shut down the engine by memory, to leave it running at reduced thrust setting or at idle (even if it keeps surging/stalling) – making a choice that is at least theoretically reversible.
  • If the Vibration is such that you believe Flight Safety is impacted (such as impacting your ability to control Flight Path) – run the [] Eng Svr Dam/Sep memory items to shut down and secure the engine. In a just and fair world this should reduce the impact of the (severely) damaged engine on your ability to safely fly the aircraft away from the ground.

If this technique seems radical, then the rest of this article is for you. On the other hand, if you’ve been doing it this way since the QRH change back in the mid 2000’s (and there are quite a few now) – I’m surprised you’ve read this far through …

Issues and Justification

Firstly, I went through the same angst you are in now back in 2008 when this first came through. Emails, Phone Calls and eventually a Meeting with Boeing Flight Standards who were adamant.

  1. Running memory items at low altitude is a high risk activity.
  2. Many of the engine malfunctions we were treating with memory items (such as seized engines) did not warrant memory items at all.

Before you read too much further – think for the moment about how you are diagnosing your engine malfunctions and making the choice to run memory items on them based on “damage” (N1/N2/N3 seized; Engine Vibration; or Airframe Vibration at the time of the failure) – is “your” technique fully documented and supported in the FCOM, FCTM? Sure about that? Are you doing it that way because that’s the way it’s always been done?

Q : If the engine has failed, don’t we need to secure it?
A : Yes, this is what the checklist is for. In the meantime – if you see [] ENG FAIL on EICAS – the EEC’s have detected a below minimum idle event and closed both the engine and spar fuel valves anyway. How much more do you want?

Q : Isn’t a seized engine a damaged engine – so N2 Zero requires [] Eng Svr Damage/Sep Memory Items?
A : It’s definitely damaged if it’s not spinning, but is it Severe? Moreover – un-annunciated checklists are called for based on the Condition Statements – if there is no Airframe Vibration, why are you running the memory items on your “damaged” engine?

There are many more and if you send me your questions I’ll attempt to address them in the context of what I have come to understand about this issue. But let’s look at the checklists for a moment.

[] ENG FAIL on EICAS

For many of the failures that we used to run memory items on – we now run the [] ENG FAIL checklist after the aircraft is clean and at a safe altitude. This presents a couple of new issues (such as whether to re-start the engine) but first let’s look at the checklist. Once you’re past the condition statement (which uses “is” to indicate to look-at-what-you-have-now):

  1. It makes sure that you’re only dealing with the loss of one engine, not both.
  2. It says that if airframe vibrations exist (with abnormal engine indications) – you’re in the wrong checklist buddy – you’re supposed to be in [] Eng Svr Damage/Sep!
  3. And then to add insult to injury – it makes sure that somehow you didn’t miss that your engine has fallen off.

In essence – the checklist questions back up the Two Question process above. If you asked those two questions and chose the appropriate response (from the flow chart) – you won’t fall foul of these questions in the [] ENG FAIL checklist.

Re-Starting a (Damaged?) Engine

Another common question is that if we are no longer running [] Eng Svr Damage/Sep memory items for seized or otherwise “damaged” engines – this leaves us exposed to the option to re-start that engine as a result of running the [] ENG FAIL checklist. A couple of points on that …

  • While the checklist may offer the option – it’s the PF/Captain who is ultimately responsible for the decision to re-start an engine that has failed. Just because the checklist says you can re-start an engine, doesn’t mean you need to re-start the engine – or should.
  • The checklist specifically restricts starting without N1 rotation.
  • When it comes to N2; the response we got back from Boeing/GE was that there are circumstances of airspeed/altitude combinations where the N2 may show zero rotation even though the engine is not actually seized. Accessories on the engine can limit rotation when the engine is un-powered. In any case – we are told that if you attempt to start an engine with a seized N2 – that start attempt will be un-successful anyway, and should not cause any further damage.
  • The issue of whether you (as the checklist puts it) need to re-start an engine after a failure is whole ‘nother topic.

ENG FIRE SWITCH … PULL

Another significant result of this change is that whereas previously a “damaged” engine (N1 or N2 seizure, engine vibration during the failure, etc) would result in the Engine Fire Switch pulled at low altitude, under the new paradigm the Fire Switch will not be pulled at all.

The response we received from Boeing confirmed the desire to minimise the use of memory items at low altitude and the reduced requirement to run either the Lim/Surge/Stall or the Severe Damage/Separation checklists for failures that result in engine speed below idle.

In Conclusion

I present this for your consideration. I believe it’s a process that is well justified by the QRH and FCTM an in line with Boeing’s stated intent that came with the QRH changes in the early 2000’s (and subsequent). I know of two other major international 777 carriers who are doing exactly this process – after much consultation with Boeing and their engine manufacturers. After all – this was a significant change. But it’s a change for the better, so why not consider it?

Ken.

If you find my content useful and are in a position to do so – I would appreciate a contribution to my PayPal account (ken.pascoe@gmail.com) – If you use the Friends and Family feature in PayPal it reduces the charges to the transfer. Please note that when sending money in this way you are removing any form of purchase protection, which is not relevant to a contribution of this type anyway.

| | | , , , , |