Sometimes something as simple in the aircraft as looking and assessing the indications in front of you can be far more complex that it first seems. I was reminded of this in the simulator recently as several crews were required to assess aircraft pressurisation performance during a door unlocked indication failure in flight. First, some background.

Our current phase training includes a DOOR FWD CARGO unlocked indication shortly after takeoff. Apart from satisfying a matrix requirement and giving crew experience of this non-normal, the overt intent of this failure in the simulator profile is to give crew a reason to divert to the nearest suitable airport.

The DOOR FWD CARGO checklist itself requires that the aircraft be de-pressurised to ensure that if the door was to come off, less damage would be done than if the aircraft were fully pressurised. At this point the crew are at 8,000 ft and de-pressurised. Continuing to Los Angeles seems unlikely.

That said in a previous simulator we had two similar failures like this. The first was Door Forward Cargo indicating not locked in flight; the second was Door Forward Cargo – door comes off the fuselage out into the airflow and on it’s way down the side of the aircraft, takes out the right engine along with two hydraulic systems. As the instructor it was easy to confuse the two failures in the IOS – well, it was easy to confuse them once. Being pressurised/unpressurised never seemed to make much impact on the amount of damage that forward cargo door did as it embedded itself in the right engine – but I digress.

Anyway – so I was supposed to program a Door Forward Cargo indication failure on takeoff. I did this through the gear lever so I wouldn’t have to hit the button on the failure myself. I programmed the simulator so that when the lever was selected UP, the failure became active – and sat back to watch.

At least that was my intention – so far it hasn’t been successful. The Sim Instructor Operator Station (IOS) indicated the failure was active – but there was no indication to the crew, even after the takeoff inhibit ended. Oops. As it turned out later – this failure is only written by CAE to work on the ground. We’re still trying to find out why, but even knowing that isn’t going to change the fact that the failure doesn’t work airborne.

As such I was forced to improvise on the spot – often not a great recipe for training fidelity …

Sticking with the theme – I failed one of the other cargo doors instead. The problem now is that the simulator is VH-VPD which was our first owned aircraft, and it has the small version of the main cargo door aft of the wing. The size distinction is important in this failure. All doors on the aircraft (Cargo, Cabin, E/E Bay, etc) are “Plug” type doors – a Boeing innovation where essentially the door is bigger than the hole it fills and therefore the higher the pressurisation differential between inside/outside the aircraft, the less likely the door will come open. Don’t ask me how a door that’s bigger than the hole opens outwards to let the passengers and cargo in – that’s just magic as far as I’m concerned.

Despite being a plug type door, when not indicating locked the Forward Cargo Door checklist requires the aircraft de-pressurise. We have always presumed this is related to the size of the door. The smaller Aft Cargo door does not require de-pressurisation and diversion – as long as the cabin is pressurising normally. Thus despite the failure the crew would assess and continue on to Los Angeles, extending the sim session from 2 hours to 14. Since I needed them to divert (no coffee or toilet in the sim) the next obvious choice was … you guessed it, pressurisation failure.

Because I knew the small door failure wouldn’t cut it, I programmed them simultaneously. Rather than the instantaneous heart-rate-raising big bang failure, I used slow de-pressurisation. Essentially the aircraft would fail to pressurise because the aforementioned small door was not only unlocked, but not properly closed. Hence the crew would assess pressurisation, realise the problem, and return. At least, that was the plan.

This statement seems pretty clear, doesn’t it?

Note: The aft lower cargo door is in a safe configuration 
as long as cabin pressurization is normal. Positive cabin
differential pressure ensures the door stays in place.

That shouldn’t be too hard to work out, should it? Pressurisation at this point is assessed via the AIR Synoptic page. Apart from showing good bleed air from the engines to the air-conditioning packs, the AIR synoptic also shows values such as Cabin Altitude and Rate of Climb, Differential Pressure and Forwad/Aft Outflow value positions.

A good crew would typically see the picture shown here during climb after takeoff. By “good” I mean a crew who would initially see the failure, think about it, then ignore it. They’d have QRH familiarity and know that this checklist doesn’t come with memory items, but they’d also know what the most likely outcome of this checklist was. They’d follow Boeing doctrine and delay running it until the critical take off phase was over, the aircraft was clean (gear and flaps retracted) and usually wait until the aircraft had cleared any terrain issues associated with the departure airport. Thus typically the aircraft would be climbing through about 7,000 ft by the time they finished the checklist and had a look at the AIR synoptic to assess pressurisation.

A quick glance shows you – Cabin Altitude below aircraft (as it should be); Cabin Altitude Rate climbing (normal, so is the aircraft); Outflow Valves Closed; duct pressure adequate, differential pressure positive. The problem here is … the quick glance. Like me – you’re looking to confirm the normal, rather than seeking what’s abnormal and looking for indications against the normal bias – looking to confirm a problem. Now let’s look again.

  • Cabin Altitude – 5,500 is quite high. The cabin altitude is controlled in part by the selected cruise altitude. High takeoff weights (and therefore lower initial crusing altitudes) combined with the high cabin differential pressure capability of the 777 (9+ PSI), initial cabin altitudes in the 3000-4000 feet range are normal. This one is at 5,500 because the door is slightly ajar and the pressurisation system is unable to maintain the required lower altitude as the aircraft is climbing. It’s doing it’s best – I’ve been seeing cabin altitudes up to 2000 ft below the aircraft in the climb with this failure – but still to high for an initial cabin altitude.
  • Cabin Rate – 800 fpm is not extreme, but again given the high diff of the 777 and the typically lower initial cruise altitudes, you see less than this typically.
  • Cabin Differential Pressure – a Delta P of 1.2 is way too low. In cruise it would be well over 8. The 1.2 here is because the hole in the aircraft is not quite big enough to equalise the pressure – the Bleed Air/Packs are working hard. But 1.2 is far too low for this altitude when the pressurisation is working “normally”. Speaking of holes in the aircraft …
  • Outflow Valves – The basic operating premise of an aircraft pressurisation system is that air flows in at a faster rate than it flows out – but it does flow out. It is only during Non-Normal events that you see fully closed outflow valves. Closed outflow valves are an indication that the Bleed Air/Packs are unable to provide adequate airflow – a pressurisation problem.

It’s very easy as the instructor to sit at the back and judge the errors of your students in front of you. It’s slightly more difficult to divorce yourself from the insider knowledge you have as an instructor and assess realistically. In this case, the signs are subtle – but they’re there. I could certainly not state with my hand over my heart that confronted with the same situation the first time, I would have picked up on these indications. For me though, the outflow valves are definitive. The only time they’re both closed airborne is when something is wrong.

The discussion point here is the concept of assessing a system on the aircraft. With EICAS Warning/Caution/Alert messages – we are no longer used to looking at gauges and indicators and assessing the performance of a system. We are also separated from the normal operation of the aircraft by automatics and self monitoring systems and synoptics pages that were looked at during initial training, but now remain hidden away until they’re required by an unusual situation. We’ve become quite reliant on the alerting system to diagnose failures and provide clear, simple indications of what the problem is and what we have to do next.

So far most crew have missed the pressurisation problem that I programmed in concert with the door failure. Once the aircraft climbs above 10,000 ft (and the cabin above 8,000 ft) the pressurisation failure becomes clear and the crew act accordingly. For myself, serendipitously this experience has taught me to take simple checklist words such as “cabin pressurisation is normal” more carefully.

| | | , , , |