Managing Non-Normal Situations and Diversion

A non-normal situation is any departure from normal operation that calls for a procedure other than the normal checklist: an abnormal event such as a system failure that degrades the aircraft, or an emergency that threatens the aircraft or its occupants. Manufacturers publish the procedures, operators adapt them in their manuals, and the crew applies them. What the procedures cannot supply is judgement: keeping the aircraft under control while the problem is diagnosed, avoiding a second, self-inflicted failure, and deciding where and how soon to land.

Accident reports repeatedly show crews turning a survivable failure into an accident by ceasing to fly the aircraft, rushing an irreversible action or pressing on towards an unsuitable destination. The principles below, most of them written down by manufacturers and operators, guard against those errors.

Golden rules for pilots

Airbus condenses its operating philosophy into four golden rules for pilots, which apply to all normal operations and to every unexpected, abnormal or emergency situation.

Under rule 1, Airbus defines "navigate" as four statements: know where you are, where you should be, where you should go, and where the weather, terrain and obstacles are. "Communicate" covers four links: between the pilot flying (PF) and the pilot monitoring (PM), with ATC, with the cabin crew and with the ground crew. For abnormal and emergency situations Airbus adds a blunt key message: fly the aircraft, fly the aircraft, fly the aircraft.

Aviate, navigate, communicate

Aviate, navigate, communicate states the same priority for every pilot. Loss of flight path control kills faster than any navigation or communication lapse, so control of attitude, speed and flight path comes first, then protection from terrain and airspace, and only then the radio. The rule also authorises shedding tasks: a single pilot copying a re-route when a warning appears flies the aircraft, tells ATC to stand by, then works the failure.

Eastern Air Lines Flight 401 is the classic lesson. In December 1972 a Lockheed L-1011 approaching Miami flew into the Everglades while its crew was absorbed in a malfunction of the nose landing gear position indicating system. The NTSB found that nobody had monitored the flight instruments in the final four minutes, so the descent went unnoticed; 101 people died.

A two-pilot crew therefore splits the work (see crew coordination, briefings and callouts). In the Airbus task sharing for abnormal operations, the PF flies and navigates and, once the ECAM or QRH actions have been initiated, also takes the radio. The PM monitors the flight path and navigation and performs the procedure. The radio moves to the PF because the procedure absorbs the PM's attention. Airbus applies procedures in a fixed sequence: memory items or immediate actions of an operations engineering bulletin (OEB) first, then the OEB, then ECAM, then the QRH.

Speed of action matters less than accuracy. After a failure on take-off or during a go-around, Airbus crews delay read-and-do actions until at least 400 ft AGL unless the flight path is already safe. Where the situation is not covered by a drill, a structured model such as DODAR (diagnose, options, decide, act or assign, review) keeps the diagnosis separate from the choice and loops back whenever the situation changes (see aeronautical decision making). The cabin crew are then briefed, often with the NITS format: nature of the problem, intentions, time available and special instructions.

One procedure at a time

Airbus states a one procedure at a time rule: once a crew starts a procedure, it completes it, unless an action in it calls for another procedure, or an unexpected new event, such as smoke reported by the cabin crew or a volcanic ash encounter, forces a fresh assessment of the situation. Jumping between checklists is how items get missed, and a half-completed procedure can leave a system in a configuration nobody intended (see standard operating procedures and checklists).

The PM reads the actions aloud and performs them, and obtains the PF's confirmation before clearing each ECAM procedure. Crews working from a paper or electronic QRH follow the same discipline: memory items first, then the non-normal checklist read aloud by the PM, with both pilots confirming each action. Throughout, the PF keeps flying and catches anything read or done wrongly.

Guarded controls and irreversible actions

A guarded control has a hinged cover or guard that must be lifted before the control can be operated, turning it into a deliberate two-step action. Guards protect controls whose inadvertent or wrong use would be serious, such as engine fire pushbuttons, generator disconnection and ditching or evacuation controls.

Some actions cannot be undone in flight. An engine shut down with its fire switch, a fire bottle discharged or a fuel supply cut off stay that way, so irreversible action confirmation is built into the procedure. In flight, Airbus requires the PF and PM to cross-check before any action on the engine master levers, the IR mode selectors, any guarded control and any cockpit circuit breaker:

1. The PM points to the control and names it, announcing the system, the control and the action, for example "AIR, X BLEED, CLOSE".
2. The PF checks that the correct control has been designated and confirms.
3. The PM operates it.

Thrust levers are the exception: they belong to the PF's flying task, so the PF points, the PM confirms and the PF moves the lever.

In January 1989 near Kegworth, in England, the crew of a British Midland Boeing 737-400 shut down the serviceable right engine after a fan blade had broken in the left one. The damaged engine lost power on the approach to East Midlands Airport, and the aircraft crashed short of the runway. The accident is still the standard example of why engine and fire actions are confirmed by both pilots before anything is moved (see engine failure and engine fire).

View full schematic

Circuit breaker resets and nuisance warnings

A circuit breaker protects its circuit, above all the wiring, from excessive current. Aircraft breakers are trip-free: they open on an overload whatever the position of the button, so a faulty circuit cannot be held on by hand. The circuit breaker reset rule follows from this:

• reset a tripped breaker at most once, after a short cooling period;
• reset it only if the service is needed for the safe continuation of the flight;
• if it trips again, leave it out: a persistent fault such as a short circuit is present, and further resets risk fire in an inaccessible part of the airframe.

A tripped breaker may itself signal smoke or fire to come, so FAA guidance on in-flight fires asks that cabin crew never reset one but report it to the flight crew.

The flight manual may forbid resetting certain breakers at all. On the A320, green monitored breakers trigger a C/B TRIPPED caution when out for more than one minute, and the wing tip brake breakers carry red caps so that they cannot be reset. Pulling a breaker can also be a procedural step: EASA's revised airspeed unreliable procedure for the 737 MAX lets the crew silence an erroneous stick shaker with its breaker, an option the FAA did not adopt after its test crews could not reach the breaker while seated with their harnesses fastened.

A nuisance warning is an alert given in accordance with the system's specification while the crew is flying an accepted, safe procedure, such as a GPWS alert on a known approach through high terrain (see GPWS and TAWS). Exam texts contrast it with a genuine warning of a real hazard and with a false warning, caused by a fault in the system. A fire warning is actioned as a real fire even when a detection fault is suspected, and all GPWS alerts are reported to the operator. Designers reduce spurious alerts with dual-loop fire detection and with warning inhibition during take-off and landing, when most failures do not affect the ability to continue. On the A320 the EMER CANC pushbutton is used only to suppress a spurious master caution.

Land as soon as possible

Procedures tell the crew how urgently to land. Airbus uses two levels:

The FAA's Part 121 rule for engine failures, 14 CFR 121.565, requires the pilot in command to land at the nearest suitable airport, in point of time, at which a safe landing can be made, whenever an engine fails or is shut down to prevent possible damage. On an aeroplane with three or more engines, if no more than one engine has failed, the pilot in command may proceed to an airport of his or her choice after considering the nature of the malfunction, and must then justify in a written report why that choice was as safe. In-flight fire and smoke are the textbook cases of red LAND ASAP. The crew declares the emergency and asks for what is needed (see distress and urgency communications).

Choosing a diversion aerodrome

A diversion is a landing at an aerodrome other than the planned destination. Planning has already identified candidates, the en-route and destination alternates, and on remote routes the equal time points between them (see alternate aerodromes). In flight, the nearest suitable aerodrome is the closest one, in time rather than distance, at which the aircraft in its degraded state can land safely. Nearest is not always best: a closer aerodrome with a short runway or weather at minima may be less safe than one a few minutes further on.

The crew weighs:

• the urgency of the failure, which sets how far they can afford to fly;
• the weather and its trend, and the approaches available;
• the landing distance required with the failure, from the QRH, against the runway and its condition;
• rescue and fire-fighting cover, medical and maintenance support and passenger handling;
• fuel, terrain, ATC and the time needed to prepare the aircraft and cabin.

When time allows, the operator's dispatch or operations centre supplies weather, runway and handling information. The decision itself is the commander's. It is best made early, while options remain: plan continuation bias grows as the destination nears, and the cost of an unnecessary diversion is disruption, not danger.

Overweight landing considerations

The maximum landing mass is a structural limit (see maximum structural and regulated masses): transport landing gear is designed for a touchdown rate of descent of 10 ft/s at that mass. An aircraft that must land soon after taking off near its maximum take-off mass has three choices: hold and burn fuel, jettison fuel if it can, or make an overweight landing. The A320 limitations permit an immediate landing above the maximum landing weight after an in-flight turn-back or diversion, provided the overweight landing procedure is followed.

An overweight landing means a higher approach speed, a longer landing distance, more brake energy (it rises with mass and with the square of speed), a smaller go-around climb margin and a need for a gentle touchdown. Afterwards the aircraft is inspected in accordance with the maintenance manual, much as after a heavy landing: first the landing gear and its attachments, the wing-to-fuselage structure and the engine mountings.

Fuel jettison is an emergency procedure to reduce mass quickly where an overweight landing could damage the aircraft. Where CS-25 requires a jettison system, it must dump enough fuel within 15 minutes for the aircraft to meet the approach and landing climb requirements, and must leave enough fuel to climb to 10,000 ft and then cruise for 45 minutes at maximum range speed. The decision rests with the commander. In controlled airspace fuel is jettisoned not below 6,000 ft (1,800 m), in coordination with ATC, preferably over water and away from towns and thunderstorms. While it runs, electrical switching is kept to essentials, HF transmissions are suspended and VHF is restricted to safety messages.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.