Premium on Safety - Issue 41, 2021 - 4

Photo courtesy of Gulfstream Aerospace
Thinking Machines
BY David J. Kenny
Conventional wisdom holds that increasingly sophisticated
automation has improved both aviation safety and reliability.
However, experienced programmers also know that greater
complexity compounds the risk of encountering some
combination of system state and new inputs that was never
anticipated in the design. Even in these days of vastly expanded
computational power, it may not be feasible to simulate every
possible permutation, even if the designers could successfully
enumerate them all. This makes thoughtful specification of the
default response-what the machine does when it doesn't know
what to do-critically important.
On the afternoon of July 7, 2019, a Gulfstream G650 departed
from Ireland's Shannon Airport (EINN) for Farnborough Airport
(EGLF) in the United Kingdom with two pilots, a flight attendant,
and a single passenger on board. Fifteen minutes after takeoff,
climbing through Flight Level 290 over County Waterford, an
amber " L ENGINE MAINTENANCE " warning appeared on the
Engine Indicating and Crew Alerting System (EICAS). Within 15
seconds, before the pilots could begin troubleshooting, the " L
ENGINE FAIL " indicator illuminated and the left engine shut down.
The airplane was climbing 2,000 feet per minute at an indicated
airspeed of about 300 knots.
The left engine shutdown in turn shut off power to the air data
system 3. The brief loss of air data to the right engine caused it to
revert to " alternate control mode. " This disabled the autothrottle,
requiring the crew to estimate thrust based on fuel flow. Power to
the onboard satellite phone was also lost. The copilot started the
" ENGINE SECURING / FAILURE IN FLIGHT / INTENTIONAL SHUT
DOWN " checklist as the pilot levelled the airplane at FL310 and
stabilized its airspeed. After considering their options, they chose
4
to return to Shannon rather than diverting to Dublin due to the
former's longer runway, lighter traffic, and availability of a gradual
descent profile to ease the load on the operating engine.
Their approach clearance included a hold at 8,000 feet at the
DERAG waypoint, during which the flight crew declared an
emergency and got the engineering team at their base at Shannon
Relevant EASA certification requirements
include a maximum risk per flight hour of
" any individual component failure developing
into a hazardous engine effect " no greater
than one in 100,000,000 and a maximum
risk of one per 100,000 flight hours of an inflight
engine shutdown.
to relay VHF radio messages to Gulfstream's technical support
team. Those discussions confirmed the wisdom of landing as
soon as possible, but during their first approach a " L-R MAIN
GEAR DOOR OPEN " message came up on the EICAS. The crew
performed a single-engine missed approach. The warning did not
recur on the second approach and the jet landed safely without
further incident.
The Gulfstream was powered by two Rolls-Royce BR700-725A1-12
( " BR725 " ) engines, both of which had been on the airplane since
its manufacture in 2014 and operated for 1,187 hours over 570
cycles. Each engine is governed by a dual-channel electronic
engine controller (EEC). If the channel designated as primary at
Premium on Safety - Issue 41, 2021

Table of Contents for the Digital Edition of Premium on Safety - Issue 41, 2021
