Introduction
The EC135 SAS DCPL or SAS/AP CUT button is a red semi-guarded button on the head of the cyclic used to disengage all elements of the autopilot and stabilisation system simultaneously. Pressing the button usually gives fairly benign results when flying visually but if it is pressed in fully coupled instrument flight, it can make the aircraft quite a handful instantly.
In this article we look at how the Automatic Flight Control System (AFCS) of the EC135 has evolved and how the SAS DCPL button came to form part of the system. We then look at how the evolutionary nature of the EC135 has led to this button presenting a latent risk as the capability of the EC135 has expanded.
We finish by looking at how this button has featured in 5 serious incidents on the EC135 over the service life of the aircraft and provide some recommendations for operators such that the risks of a loss of control are minimized.
Let’s take a closer look.
Contents
EC135 AFCS
SAS
The EC135 AFCS has developed incrementally over the service life of the aircraft using a modular approach. The original basic stabilisation systems on the aircraft were the electro-hydraulic actuators of the Pitch and Roll Stability Augmentation System (P/R SAS) and the electromechanical Yaw Stability Augmentation System (Yaw SAS). These systems when combined delivered an aircraft with good VFR handling. Indeed, this configuration is still flying on some EC135, particularly early models where single pilot IFR certification is not necessary. It is usually paired up with the original analogue cockpit.
The addition of the Pitch Damper gave a dual-pilot IFR aircraft. This can be thought as a extra “Pitch SAS” and when combined with the existing P/R SAS, the system now had 2 actuators in the pitch axis to minimise the risk of a runaway causing a large pitch upset (each actuator would oppose a runaway of the other).
Origin of the SAS DCPL button
With just the P/R SAS, Yaw SAS and Pitch Damper installed, a method was required to disengage these systems if they misbehaved or failed. This was the function of the SAS DCPL button. Given the system was either in visual conditions or was flown twin pilot, the loss of all stabilisation for brief period was not a huge hazard. Thus it didn’t need a full guard as the consequence of inadvertent selection was low risk. There is an annular guard to the upper left but the button still protrudes 1mm above the guard.
The remaining working elements could then be re-engaged using the cyclic mounted SAS RST 4-way switch. When moved left the P/R SAS re-engaged. Yaw SAS is the right selection and Pitch Damper is the up direction. They are mounted next to each other on the cyclic head and were operated by the pilot’s left thumb. The re-engagement of all three systems can be completed in about 1 second with a practiced multiway flick motion.
Origin of the Pilot Emergency Checklist
As mentioned above, on early EC135 or EC135 without the AFCS fitted, the SAS DCPL button is necessary to disengage the SAS in the event of a malfunction. The emergency procedures are in the emergency pilot’s checklist under the relevant caution. Let’s say the P/R SAS has failed. This will generate a “P/R SAS” caution. Let’s look at the emergency procedure.
In simple terms, “Take everything out then re-engage the functioning components. All possible with hands on the controls. Interesting a caution on its own does not generate an audio alert in the EC135. We will come back to that. Of note, the P DAMPER and YAW SAS emergency procedures are similar.
Single pilot IFR AFCS
As the EC135 developed, the demands of customers increased and a full AFCS was needed which elevated the aircraft to being suitable for single pilot IFR operations. This required the installation of a significant upgrade in the cockpit displays to a glass cockpit – the Flight Control Display System (FCDS). In addition, many new avionics and control panels were added. Importantly, the AFCS was built on top of the existing 3 SAS systems. There were an integral part of the new autopilot but crucially they could be used together independently as a “backup” SAS.
The extra elements of the autopilot could be engaged and disengaged with a new autopilot button on the Autopilot Control Panel (APCP). Pressing the AP button when ON, effectively selected Backup SAS, which is the 3 SAS elements we already met.
Evolution of the SAS DCPL button
As part of the upgrade to the AFCS, the SAS DCPL button was updated to also decouple the AP in addition to the original SAS systems. Thus the SAS DCPL maintained the function of removing all stabilisation. To re-engage the autopilot after pressing the SAS DCPL button required the pilot to using the 4-way SAS RST button in 3 directions and then the AP button.
One button to remove it all, but 4 to re-engage it. The 4 elements can be reselected in any order but the SAS does not need to be re-engaged first. It is however easier to re-engage the SAS first as the necessary switch is on the cyclic. The AP button is on the centre console.
Physically, the SAS DCPL button is identical to the earlier variants. It has no significant guard to prevent inadvertent operation. Now the aircraft could be flown single pilot under IFR rules. This would normally be fully coupled to the 3-axis autopilot. This is quite a low workload for the pilot. Pressing the SAS DCPL button could dramatically increase the pilot workload in these conditions.
No surprises
One important point is that pressing the SAS DCPL button does generate a warning audio alert – a “bong” sound. This is due to the AP A.TRIM warning coming on for 10 seconds following SAS disengagement.
However, the same “bong” sound comes on for any warning (except an engine fire) including:
- A double engine failure which generates a BATT DISCH warning (see image below)
- A rise in rotor speed above 106 % (see ROTOR RPM warning)
- An exceedance of the engine limit timers
- An exceedance of the mass moment limit on the main rotor (excessive displacement on the ground)
- Any other warning on the warning panel
AFCS structure
The structure of the new AFCS can be shown diagrammatically. The Yaw SAS is the red box and consist on one Smart Electro Mechanical Actuator (SEMA) and one Fibre Optic Gyro (FOG). The Pitch Damper is the blue box and has a similar makeup as the Yaw SAS. The green box is the P/R SAS and has a computer (the SAS 2000) and an Electro Hydraulic Actuator (EHA) in pitch and roll. Each system is independent.
The Autopilot is the magenta box and shows the extra components needed to allow it to function. On the right are the Mechanical Hydraulic Actuators (MHA) that actually control the main rotor and fenestron. On the left are the pilot controls.
A failure of any one of the 4 main modules (P/R SAS, Yaw SAS, Pitch Damper and Autopilot) of the AFCS will degrade the overall stability and control of the aircraft but basic stability will continue to be provided by the remaining elements. Even a failure of both Attitude and Heading Reference Systems (AHRS) does not lead to complete loss of stabilisation due to system redundancy provided by the independent FOG in the Yaw SAS and Pitch Damper. In contrast, pressing the SAS DCPL button disconnects all four elements at once, leaving no stabilisation.
In normal operations for EC135 with the AFCS fitted, the pilot has everything functioning. De-selection of any part of the system is only required for malfunction handling. This is done in accordance with the emergency checklist.
Evolution of the emergency checklist
The EC135 with AFCS is a significant upgrade from the original aircraft and this is reflected in new emergency checklists. However, no matter what variant of the EC135 is being flown, the aircraft can be supplied without the AFCS. It is not the default equipment – it is an optional extra. As it is optional, the new emergency checklist procedures are included in a supplement to the Flight Manual which is then distilled down into the emergency checklist. But crucially the original non-AFCS emergency procedures remain in the emergency checklist. These are before the newer AFCS specific procedures.
There are a lot of new and revised procedures in the AFCS supplement to the EC135 Flight Manual (reference 9.2-48). Adding these to the emergency checklist would increase its size significantly.
A design choice for the checklist was that the AFCS drills would be included in an extra section at the back of the emergency checklist and only the major emergencies would be included. All minor emergencies would still be available in the Flight Manual supplement (9.2-48). Let’s look at the P/R SAS emergency procedure in that supplement.
Note this is significantly simpler than the one we saw for the basic aircraft. The SAS DCPL button is no longer used. The instruction “System performance – monitor” is essentially “Do nothing” and continue the sortie. Redundancy is slightly reduced but full AFCS functionality remains. But remember, this new procedure is not included in the emergency checklist.
A final point is that when reviewing the totality of the emergency checklist with the AFCS supplement, the SAS DCPL button is only used in one emergency. This is a failure of one AHRS followed by a second AHRS after the crew have already reconfigured to the good AHRS.
The SAS DCPL button is almost not needed at all.
Missing procedures
As mentioned above, a design choice was that not all AFCS procedures would be included in the pilot’s emergency checklist; the complete list of missing procedures is quite long. However, a summary of the procedures that did not make it into the emergency checklist is provided at the end of the emergency checklist, along with a reference out to the Flight Manual supplement. In addition, 2 emergencies which are applicable to a failure of the collective position sensor and loss of communications between the control panel and display are also missed out.
Summary so far
Let’s review what we know so far:
- The SAS DCPL button was introduced on the early VFR-only EC135 to deselect the SAS
- The risk of inadvertent deselection was low as visual conditions prevailed or the aircraft was flown twin pilot
- The emergency procedures for the SAS required the SAS DCPL to be pressed before re-engaging the functioning SAS components
Now for the autopilot:
- The SAS DCPL button also disengages the autopilot if fitted
- The SAS DCPL button is relatively un-guarded
- To re-engage the autopilot after SAS DCPL is pressed requires 4 switch or button presses
- The original non-AFCS emergency procedures are still in the emergency checklist
- The newer “Do nothing” procedures are excluded from the emergency checklist
- Disengaging the autopilot and SAS in single pilot IFR operation when fully coupled has the potential to dramatically increase the pilot’s workload
- Pressing the SAS DCPL button generates a “bong” audio alert which is the same alert as a double engine failure or other warning
Accident Review
Now we had a chance to look at the systems, lets review a few accidents where the incorrect or inadvertent use of the SAS DCPL button may have featured in the accident sequence.
G-SPAU – 17 February 2002
On a dark and cloudy night a crew operating an EC135 for the Scotland Police encountered inadvertent instrument conditions. The pilot was flying manually at the point of cloud entry. He decided to reduce his workload by engaging heading hold and altitude hold to allow him to safely exit the instrument conditions. However, this aircraft had an early version of the EC135 AFCS with a quirk. When heading hold was engaged, the heading defaulted to north.
The aircraft was heading west at the point of cloud entry. In accordance with the normal behaviour of the AFCS, the aircraft turned right towards north and some high terrain. The pilot interpreted this turn as an uncommanded roll and opposed the motion several times. Then the autopilot failed or was disconnected and control was lost.
The AAIB concluded that most likely sequence of events was that the pilot, who had limited AFCS experience, had inadvertently disengaged the AFCS and SAS by pressing the SAS DCPL button while opposing the AFCS. AFCS training was improved by the operator but no aircraft modification was recommended by the AAIB.
G-IWRC – 16 September 2007
The EC135 was being used by the pilot owner to fly from Europe to the UK. Of particular note, the pilot’s friend had died the previous day in a helicopter accident. The pilot was accompanied by his wife in the left seat.
The pilot was making full use of the AFCS and had altitude and heading hold engaged. In the cruise near Stansted airport, he suddenly heard a thud behind him and he saw the nose pitching down. After a quick glance at the triple tacho gauge (NR and N2) he diagnosed a double engine failure and entered autorotation. The subsequently autorotative landing led to major damage to the helicopter.
The AAIB concluded that the SAS DCPL button could have been inadvertently pressed by the magazine being read by the passenger or may have disconnected due to a sudden vibration of the AHRS. They stated the latter was more likely, although they did not exclude the former option. However, they did highlight the guarding of the SAS DCPL button was insufficient and recommended the manufacturer review its design.
The AAIB also noted another pilot had experienced a sudden autopilot disengagement on another EC135 earlier in 2007. No fault was found in that incident.
Finally, the audio alert of sudden disengagement of the AFCS (“gong”) is identical to the audio alert for a double engine failure (“gong”). Suddenly going from a low workload in a coupled cruise to an unexpected autorotation in an un-stablized helicopter would be especially traumatic for the pilot.
YR-CPC – 28 November 2011
The EC135 was operating a passenger flight and was in the cruise with altitude and heading hold engaged. The aircraft then suddenly experience a severe flight path upset. The pilot managed to regain control but after significant height loss. The aircraft was landed safely but was damaged due to the main rotors contacting the fuselage during the recovery. No other faults were found.
The CIAS in Romania concluded that the cause of the upset could not positively be determined. It is however quite revealing that after regaining level flight, the pilot noted several SAS cautions. During the gyrations of the aircraft the extreme manoeuvres causes the rotor to overspeed which also let to an overspeed of both engines as the torque requirement suddenly dropped.
A sudden departure from controlled flight in fully coupled cruise of a fully serviceable helicopter, leads inevitably to the SAS DCPL button featuring in the initial phase of the incident. A pilot at a low level of stimulation (fully coupled cruise) suddenly trying to control an unstabilised aircraft could replicate the gyrations of this helicopter.
N62UP – 25 May 2017
The pilot was conducting solo IFR approach practice. During one coupled ILS approach, the pilot found himself much higher than he planned at the end of the approach. He was at 2000 ft not 200 ft.
The pilot was task saturated and loss control of the aircraft. The aircraft impacted the ground.
Based on the ground track of the aircraft and its altitude, the pilot never descended on the glideslope after intercepting the localizer. A relevant feature of the EC135 autopilot is that the localizer and glideslope modes of the ILS approach mode are separate buttons. A possible scenario is that he only coupled to the localizer and not the glideslope (they are separate buttons on the EC135).
The feed in to the ILS was sub-optimal by the controller which may have elevated the pilot’s workload at the point of mode engagement. In any case, during the missed approach, the aircraft suddenly departed controlled flight. The rotor exceeded the upper limits during the subsequent gyrations.
This suddenly departure into uncontrolled flight following fully coupled flight again points to the SAS DCPL button. The NTSB report does not mention this possibility but an AFCS equipped EC135 is generally a pleasant aircraft to fly, even in IFR.
Of note in this incident, there was limited data extracted from the aircraft due to the severe post crash fire, although data was extracted from the warning unit. This indicates the initial upset occurred before the autopilot was disconnected but that autopilot decoupling did occur during the upset sequence. There is no time stamp on the data so it could have happened quite rapidly after the initial upset (rotor high).
A sudden loss of control and large rotor speed excursions is very similar to G-IWRC, YR-CPC and G-SPAU. The full NTSB docket is here.
N531LN – 11 January 2022
The helicopter was on an air ambulance mission with a young patient on board. The aircraft was coupled up to heading and altitude hold in the cruise. Suddenly the aircraft departed controlled flight. During the subsequent gyrations, the aircraft impacted the ground, killing one of the crew. Remarkably the nurse in the cabin was able to exit the aircraft unassisted with the little patient in her arms.
Again, during the gyrations following initial loss of control, the main rotor speed exceeded limits. This caused the engines to be unloaded and they reached an overspeed condition. The engine memory units (DCU) revealed the engines entered a manual mode during the extreme manoeuvres. However, doorbell camera footage of the incident, in particular the sound, suggests the rotor speed was extremely high throughout meaning the rotor was likely not loaded during the whole sequence, so the possible low power output of the engines is a symptom not the causal factor in this case.
NTSB oddities
The report from the NTSB concluded that an AFCS malfunction was likely the cause of the upset based on simulator trials. Weirdly, this was then not mentioned again in the conclusion of the report with it just stating the departure from controlled flight was for unknown reasons.
Even stranger when the warning unit log is reviewed in the Airworthiness Factual Report it shows definitively that the Autopilot warning was the first thing that happened before the over speed of the main rotor. This seems like something of a smoking gun. Notably the accident involving N62UP is not mentioned at all, despite the similarities.
There were also some factual errors in the description of the AFCS, particularly the SAS. For example, losing AHRS 1 (as happened during the uncontrolled flight) will cause the P/R SAS to become inoperative. The NTSB report incorrectly stated the P/R SAS would continue to operate. No it would not! The P/R SAS needs the AHRS 1 to generate attitude and rate data to function.
11 If the AHRS 1 circuit breaker (on the AC Bus I) became extended in flight, the pitch and roll SAS control law processing would become inoperative, leading to a pitch and roll SAS caution on the CAD.
The pitch and roll SAS computer would continue to operate and provide pitch stability augmentation via the pitch EHA.
Accident review conclusion
From these 5 incidents, which all occurred where the aircraft was in coupled flight and then experienced extreme attitude upsets leading to rotor speed and engine exceedances. Only in one case was any suggestion made that the guarding or function of this switch needed revision.
With that in mind, what can operators do about the latent issue?
Managing the risk of the SAS DCPL button
In order to ensure another accident does not occur where there is a sudden loss of stabilisation which may be due to the SAS DCPL button, there are several strategies operators of the aircraft can use. The first is clearly training and accident reviews. Another method is to change how the autopilot is used and managed.
Levels of automation and stabilisation
Whilst the SAS DCPL button always allows the pilot to drop straight into an un-stabilised state, other switches and buttons provide incremental options to move up and down the automation levels of the EC135 as shown below. Different levels of automation and stabilisation are appropriate to various flight conditions and an appropriate incremental approach should be adopted when moving up and down the levels such as when transitioning to IFR or conducted sloping ground landings. A similar approach should be adopted when dealing with AFCS malfunctions, Unusual Attitudes (UA) or flight control malfunctions.
Step up and down through the autopilot, never jump. The following diagram shows the various levels of automation on EC135 and how small steps are possible. The SAS DCPL / SAS AP CUT is very rarely the right answer (far right column)
Quick Recovery
Operation of the aircraft in an un-stabilised state can be challenging, particularly at high speed or with limited or no external references. Stabilisation should be restored following inadvertent operation of the SAS DCPL button at the earliest opportunity. Of note, the only way shown in the diagram above of achieving any stabilisation following use of the SAS DCPL / SAS/AP CUT button is to first re-engage the SAS modes using the SAS RST switch (SAS 4-way switch), before engaging the AP and any appropriate upper modes. It is also possible to press the AP button first, but this is not recommended as it requires the pilot to remove their hands from the controls.
In the cases of inadvertent selection of SAS DCPL in the accidents above, reengagement of stabilisation may have prevented or reduced the severity of the incidents. Subsequent higher level of automation could have then been selected. Therefore:
If the SAS DCPL switch is inadvertently pressed in flight, the immediate response should be to re-engage the Backup SAS using the SAS RST switch (Left, Right and Up in any order)
Normal Use of the SAS DCPL button
The SAS DCPL button is part of the routine pre-flight check of the AFCS. This check is appropriate to all variants of EC135 and should be conducted in accordance with the PCL or Flight Manual
Emergency Use of the SAS DCPL button
The use of the SAS DCPL button is mentioned in several emergency procedures in the Flight Manual and Airbus-supplied Emergency Checklist. However, since the Flight Manual and emergency checklist have to cover both simpler VFR-only aircraft and single pilot IFR aircraft, the same caution can be associated with several procedures depending on the SAS or AFCS systems fitted to the aircraft. Of particular note, the following cautions in the main alphabetical section of the Emergency checklist are only appropriate to EC135 without the single pilot AFCS fitted and are therefore not applicable to EC135 which have the AFCS fitted:
· P/R SAS
· YAW SAS
· P DAMPER
Therefore:
The P/R SAS, YAW SAS and P DAMPER procedures in the alphabetical section of the Emergency PCL should not be used on AFCS-equipped EC135
All of the AFCS-related emergency procedures related to EC135 with AFCS are in the appropriate Flight Manual Supplement (9.2-48). For simple, single caution emergencies like P/R SAS the action is essentially “Do nothing” or more correctly “System Performance – Monitor”. This should be the normal action by a pilot unless the AP A.TRIM warning is present. Here is a reminder of the correct P/R SAS drill for an AFCS aircraft.
Therefore:
In the event of a single AFCS-related caution found on the summary card at the back of the emergency PCL, the action is “System Performance – Monitor”
The only remaining instance where SAS DCPL / AP/SAS CUT button is used in an emergency procedure on AFCS aircraft is the failure of both AHRS. For complex emergencies not contained or envisaged in the PCL, use of the SAS DCPL button should be with extreme caution.
Training Use of the SAS DCPL button
Intentional use for training of the SAS DCPL button in flight should only be done VMC during training with a type qualified instructor.
Company specific emergency checklists
Airbus provided checklists have a major disadvantage in that they do not integrate or cover many modifications such as emergency medical fits, role-fit turrets or, as already discussed, AFCS. If locally a customised checklist is created, it is vital the correct procedures are selected from the flight manual and its supplements so they are appropriate to the aircraft the checklist are used on.
Airbus Changes
One final point of note is what Airbus have done on later variants of the EC135 – the Helionix equipped T3H and P3H variants. The SAS DCPL button is now a 2 press button. The first press drops to backup SAS. Only after a second press is the aircraft completely unstabilised. Also, the emergency pilot checklist now comprehensively covers all the autopilot emergencies. Also, the response to an autopilot issue? A quick right-left input on a 4-way switch on the cyclic.
Conclusion
The SAS DCPL button is a legacy of the origins of the EC135. It is a possible factor in 5 serious incidents, some of which have included fatalities. It is vital the EC135 operators understand the function of the button and the appropriate rapid response to recouple the system. All EC135 pilots should be exposed to a sudden decoupling of the autopilot and SAS from fully coupled benign flight so that there instincts to re-engage the SAS quickly are instinctive. This should of course be in controlled conditions, preferably in a simulator.
During training, this button has been described by one instructor as “The Red Button of Doom” for its ability to turn a benign simulator sortie into a major simulator motion trashing rollercoaster ride. Do not let that be your fate.
Fly safe.
Take a look at my other articles:
- Unfair Skies: Restrictive helicopter instructor rules and how to fix them
- How to create an instrument rating instructor (IRI) – A helicopter anomaly
- The evolution of Category A Helipad procedures – A strong foundation for VTOL to learn from?
- Strips vs dials – Which is better?
- Under the weather – are UK HEMS weather rules broken?
- Mastery of the GTN 750 – Ten things you should know
- Checking anomalies – The weird requirements of helicopter proficiency checks
- It’s all about the switch – How helicopter designers need to think about the human in the cockpit
- Engine Failure Training Mode – A safety tool that will punish the unwary
- Automated take offs – Pointless or are they the new standard?
- Keeping up with the Norwegians – Six amazing innovations for UK HEMS
- LNAV/VNAV (SBAS) – Are they approved for use in the UK?
- Helicopter 2D IFR approaches – Is CDFA the best choice?
- Understanding Helicopter Flight Manuals – Everything you need to operate safely
- Post Maintenance Flight Tests – How to avoid fatal traps
Leave a Reply