EC135, Checklists and the “Red Button of Doom”

Introduction

The EC135 SAS DCPL or SAS/AP CUT button is a red semi-guarded button on the head of the cyclic used to disengage all elements of the AFCS and stabilisation system simultaneously (both names for the button are used by Airbus in the Flight Manual and Pilot Check Lists (PCL)). The button is present on all pre-Helionix versions of the EC135, from VFR-only versions with just P/R SAS and Yaw SAS up to full single pilot IFR versions with full 3-axis Automatic Flight Control System (AFCS).

The inadvertent or inappropriate use of the SAS DCPL button has been cited in the investigation of 5 serious accidents on EC135 over the service life of the aircraft (Ref A-E). These accidents have ranged from inappropriate use of the button in response to an AFCS problem, through to inadvertent operation of the button by a passenger and subsequent assumption of double engine failure.

Wreckage of Air Methods Airbus EC135 P2+ Air Ambulance N531LN (Credit: UDPD via NTSB)

Whilst no report has definitely stated the button was the direct cause due to a lack of appropriate FDR data, there is strong evidence it was involved. Very disappointingly, none of the reports generated any safety recommendations aimed at preventing the following accidents. A recent event during a simulator sortie I instructed on has highlighted that the implications of operating this button could be better understood by flight crew. In all my training sessions I refer to this button as the “Red Button of Doom” and ensure crews have the appropriate skills to handle an inadvertent press of the button including the appropriate immediate reaction to reengage basic SAS. I make frequent reference to these five hull-loss accidents.

This article provides some background to the button, addresses the appropriate uses and highlights the correct application of the Airbus Emergency PCL with respect to AFCS-related warning, cautions and malfunctions. The intention is to highlight the issue to the wider EC135 community. A more formal Tech Enquiry has been raised with Airbus Helicopters to try to get some changes made to the procedures.

Summary of key points

If the SAS DCPL switch is inadvertently pressed, the immediate response should be to re-engage the Backup SAS using the SAS RST switch (Left, Right and Up in any order)

Changing EC135 AFCS levels of automation should be done so incrementally

The P/R SAS, YAW SAS and P DAMPER procedures in the alphabetical section of the Airbus Emergency PCL should not be used on EC135 with AFCS fitted

In the event of a single AFCS-related caution found on the summary card at the back of the emergency PCL, the most appropriate action is “System Performance – Monitor” in accordance with Flight Manual Supplement 9-2.48

Intentional use for training of the SAS DCPL button in flight should only be done VMC under the guidance of a type-qualified instructor

Intentional use of the SAS DCPL button for pre-flight checks in accordance with the provided checklists is still necessary

EC135 AFCS

The EC135 AFCS has developed incrementally over the service life of the aircraft using a modular approach. The original basic stabilisation systems on the aircraft were the electro-hydraulic actuators of the P/R SAS and the electromechanical Yaw SAS. This gave good VFR handling. The addition of the Pitch Damper gave a dual pilot IFR aircraft and finally the full AFCS delivered single pilot IFR handling qualities.

Each of these elements is depicted in the diagram below (P/R SAS – green, YAW SAS – red, P DAMPER – blue, AFCS – purple). The diagram shows the controls on the left, the AFCS in the middle and the hydraulic actuators on the right. Control inputs by the pilot flow from left to right.

A failure of any one of the 4 main modules of the AFCS will degrade the overall stability and control of the aircraft but basic stability will continue to be provided by the other elements. Even a failure of both AHRS does not lead to complete loss of stabilisation due to system redundancy. In contrast, pressing the SAS DCPL button disconnects all four elements at once, leaving no stabilisation.

Of note on H135 and H145 with Helionix, the button has been improved to provide a two-stage drop in stabilisation levels requiring the button to be double pressed to completely remove all stabilisation.

For reference:

FOG = Fibre Optic Gyro

MHA =Main Hydraulic Actuator

EHA = Electro-hydraulic Actuator (series actuator)

SEMA = Smart Electro Mechanical Actuator (series actuator)

AHRS = Attitude Heading Reference System

APM = Autopilot Module

Schematic of EC135 Automatic Flight Control System (AFCS)

Levels of automation and stabilisation

Whilst the SAS DCPL button always allows the pilot to drop straight into an un-stabilised state, other switches and buttons provide incremental options to move up and down the automation levels of the EC135 as shown below. Different levels of automation and stabilisation are appropriate to various flight conditions and an appropriate incremental approach should be adopted when moving up and down the levels such as when transitioning to IFR or conducted sloping ground landings. A similar approach should be adopted when dealing with AFCS malfunctions, Unusual Attitudes (UA) or flight control malfunctions.

Changing EC135 AFCS levels of automation should be done so incrementally

EC135 Levels of Automation

Operation of the aircraft in an un-stabilised state can be challenging, particularly at high speed or with limited or no external references. Stabilisation should be restored following inadvertent operation of the SAS DCPL button at the earliest opportunity. Of note, the only way shown in the diagram of achieving any stabilisation following use of the SAS DCPL / SAS/AP CUT button is to first re-engage the SAS modes using the SAS RST switch (SAS 4-way switch), before engaging the AP and any appropriate upper modes. It is also possible to press the AP button first, but this is not recommended as it requires the pilot to remove their hands from the controls. In the cases of inadvertent selection of SAS DCPL in Refs A-E, reengagement of stabilisation may have prevented or reduced the severity of the incidents. Subsequent higher level of automation could have then been selected. Therefore:

If the SAS DCPL switch is inadvertently pressed in flight, the immediate response should be to re-engage the Backup SAS using the SAS RST switch (Left, Right and Up in any order)

Normal Use of the SAS DCPL button

The SAS DCPL button is part of the routine pre-flight check of the AFCS. This check is appropriate to all variants of EC135 and should be conducted in accordance with the PCL or Flight Manual

Emergency Use of the SAS DCPL button

The use of the SAS DCPL button is mentioned in several emergency procedures in the Flight Manual and Airbus-supplied Emergency PCL. However, since the Flight Manual and PCL have to cover both simpler VFR-only aircraft and single pilot IFR aircraft, the same caution can be associated with several procedures depending on the SAS or AFCS systems fitted to the aircraft. Of particular note, the following cautions in the main alphabetical section of the Emergency PCL are only appropriate to EC135 without the single pilot AFCS fitted and are therefore not applicable to EC135 which have the AFCS fitted:

· P/R SAS

· YAW SAS

· P DAMPER

Therefore:

The P/R SAS, YAW SAS and P DAMPER procedures in the alphabetical section of the Emergency PCL should not be used on AFCS-equipped EC135

As an example, the procedure for P/R SAS is outlined below. Following this procedure VFR at moderate speed would be manageable, but when single pilot in IMC it could be extremely hazardous. As shown in Ref E, even on clear VMC days, pressing the SAS DCPL when fully coupled can be such a stark change in stability that control can be lost. Note there is no indication this procedure is inappropriate IMC or on an aircraft with AFCS (a request for this to be changed has been submitted to Airbus). The unwritten assumption is that the procedure is for a VFR-only machine and therefore would not be conducted by someone in a cloud or when fully coupled:

P/R SAS emergency procedure from main body of EC135 Airbus Emergency Pilot Checklist

All of the AFCS-related emergency procedures related to EC135 with AFCS are in the appropriate Flight Manual Supplement (9.2-48). For example, the P/R SAS procedure is shown below. In contrast to the previous procedure, the actions listed of “System Performance – Monitor” do not require use of the SAS DCPL button and are essentially “Continue flight”. The pilot may need to adapt to the degraded capability of the AFCS but dropping into unstabilised flight is not required and the SAS DCPL button should not be pressed.

P/R SAS procedure from AFCS Flight Manual Supplement 9.2-48

The Airbus-provided EC135 Emergency PCL include a supplementary section at the back for the AFCS. However, due to editorial decisions, the procedures for many simpler, single-caution AFCS emergencies are not included in full in the PCL and are instead just presented as a list of cautions on the last page as shown below. Whilst the appropriate supplement is highlighted in red, there is no guidance on the required actions. Fortunately, in every case for single caution without the AP A.TRIM warning, the action is universally, “System Performance – Monitor”. All AFCS failures which trigger AP A.TRIM or involve AHRS failures are presented in full in the PCL.

Summary of what is shown on last page of AFCS supplement to EC135 Emergency Pilots Checklist

Therefore:

In the event of a single AFCS-related caution found on the summary card at the back of the emergency PCL, the action is “System Performance – Monitor”

The only remaining instance where SAS DCPL / AP/SAS CUT button is used in an emergency procedure on AFCS aircraft is the failure of both AHRS. For complex emergencies not contained or envisaged in the PCL, use of the SAS DCPL button should be with extreme caution.

Training Use of the SAS DCPL button

Intentional use for training of the SAS DCPL button in flight should only be done VMC during training with a type qualified instructor.

Company specific emergency checklists

Airbus provided checklists have a major disadvantage in that they do not integrate or cover many modifications such as emergency medical fits, role-fit turrets or, as already discussed, AFCS. If locally a customised checklist is created, it is vital the correct procedures are selected from the flight manual and its supplements so they are appropriate to the aircraft the checklist are used on. I once saw a German operators checklists and they had correctly identified that the normal P/R SAS procedure was not appropriate to IFR flight and published the 9-2.48 procedure. But bizarrely they still included the SAS DCPL version under the title of “When VFR”. Quite unhelpful and unnecessary.

References

Take a look at my other articles:

Rotary Wing Geek