Dual bleed loss at FL350: controlling cabin altitude with no engine bleed available
You are the flight engineer on a Kenyan-registered three-crew twin-turbofan freighter cruising at FL350, 1 h 40 min into a night sector. The right bleed trip light illuminates and the right pack valve closes; the left system then carries both packs. Six minutes later the left bleed trips and its pack valve closes as well. Cabin altitude is now 7,600 ft and rising at 1,200 ft/min. The outflow valve position indicator is near CLOSED and the cabin pressure controller is in AUTO. Both engine bleeds are unavailable and the APU has not been run this sector. Aircraft data: APU start is permitted up to FL250, and APU bleed may feed the packs only below FL200; single-bleed operation of both packs is prohibited above FL250; crew oxygen at the present cabin altitude lasts 45 min. Nearest suitable aerodrome is 95 nm ahead, elevation 1,200 ft, runway 2,300 m. Fuel on board 6,400 kg; burn increases 5 % per 1,000 ft below FL350. Terrain within 60 nm west of track rises to 9,000 ft.
1. State your immediate actions, the trigger for the emergency descent and the profile you would fly, including how you would use the APU.
Read the worked answer
Masks on first, then fly the aircraft. With both packs off there is no inflow, so the 1,200 ft/min climb rate will not stop by itself; the cabin will pass 10,000 ft in roughly two minutes. That is the trigger: I would not wait for 10,000 ft, I would start down as soon as it is clear the pressure cannot be controlled, and treat 14,000 ft as the point where the masks and the emergency descent are mandatory rather than discretionary.
Profile: thrust idle, speedbrakes out, descend at VMO/MMO for 4,000–6,000 ft/min, with ATC advised (PAN PAN, or MAYDAY if separation is compromised) and a terrain check against the 9,000 ft high ground before turning off track.
The APU is the key to stopping at an intermediate level rather than going all the way to 10,000 ft. From FL350 to FL250 is about 3 minutes at 4,000 ft/min; that level is inside the APU start envelope, but above the FL200 bleed envelope. So: level at FL250, start the APU, select APU bleed to one pack, and watch the cabin rate. If the cabin stabilises, the aircraft can be held at FL250 while the diversion is assessed; if it does not, continue to FL200 where both APU bleed capability and the lower differential give margin. Fuel is not a constraint: 6,400 kg with a 5 % per 1,000 ft penalty still leaves more than 2 hours at low level.
2. Explain why single-bleed operation of both packs is prohibited above FL250, and what you would expect to see if the prohibition were ignored.
Read the worked answer
The limit is a supply-and-demand problem. Each pack needs a minimum inlet pressure and mass flow to deliver conditioned air at the required cabin differential. Above roughly FL250 the engine bleed is already working near the top of its pressure schedule: the high-pressure valve is open, the bleed air is hot, and the available flow from one engine is sized for one pack at high altitude, not two. If both packs are fed from one bleed you get a low pack inlet pressure condition, the pack valves modulate toward closed to protect the turbines, and the conditioned-air flow collapses exactly when the cabin needs it most. The second failure mode is worse: the remaining bleed is driven to its flow limit, the HP valve and precooler run hot, and you risk an over-temperature shutdown of the only bleed you have left - turning a single failure into a total pneumatic loss, with engine anti-ice also gone. In practice you would expect pack inlet pressure low lights, poor cabin control, and possibly a third trip. That is why one pack, one bleed, is the correct configuration at altitude, with the second pack left off until you are low enough.
3. What entries and airworthiness actions are required before the aircraft flies again, and is the case reportable?
Read the worked answer
The technical log must carry a specific defect entry, not 'bleed problem': both bleed trips, both pack valve closures, the cabin altitude peak and rate, the emergency descent with the levels and times, and the APU start and bleed selection. Vague entries are how a repeat dual trip gets dispatched.
The aircraft is not dispatchable on the strength of an MEL. A single bleed trip may be covered by an MEL with conditions, but a dual bleed failure is a combination the MEL does not address, and an MEL cannot be used to dispatch a combination of failures it does not list. Rectification per the troubleshooting manual and an operational bleed check are required, followed by a Certificate of Release to Service signed by appropriately licensed maintenance personnel before the next flight. The APU bleed system used as an emergency source must also be functionally checked and any limitations verified.
The event is reportable: an emergency descent and a loss of cabin pressurisation control is a serious incident under the operator's SMS and the KCAA occurrence-reporting requirements, submitted within the prescribed time. The FE's own report, the CVR/FDR preservation if the operator's manual requires it, and the engineering investigation findings all feed the report.