I Can’t Believe THIS Happened! The Blackout of EasyJet 6074

0:00 Flying an aircraft with the majority of its most important systems failed is a nightmare that we pilots are not even trained to handle since that just shouldn't even be possible. But what if it happened anyway? And what if that same failure would also turn the aircraft completely invisible just as it's flying towards another aircraft? Stay tuned. Despite the high level of redundancy built into every airliner, almost all the features of modern airplanes still rely on one thing, electricity. That's why an aircraft's electrical system has some of the most complex safety features known to man. But what happens if those redundancies would still fail? Well, we're about to find out since that's exactly what happened to an

0:45 EasyJet Airbus A319 back on the 15th of September 2006 on a regularly scheduled flight from Aleante in Spain up to Bristol in England. The crew rosted for this flight included a 42year-old captain with around 8,800 hours of total flying time. But even though he was highly experienced in general, he had just recently switched over to the Airbus A320 family. So, it had only flown around 390 hours on that series of aircraft. The first officer was 34 years old with 3,200 total hours, and he had been flying the Airbus A320 family slightly longer than the captain, 560 hours to be exact, which is still not much. The crew started their day on the 15th of September by flying an aircraft

1:31 down to Alicante early in the morning, where they then expected to do an aircraft change and fly a new aircraft up to Bristol. But while they were on route down towards Aleante, they had then received a message from their company via the aircraft communications addressing and reporting system ARS and it informed them that the aircraft that they were supposed to fly up to Bristol had suffered a fault with its number one electrical generator and that they should therefore plan to fly it back from Aleante with that generator turned off. Now, letting them know this early was a great thing to do because it allowed the pilots to plan ahead for how to operate the airplane with this slightly degraded state. But what exactly would that mean then? Well, the

2:16 Airbus A319 has two engine-driven generators which uses the rotation of the engine core to generate electricity and that electricity is then used to power most of the other systems on board. On top of that, there is also something known as an auxiliary power unit or an APU, which is a third generator that can be used either on the ground or in flight in the event that one of the main engine driven generators should fail. On top of those three main sources, there is also a fourth emergency generator which uses a deployable ram air turbine to power a few essential systems in case of a loss of all the other generators. And this quadruple backup is needed on the Airbus since it is a flybywire aircraft, meaning that even its flight controls are electronic and must

3:03 therefore have access to electricity at all times. Now, in order for all of the craziness that is about to happen to make sense, I will need to give you a brief explanation of the electrical system on the Airbus. So, please bear with me. It will be worth it. I promise. The Airbus A319's electrical system consists of two essentially independent networks with the left number one system powered by the number one generator and the right number two system powered by the number two generator and with the APU available to be connected to any of those systems if needed. The overall network is designed in such a way that a fault with one system like a power surge for example can't propagate into the other system and cause any problems there. Now

3:51 in order to increase overall redundancy aircraft systems are usually divided so that one side is powered by the number one electrical system and the other by the number two. For example, the captain's instruments are powered by the number one system, while the first offic's instruments are powered by the number two continuously throughout the flight. But the most important systems on the Airbus are also attached to a third subn network called the essential network, which allows them to receive power from either electrical system if a fault should occur. So, with all of that in mind, let's take a look at the aircraft at the center of this story. This was a brand new Airbus A319 registered as GF Echosulu Alpha Charlie which had been manufactured in February of 2006.

4:37 But even though it was only a few months old at this time, it already had a quite long technical history. Most of its problems had to do with the electrical generation system, specifically generators tripping off or failing to come online after an engine start. In fact, most Airbus A320 family aircraft built during that period had similar records thanks to a bad batch of static random access memory chips or SRAMM chips installed in their generator control units. The generated control unit are computers who monitor and regulate the generator output and also provides the generator status information to other aircraft systems. A failure of the generator control unit or GCU can prevent the generator from operating, which is why there had been

5:24 so many generator issues on aircraft with these faulty chips. Anyway, on the 14th of September 2006, one day before the incident flight, the number one generator on Gulf Echos Alpha Charlie had tripped off during a flight, probably because of one of those SRAMM chip issues. So, while the plane was parked overnight at Stanstead airport outside of London, EasyJet mechanics had replaced the number one generator control unit in an attempt to fix the problem. But when they then powered up the aircraft to test their fix, the number one generator just tripped off again, which caused the mechanics to try to reset the generator, and that seemed to fix the issue. Now, according to best practices, they should have responded to this initial

6:09 failure by simply rejecting the new GCU. But that's not what happened. Instead, the mechanics concluded that despite the initial trip, the generator was now working fine, and they therefore approved the aircraft for dispatch. But what EasyJet's maintenance engineers didn't know was that the GCU that they had just installed on this aircraft previously had been installed on three other aircraft within the last 5 months. And every single time it had been then removed due to some sort of malfunction. After each of those problems, the GCU had then been sent to the manufacturer Hamilton Sunstrand for testing and repair. But they were never able to recreate or identify the cause of the problems. So the GCU was simply sent

6:55 back into service again and again and again. In fact, it was later discovered that around 29% of the units sent to Hamilton Sunstrand for repair had been sent back unmodified after the engineers failed to reproduce the fault. So this meant that the company had no system to identify units that had been repeatedly rejected from service or to keep track of units that might be suffering recurrent but intermittent malfunctions. Now, identifying an intermittent malfunction during bench testing is quite difficult, but this difficulty can be overcome by saving the unit's internal memory and keeping records of past faults until some kind of pattern emerges. But that hadn't happened. So, in this case, the unit was released back into

7:42 easy stock where it was eventually installed on the aircraft in this story. So the morning after this repair had been completed, the aircraft then departed Stanstead airport bound for Alleante with a full load of passengers on board. But just 20 minutes into the flight, the crew then heard a strange clonk sound and the number one generator tripped off causing the electrical system to automatically reconfigure into supplying both electrical networks from the number two generator. This failure and the required actions to do were then displayed to the crew on the electronic centralized aircraft monitoring system or ECAM. And in the case of a failure of a number one generator, the checklist called for the crew to attempt to reset the generator. But when they tried that,

8:27 it didn't work. So instead they carried out the alternate procedure which was to turn off the faulty generator, start the auxiliary power unit and then reconfigure the electrical system to run the left part of the network directly from the APU. That was accomplished without any issues and after having discussed their situation with EasyJet's maintenance control, the crew were advised to just continue their flight down towards Alicante, which they also did. Now, this story is about to become much more complicated. And when my team and I are researching these types of complex topics, we have to be very careful with how and where we are browsing. Sometimes what looks like legitimate websites turns out to be sophisticated fishing sites instead. And

9:13 up until recently, there wasn't much that we could do about that. But now, thanks to today's sponsor, NordVPN, we can use their threat protection pro, which checks every site before you even open them, immediately, letting you know if it's safe to proceed. And by doing that, it catches 85% of all fishing sites, which dramatically decreases the chances of some shady entity getting their sweaty hands on your information. For my team and I, that's been a real gamecher. And it also blocks things like trackers, intrusive ads, and malware without you even being connected to a VPN. But Nord isn't just about staying safe. It also gives you access to your favorite content worldwide. Whether

9:59 that's a documentary that hasn't launched yet in your region or a live sport event happening halfway across the globe. Right now, Nord is offering you, my viewers, a great deal. Sign up for their 2-year plan using this QR code or by going to nordvpn.com/pilot and you'll get four extra month for free. Also, remember that Nord always gives you a 30-day money back guarantee, so you risk nothing by trying them out. Thank you, Nord, for your ongoing support of my channels. And now, let's get back to that ECJet Airbus and its broken generator. Now, because the APU provides a redundant power source, it was allowed to dispatch the aircraft with one generator inoperative for up to

10:46 10 days, provided that the aircraft met the specified criteria in the minimum equipment list or MEAL. The meal contains a detailed list of items that can be inoperative for dispatch as well as any special instructions or procedures needed to handle the risk of flying with these reduced redundancies. In the case of an inoperative generator, the Airbus A319 can be dispatched with the APU powering the affected network, provided that the crew carries out certain checks before the flight, like checking that all systems are properly powered, that the APU fuel pump is working, that all warning lights and indicators for the electrical systems are functional and so on. Under this condition, the airplane is also barred

11:31 from extended operations over water and is limited to a service ceiling of 33,500 ft or flight level 335. So with all of that in mind, it actually made sense for the company to allow the flight to continue down to Aleante and then to fly it back to Bristol, all with the number one generator turned off. After all, EasyJet didn't have a maintenance base in Aleante. So, it was much more convenient to fix the generator once the plane was back in the UK again. So, the flight proceeded normally and it eventually landed without any further incident. And not long after that, what would become the incident flight crew also arrived in Aleante and then walked over to their new aircraft in order to prepare it for flight 6074 back towards

12:16 Bristol. As they were walking over, they also stopped with the previous captain who gave them some more information about the generator failure and how they had responded to it. And based on that, the crew decided to accept the aircraft. So the captain just contacted the company to file a flight plan with a maximum cruise altitude of flight level 320 and also that he needed a plan that would account for the need to run the APU during the entire flight, which would burn a little bit more fuel. Once they had entered the cockpit, in addition to the usual pre-flight checks, the crew also completed the special checks required by the minimum equipment list, which I mentioned before, and everything appeared to be working perfectly. While the pilots finished the pre-flight procedures, the four flight attendants

13:03 then oversaw the boarding of the 138 passengers booked for the flight. So, when the doors were finally closed, there was a total of 144 people on board. The crew then asked for push back, started their engines, and eventually taxied out to the runway in use. And at the time 0926, Eastjet flight 674 took off into the bright cloudless sky with a captain as pilot flying and the first officer as pilot monitoring. And at this point, obviously, neither one of them had any idea that deep inside of their aircraft's electrical system, there was now a hidden floor that was soon about to plunge them into a serious emergency. So, let's take a moment here to roll back the clock to the previous night when the maintenance engineer had performed that ground test run with the replacement generator control unit. When

13:50 the generator had tripped off again after the replacement, the engineers had assumed that this was probably because of those SRAMM chip issues which were wildly known at the time. So, when the generator was then reset and operated normally, they didn't think that this was anything more than just a routine glitch. But what they didn't know was that this replacement GCU actually contained a different problem, a recurring issue which had already caused it to be removed from several other aircraft. Now, in order to understand this problem, we need to take a closer look at some of the specific functions performed by the GCU. In addition to controlling the generator itself, the GCU also includes protections against certain potential

14:35 failures. One of these is called the differential protection which is designed to detect a short circuit by measuring the current at two different locations downstream of the generator. And if the GCU measures a difference between these two locations, it will immediately trip off the generator. It's doing that because the current should be the same throughout the distribution line from the generator. So if the current is suddenly decreasing somewhere downstream, well then that means that electricity must be flowing somewhere else which can be very dangerous. Now a second type of protection performed by the GCU is something known as welded protection. This measures the current level downstream of the generator when the generator is turned off. In other words,

15:22 when there shouldn't be any current there at all. So if a current is still detected with the generator turned off, well then that could mean that electricity from another generator is flowing backward down the distribution line to the inoperative generator which could damage it. So in that case the GCU will completely isolate the entire electrical network on the affected side. The problem here was that on this particular GCU, one of the sensors measuring downstream current levels was faulty. Basically, these sensors have a pair of electrical contacts that close when exposed to a current. But in this case, the contacts were sometimes opening when they should be closed and closing when they should be open. When

16:07 the number one generator was turned on, the sensor contacts should be closed. But once in a while, they would instead get stuck open, causing the sensor to measure no current, which would then erroneously trigger the GCU's differential protection and trip off the generator. But at the same time, when the generator was turned off, those same sensor contacts could sometimes close when they should be open, causing the sensor to report the presence of a current that wasn't actually there, which would erroneously then trigger the GCU's welded protection and isolate the circuit. You see the problem? Now neither the EasyJet maintenance personnel nor the engineers at Hamilton Sunstrand knew about this fault which had gone unidentified for months since

16:53 it only occurred intermittently. But what exactly were the consequences of this then? And what's the difference between tripping a generator off and isolating a generator? Well, for that we need to dive even deeper into the layout of the Airbus A319's electrical system. But don't worry, it will all make sense soon. In most complex electrical systems, not just on aircraft, systems requiring electrical power are connected to the electricity source via a device called a bus bar. A bus bar is a large conductive bar capable of withstanding a considerable electric current and to that many individual systems can then be attached. The electrical system on the Airbus A320 family contains a series of

17:39 different bus bars that divide the entire electric network into various sections. The left side or number one electrical network receives power from the number one generator via a bus bar called the AC bus one while the corresponding right or number two network receives power from the number two generator via an identical bus bar called AC bus two. Each alternating current AC busar also feeds a corresponding direct current DC bus bar that supplies the DC systems. But all really important systems on the aircraft are attached to something known as the AC essential bus bar which normally receives power from AC bus one but can also be reconfigured manually to receive

18:24 power from AC bus 2. This ability to power essential systems from either AC bus improves redundancy and ensures that no single failure within the electrical system can lead to the loss of any essential systems. Or at least that was the idea. On top of this, both AC buses can also receive power from either engine driven generator or the APU via yet another bus bar called the transfer bus bar. Now, when both engine-driven generators are operating normally, the transfer bus bar is deenergized because its purpose is only to allow AC bus one to be fed from the number two generator or AC bus two from the number one or both from the APU. It becomes energized by closing two

19:12 switches called the number one and number two bus tie connectors. So for example, if the number one generator stops working, well then closing both bus tie connectors will cause electricity to flow from the number two generator across the transfer bus bar and then into the AC bus one. Alternatively, if the number one generator is turned off, but the APU is turned on, well, then the number one busie connector closes while the number two bus side connector remains open, allowing electricity to flow from the APU into the transfer bus bar and into the AC bus one, but not into AC bus 2. Quite complicated, I know. But all of these configuration changes I just described happens automatically. So if the number one generator fails, all the

19:58 switches will automatically reconfigure to keep AC bus one powered via the transfer bus bar with no pilot input needed and no loss of any system functionality except well I guess maybe some non-essential galley equipment. Now one of the last things that's important to understand here is the difference between a generator that has tripped off and a generator that is turned off. You see, for electricity from any generator to reach any of the bus bars, it must first pass through a switch called the generator line connector or GLC. The GLC is normally closed, permitting electricity to flow normally. But when the GLC is open, electricity from the generator will not reach the electrical network even if the generator is turned on. For example, if the GCU detects a

20:46 short circuit and activates the differential protection, the unit will command the corresponding GLC to open, cutting off the generator from the network, and the generator must then be shut down manually by the pilot, which was exactly what had happened when the generator tripped off during the aircraft's outbound flight down to Aleante. But for the following departure, flight 6074 up to Bristol, the aircraft was dispatched with the number one generator turned off with a number one GLC open and the APU powering AC bus one via the transfer bus bar as you can see in this diagram. Now, I know that that's a lot to remember even with these animations, but bear with me. Anyway, for the first hour of the flight

21:33 up towards Bristol, everything seemed normal. Flight 6074 climbed to its cruising altitude of 32,000 ft and then proceeded north across Spain and up through France. The electrical power system was working as designed and other than the inoperative number one generator and the running APU, there was nothing abnormal at all. That is until time 1052 when flight 6074 was passing overhead nons in northwestern France when something suddenly went horribly wrong. Remember how that faulty sensor could sense current in the generator line even when there was nothing there? Erroneously triggering the GCU's welded protection. Yeah, that's exactly what now happened.

22:19 With the generator turned off, the GLC should be open. But if current is detected in the generator line despite this, that could indicate a failure of the GLC open function. So in order to prevent a current from backflowing through an improperly closed GLC and entering into the generator, the GCU now instead open the number one bus tie connector to prevent electricity from entering the entire left part of the electrical network. But of course that also caused electricity to stop flowing from the APU through the transfer bus bar into AC bus one and therefore also into the AC essential bus bar. Now, while the electrical system can automatically reconfigure to supply AC

23:04 bus one from a different generator if the number one generator should fail, it can't automatically reconfigure to power the AC essential bus part from AC bus 2 in the event of a failure of AC bus one. On more recent Airbus models, this reconfiguration has also been made automatic, but on the older and less advanced Airbus A320 series, it wasn't. Instead, the pilots had to manually switch the AC essential bus bar to receive power from AC bus 2 by pressing something known as the AC essential feed button on the electrical system overheads control panel. And when the AC essential bus bar is not powered, a caption light reading fault should be illuminated under that button. And after the system is then manually

23:50 reconfigured, that fault light should go out and be replaced by an alternate light instead. As soon as the AC essential bus bar depowers, this failure is immediately also displayed on the ECAM screen along with the required action to press the AC essential busbar button. And the idea was that this should result in the AC essential busbar being depowered for only a very short time before the pilots could reconfigure the system. But that was just the manufacturer's assumption. And as we will soon see, in reality, things are sometimes a lot more complicated. At the same moment that the welded protection activated the number one GCU, the pilots heard a clunk sound, followed by an avalanche of failures. The

24:37 captain's instruments all went blank. The autopilot and outer thrust disconnected, the master warning sounded, and most of the lights on the overhead panel went completely dark. In fact, the list of systems that became inoperative at that precise moment was so long that it would have been almost impossible for the pilots to grasp the true extent of this failure. The loss of AC bus one and the AC essential bus bar resulted in not only the things that I've already mentioned, but also the loss of the blue hydraulic system, loss of the number three spoiler on each wing, loss of two out of three air data inertial reference units, reversion of the flyby wire control system to alternate law, loss of normal landing gear extension, loss of automatic cabin pressure control, loss of both automatic

25:24 and manual passenger oxygen mask deployment, Loss of all three radio management units and audio control panels. Loss of the primary transponder. Loss of the traffic collision avoidance system. Loss of the ground proximity warning system. And loss of VHF radio 1. And those were just the most obvious things. The full list of lost items actually goes on for about three full A4 pages. Anyway, the first thing that the captain did when all of this happened was to hand over the controls to the first officer since at least he had working instruments on his side. The pilots then tried to quickly diagnose the failure, but that proved extremely difficult since not only were so many systems gone, but a lot of the indicator lights

26:11 showing each system status had also failed. The pilot's best initial guess was that the APU had somehow tripped off, depowering the left side electrical network, but that turned out to be wrong. Fortunately though, the first officer found that the plane was controllable in manual flight despite the loss of all normal law envelope protections and automation. But of course, flying the aircraft manually in alternate law at that altitude would have likely taken up most of his attention. Meanwhile, the captain focused on examining the ecam, which displayed a large number of warnings and caution messages. The upper screen of the dual display eCam had failed, but the lower screen was thankfully still running off the AC bus 2. Among the ECAM messages

26:59 was a warning that read AC essential bus fault with the prompt to press the AC essential feed button to restore power over to the AC essential bus. But when the pilots looked up at the button, they observed that the fault caption under it wasn't illuminated as it should. The captain tried pressing the button anyway to switch the AC essential bus over to AC bus 2, but the button didn't appear to do anything and the system did not reconfigure. Now, we don't know why this button didn't work. With this failure condition, the fault caption should have been illuminated and the button should have worked normally. But the change of the caption status from fault over to alternate on the button was the only

27:45 positive assurance that the crew had to see if they've actually press the button correctly. There's no change in the button position itself. So if there was something wrong with the caption light, well then the pilots wouldn't have had any way of knowing whether they had pressed the button far enough or if they had pressed it the correct number of times. So it is possible that the reconfiguration failed because the button was actually pressed twice in very quick succession without the captain realizing it. But we were never able to possibly confirm that. It is also quite possible that there were some kind of further malfunction that the investigators just were never able to find. Anyway, the captain tried several times to reconfigure the electrical system,

28:30 but they were all unsuccessful. So pretty soon it became clear that they likely wouldn't be able to restore any of these failed systems, but at least they had the aircraft under control and they were still able to track the navigational aids that they had in front of them which they would need in order to be able to reach the destination. So by the principle of aviate, navigate, communicate, this meant that the first two priorities were at least covered. So the captain decided to now focus his efforts on the third emergency priority, communication. And as it turns out, it was actually the lack of this that would turn his flight into something really scary. You see, one of the systems that failed at the onset of the emergency was the

29:15 VHF radio 1 since it was powered by the DC essential bus bar, which in turn was powered by AC bus 1. And the VHF radio one is normally used for communication with air traffic control. Now VHF radio 2 and three were still technically working since they were powered by the right side electrical network. But because all three audio control panels drew power from the left network, the pilots now had no way to actually selecting either of those working radios. So this left the crew with no way to contact air traffic control at all. And to make matters even worse, the primary transponder had also failed. And while there was a backup transponder powered by the right side electrical network,

30:00 the pilots would have need to think of switching over to that transponder manually. And they certainly now had other things to think about. So with that in mind, you might be wondering how the air traffic controllers reacted to all of this. And as it turns out, that's one of the craziest part of this entire story. At the moment the electrical failure happened, flight 6074 was passing through airspace controlled from the breast area control center in northwest France. And at that facility, a shift change was just about to begin when the controller monitoring flight 6074 suddenly noticed that the Airbus A319 had disappeared from his radar screen. You see, air traffic controllers normally rely on secondary radar, which interrogates an airplane's transponder

30:47 in order to determine its identity, position, speed, altitude, and so on, and then display it on the controller screen. I think when most people hear the word radar, they think of primary radar, which bounces radio waves of airborne objects to determine their position. But as it turns out, the controllers in breast didn't have any primary radar available, meaning that they just couldn't see any aircraft flying without a transponder. So as soon as the controller noticed that flight 6074 had disappeared from his screen, he tried calling the pilots several times, but received no response back. Now, the combination of a loss of radar and radio contact caused quite a lot of constonnation at the facility, which soon turned into real fear as the

31:33 controllers became increasingly convinced that flight 6074 had possibly crashed. And as they debated whether to notify emergency services of a possible missing aircraft, the controller in charge of flight 6074 suddenly received a call from an American Airlines Boing trip 7 operating flight American Airlines 63, which was just entering the breast sector, flying on a westbound heading at flight level 320, the same level as the disappeared EasyJet flight. Now, at that point, the controller was already becoming increasingly convinced that something terrible had indeed happened. But he soon also made the incredible realization that if flight 6074 was still airborne at its last known speed and heading, it would now be on a

32:19 collision course with American Airlines flight 63. So, the controller asked the American Airlines flight if they could see flight 6074 in their TCAS, which the pilot responded that they couldn't. And that kind of makes sense since TCAST uses the transponders in order to function. Despite this, the controller decided to instruct flight 63 to descend to flight level 310 as a precaution. And he then briefed his replacement on the situation before leaving at the end of his shift. Now, although I think it was a little bit odd for him to leave his post under these kind of circumstances, I have to commend the controller for his quick thinking here. Obviously, flight 674 was indeed still airborne, heading north at flight level 320. And calculations later

33:06 showed that if the controller had not ordered flight 63 to descend, the two airplanes would have passed through the same point in space less than 20 seconds apart. With no transponder broadcasting its identity and position, flight 6074 wouldn't then have appeared on flight 63's traffic collision avoidance system. So, there was a real and terrifying risk of a midair collision if either of these planes had behaved just slightly differently. Just changed their speed a little bit. But now, due to the controller's quick reaction, the pilots of flight 63 descended out of the way in time, and they actually soon saw the EasyJet Airbus A319 crossing their flight path 2.67 67 nautical miles ahead and 600 ft

33:53 above them. Closer than normal for sure, but thankfully not a collision risk. The American pilots immediately reported seeing an aircraft resembling the missing plane, which came as a huge relief to the controllers impressed, but they were still alarmed that the two aircraft had gotten so close to each other. Meanwhile, on board flight 674, the pilots had no idea just how close they had already come to disaster. The captain was still trying to contact air traffic control by switching to VHF radio 2, which was unsuccessful, and he also attempted to declare mayday on the universal emergency frequency of 1:1 decimal 5 MHz, but that didn't work either. He then tried to restore electrical power by turning the number

34:39 one generator on and then off, which also didn't work. And after about 10 minutes of totally unsuccessful efforts, he then moved on to lower priority ECAM actions, one of which told him to switch the number two transponder, which he did. The transponder control panel was unlit and didn't appear to be responsive. But when he switched to the standby transponder, the digits showing the currently selected code came back. With the rest of the panel still unlit, the pilots weren't sure whether the transponder was actually working. But just in case, the crew changed the transponder code over to 7700, the universal emergency code. The other choice they would have would have been to change it over to 7600,

35:25 which is the code for radio failure. But with so many systems inoperative, I think that the emergency code was likely the better choice here. Back in the breast control center, the aircraft now reappeared on the radar screens, squawking 7700, finally confirming to the controllers that the aircraft was indeed in trouble. But at least it was still flying and they could see it. On board inside the cockpit, the captain started flipping through the system status pages on the ECAM display, trying to get a better sense of what was actually working. He soon found that the AC and DC essential buses were all unpowered and also noted that the cabin pressure page showed no issues despite the loss of both cabin pressure controllers. The hydraulics page also

36:12 showed no data from any of the pressure sensors and that was because the sensors were all powered by the left side electric network and the page also erroneously indicated that the Ramire turbine had deployed which it hadn't. The captain then tried turning the APU off and then back on again multiple times, but with no effect. So, both pilots eventually concluded that they probably wouldn't be able to restore normal operations on any of these systems. Instead, they turned to trying to figure out how they could land the aircraft safely with a few systems that they still had. Now, since they were able to navigate and fly, their biggest problem was still going to be communication. And the captain actually had some very real and serious concerns

36:59 about this. You see, they had initially considered diverting to the nearest airport due to the numerous system failures they had, but ultimately they decided that that wasn't the best idea. It had been almost exactly 5 years since the September 11th attacks, and the captain was worried that with a transponder potentially off and with no radio communication, any deviation from their filed flight plan could be interpreted as a hostile intent, which he then of course feared could cause the French or British Air Force to potentially fire on the aircraft because they did have primary radar. He was also concerned that if a fighter jet intercepted them and ordered them to follow to an airport, they might be

37:44 unable to comply due to the degraded state of their aircraft systems or not be able to indicate that they were in control, which is normally done with the help of external lights and specific maneuvers. Also influencing their decision to continue was the fact that they knew that the weather was good in Bristol that they had no way of acquiring weather or not information for any other airport since neither a cars nor any of their radios were working. The captain continued with checking whether the runway in Bristol was long enough to land with several braking systems degraded and he soon concluded that yeah it was. So in the end, the pilots decided that the safest course of action was to stick to their flight plan as closely as possible and then continue their flight to the destination. This,

38:31 by the way, is also the recommended action in the event of a total radio failure since it simply keeps the aircraft movements predictable and therefore allows air traffic control to move other aircraft out of the way. I have to also say that I think that this is a great example of how effectively you can use the time available decision-making model PIO which of course stands for problem information options select execute and evaluate first you have to try to determine what the problem is. Then you gather as much information as you can about the situation and then assess your options. Select the safest one and execute it. and then you constantly re-evaluate it to ensure that you're still making the right call, which is exactly what this crew was continuously doing.

39:17 They had been placed in an extraordinarily difficult situation with the cause and scope of the problem were basically impossible to determine. But by gathering what limited information they had and anticipating potential future scenarios, the pilots were able to select the safest option. It's just that's great to see. This type of behaviors is also a great example of something that we call resilience, which is the ability to adapt to a completely new situation based on previous experience, training, and skills. Even though that exact situation has never been seen before, but of course, this ordeal was still not over, and it wasn't about to become any easier either. Breast ATC had now informed West Drayton ATC, its

40:02 counterpart across the channel, about the situation. And in turn, West Drayton had informed Bristol. So the controllers there knew that the plane was coming in. Since the backup transponder was working, the controllers were able to keep other planes out of flight 604's way and eventually allow it to slot itself onto the approach sequence. At the same time, Bristol ATC had also declared an emergency on behalf of the flight and positioned fire crews to meet the aircraft on the landing since, remember, they had no idea what kind of emergency the flight was actually facing. They only knew that it was squawking 770. As the aircraft lined up for its approach, the controller also tried broadcasting the wind and landing clearance in blind, hoping that flight 674 might hear it, which they sadly

40:48 didn't. But that was a good effort. And on board the plane, the pilots now started preparing for landing by extending the flaps, which worked despite the pilot's doubt about the hydraulic system. But when they selected the landing gear lever down, the gear didn't deploy and none of the gear lights illuminated. Turns out that the landing gear is prevented from deploying above a certain air speed by a device called the landing gear safety valve. But because that valve had lost all of its airspeed data sources due to the electrical failure, it had now defaulted to closed. Fortunately, the pilot reacted quickly and were able to successfully extend the landing gear using the alternate gear extension mechanism. And the captain also tried to call air traffic control

41:34 using his cell phone during the approach, but unfortunately without being able to reach them. Now, I just love that kind of thinking outside of the box. That's yet another great example of resilience in my view. In the end, despite the lack of contact with air traffic control and the numerous system failures, the first officer was able to land the aircraft perfectly and then bring it to a safe stop on the runway. And also, despite slightly degraded nose steering, the captain was then able to taxi the aircraft off the runway to its parking stand. But as if the universe just wouldn't let them catch a break, when the pilots tried to shut down the engines using the master switches, nothing happened. The engines just kept running. The report doesn't actually explain why

42:21 this was the case, but most probably some component between the switches and the engines had also lost power with the failure of AC bus one. Fortunately, the crew were able to force the engines to shut down by pulling the fire shut off handles instead. And after that, all 144 passengers and crew safely disembarked the aircraft. Now, in the report, there was no mention about the interaction between the pilots and the cabin crew. But apart from just keeping them in the loop, there wasn't much that the cabin crew could have done to get or make the outcome any different here. When investigators from the British Air accident investigation branch arrived at the aircraft to investigate this incident, they were unable to get the airplane to power on normally. And there were also numerous abnormal indications that only went away after replacing the

43:08 number one generator control unit. Eventually, after extensive testing, the AIB found that the cause of the incident was a single faulty sensor contact in the number one GCU, combined with an unknown problem that prevented the crew from reconfiguring the power source for the AC essential bus bar. Throughout this incident, the pilots and air traffic controllers all made important and accurate decisions that contributed to the safe outcome of the flight. From the controller's decision to assume that the aircraft was still airborne to the captain's decision to not divert to an alternate airport. The AIB also noted that this wasn't the only incident involving the Airbus A320 family in which the pilots were unable to reconfigure the electrical system in

43:54 a timely manner following the failure of AC bus one. Operating the aircraft for a long period without the AC essential bus powered was not a scenario that had been fully considered during the design and certification of this aircraft. But when it did occur, it proved very complicated due to the many overlapping failures that sometimes penetrated several layers of redundancies. In this case, the most serious consequence was the failure of all three audio control panels which resulted in a total loss of radio contact despite the presence of three redundant VHF radios. So after this incident, Airbus took action to correct some of these deficiencies by introducing design modifications that would permit automatic reconfiguration of the

44:40 electrical system in the event of a failure of AC bus one and would also prevent the loss of all three radios. Hamilton Sunstrand also updated the GCU logic to require multiple sensors to agree that a stray current was present in the generator line before activating the welded protection. So, in the end, this incident made the Airbus A320 family into a safer aircraft, just like these type of incidents always should. I actually mentioned this incident in the first ever episode of Ben and my podcast, Captain Speaking, which I hope that you've already checked out, and if you haven't, do so now. In there, we speak freely and unscripted about everything aviation and non-aviation, and you can find it on YouTube or

45:26 wherever you listen to podcast. Please check it out and consider subscribing. It would really mean a lot to me. Now, if you want to see my next video before everyone else, maybe even today, well, then use this QR code or go to patreon.com/join/mentorpilot and sign up. Have an absolutely fantastic day wherever you are and I'll see you next time. Bye-bye.