Electrical Encore

Here's another data point in the category of resetting breakers. It has a similarity to the NASCAR incident, in that an electrical malfunction deferred after one flight carried over to the next with more severe consequences. This time the incident aircraft is an A319 operating between England and Spain.

About twenty minutes into the outbound leg, a clunk, an overhead warning light and a computer message announced that the the number one electrical generator had gone off line. Checklist actions called for one attempt to reset the generator. (See? The one-reset rule isn't a GA legend, it's a pervasive theme through the industry). That attempt was unsuccessful, so the crew shut down the generator according to the rest of the checklist and fired up the APU (an extra generator normally used for power on the ground) to supply the left electrical network. Company confirmed that the situation was satisfactory to continue to Spain.

After they landed in Spain, an engineer signed off the situation as acceptable for a return flight, with a few provisions. The captain of the return flight knew about the #1 generator problem from a company message, from the deferral in the journey log and in person from the captain of the outbound flight. They complied with all the procedures required for the deferral and brought extra fuel to make up for needing to run the APU for the whole flight. It all sounds safe and normal.

Clunk is rarely a good sound in aviation, but an hour and a half after takeoff there was another one. This one was accompanied by a loss of power to the autopilot, the captain's displays, and most of the overhead panel. The remaining electrical power appears to have been mainly concentrated in the warnings that nothing else was working. They had also lost autothrust, flight director, and all radios, plus the flight control had degraded to alternate law, reducing the smartass quotient of the Airbus.

The first officer's basic flight display was working so he flew while the captain attempted unsuccessfully to restore electrical power. They considered diverting but were concerned that without radios their actions could be interpreted as hostile, plus they already had weather information for Bristol and knew it was good there.

The captain managed to program the landing into the FMS and the airplane followed that profile. They tried to call ATC on two different cellphones, but were unsuccessful. They weren't sure what systems they would have operative for the landing. The flaps worked normally, but the landing gear didn't, until they used the emergency extension procedure, which works by gravity. Gravity is one of the few things in aviation that is always reliable. So it goes.

They landed safely and taxied to parking, where the engines wouldn't shut down using the normal method, so they used the fire switches. The APU continued to run after engine shutdown and the report doesn't mention how they shut it off, just that maintenance were subsequently unable to use the APU for electrical power.

There is plenty of interesting analysis in the report, explaining why things went wrong when there were backups still functioning. For example why didn't the landing gear extend? The Blue hydraulic system was affected by the failure, but the Green hydraulic system that normally operates the landing gear should not have been. However, the A319 cuts off the hydraulic supply to the gear at calibrated airspeeds above 260 knots, as reported by the #1 and #3 ADIRU (Air Data and Inertial Reference Unit) computers. Both were offline. No airspeed data, no gear. That's reasonable. That's the sort of thing manual backups are designed to circumvent.

There are three radio systems onboard, one for the captain, one for the FO and one for the jumpseat. If either pilot's audio control panel fails, there is a switch that allows them to use the jumpseat panel instead. Except that this aircraft had upgraded digital audio management units, and both audio cards in all three AMUs depended on power from the same inoperative bus bar. Oops. Airbus says it is "evaluating" if that power supply needs to be modified. I'll bet.

With all the lights out on the button panel, the captain couldn't tell which buttons were pushed and which were unpushed. Apparently there is a one to two millimetre difference between a button been selected and not selected. I wonder if his inability to restore power may have been related to an incorrect configuration that he couldn't see. That's what I like about old fashioned toggle switches: you don't even have to look at them, just put your finger on them, and you know what is selected.

It's also interesting to read about the incident from the point of view of ATC. The controller working the flight saw the airplane disappear from both his radar screens, as a result of the loss of power to the transponder, and when he couldn't make radio contact, "feared that it might have suffered a catastrophic event." ATC asked another aircplane to call it on company frequency, and then to descend out of its path. Just in time, too, as the other flight reported seeing the missing airplane pass overhead without appearing on TCAS. When the crew of the incident airplane selected 7700 on the second transponder they weren't sure if it was working, but it was, so ATC could see that it was descending on course, and Bristol was cleared of other traffic for their arrival.

There's lots more juicy stuff in this report, especially for you electrical fans, but most of it is readable without an extensive knowledge of aviation. Just note the Airbus abbreviation glossary at the beginning.