At 9.32 am on August 4, the passengers on Air India flight AI2379 were two hours into a routine journey from Phuket to Delhi. The aircraft was cruising at 36,000 feet and the seat belt signs were off.
Then the aircraft climbed 372 feet above its assigned altitude and fell 292 feet below it. Twenty-four of the 145 people on board were hurt, four of them seriously. The Aircraft Accident Investigation Bureau's damage inventory records cracked ceiling panels across at least a dozen rows, two overhead bin doors dislodged from their hinges, broken handrails, a broken emergency exit handle, a bent crew seat and a lavatory commode uprooted from its mounting.
A 664-foot change in height is not unusual. An aircraft descending loses that much in under a minute. What made this instance different was the speed of it, and the fact that the aircraft went up before it went down. Passengers who were not strapped in were lifted out of their seats and then thrown into the ceiling.
Capt Sharath Panicker, a former Dreamliner pilot, told HT that when the autopilot disconnected, it's likely that the aircraft's two elevators — the hinged panels on the tailplane that tilt the nose up or down — were at different positions, and the mismatch pitched the nose up. That climb triggered a stall warning. Recovering from a stall requires pushing the sidestick forward to lower the nose. According to Panicker, the first push would have produced no aircraft response while the systems were resetting. The second, probably harder, would have produced the negative-g manoeuvre that threw everyone unbelted into the ceiling.
{{/usCountry}}Capt Sharath Panicker, a former Dreamliner pilot, told HT that when the autopilot disconnected, it's likely that the aircraft's two elevators — the hinged panels on the tailplane that tilt the nose up or down — were at different positions, and the mismatch pitched the nose up. That climb triggered a stall warning. Recovering from a stall requires pushing the sidestick forward to lower the nose. According to Panicker, the first push would have produced no aircraft response while the systems were resetting. The second, probably harder, would have produced the negative-g manoeuvre that threw everyone unbelted into the ceiling.
{{/usCountry}}While that was Panicker's reading, the AAIB's preliminary report, released on Friday, describes only what the recorders captured.
The assumption
At 04:02:43 UTC the flight-control system detected the loss of the green hydraulic system. Four seconds later it detected the loss of the blue and the yellow. The autopilot dropped out a second after that. Blue came back at 04:02:52, with yellow and green following within seconds.
A hydraulic system uses pressurised fluid to multiply force. A small movement of the pilot's controls is converted into enough power to move heavy parts that resist being moved — on an aircraft in cruise, the airflow over the wings and tail is far too strong for a person to push a control surface against. Fluid held at about 3,000 pounds per square inch is pumped through sealed circuits to jacks that do that pushing. On the A320, the systems also drive the landing gear, the brakes and the wing flaps. Without hydraulic pressure, none of them can be moved.
An Airbus A320 has three hydraulic systems, and that number is how the manufacturer meets the certification rules.
Airworthiness rules in Europe and the US require that a failure severe enough to be catastrophic must be, in the regulator's phrase, extremely improbable — a probability the US Federal Aviation Administration puts at roughly one in a billion per flight hour. It must also not be capable of arising from any single failure.
No component is that reliable. The number is reached by multiplication. If one hydraulic system might fail once in a thousand flight hours, three of them failing together works out at one in a billion, but only if the three failures are unrelated to one another.
So the A320's three systems are kept apart by design. Each has its own reservoir, and hydraulic fluid is never transferred between them. Green is pressurised by a pump on the left engine, yellow by a pump on the right engine, and blue by an electric pump. Each elevator and each aileron is driven by two jacks fed from different systems, so that losing one circuit still leaves the surface powered. It is built on the expectation that no single problem can reach all three.
How the assumption has been broken
That expectation — that no one failure can reach all three systems — has been breached before, in cases that are among the most closely studied in aviation.
In July 1989, a fan disc on the tail-mounted engine of a United Airlines DC-10 came apart over Iowa. The debris cut all three hydraulic lines where they converged in the tail. The crew flew the aircraft to Sioux City using engine thrust alone.
In August 1985, a Japan Air Lines Boeing 747's rear pressure bulkhead ruptured, taking much of the vertical fin with it and severing all four hydraulic systems.
In November 2003, a missile struck the wing of a DHL A300 climbing out of Baghdad, and fire and damage cost the crew all three systems; they landed on differential thrust with no injuries.
Each of these defeated redundancy the same way. A single physical event reached lines that were separate by design but close together in the airframe. Investigators could point to the disc, the bulkhead and the missile, and in each case the systems stayed lost.
Manufacturers and regulators responded. Hydraulic routing was separated further and fitted with fuses. Later aircraft were designed so that no single uncontained engine failure could sever more than one system.
Why AI2379 is not part of that pattern
No such physical event — nothing that broke apart, ruptured or struck the airframe — happened to VT-EXO. The AAIB records that neither the crew nor air traffic control reported adverse weather. The aircraft flew on to Delhi under its own power and taxied to the bay.
Blue came back within nine seconds of the first indication, and the other two within seconds of that. Hydraulic fluid that has been lost does not return.
The absence of a physical cause, combined with full recovery within seconds, makes the event hard to place. On the publicly available record of accident investigations, there does not appear to be a close precedent on the A320 family or on any comparable modern airliner. Several pilots have described it as extremely rare. Whether it is unprecedented is not known because a manufacturer's own service history is not public.
What investigators are looking for
Airbus's own early assessment of the event, reported by Reuters on August 14, is more specific.
During the sequence, according to that assessment, the pilots were unable to use the elevators and ailerons for about four seconds, and the co-pilot's full nose-down input drew no direct response. Airbus asked Air India to test the hydraulic systems and the pressure sensors and switches that monitor them, to remove some sensors for inspection, and said further checks of the wiring might be needed. It also found the aircraft had experienced forces above specified limits and asked for a structural inspection.
Sensors, switches and wiring sit on that list alongside the hydraulic systems. On a fly-by-wire aircraft, a hydraulic system includes the chain of instruments that tells the flight-control computers what the pressure is, and those computers reconfigure the aircraft's handling on the basis of what they are told. (A fly-by-wire aircraft is one where the pilot's sidestick sends an electrical signal to a computer, which then decides how far to move the control surfaces, rather than being connected to them by cables)
Whether pressure was lost or only registered as lost is a distinction the investigation will have to settle. The autopilot disconnected a second after the second and third systems were flagged.
The AAIB report is silent on all of this. It notes that hydraulic components and fluid samples have gone to its headquarters for testing, that Airbus experts inspected the aircraft between August 13 and 15, and that records are being scrutinised. It offers no hypothesis and, on the hydraulics, no interim safety recommendation.
What is not known
The aircraft had been dispatched from Phuket under a minimum equipment list item, invoked a week earlier on July 28, covering an inoperative power transfer unit — an auxiliary unit that lets one of the green and yellow systems pressurise the other when their pressures diverge. The AAIB records this and draws no connection to what followed.
A second Air India A320 aborted take-off at Bangkok on August 13 after the crew detected a hydraulic malfunction. Investigators have not linked the two, and a fault caught on the ground is a different thing from a fault at cruise.
The final report will have to say whether the three systems failed independently of one another or whether something connected them on August 4 — and if something did, what it was. As of now, no airworthiness directive arising from this incident has gone to the more than 11,000 A320-family aircraft flying worldwide, around 500 of them in India. The AAIB has said the final report will be published in due course.