Dual Hydraulic Failure: Flying with Limited Control

Imagine losing two of your aircraft's three hydraulic systems simultaneously. Your autopilot disconnects, flight controls change behavior, and landing becomes a complex manual operation requiring precise technique. While dual hydraulic failures are rare, they represent one of the most challenging scenarios you'll face as a pilot. Understanding how these failures affect your aircraft—and how to manage them safely—could make the difference between a successful landing and a catastrophic outcome.

How Hydraulic Systems Work Together

The A320/A321 operates three independent hydraulic systems—green, yellow, and blue—each pressurized to 3000 PSI, powering different flight controls and systems. This redundancy ensures that losing one system doesn't compromise flight safety. However, when two systems fail simultaneously, the aircraft's capabilities change dramatically.

Each system has specific responsibilities: Green powers the landing gear operation, slats and flaps, left elevator, some spoilers, and normal braking; Yellow drives the flaps, right elevator, and other spoilers; Blue provides the slats, backup elevator control, and emergency power through the RAT (Ram Air Turbine). When two systems fail, you lose significant control authority and must adapt your flying technique accordingly.

The Power Transfer Unit (PTU) typically assists by enabling one system to pressurize another (between yellow and green) when pressure differences exceed 500 PSI. However, this backup becomes irrelevant during dual failures—you operate on whatever system remains functional.

Managing Power Distribution and System Priorities

Understanding which combination of systems failed determines your aircraft's remaining capabilities. The three possible dual failure scenarios each present unique challenges:

Green + Blue Failure (Yellow Remaining): You retain the right elevator, some spoilers, and the flaps. However, you lose the left elevator, reducing pitch control authority. Normal braking becomes unavailable, forcing reliance on alternate braking. The autopilot disconnects immediately, and you'll fly in alternate law, transitioning to direct law when the landing gear extends. In summary, "Demanding when overweight."

Green + Yellow Failure (Blue Remaining): This scenario leaves you with limited elevator control through blue system backup, but you lose the stabilizer authority from both green and yellow systems. Landing gear must be extended using gravity extension procedures. Braking relies on yellow accumulator pressure, which provides limited stopping capability. In summary, "You need a very long landing distance."

Blue + Yellow Failure (Green Remaining): You maintain slats and flaps, normal braking, left elevator control, and some spoiler authority, but lose right elevator control. The RAT cannot deploy to provide emergency power since the blue system has failed. In summary: „If you have a choice, go with that one, you are still in normal law.”

When Things Go Wrong: Flight Characteristics and Handling

Once dual hydraulic failure occurs, your aircraft transforms from a highly automated, computer-controlled machine into one requiring constant manual input and careful energy management. The autopilot becomes unavailable immediately—there’s no getting it back. Flight director and autothrust remain functional, providing guidance and thrust management, but you're hand-flying from the moment of failure.

Flight control laws degrade significantly, except during HYD B+Y SYS LO PR. You'll initially operate in alternate law, which removes many of the normal protections while maintaining some computer assistance. However, when you extend the landing gear for approach, the system transitions to direct law—essentially giving you direct control over the flight controls with minimal computer intervention. This means no auto trim, no envelope protection, and control responses that feel different from normal operations.

The aircraft's handling characteristics change noticeably. Control inputs produce different responses than you're accustomed to. Some control surfaces become inoperative or operate in degraded modes, affecting roll and pitch authority. You must use smooth, deliberate control inputs to minimize hydraulic demand on the remaining system.

Operational Implications and Decision Making

The moment you experience dual hydraulic failure, declare MAYDAY to ATC. This isn't optional—you need priority handling and should land as soon as possible at a suitable airport. However, "as soon as possible" doesn't mean the nearest runway regardless of conditions. Avoid airports with poor equipment or marginal weather, even if ECAM displays "LAND ASAP" in red.

Your approach planning becomes critical. Complete all ECAM actions before beginning the approach—you don't want to run checklists while hand-flying a degraded aircraft on final approach. Carefully review the STATUS page to understand exactly which systems remain available and plan your approach sequence accordingly.

Landing gear extension requires gravity extension procedures in all dual hydraulic failure scenarios. The STATUS page will indicate when this becomes necessary, and you must follow (e)QRH procedures precisely.

Speed management becomes crucial. Use selected speeds on the FCU rather than managed speeds, as FMS predictions become unreliable with system failures. Maintain VAPP throughout the approach and aim for early stabilization. The aircraft will likely require a higher pitch attitude during approach, increasing tail strike risk during flare during HYD G+Y SYS LO PR.

Landing Phase Considerations

Your landing technique must adapt to the aircraft's degraded state. Braking capability depends on which systems failed—you might have alternate braking, accumulator pressure braking, or normal braking available. Anti-skid may or may not function, affecting your stopping performance calculations.

Depending on the aircraft type, nose wheel steering becomes unavailable in most dual failure scenarios, requiring directional control through rudder pedals and differential braking. This makes runway alignment critical during approach—you have limited ability to correct for drift after touchdown.

Reverse thrust availability varies by failure type. You might have reverse on one engine, both engines, or neither, depending on which hydraulic systems remain operational. Plan your landing distance calculations accordingly, and don't count on reverse thrust; you might not have it.

What This Means for You

Dual hydraulic failures test every aspect of your piloting skills—systems knowledge, manual flying ability, decision-making under pressure, and crew resource management. The key to success lies in understanding your aircraft's degraded capabilities and adapting your technique accordingly.

Remember that while these failures are complex and challenging, your A320/A321 remains flyable. The aircraft was designed with redundancy to handle such scenarios. Your job is to understand the limitations, fly within them, and execute a safe landing using the systems that remain available.

Practice these scenarios in the simulator regularly. The muscle memory and decision-making patterns you develop during training become invaluable when facing the real situation. Focus on smooth control inputs, energy management, and systematic execution of procedures rather than trying to rush through the emergency.

Most importantly, don't let the complexity overwhelm you. Take the situation step by step: secure the aircraft, complete ECAM actions, assess your capabilities, plan your approach, and execute with precision. Your training and the aircraft's remaining systems will see you through to a successful outcome.

The three A320 dual hydraulic failure combinations explained – what each scenario leaves you with, how flight control laws degrade, and what landing really looks like.