Three Independent Hydraulic Systems on an Air India Jet Failed in Four Seconds

An Air India Airbus A320 cruising from Phuket to Delhi as flight AI-2379 lost pressure in all three of its hydraulic systems within four seconds, then landed safely in Delhi anyway. The Aircraft Accident Investigation Bureau's preliminary report states that at 04:02:43 UTC, while cruising at Flight Level 360, the aircraft's flight control system detected the loss of the Green hydraulic system, and that four seconds later, at 04:02:47 UTC, the same system detected the loss of the Blue and Yellow hydraulic systems too, with the autopilot disengaging a second after that. Read quickly, this is a story with a clean ending: something rare happened at 36,000 feet, the crew handled it, and everyone reached Delhi alive.

It is worth slowing down on that ending. An Airbus A320's three hydraulic systems are not a loose backup arrangement. They are built specifically so that this exact failure cannot happen. The AAIB preliminary report explains that hydraulic fluid cannot be transferred from one system to another and that each system has its own reservoir, precisely so a fault in one cannot physically reach the others. Yet Green, Blue and Yellow all went dark within four seconds of each other. The redundancy did its job in the sense that the crew brought the aircraft down safely, but it failed in the sense that the one failure mode the architecture exists to rule out is exactly the one that happened.

The design meant to make this near impossible

Three separate reservoirs, three separate sets of lines, no shared fluid. That is the whole logic of the A320's hydraulic architecture, and it is why a single leak, pump failure or contamination event is not supposed to be able to take down more than one system at a time. This is not just engineering house style; it is a regulatory floor. The FAA's certification standard for aircraft like the A320 requires that any catastrophic failure condition be designed so that it is extremely improbable and does not result from a single failure. The standard defines "extremely improbable" as an average probability per flight hour on the order of one in a billion. A triple hydraulic loss inside four seconds sits squarely in the category that threshold exists to rule out. The single deliberate exception sits between two of the three. The AAIB preliminary report explains that the Power Transfer Unit is an auxiliary pressure supply for either the Green or Yellow system, without transfer of fluid between the two, and that it operates automatically whenever a 500 psi pressure delta opens between them. It is a pressure link, not a plumbing one, and it touches only two of the three systems. Blue has no such connection to either.

A defect the airline had been flying with for a week

The AAIB preliminary report states that the aircraft, registration VT-EXO, was dispatched from Phuket under a Minimum Equipment List entry for the Power Transfer Unit, first invoked on 28 July 2026, seven days before the accident. Airlines dispatch aircraft with specific defects deferred under an MEL constantly, on the premise that redundancy elsewhere in the design covers the gap. That premise is exactly what this flight tested. The preliminary report does not say the deferred PTU caused the triple failure, and on the facts available it could not fully explain it either: the PTU links Green and Yellow, never Blue, which failed in the same four seconds as Yellow. Whatever knocked out all three systems together, the one component with a known link to two of them had already been flagged as degraded when the aircraft left Phuket.

The honest objection

The strongest case against reading much into the MEL entry is that a deferred Power Transfer Unit is routine, not remarkable, and mechanically beside the point. The PTU is an auxiliary pressure supply, not a structural bridge between the three systems, and losing it does not, on paper, make Green, Blue and Yellow more likely to fail together, since fluid still cannot move between any of them. On that reading, the MEL entry is a coincidence of timing, and the real trigger is something else entirely that the preliminary report has not yet identified.

That case holds up mechanically. It does not explain why Green failed, then Blue and Yellow failed four seconds later. A single component failing on its own accounts for one system going down, not three in the time it takes to read this sentence aloud. The preliminary report, true to its name, does not yet name a common cause. That gap, more than the MEL entry on its own, is the actual finding: the redundancy built to make a triple failure a near-statistical impossibility failed anyway, and as of this report, nobody outside the investigation has said why.

What it looked like from the cabin

The cockpit had almost no time to orient. Three seconds after the autopilot disengaged, at 04:02:51 UTC, a stall warning triggered for two seconds; the Co-Pilot, the Pilot Flying, responded before the Pilot-in-Command took over the controls.

For the people onboard, the failure showed up as altitude, not paperwork. The AAIB preliminary report states that the aircraft, no longer under autopilot control, first climbed 372 feet above its assigned Flight Level 360 and then fell 292 feet below it during the event.

On the ground in Delhi, the AAIB preliminary report states that of the 145 people onboard, 24 (20 passengers and 4 cabin crew) required medical assistance on arrival and 4 were hospitalised with serious injuries. The bureau reclassified the occurrence from a turbulence report to an accident.

The captain, the report and the same-day firing

A second finding in the same document has nothing to do with hydraulics. The AAIB preliminary report states that post-flight testing found the Pilot-in-Command's psychoactive-substance screening non-negative, confirmed by a follow-up laboratory blood test, while the Co-Pilot tested negative on both. The AAIB recommends that DGCA take priority action to prevent abuse of psychoactive substances among flight crew, calling the confirmed result a serious concern. Air India terminated the captain's employment with immediate effect the same day the preliminary report was published, citing, in a statement reported by the Free Press Journal, its zero-tolerance policy on safety and regulatory violations. On the human finding, the report reached a conclusion firm enough to end a career the same day it published. The mechanical finding has produced no such conclusion yet.

A pattern of scrutiny, not an isolated flight

Air India's safety record has been under escalating, formal scrutiny since the middle of 2025. The airline under that scrutiny has also changed hands structurally: Singapore Airlines has held a 25.1% stake in Air India since the Air India-Vistara merger completed in November 2024, with Tata Sons retaining the controlling stake.

Sources: Newsonair, All India Radio's News Services Division, reporting the DGCA directive; The Tribune, citing sources on the DGCA's show-cause notice and audit request; The Tribune, reporting the Ministry's Rajya Sabha reply; Free Press Journal, reporting Air India's statement.

Within a day of the fatal AI171 crash in Ahmedabad in June 2025, DGCA ordered enhanced, fleet-wide safety inspections of Air India's Boeing 787 aircraft, covering fuel-parameter monitoring, engine-control systems and flight-control checks. That same month, DGCA issued Air India a show-cause notice over flight-duty time limitation violations and ordered the removal of three senior officials over lapses; a follow-up email seeking the airline's full 2024-25 inspection and audit record arrived the next day. In the six months that followed, the Civil Aviation Ministry told the Rajya Sabha, Air India had been issued nine show-cause notices over five identified safety violations. Against that backdrop, a preliminary report that both documents an unexplained mechanical failure and moves fast enough to end a pilot's career the same day is not an anomaly for this airline. It is close to the pattern.

The Signal

Two separate findings sit inside one preliminary report, and only one of them has an assigned cause. Investigators can already say, with confidence, that a pilot's drug screening came back non-negative, and Air India acted on that finding within a day of the report's publication. Investigators cannot yet say why an aircraft engineered so that a fault in one hydraulic system cannot reach another lost all three within four seconds anyway. A fuller report presumably will. Until it does, the number worth holding onto is not the injury count from the cabin, the altitude the jet swung through, or the show-cause tally regulators have kept since 2025. It is four: the seconds between an aircraft's first hydraulic warning and the loss of everything the redundancy was designed to keep it from losing at once.

Reporting basis: the hydraulic failure sequence, the stall warning, the architecture of the A320's three independent systems, the Power Transfer Unit's function, the Minimum Equipment List entry, the altitude upset, the onboard injury count and reclassification, the flight crew's drug test results and the AAIB's recommendation to DGCA are all from the Aircraft Accident Investigation Bureau's preliminary report on VT-EXO, a single primary source. The certification standard behind "extremely improbable" is per the FAA's Advisory Circular 25.1309-1B. Air India's termination of the captain is per the airline's own statement, as reported by the Free Press Journal. The nine show-cause notices are per the Civil Aviation Ministry's written reply to the Rajya Sabha, as reported by The Tribune. The DGCA's fleet-wide Boeing 787 inspection order following the AI171 crash is per Newsonair, All India Radio's News Services Division. The FDTL show-cause notice and the removal of three senior officials are per The Tribune, citing sources. Singapore Airlines' 25.1% stake in Air India is per its own statement, as reported by Business Standard. No figure in this piece is calculated; every number is as stated in its source.