Abnormal III: Dual Bleed Failure and the QRH

One failed bleed borrows air across the crossbleed (article 09). Lose both and the lender of last resort is the APU — whose bleed lives inside an altitude envelope (article 04: closes climbing through 25 000 ft, returns descending through 23 000). The whole event therefore becomes an energy problem: descend first, connect the APU second, and if the APU cannot help, descend further. And the clock never stops — with no inflow the cabin leaks itself upward, which is why the procedure's very first line is a standing bail-out: at any time, if the excess-cabin-altitude alert triggers, fly that ECAM first.

1. The alert and its four-branch tree

Trigger, per FCOM PRO-ABN-AIR:

This alert triggers when both engine bleed supply systems are lost.

ECAM tells you how they were lost through sub-legends — LEFT LEAK, RIGHT LEAK, BLEED 1 NOT CLOSED, BLEED 2 NOT CLOSED — with a display rule worth knowing: Out of the four above-mentioned ECAM subtitles, only two are displayed, depending on the failure. The sub-legends are the routing signs for four branches (condensed from the FCOM procedure; hard-failure vocabulary per article 08 — a leak or an uncloseable overheating valve):

 AIR ENG 1+2 BLEED FAULT
 ├─ ① hard failures BOTH sides (any two sub-legends)
 │     → X BLEED CLOSE · both ENG BLEED OFF · APU BLEED OFF (if on)
 │     → DES TO FL 100/MEA-MORA · packs per stuck side · anti-ice off · AVOID ICING
 │     → MAX FL 100/MEA-MORA · APU BLEED — DO NOT USE · BLEED 1+2 PROC APPLY
 ├─ ② LEFT hard failure (LEFT LEAK or BLEED 1 NOT CLOSED)
 │     → X BLEED CLOSE · ENG 2 BLEED OFF THEN ON (revive the healthy side)
 │     → if unsuccessful: both OFF → FL 100 → … → APU BLEED — DO NOT USE
 ├─ ③ RIGHT hard failure (RIGHT LEAK or BLEED 2 NOT CLOSED)
 │     → X BLEED CLOSE · ENG 1 BLEED OFF THEN ON
 │     → if unsuccessful: both OFF · APU START · descend
 │     → APU available: WHEN BELOW FL 220 AND APU AVAIL → APU BLEED ON · MAX FL 220
 │     → APU not available: MAX FL 100/MEA-MORA · APU BLEED — DO NOT USE
 └─ ④ everything else (no sub-legend — "soft" double failure)
       → X BLEED AUTO · ENG 1 then ENG 2 BLEED OFF THEN ON (double reset)
       → if unsuccessful: both OFF · APU START · PACK 2 OFF · the FL 220 / FL 100 fork as in ③

Three keys unlock the tree.

Key 1 — the left/right asymmetry is APU-corridor geography. The APU delivers into the left half of the network (articles 04, 06, 08). A left-side leak or stuck-open valve means any APU air would pour straight onto the casualty — so branches ① and ② carry the stark line APU BLEED — DO NOT USE, and the aircraft settles at FL 100. A right-side hard failure is different: close the crossbleed and the right half is amputated; the left half is clean pipework, the APU may feed it, and the operating ceiling improves to FL 220. In one sentence: left-side damage locks the APU out; right-side damage leaves the APU a lane.

Key 2 — the crossbleed decision is the same contagion test as ever. Hard failures (leak / valve stuck open — the exportable diseases of article 08's CLOSE list) → X BLEED CLOSE. The no-sub-legend branch ④ — two independent parameter failures, nothing contagious — sets X BLEED AUTO, deliberately, so that when the APU comes on line the AUTO logic can open the valve for it (article 04).

Key 3 — resets go only to the innocent. Branches ② and ③ apply OFF THEN ON solely to the side without a sub-legend; branch ④ resets both. A side wearing LEAK or NOT CLOSED never gets a revival attempt — article 09's first principle (physics does not reset) applied under pressure.

The common tail for branches ③/④, assembled from the procedure: anti-ice surrendered (automatic-mode selector where fitted, and wing anti-ice off — two dead bleeds cannot heat two wings) with AVOID ICING CONDITIONS and, under severe accretion, the familiar MIN SPD VLS +10 / G DOT floor with MANEUVER WITH CARE; a pack sacrificed where a stuck-open overheating side demands it (branch ①/②/③ per side) or as APU-capacity rationing (branch ④'s PACK 2 OFF — one APU source, one pack); and the handover line BLEED 1+2 PROC — APPLY, which is the bridge to section 2. STATUS consolidates the ceiling — MAX FL 220 with APU bleed on, MAX FL 100/MEA-MORA without — plus the icing lines and an inoperative-systems list (both engine bleeds, wing anti-ice, affected packs, APU bleed if unavailable).

[!warning]- Where do FL 220 and FL 100 come from? Neither number is arbitrary. FL 220 sits just under the APU-bleed return boundary (23 000 ft descending) — an operating ceiling with margin, low enough that a momentary excursion does not disconnect the cabin's only air source. FL 100 / MEA-MORA is the no-pressurisation survival floor: breathable without supplemental oxygen, terrain-checked by minimum en-route altitudes. Read them as the floor the APU can keep the cabin alive at versus the floor people can keep themselves alive at.

2. The QRH pair: what happens after the ECAM is finished

The follow-on cards exist because the ECAM stops at "stabilised" — and a crew then faces hours of cruise with a question the ECAM does not answer: can any engine bleed be won back? The FCOM states each card's entry condition verbatim. Per FCOM PRO-ABN-AIR:

Apply this procedure when both engine bleed supply systems are failed at the end of the AIR ENG 1+2 BLEED FAULT ECAM procedure and if the APU bleed supplies the aircraft.

Apply this procedure when both engine bleed supply systems are failed at the end of the AIR ENG 1+2 BLEED FAULT ECAM procedure and if the APU bleed is NOT available to supply the aircraft.

Two cards, sorted by whether the APU is carrying the cabin. Both open with the same three fixtures: the standing EXCESS CAB ALT bail-out; the ceiling (MONITOR CABIN PRESSURE / MAX FL: 220 on the with-APU card; MAX FL: 100 / MEA-MORA on the without-APU card) with AVOID ICING CONDITIONS; and a small button with a big job — RCL pb — PRESS, explained on the card:

This action enables to recover the subtitle (if any) associated with the AIR ENG 1+2 BLEED FAULT alert.

During the ECAM phase the sub-legend may have been cleared from the screen — and the entire recovery strategy branches on that sub-legend. RCL retrieves the patient's chart before prescribing. Skip it and every subsequent branch is a guess.

With APU bleed supplying (the "grand reset" card). For the benign case — no sub-legend, and the loss not due to engine fire nor a start-valve stuck open — the card attempts full restoration in a precise order: PACK 1 ON, PACK 2 ON, ENG 1 BLEED ON, ENG 2 BLEED ON, APU BLEED OFF. That last step first-principle: while APU air fills the manifold, the engine bleed valves are held closed by protocol (article 02's closure inventory) — switching the APU off is what gives the engines room to come back; the packs go on beforehand so the network has a load and success shows immediately. If no engine bleed recovers: APU BLEED back ON, and the survivable configuration is trimmed — if PACK 1 is available, PACK 2 OFF and both engine bleeds OFF, with WING A.ICE NOT AVAILABLE standing over the rest of the flight. For a right-side hard failure (or engine-2 fire / start-valve case) the card tries only the left: PACK 1 ON, ENG 1 BLEED ON, APU BLEED OFF; failure reverts to APU care. Notice what this card conspicuously lacks — a left-side hard-failure branch. It cannot occur here: left-side damage forbade the APU (Key 1), so such a crew is holding the other card.

Without APU bleed (the survival card). The same grand reset is attempted where legal (the entry filter adds one more disqualifier: nor APU leak fed by engine — the backflow case of article 08 means left-corridor plumbing is compromised). Its signature line, repeated at every dead end:

the condition line When CAB PR ΔP < 1 psi: followed by the action RAM AIR — ON.

Why wait for ΔP below 1 psi: the ram-air door opens the cabin to the outside. With several psi still bottled up, opening it vents outward — the flow reverses only once the cabin has drifted down near ambient. Depressurise first, then open the window. And the card's grimmest branch names its own verdict — for losses caused by any hard failure, engine fire, stuck-open start valve, or the fed-by-engine case:

NO ENGINE BLEED CAN BE RECOVERED

All four causes are physical (article 09's principle at maximum stakes): leaked, burnt, jammed or back-fed — nothing a pushbutton cycle can cure. The remainder of the flight is FL 100, ram-air ventilation, anti-ice unavailable.

3. The extreme cousin: all engines failed

Dual bleed failure's darkest relative is the all-engine flame-out — where APU bleed stops being a comfort item and becomes the crank handle. Three FCTM facts complete this chapter's view of it. First, the preference order — per FCTM PR-AEP-ENG, the [QRH] ALL ENG FAIL procedure promotes the Windmill relight for all altitudes of the certified relight envelope. — windmilling asks nothing of aircraft systems and relights all engines simultaneously. Second, the fallback and its gate:

However, below FL 200, the flight crew can attempt a starter assisted relight of one engine at a time, if: ‐ None of the engines relight after windmill relight attempts, and ‐ The APU bleed air is available.

FL 200 dovetails with the APU-bleed return envelope, and the aircraft is slowed below optimum windmill speed toward green dot so the FADEC runs a ground-style assisted start. Third, the reason the procedure says one at a time — in the FCTM's own words:

The APU cannot provide sufficient bleed to relight two engines at the same time. Therefore, during the sequence of a starter assisted relight, both master levers must NOT be in the ON position at the same time.

Article 04's demand-following supply has a ceiling, and one starter consumes all of it. The cadence around each attempt: monitor N3 and EGT for at least 30 seconds (which doubles as the combustion-chamber ventilation time before re-trying the same engine; the opposite engine, already ventilated, may be tried immediately). And if relight is off the table, the APU still earns its keep — start it below FL 250 for electrics, use its bleed below FL 200 to restore cabin pressurisation for the drift-down. One general principle from the same FCTM section rounds off the chapter's engine-bleed relationship: even a misbehaving engine at idle still powers the hydraulic, electric, and bleed systems — keep it running unless a procedure demands otherwise.

Self-test

[!note]- Q1. For each of the four branches: crossbleed position, which side (if any) gets a reset, and the APU's fate.

① Both sides hard-failed: X CLOSE, no resets, APU BLEED DO NOT USE, FL 100. ② Left hard failure: X CLOSE, reset attempt on engine 2 only, APU forbidden, FL 100 if the reset fails. ③ Right hard failure: X CLOSE, reset on engine 1 only; APU START, and below FL 220 with APU available, APU BLEED ON — MAX FL 220 (without it, FL 100 and DO NOT USE). ④ No sub-legend: X AUTO, both sides reset in turn; failing that, APU as in ③ with PACK 2 OFF.

[!note]- Q2. Why does left-side damage lock the APU out while right-side damage leaves it usable?

The APU's delivery corridor is the left half of the network. Left-side leaks or stuck-open valves would be fed directly by APU air. A right-side casualty is amputated by closing the crossbleed, leaving clean left-half pipework for the APU — hence FL 220 instead of FL 100.

[!note]- Q3. Justify FL 220 and FL 100 physically.

FL 220 sits just below the APU-bleed descent-return boundary (23 000 ft) — the highest level at which the cabin's only air source stays reliably connected, with margin. FL 100/MEA-MORA is the unpressurised survival floor: breathable air, terrain-safe altitudes.

[!note]- Q4. What exactly does the RCL press recover, and why is it the first act of both QRH cards?

The sub-legend(s) attached to the original alert, possibly cleared during ECAM handling. Every recovery branch on both cards keys on that sub-legend — retrieving the chart precedes prescribing.

[!note]- Q5. On the with-APU card, why does the grand reset switch APU BLEED OFF before expecting the engine bleeds back?

With APU air in the manifold, protocol holds the engine bleed valves closed. Removing the APU supply releases them to open; the packs are switched on first so success or failure shows immediately under load.

[!note]- Q6. List the four causes behind NO ENGINE BLEED CAN BE RECOVERED and the principle they share.

Hard bleed failure (any LEAK/NOT CLOSED sub-legend), engine fire, start valve failed open, APU leak fed by engine. All are physical failures — leaked, burnt, jammed, back-fed — and physics does not reset.

[!note]- Q7. Why must ram air wait for ΔP < 1 psi, and why is the assisted relight one-engine-at-a-time below FL 200?

The ram-air door vents outward while the cabin still holds pressure; only near ambient does fresh air flow in — depressurise first, then open the window. The APU cannot make enough bleed for two starters; both master levers must never be ON together, with ≥30 s of N3/EGT monitoring per attempt (which is also the ventilation interval).

Key takeaways

References

Alert trigger, sub-legend display rule, all four branch procedures with their crossbleed selections, reset assignments, APU instructions (START / BLEED ON below FL 220 / DO NOT USE), descent and MAX FL lines, anti-ice and pack actions, the severe-icing speed floor and the STATUS consolidation per FCOM PRO-ABN-AIR (AIR ENG 1+2 BLEED FAULT). Both follow-on cards' entry conditions, standing EXCESS CAB ALT precedence, ceilings, the RCL recovery note, the grand-reset sequences, the ram-air ΔP condition and the NO ENGINE BLEED CAN BE RECOVERED verdict per the same chapter's [QRH] BLEED 1+2 FAULT procedures (APU BLEED ON / APU BLEED NOT AVAILABLE variants, as published for one representative operator's airframe). APU envelope and corridor geography per FCOM DSC-49-10-20 and articles 04/06/08. Windmill preference, the FL 200 / one-at-a-time starter-assisted relight constraint with the 30 s monitoring-and-ventilation cadence, APU electrical/pressurisation recovery altitudes and the keep-it-running principle per FCTM PR-AEP-ENG. The branch tree and the two-card comparison table are integrative syntheses of the referenced procedures.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.