# Why is powering on the APU so low on the A320 emergency checklist?

In the movie Sully we have this section of dialogue

He wasn't following proper procedure at all. And I know because I had the QRH in my hands. He switched on the APU immediately after engine blowback. According to the Airbus that's the 15th thing on the list to do. 15th! If he had followed the damn rules, we'd all be dead.

Now, another question discusses the importance of the APU to the crash, but my question is, why is it so far down the list? I suspect the above is dramatized somewhat, but it does seem odd that it's so low. What does Airbus consider more important in their handbook?

• Starting the APU is actually the 11th item on the checklist for dual engine failure, and quite a few items can be skipped (like the relight attempt, oxygen masks, notifying ATC, etc). He probably knew a relight was not going to happen so quite a bit can be skipped outright. – Ron Beyer Dec 30 '17 at 5:23
• Here are the excerpts from the QRH for the A320, dual engine failure. – Ron Beyer Dec 30 '17 at 5:31
• It's not particularly an error on Airbus' part, if it is before the oxygen mask stuff, and that failure happened at high altitude, then there's a risk of hypoxia. This is where memory items and training and common sense come in. Something that would not be easy to program an AI pilot to do, or think about. (A mere comment.) – ymb1 Dec 30 '17 at 11:33
• @MichaelKjörling Sully seemed very accurate on the terminology aspect. It wasn't Star Trek, where the names are made up, and the points don't matter. – Machavity Dec 30 '17 at 16:47
• @ymb1 It would probably be fairly easy to make separate checklists for, say, dual engine failure below 10,000 ft (where supplemental oxygen is unnecessary even for extended periods) and dual engine failure above 10,000 ft (where supplemental oxygen starts to become needed, depending on duration of operations, but you're able to glide farther). I guess I personally hope that Airbus will respond by making such checklists, plus one specifically for dual engine failure during early climbout; possibly by renaming the existing one "dual engine failure above 10,000 ft" or some such. – a CVn Dec 30 '17 at 16:59

All-engine-failure in airliners is very very unlikely. It is a function of number of engines - in a four-engined aeroplane, the chance of all four engines failing is assumed to be super extremely incredibly unlikely. With a statistical failure rate of 10$^{-5}$ per flying hour per engine, a four-engined aeroplane would experience all engine failure due to statistical causes once in $\frac{10^{20}}{24}$ flying hours1: a billion times a billion times four. So very uncommon that the only practical consideration would be a common mode failure from external causes, such as the volcanic ash cloud.
For a twin-engine like the A320, chance of all engine failure due to random causes is 2 * 10$^{-10}$, still considered an Extremely Unlikely event. Procedures are written for the least unlikely events, and updated according to events that actually happened. Now that a dual engine failure during take-off has actually happened, updating the procedures will be the result of failure analyses: how likely would it be to happen again, or what other procedures can be put in place to avoid this situation.
1: The chance that any of four engines fails is 4 * 10$^{-5}$ per flying hour. Then 3 * 10$^{-5}$ per flying hour for the remaining engines etc.