The Manhattan Power Room That Blinded the FAA (1991)

On the afternoon of Tuesday, September 17, 1991, during the peak arrival window for the Northeast corridor, a systemic failure struck the heart of New York's aviation infrastructure. Simultaneously, air traffic controllers at the regional radar center and the towers at John F. Kennedy (JFK), LaGuardia (LGA), and Newark (EWR) lost:

• Radar feeds
• Primary radio communications
• Automated flight-handoff systems

With aircraft converging on three major hubs, controllers were forced to rely on manual tower-to-tower relays and short-range backup frequencies. The FAA responded by halting traffic, resulting in 1,174 flights being either delayed or canceled.

The Single Point of Failure: 33 Thomas Street

Surprisingly, the failure did not occur at the airports. Instead, the culprit was a 29-story, windowless granite monolith in Lower Manhattan: 33 Thomas Street, an AT&T switching hub. Every primary and backup FAA landline for the New York metro area routed through transmission bays powered by the building's 20th-floor DC power room.

The Sequence of Events

The crisis began more than six hours before the systems crashed. Under a voluntary peak-load power-sharing agreement, Consolidated Edison (Con Ed) requested that AT&T's Building Operations Group shift off the commercial grid for the day.

The relay had been misadjusted during a recent modernization of the plant, making it hypersensitive to the spike.

The Physics of the Failure

In a central office DC power plant, the rectifiers and battery strings are configured in parallel across the main busbars.

$\text{Operating Voltage} \approx -48\text{V DC}$

Under standard conditions, the rectifiers maintain the bus voltage slightly above the resting voltage of the lead-acid cells. This ensures the batteries remain fully charged while providing the necessary current for the switching bays.

When the rectifiers failed at 10:10 a.m., the following occurred:

1. The bus voltage dropped slightly to the battery plateau.
2. Because the voltage remained steady, no circuits dropped.
3. The high-capacity DS3 (45-megabit T3) fiber and coaxial transmission bays continued to function.

The system failed immediately. $\rightarrow$ The system entered a "silent" failure mode.

The FAA's New York Terminal Radar Approach Control (TRACON) in Hempstead, along with the three major airport towers, continued to operate normally—powered entirely by a lead-acid battery reserve that had begun a six-and-a-half-hour countdown to depletion.

The "Four Broken Links" in the Alarm Path

For a battery reserve to be effective, it must provide enough time for a human to intervene. However, the notification path from the 20th-floor rectifiers to the operators was severed at four distinct points.

1. The Burned-Out Indicator Lamp

A local indicator bulb designed to signal the fault was dead. Because there was no lamp-supervision check or pre-transfer test, the bulb remained dark during the fault, appearing identical to a "normal" state.

• Note: A technician walking the floor would have seen a POWER alarm, but no one performed a floor walk until the evening shift.

2. The Missing 25-Inch Jumper Strap

On the 14th floor, a critical 25-inch metal strap was missing from the alarm control base, which neutralized the secondary alarm circuit.

# Conceptual logic of the alarm failure
if strap_present == False:
    fault_current = 0 
    status = "NORMAL" # The monitoring panel treats silence as health

According to the FCC Common Carrier Bureau, this alarm had not been inspected since June 1990. Because the wire only carried current during a fault, the missing strap created an electrical state indistinguishable from a healthy plant.

3. The Mechanically Clamped Bell

Even with the lamp dead and the strap missing, a local audible bell on the 14th floor did receive current. However, as reported in a September 20 briefing, the bell had been mechanically clamped, rendering it silent.

4. [Pending/Incomplete]

(The provided text ends here, but the failure path required four links to be broken for the disaster to occur.)

Summary Checklist of Failures

• Misadjusted overload relay
• Burned-out indicator bulb
• Lack of lamp-supervision protocols
• Missing 25-inch jumper strap (unchecked for 15 months)
• Mechanically silenced alarm bell