QF32

by Richard de Crespigny

  Matt looked at ECAM. There was nothing to report.

  During this time it was still a ‘sterile cockpit’ – no one talked unless required. Everyone was intensely focused on what they were doing and they didn’t want distractions. ECAM also supported this sterile cockpit. During take-off the ECAM – which collects inputs from 250,000 sensors around the plane – dynamically filters the information provided on screen to what is important during that phase. All ECAM warnings were ­inhibited during the take-off above 80 knots except those warnings that would have recommended I abort the take-off. Once we climbed through 1500 feet, with the runway well behind us and the risks subsiding, most of ECAM’s 1225 messages and checklists now became enabled.

  We were now climbing at 2000 feet per minute up to 10,000 feet, and while we were starting to relax there would be no idle chatter until we climbed through 20,000 feet. We were picking up speed, it was a beautiful day, and I was looking at the radar screen for a hint about the weather that lay ahead. The cabin crew wanted to start serving and I had to ensure we were clear of clouds, thunderstorms and turbulence before I could turn off the ‘seatbelts’ sign. The weather radar was clear and, as we passed through 7400 feet, I was sure the passengers would be thinking just how true the stories they had heard about the luxurious A380 were. The cabin was spacious, with comfortable seats and a fantastic video screen showing the aircraft with the ground streaking past below. And it was so quiet.

  At 10.01 am I was about to turn off the seatbelt signs when . . .

  BOOM.

  I looked to my right to see if Matt had heard it too.

  BOOM! This one was louder than the first and the airframe shuddered.

  ‘Bing-bing-bing-bing-bing . . .’ The master warning system was set off.

  The first sound was like a backfiring car, and could easily have been the noise resulting from an engine surge we get from time to time on the big jets. A surge occurs when the high-pressure air travels from the combustion chamber backwards through the compressors and out through the engine intake. Jet engines can recover from a surge condition and the flight might even be able to continue to destination.

  But the second boom was like nothing I’d experienced before. Two booms one second apart. Was it the first engine having more grief or had I lost another engine? There was no time to think . . .

  ‘Bing-bing-bing-bing-bing . . .’

  There were two master warning lights: one in front of Matt’s eyes and one in front of mine. Big red lights to grab our attention in only the worst emergencies. They were both lit up in brilliant red.

  My mind raced, my senses of sight, sound and touch were in overdrive. Then the benefits of my hours spent training for engine failures in the simulator kicked in.

  My first reaction to the booming sounds and the master warning was instinctive – I hit the ‘altitude hold’ button, which told the autopilot to lower the nose and level the aircraft at the current altitude.

  Matt hit the ‘master warning’ pushbutton to cancel the red light and the ‘bing-bing’ alert. He then instinctively started the aircraft’s stopwatch – if this was a standard engine problem we would have it secured within 30 seconds.

  I knew our safety height was 2100 feet, so I knew we could stop the climb and still remain safely above nearby mountains. By hitting the altitude hold and dropping the nose the auto-thrust should immediately reduce engine thrust to maintain our selected speed of 250 knots, an action that would reduce stress on the engines and airframe.

  I learned this technique from a fellow Qantas pilot and ex-US Navy F-14 top-gun pilot. I was a passenger in his B767 aircraft travelling from Melbourne to Sydney in 2001. We were climbing through about 15,000 feet – about ten minutes after taking off from Melbourne – and I remember turning to another passenger-pilot beside me and remarking that the engine beside us sounded very loud. In fact it reminded me of a lawnmower – and the last time I’d said that about an engine, it blew up!

  Ten seconds later . . . KABOOM!

  The engine exploded! A massive fan blade had separated from its hub at the front of the engine, punctured the engine nacelle immediately in line with me before screaming sideways and narrowly missing the fuselage. The entire aircraft rocked and vibrated violently. My first thoughts were that either a bomb had exploded or a passenger door had been blown out of the aircraft. I was sitting only 4 metres from the engine. I was lucky the blade didn’t penetrate the cabin.

  After a few moments I heard the engine’s revolutions winding down and the aircraft’s violent shaking gave way to a quick rocking – the seats, overhead lockers, everything was rocking to and fro quickly, but not violently.

  The pilot had reduced the stress in the airframe and inside the cabin dramatically. We got back to the ground in one piece with everyone on board shaken but uninjured. It was an amazing piece of flying, to get the violent rocking under control so quickly, and I caught up with the pilot after the incident and asked how he’d shut down the thrust so fast. ‘I didn’t,’ he said. ‘I just hit the altitude hold button.’ It was a classic example of airmanship at its best.

  So as the second ‘BOOM’ on QF32 shook the cockpit, I hit the altitude hold. The nose dropped but I didn’t hear the engines come back to idle. The speed was increasing. Something was wrong! At this point I knew we were dealing with a serious problem. The airframe was still shaking from the second explosion and there was no engine reaction to the ‘altitude hold’ – not in terms of sounds or the controls. So I instinctively pulled back on the thrust levers, taking thrust from 95 per cent down to idle to de-stress the situation. After a few seconds I realised the auto-thrust system had failed. It was a very bad sign – the auto-thrust is at the heart of the fly-by-wire philosophy. It should not fail – but, if it does, then something is seriously wrong.

  I was trying to stabilise the aircraft. I had locked it to a con­stant altitude, locked the thrust to maintain a constant 250 knots airspeed, and I’d locked the heading, all of it manually. I was confident I had control. We were flying and we were safe for now.

  I had to keep the plane in the air so I just sat there and watched the displays for a few seconds – until I was confident everything was stable and I could include other scans into my field of view. We were still a ‘sterile cockpit’ – I was the only person who spoke, reading out the ‘flight mode annunciator’ status from the display in front of me. It showed that our altitude and heading were holding steady and autopilot 1 was engaged. There was shock around me as the other pilots waited for me to speak. With the aircraft flying straight and level, and at a constant speed, I now focused on the engine and warning display, the top display in the middle of the instrument panel. Engine 2 looked very sick. All of the sensors for thrust, temperature and pressures were replaced with crosses telling us there was no data to display. It appeared that all the sensors had been blown off that engine. This was a catastrophic failure.

  But I felt confident the plane wanted to stay in the air for now and I knew we had a serious problem with Engine 2. So I broke the silence.

  ‘ECAM actions,’ I said, and Matt charged into action.

  *

  ECAM (Electronic Centralised Aircraft Monitoring) is a com­puter program that tells you what is wrong with the plane and makes suggestions about how to resolve it.

  In the Airbus, the ECAM not only tells you what is wrong and gives you the ‘fix’, it also intelligently prioritises the problem, so you deal with fire, for instance, before an overheated engine, or a data link error. ECAM’s instructions evolve as the damage is detected and fixed, so you’re always fixing problems in the order Airbus intended.

  The first ECAM warning checklist that morning was ‘Engine 2 turbine overheat’. The checklist’s first instruction was to move the number 2 thrust lever to idle. Matt called the action and I moved the lever (only the flying pilot touches the thrust levers). The second item was to move the ‘Engine 2 master switch to off’ – this shuts off high-pressure fuel flow inside the engi
ne and closes down the engine. I was guarded about that because when you shut an engine down you might lose the ability to restart it later.

  Then the threat changed. Matt suddenly found himself at the top of a new checklist – ‘Engine 2 fire’. The ECAM had detected indications of a fire in Engine 2 and so prioritised that procedure to the top. The fire checklist appeared and then disappeared so quickly that I don’t remember seeing it. I was busy flying the aircraft and keeping a broad assessment of the whole situation, so I was not preoccupied with the ECAM checklists.

  Fire on a plane is something to be feared, and the explosion followed by the frenetic and confusing alerts had put us in a flurry of activity, but Matt and I kept our focus on our assigned tasks. The ECAM line instructed ‘Fire bottle – push in 30 seconds’, then began counting down the time delay before we would action the checklist item. This pause gave me the ideal opportunity to notify air traffic control of our problem and to make a PAN call. PAN is a message to air traffic control indicating a situation that requires priority. I pressed the transmit button on my sidestick and calmly transmitted: ‘PAN PAN PAN, Qantas 32, engine failure, maintaining 7400, and current heading.’

  The Singapore Approach controller replied: ‘Qantas 32 copied.’

  Air traffic control could now monitor our predicted track, vector other aircraft clear of us and keep us above any obstacles.

  Shortly after that I made another call: ‘QF32, Engine 2 appears failed. Heading 150, maintaining 7400 feet, we’ll keep you informed and will get back to you in five minutes.’

  This call made it clear that we were now giving the instructions, not asking for them, and that, when it suited us, we would make other demands. The intent of this succinct radio call was to impress on ATC that we were focusing on the problem and didn’t want distracting radio calls from them. It worked a treat. ATC left us alone, but monitored us and notified other airport and rescue services that we had declared an emergency. In just ten seconds we had sorted out ATC and taken control.

  Aviate, navigate, communicate. With these three golden rules now satisfied, my attention was then directed back to ECAM.

  The ECAM checklists started with engines, hydraulics, flight controls, then fuel, each of them with a series of fixes we had to perform to see if we could get the problem under control. The explosions had obviously started a fire and disabled an engine, which we’d shut down, hopefully containing or extinguishing the fire. But the fix for the fire in Engine 2 was only the beginning of it: Engines 1, 3 and 4 were degraded in different forms, the fuel system was in a total mess, the hydraulics and electrics and pneumatics were plundered, and even our flight controls were compromised.

  Any of these problems alone could disable an aircraft – having the hydraulics and electrics on the blink is a potentially catastrophic situation when you consider all the control surfaces in an Airbus run on hydraulics and electrics. Yet, unknown to us, we had a bigger headache.

  We knew one fuel pump had failed, but after a few minutes we realised five more had also failed. This, along with other failures, prevented us shifting fuel around the aircraft to ensure the engines could keep firing.

  We were barely seven minutes into this nightmare, still heading southeast with severe engine problems, and now moving on to process the hydraulic checklists. The main ECAM page was bad enough – so many serious checklists. There was a sea of red lights above us on the overhead panel, and pages of red synoptic displays spewed up failed systems from all over the plane. The problems with the fuel tanks and hydraulics, in particular, were growing. The ECAM system was becoming overwhelming.

  Matt suddenly looked up from the screen. I looked over and I could see it in his eyes: he was worried. In fact he was now thinking that we could end up in the water. Matt suggested we turn back for Changi. Matt is absolutely one of the best FOs in Qantas; I had flown with him before and he had my complete respect. I had thought of turning back to Singapore at about the same time, but I did not want to stop Matt and distract him from these critical ECAM checklists while I made the ATC request. The aircraft was flying, and at that time we were safe above the hills. But I think Matt had reached his critical point and he wanted to head towards lower terrain and the security of Singapore.

  CHAPTER 15

  The Armstrong Spiral (HAC)

  By this stage to any observer, the cockpit would have appeared to be in utter chaos. We had to deal with continual alarms sounding, a sea of red lights and seemingly never-ending ECAM checklists. We were all in a state of disbelief that this could actually be happening.

  When they recruit pilots, the Air Force and commercial airlines look for confident personality types that tend not to panic. As pilots, we learn to control our stress and minimise the adrenaline rush in panic situations and keep our reasoning going.

  We were worried, but our training kicked in. We knew every part of the A380. I had been flying for 35 years and had over 15,000 hours of flying experience, plus at least a thousand hours in simulators experiencing stressful scenarios. The aircraft was flying and, although our heartbeats were elevated, we knew we needed to stay calm and in control.

  There were five pilots on the QF32 flight deck, but we operated the aircraft exactly as per Airbus SOPs – as a two-pilot aircraft. We had three extra pilots behind us as a resource – for delegated duties, monitoring and to offer assistance. In a flight deck team, you never have all pilots focusing on the same functions: you have task sharing, which means each pilot is responsible for their activity, and together they support each other. Matt’s job was to read out and action the ECAMs, and that was occupying 100 per cent of his time. My job was to fly the aircraft, maintain a global situational awareness, monitor Matt’s actions and make the radio calls to ATC. There was no confusion. The other three pilots monitored and assisted us.

  There is a real danger in flight decks where there are surplus pilots. It would be easy for everyone to be distracted into looking at one area, meanwhile the aircraft flies into a hill or runs out of fuel. In an infamous accident, an aircraft did just this: the pilots were preoccupied running through a long checklist and failed to share tasks and monitor the fuel on board, so they ran out of fuel, and crashed.

  It is even more common for ‘group think’ syndrome to take hold, where individuals who detect faults fail to expose them because they believe the group is more intelligent and more correct. The ‘group think’ problem is remarkably prevalent in crews augmented with management and checking captains, because junior pilots feel intimidated.

  I had been clear on the drive to the airport and in the discussion about Harry’s seat just before pushback of what the team responsibilities were and how the team would function. It was going to plan. I remember telling Mark when he was standing behind me: ‘If we are all looking down, then you look up. If we are all looking up, then you look down.’ Harry and Dave were watching us, Mark was supporting us, and we were working together.

  I thought about Matt’s request. Returning to Singapore had to be a safer option than continuing south-eastwards and trying to fix the plane. The checklists were still coming – they didn’t stop. It was like taking a plate from the top of a plate dispenser in a cafeteria – it would simply be replaced with another. We did one checklist after another, and they kept coming – serious checklists, ugly checklists. I was getting concerned at just how much of our aircraft had failed and what we’d be left with. There was no way to know if the problems could be resolved or if one of those problems would suddenly be the reason we could no longer fly the plane.

  I pressed the transmit switch for VHF radio 1 to our air traffic controllers: ‘Singapore, Qantas 32, we require a left turn back towards Singapore to hold while we fix our problems.’

  I breathed deeply to control my stress and proceeded to bank that huge, crippled aircraft as gently as I could. I had no idea what such a manoeuvre would do to our chances of staying in the air. The aircraft was flying smoothly, but the extent of our problems with hydraulics and el
ectrics was so great I couldn’t determine how much it would affect our flying performance. Something as basic as a turn might cause something else to break. As we turned northward, I asked Dave to make a PA to the passengers assuring them they were safe. Dave’s initial PA was brilliant, textbook perfect and broadcast calmly. It did a great deal early on to inform and calm both the passengers and crew. But besides telling the passengers that we were in control of the plane and were dealing with technical issues before landing, I saw no advantage in going into too much detail.

  I think it was the longest banking turn ever completed in an A380, and when we were finally heading north, and everyone had stopped holding their breath, we got back to work.

  The fuel system had so many failures and was leaking from so many points it was hard to know where to start. Looking at the fuel synoptic page, I thought we had leaks in the feed tanks for Engine 1 and Engine 2 as well as the transfer tank that sits in the left wing and fills the feed tanks. We had a fuel jettison valve failed open, slashed fuel transfer galleries, we had failed main and standby fuel pumps in feed tank 2, and we had failed transfer pumps for the left inner fuel tank.

  We had very hot pneumatic bleed-air leaking from slashed ducts in the left wing. And a low reservoir air pressure over the hydraulic oil that prevents the hydraulic pumps cavitating, meaning degraded hydraulics. Some of our fire extinguishing systems had failed and, as we worked the lists, our control surfaces came up damaged too: aileron actuator faults, outer ailerons damaged, mid ailerons damaged, backup emergency electric aileron actuators failed. It was an extraordinary amount of damage – more than I’d ever seen or imagined before, and more damage than an Airbus aircraft had ever experienced in the air.