It was now about twelve minutes since the engine had exploded. I didn’t like the rate of fuel loss or the lack of ability to pump fuel to our engine feed tanks. So I made another decision shortly after we’d made the turn for Changi.
‘Qantas 32, request climb to 10,000 feet and keep us within 30 miles of the airport.’
I wanted enough altitude so we could glide back to Changi should we need to. Emergency glide and forced landings were part of the standard syllabus in the Air Force. In one of my early RAAF Macchi jet flights over the Indian Ocean more than 30 years earlier, our Macchi’s engine developed a vibration which got progressively worse. My instructor asked me what I wanted to do, and I said I didn’t like the sound of the engine or the way it was shaking the airframe. So I took the aircraft to altitude in preparation for an emergency glide and forced landing, should our only engine fail. Now, in the A380, I had the same instinct.
Singapore Approach replied: ‘Qantas 32 roger. Climb to 10,000 feet.’
The atmosphere in the cockpit suddenly changed. Harry and Dave, and then Matt and Mark, all said ‘No!’ The thought of trying to climb with such a damaged aircraft seemed crazy to them – they thought I was talking about a maximum-thrust climb. They thought we were lucky enough to be in one piece and still airborne, and they didn’t want to be in the air when another engine failed or the fuel leaks increased, which a sudden change in attitude might trigger. I had the call and I had also dialled 10,000 feet into the altitude selector without discussion. But the other four pilots were adamant: they wanted to get the plane lower, not higher.
I think Dave took particular exception to my plan. From what he could see on the ECAM, he initially thought we might actually be flying on only one engine: Engine 2 had failed and showed ‘XX’ (no data). Engine 3 had been switched into an alternate mode and the thrust was degraded by 4 per cent. And although Engines 1 and 4 were notionally operating, they showed ‘XX’ in their thrust indicators – no data. Dave was technically right: it was possible we were flying on one normal engine, and trying to coax more thrust out of it to climb to 10,000 feet might have been a bridge too far. It might have forced a further incident in an already heavily compromised aircraft.
The other pilots perhaps wanted to make a sprint for Changi, but I was prepared to be slower arriving at Changi in order to have an ace up our sleeves: what I called the ‘Armstrong Spiral’.
Neil Armstrong, before he went to the moon with NASA, was a NACA test pilot who used to fly rocket-powered planes out of the Earth’s atmosphere. Once they’d spent their fuel breaking through the atmosphere, the pilots used small impulse rockets to lower the nose and steer their planes to re-enter the atmosphere and then glide back to the airfield. They performed a descending glide-spiral approach that used a reducing radius (as the speed reduced with altitude) around their air base. Neil Armstrong’s spiral glide descent was widely acknowledged as the best glide descent and was subsequently used to design the Space Shuttles’ descent approach (also called the Heading Alignment Cone).
I wanted to be in a position to glide into Changi in an Armstrong Spiral should the engines give up.
The aircraft was so injured, and so many of the 250,000 sensors were complaining, that I had reached the limit of my ability to absorb them all. The ECAM threw up so many failures, degradations and checklists – especially in the fuel system – that I could not evaluate all the interactions and consequences of the cascading failures. I just wasn’t confident how much of the aircraft we had left. So I wanted to be ready for the worst possible contingency – a no-engine landing.
But, for the others in the flight deck, my desire to climb set off alarm bells: the systems were so degraded we may have unknowingly been carrying a small fire, just waiting for fuel to explode all over the plane if we asked for too much thrust. A glide strategy would also have been, for them, the psychological point of defeat, the aviation equivalent of telling the crew and passengers to man the life rafts.
I was shocked the others didn’t agree with me, but I didn’t have time to discuss it. So I silently decided to accept their wishes and told myself that if the situation deteriorated further, I’d stop the ECAM checklists, head for overhead Changi, discuss my thoughts, and then climb to 10,000 feet, preparing for an Armstrong Spiral.
In the meantime I backed down and radioed Changi: ‘Qantas 32, disregard the climb to 10,000 feet. We will maintain 7400 feet.’
We went back to focusing on the central ECAM checklists – we were at that stage in the middle of a complicated fuel checklist and it was making us all feel stressed. It looked like we had hardly any fuel – and no access to the fuel we did have because the transfer tanks had failed. We were all wondering how much flying time we had left before we ran out of fuel – would it be enough to fix or land the plane?
CHAPTER 16
QF32 Down!
While we were busy in the cockpit dealing with the never-ending ECAM checklists and the vast array of failures, people on the ground were also coming to grips with the situation.
At the Qantas 24-hour Operations Centre in Mascot, Sydney, there is an Integrated Operations Centre (IOC), which is sort of like the Houston command centre depicted in movies about NASA. From this centre, aviation engineers can use a program called Airman to monitor any Airbus aircraft’s systems, and pilots can call the IOC from their cockpit using their satellite phones.
At 1.01 pm Sydney time on 4 November, the screen in front of the engineer on duty erupted with a rapidly scrolling list of messages from VH-OQA (QF32) – at a rate he had never seen before. His job was to monitor all 160 Qantas Boeing and Airbus aircraft, and so when one aircraft appears to be in distress he needs specialist advice. The volume and severity of messages streaming from VH-OQA was unprecedented in Airbus’s history. It seemed unbelievable. So the IOC engineer, thinking the Airman systems had malfunctioned, threw back his chair and made his way to the maintenance watch desk for the A380.
A380 Maintenance Watch provides 24-hour support to Qantas A380 aircraft worldwide, tracking the aircraft state, unserviceabilities and planned maintenance (overseas or at home in Sydney), and answering satellite phone calls from pilots. The engineers also have priority phone lines to Airbus and Rolls–Royce’s 24-hour support engineers.
The IOC engineer and the A380 maintenance watch engineer watched more than 130 gruesome red (warning) and yellow (caution) messages scroll down the screen. They couldn’t believe they were true – it meant the plane was in catastrophic trouble. The idea was confusing and terrifying.
Meanwhile, Peter Wilson, the Qantas chief pilot, who happened to be in a meeting just 30 metres away from the engineers’ desk, first found out about QF32 when he received an SMS message from his son, which said, ‘Have you lost an aeroplane?’ Peter quickly called Lyell Strambi, the group executive manager for Qantas operations, who was also unaware of our predicament.
Unbeknown to us, the exploding turbine disc from our Engine 2 had fractured into at least four pieces. When Airbus designed the A380, they assumed that in the event of a turbine disc failure the parts of the disc would have infinite energy – wherever the pieces were going, nothing would stop them. This was a wise assumption. In our case the chunks of the disc exited the engine core, cleaving the back of the engine’s nacelle from the strut. Chunks opened up the wing like a sardine can, creating a wall of shrapnel that peppered the fuselage. The engine’s rear cowling landed in a residential area of Batam, an Indonesian island just south of Singapore. The locals heard a loud explosion and, looking up at the sky, thought they saw a Qantas plane on fire. Turbine blades screamed like fizzing fireworks as they rained down to earth. A large 70-kilogram chunk of the engine’s intermediate pressure turbine disc smashed through the roof and wall of a home in Batam’s suburbs, and smaller pieces into a primary school classroom. Luckily no one was injured. With debris strewn across the landscape, locals in Batam started tweeting that a Qantas aircraft had crashed. The tweets were immediately picked up by Reuters
, Fox News and CNN, who quickly reported the news. All the tweets were wrong, but it didn’t stop the information ringing the world within minutes. The chief executive of Airbus, Tom Enders, received an email at 8.41 am German time from a Batam resident, containing a photo of an airframe part that had fallen from the aircraft, narrowly missing his wife and daughter, along with a close-up of the serial number on the wreckage. The resident’s message was clear: ‘How could this happen today?’ and ‘Please ensure this does not happen again.’
At 10.14 am Singapore time, thirteen minutes after the explosion, the Qantas share price started collapsing.
After receiving the SMS from his son, Peter Wilson hurried across the floor to the A380 maintenance watch desk to see what was going on. There was now a crowd huddled around the screens, astonished at the number and the seriousness of the alerts being broadcast out of our flight deck.
At about the same time, Roz Wheatley, manager of the Qantas emergency response, looked up at her TV screen to see CNN’s breaking news about possible crash of a Qantas aircraft in Indonesia. Without pause, Roz called the duty manager who is on 24-hour standby to activate the Crisis Management Centre. A room quickly filled with twenty experts from every corner of Qantas: operations, legal, political, HR, safety, engineering and financial. Captain Peter Probert was there representing the A380 fleet manager. Alan Rowlandson, the A380 fleet support manager, raced up to the centre as soon as he received his SMS. The crisis plan included booking hotels, notifying airport managers and consulates, perhaps even warning hospitals and requesting ambulances and fire crews. Unfortunately, with 469 people aboard a severely damaged aircraft, the operations people were also combing the passenger manifest and preparing contact lists for the crews and passengers’ next of kin, should the situation end in tragedy.
*
All of that was happening on the ground unbeknownst to us. We were very busy on the flight deck. We were still actioning serious checklists. We had normal communications with Changi ATC. When we requested for them to keep us in a holding pattern for 30 minutes, they had asked, ‘What’s the problem, Qantas? Which engine is giving trouble?’ They couldn’t understand why we wanted to hold so long for an engine failure.
I replied, ‘Qantas 32, Engine 2 has failed and there’s a hole in the side of the engine. The other engines are okay but the wing is damaged and we have extensive checklists to complete. We need at least another half an hour in the hold before returning to Singapore.’
At 10.29 am, 28 minutes after the explosion, Singapore ATC advised us that debris had been found on the ground in Batam.
Technically, we were alone on the flight deck of QF32, alone and in a bubble. The explosions had taken out both of our satellite telephone systems. Maintenance watch did send us a data-link message, asking incredulously, ‘Confirm operations normal?’ We sent back an adequate reply – ‘No!’ We could not talk to Qantas even if we wanted to, and Singapore ATC would not be able to help with A380 specifics. But I never thought we needed external help in the air. ECAM was doing a brilliant job prioritising then listing the faults, and then helping us either fix the system or mitigate its failure. Matt was racing through the ECAMS as fast as he could, with all of us monitoring him. Indeed, I think that any contact with Qantas via sat phone would have only slowed us down.
We weren’t even speaking to our cabin crew. The main intercom system ringtone that was blaring was impossible to hear among the cacophony of warning alerts. We had a secondary system called the ‘EMERgency Intercom’ that connected us to the cabin crew, but all of the emergency systems were beeping, and the flashing ‘EMER CALL’ light on the overhead panel was lost in a sea of red failure lights. Quite simply, none of us saw the intercom light or could hear the buzzer for all the other rings and buzzes emitted by the flight warning computers.
*
Back in the cabin, the passengers had been aware of the explosions too. There had been worried chatter, but luckily no one had started a panic. The cabin crew on airlines are trained to identify people prone to panic and to neutralise them quickly. As any experienced cabin services manager will tell you, the trick is to not allow the first panicked person to get out of the box. Because, if you let that ringleader start charging around the plane preaching doom and panic and demanding to have the windows opened, some of the other nervous passengers will follow suit, simply because they are also scared. And once you have 440 passengers in a state of anxiety, panic and anger – refusing to sit down, demanding action, arguing among themselves – you lose control of the plane and it is much harder to deal with the initial crisis.
On QF32 we were lucky to have Michael von Reth as the cabin services manager (CSM) in the cabin. A veteran of this work, and an expert in identifying personality types and acting quickly on them, Michael had felt the explosion at his seat at ‘main door 2 left’. He would later tell me the second explosion was followed by what sounded like ‘a thousand marbles being thrown onto a corrugated iron roof’. This was the shrapnel exploding out of the engine, through the wing and against the fuselage.
Michael tried the intercom to the cockpit, but no one answered. He then pressed the ‘PRIO’ and ‘CAPT’ buttons to select the emergency channel to the flight deck, but no one answered. The airframe had stopped shaking and Michael realised that, for whatever reason, he would have to manage the passengers without information or instruction from me.
From his seat at the door nearest Engine 2, Michael noticed the passengers were starting a loud hubbub of worry. Grabbing a handset, Michael announced to the passengers: ‘Ladies and gentlemen, the plane is safe. Please take your seats; the captain will speak to you soon.’ He visited the cabin crew stations and warned them that the next minutes were a crucial time to assert their authority and enforce calmness. In particular, the seatbelts-fastened sign was still on and there had just been an explosion, so he wanted the cabin crew to keep everyone in their seats.
Having briefed the crew, he started his walk down the aisles of the plane, searching for the ringleader, whom he found at the start of the Economy section: a man in his forties who had left his seat and gone to one of the fuselage doors.
The ringleader didn’t want to move from the door, so Michael raised his voice, pointed at the man and repeated his announcement in a very strong tone. The ringleader backed down and returned to his seat, where Michael joined him and had a quick chat about the situation.
Michael von Reth later told me he saw that armwrestle with the ringleader as the watershed moment in the crisis. ‘If we’d lost him, we may have lost the rest of the passengers,’ he told me.
Michael continued to look for ringleaders and disarm them before they could build momentum.
*
I knew nothing of this in the cockpit. What I realised, after we’d turned north for Singapore, was that we couldn’t speak with the cabin crew, which meant we couldn’t get a triangulated view of the damage to the plane. We knew what parts of the plane had been damaged, degraded and taken out altogether. And we had two cameras that gave us footage of the exterior of the plane. One of those cameras is mounted on the tail and looks forward down the roof of the fuselage, and the other camera is mounted beside the main landing gear bay and looks forward towards the nose wheel. But with these camera angles we couldn’t get a proper view of the engines or the underside of the wing. The tail camera allowed us to see a big hole in the top of the left wing, but not much else. As pilots we wanted to assess the condition of the plane externally before making decisions.
Once we had a north heading at a safe altitude, and we had Changi ATC ready to receive us at the airport, I tried to sit back and take a more broad view of the situation. We had completed a number of significant engine checklists and I had a freer mind space to gather an overall view of the crisis. So I asked Mark, who had been standing behind us monitoring everything, to go back into the cabin and have a look at the wing.
CHAPTER 17
ECAM Armageddon
There were four
teen people in First Class and they stared back at Second Officer Mark Johnson as he emerged from the cockpit. One passenger asked him what was going on, and he told them the plane was safe and to stay in their seats. Mark recognised Andrew Eccles, a Qantas second officer passengering back to Sydney, who showed Mark the SkyCam screen, part of the inflight entertainment system. Andrew pointed to the view of the aircraft taken from the camera mounted high up the tail fin. Mark then realised that everyone on the aircraft also had the SkyCam displayed on their inflight entertainment screens, so could see a clear view of the fuselage, including the holes in the left wing and a stream of fuel flooding from the rear of the wing. What interesting inflight entertainment!
Crossing to the left side of the cabin, Mark looked out through the small window in the middle of the door and observed the left wing. Engine 2 was destroyed, and the rear cowling that sported the red Qantas logo was gone, exposing the naked waist and inner workings of the Rolls-Royce turbine and exhaust sections.
The wing was peppered with holes and fuel was gushing out. There were also several holes in the top of the wing; one, a large jagged hole about 1 metre across and a metre back from Engine 2’s pylon mount, was big enough for a man to fit through. Another hole was further back along the wing, about half a metre long and 10 centimetres wide. There were many other smaller holes. A wide fan of fuel, about 2 metres wide, streamed out through two of the holes on the upper wing. This was complemented by another larger stream that appeared from underneath the trailing edge of the wing. Together they formed a chilling sight.
QF32 Page 14