QF32

by Richard de Crespigny

  As Mark moved through the cabin, passengers grabbed his arm and said, ‘Look at that!’ He was shown many other holes on the wing’s top surface – one that penetrated through the leading edge slats. The implications were obvious: the engine explosion had produced shrapnel with enough force to pass up through the 2-metre thick wing and exit on the top side, slicing through two 15 millimetre–thick aluminium plates like a knife through butter.

  The horde of fuel system alerts we’d received from ECAM now made sense as 90 per cent of the fuel is held in the wings. There are eleven fuel tanks on the A380, ten of them in the wings. Mark later told me, ‘I put on my best poker face in front of the passengers and tried not to look too alarmed, and to tell everyone it was okay. But shit, it really wasn’t.’

  Mark sought out Michael von Reth, who was at the Business Class crew station issuing orders and making frequent announcements. Identifying and calming the ringleaders was one component of Michael’s strategy, the other part was to make regular communication with the passengers, who were all confined to their seats. Once Mark had established everyone was okay, he and Michael swapped information. Michael needed insights that he could share with the passengers, and we needed to know what was happening around the entire aircraft.

  Coming back into the cockpit, Mark explained what he’d seen and been told, and so we built a more complete picture of what was going on with the plane, based on what the ECAM said, what Mark Johnson had seen and what Michael von Reth and Andrew Eccles could tell us.

  We knew at that point that we had one failed engine, two degraded engines and one engine registering revs but no thrust. We also had holes in the wing, holes in the hydraulics, holes in the pneumatics, degraded electrics, degraded communications, degraded computer systems, leaking fuel, failed fuel pumps, degraded flight controls, a few imbalances and a whole bunch of other stuff.

  All of the power to the left wing had been shut down and half our normal electrical generators depowered, but we had curtailed the possibility of starting an electrical fire inside the left wing, which was loaded with 45 tonnes of fuel. We had additional power available. The auxiliary power unit (APU), located in the tail section, drives two generators large enough to power a small town. We started the APU but it refused to distribute power to the plane. In the worst case, that of a total electrical failure in flight, the ram air turbine (RAT) was also available. The RAT is a small windmill that drops into the airflow behind Engine 2 and turns an emergency generator to supply power for essential services.

  The A380 uses a lot of power and we were down to about 40 per cent generation capacity. This was powering the cabin, flight deck and emergency electric flight controls. Michael von Reth reported that the cabin environment was very disconcerting – the normal and emergency lighting was flashing on/off throughout the aircraft, accompanied by persistent alert and warning sounds.

  The engine had exploded like a cluster bomb. Shrapnel had torn through anything in its path, including QF32’s wing, fuselage and systems. The fuel pumps and ailerons on the A380 are powered through dedicated wires that run through the leading edge of the wing with redundant wires routed through the belly of the aircraft. All these wires were cut. We’d also lost half of our spoilers (for turning and braking); the leading edge slats (which help us slow to land) on the left wing failed; and our brakes were reduced down to 28 per cent on the left and right wing. I was amazed: of the 22 systems on QF32, 21 were damaged. Only the oxygen system was (luckily) unaffected. I don’t think an Airbus aircraft had ever been damaged so severely, but there was good news – we were still flying.

  Yet we were lucky: none of the exploding engine parts hit a passenger, even though a lot of the shrapnel hit the fuselage. One of the massive chunks that travelled through the wing and punctured the inner fuel tank, then continued up and over the top of the fuselage, missed the top by just 2 centimetres. The engines on A380s are staggered in their placement so that shrapnel from an exploding engine does not fly directly sideways and frag (wreck) the neighbouring engine. This stagger saved Engine 1 from destruction. They are also set forward from the wing to limit catastrophic damage to the wing, fuel, flight controls, electrical and hydraulic systems in the case of a turbine disc failure. These offsets did not work so well given the amount of damage to the wing. Still, there is only so much you can do to protect the airframe from an engine explosion, short of encasing it in concrete.

  *

  We were now in an oblong holding pattern over a patch of water where the Singapore Strait meets the South China Sea.

  From this holding pattern to the east of Singapore, we flew and plotted, flew and plotted as we stabilised damaged systems, all the time assessing how much fuel remained and whether we had the luxury to be able to continue actioning the never-ending checklists, or whether the aircraft was a ticking time bomb with limited flying time left and we should just get onto the ground immediately with whatever systems support we could muster.

  Another thought cycled in the back of my mind that chilled my senses. Was the wing on fire? If the wing was on fire, fed by our many fuel leaks, then I’d be forced to make a quick decision, a decision so dreadful I’d always hoped I’d never have to make it. If the wing was on fire, we would have insufficient time to make the runway and I’d have to ditch the aircraft in the ocean. I had not seen the ‘ENG FIRE’ checklist flash up on the ECAM and there were no reports of fire, but it was in my thoughts.

  I keyed the radio after we’d entered our holding pattern and updated Changi ATC with a few details of our failures, in part to explain why I anticipated we would need to remain in the holding pattern. I didn’t know how many ECAM checklists were queued up. I assumed the checklist we were working on was the final checklist and, once we’d completed that, we would need an additional 30 minutes to prepare the aircraft, cabin, crew and passengers for landing.

  But the checklists kept coming and coming.

  The biggest job at our end was to work out how to get the 440-tonne aircraft on to the ground with everyone intact. We started with the fuel. If we couldn’t keep it flowing into the engines, we wouldn’t stay aloft and we wouldn’t have time to work up a plan for landing. The displays showed we’d taken off with a total fuel load of 105 tonnes but after twenty minutes of flight we were already down to 93 tonnes remaining. Nine tonnes of fuel had leaked from the wings. There are eleven fuel tanks on an A380: one feed tank over each engine, three transfer tanks in each wing, and the trim tank located in the horizontal stabiliser at the tail. We had leaks that couldn’t be plugged: five leaks in the forward wing spar, at least two holes in the bottom of the wing, and a minimum of two on the wing’s top surface. Both of our fuel quantity management system computers failed, and there were multiple problems in the left wing where six fuel pumps failed, transfer galleries (pipes) and vent pipes had been severed, and the transfer and jettison systems were failed. The system to transfer the 13.5 tonnes from the trim tank in the tail to the wing transfer tanks had failed. Losing the two fuel transfer systems meant we couldn’t shift fuel from the transfer tanks in the wing to the feed tanks located above and feeding each engine.

  It was getting very hard to resolve all these failures. The fuel quantities in the eleven tanks didn’t make sense. Engine 2 had failed, but it appeared there was a bigger hole in the feed tank to Engine 1 than there was in the feed tank to Engine 2.

  Each engine was burning about 3 tonnes of fuel every hour. So, leaks notwithstanding, it was easy to calculate we had about two and a half hours of flying before the number 1 engine ran out of fuel and then we’d be flying on the two engines on the right-wing only.

  Not only were we losing fuel in an uncontrolled way but we could not voluntarily dump fuel either. The jettison system was a mess. In fact the jettison valve was jammed open, which might have allowed us to lose fuel, but the transfer galleries were severed and many fuel pumps had failed, so the computers inhibited the jettison system. We also had many fuel transfers that failed to initiate,
and so the fuel distribution became non-standard and the aircraft became out of balance.

  ECAM detected these problems and gave us a solution. The ‘FUEL: wings not balanced’ checklist instructed us to transfer fuel from the heavier right wing into the feed tanks in the lighter left wing.

  Matt was doing a fantastic job actioning the ECAM. He wasn’t rushing, but he couldn’t go slowly because, on many occasions, he’d be in the middle of a checklist when another higher priority checklist would flash up and interrupt his flow. It was very distracting. So Matt did his best to apply the checklist fixes before another alert and action leaped onto the screen. The ‘FUEL: wings not balanced’ checklist appeared and Matt was reaching up to open the fuel cross-feed valves when I suddenly called out ‘STOP!’

  It seemed instinctively wrong to me, and I stared at the ECAM and the fuel synoptic display, then back to the ECAM.

  ‘Should we be transferring fuel out of the good right wing into the leaking left wing?’ I asked.

  ‘No!’ Mark, Harry and Dave all said loudly.

  I didn’t have to say anything more. They all knew the case of Air Transat TS236, an A330 flight from Toronto to Lisbon in 2001. During that flight an extremely rapid fuel leak developed in one wing. The crew followed the checklist procedures and transferred all the fuel from the good wing to the bad. But the fuel that transferred was lost overboard and both engines flamed out. The aircraft then conducted a superb glide landing at the Azores and luckily everyone escaped without injury. This was a remarkable incident and it provided a valuable lesson.

  I wasn’t going to let us fall into the same trap of transferring fuel away from the engines that were working. So we agreed to ignore the checklist.

  Matt had commenced actioning the next checklist, ‘FUEL: norm+altn xfr fault’. It was a checklist I never ever expected to see in any aircraft and a sign of how grim things were. The A380’s fuel system is so impressive – with so many redundant pumps, valves and galleries – that I never thought both the normal and the alternate fuel transfer systems could fail at once. But here it was, and Matt was reading out the checklist when Mark interrupted and said, ‘I think we missed something when looking at the fuel synoptic page during the previous checklist. Can we revisit it sometime please?’

  I told Matt to stop the checklist and display the fuel synoptic. It showed a sea of red failures for our left wing. It was hard to see past the red and identify the white components that were working normally.

  ‘I think we have another lateral imbalance,’ Mark said. ‘When we actioned the engine failure checklist, the checklist called for us to do an emergency transfer of fuel from the outer transfer tanks into the feed tanks. The right outer tank has transferred, the left has not!’

  Mark was the first to identify this. I had missed this added imbalance. This was not a good result as far as control of the aircraft was concerned. Our confusion was continuing to rise and our confidence started to wane. We began to think about an emergency landing with increasing urgency.

  CHAPTER 18

  Apollo 13

  The fuel imbalance was a major issue. One of the problems with modern fly-by-wire aircraft is that the distribution of the fuel critically affects the safe loading and balance of the aircraft for take-off, cruise and landing. We needed to get the plane balanced if we were going to land safely. Even small imbalances can potentially be fatal.

  Matt had tried to transfer fuel in the outer tanks to the feed tanks. The imbalance across the outer tanks was now 300 per cent outside the flight manual’s published limit. It made for an uncomfortable atmo­sphere in the flight deck. What would happen on an Airbus when the outer fuel tanks are not balanced? How well can you turn? How do you land? None of us knew the answers.

  No pilot ever wants to operate or land an aircraft out of its published limits, because either the aircraft has failed certification requirements or it has never been tested. You don’t know which of these two cases applies, so you just avoid operating outside the limits. But sometimes you don’t have a choice. On QF32 we had a badly compromised aircraft in which the centre of gravity wasn’t perfectly located in the middle of the fuselage between the wings, but instead somewhere to the right, between the fuselage and Engine 3. None of us knew how an out-of-balance A380 would perform at landing at the best of times, but in the shape that Nancy-Bird was in, it was causing us great concern.

  Our suspicions about the fuel system were about to be made worse because ECAM was not helping us. Matt was actioning a fuel ECAM and he called out the message: ‘CG OUT OF LIMITS FOR LANDING’. This was understandable. There were 13.5 tonnes of fuel stuck in the trim tank in the tail plane that would push our centre of gravity way back. The next message read: ‘TRANSFER TRIM TK FUEL’. This was also understandable. The computers would always transfer this trim tank fuel forward 74 minutes prior to landing to help balance the plane. But our thoughts were stopped by the next messages: ‘TRIM TK NOT USEABLE’. And ‘TRANSFER SYS INOP’.

  Was this a joke? Why did the ECAM tell us to transfer the trim tank fuel if the transfer system was inoperative? It wasn’t logical. Clearly the ECAM was not programmed to cater for this many concurrent failures. I felt like I was on a TV game show where you are given a challenge and have to think your way out of the problem. The game host was the ECAM; the problem was our shredded fuel system.

  I stopped for a second and thought about it. It didn’t make sense. We were in longitudinal balance when we took off 25 minutes earlier with the same amount of fuel in the trim tank down the back, so how could we be so far out of longitudinal balance now? I started to have doubts about ECAM.

  There must be another way out of this quandary. I remembered a graph deep in the manuals that showed the ‘CG envelope’ for all phases of flight. That graph flashed in front of my mind. I grabbed the A380’s laptop and thrust it back into Mark’s hands. ‘Mark, would you find the graph for the CG envelope in the Flight Crew Operating Manual and tell me what you find.’

  Mark, like all of the second officers on the A380, is a true professional pilot; in fact, he had flown F-111s and Hercules aircraft in the Royal Australian Air Force. He knew the manuals better than I did. It didn’t take him long to find the graph, and his conclusion was clear. ‘Rich, we are currently over our maximum landing weight, and our current CG is greater than the ideal, but we are within an acceptable CG range. We’re okay!’

  We all looked at the graph before I said, ‘I agree with Mark, I think we are okay and that we can ignore these ECAM CG messages.’ Everyone agreed – and that problem was quickly resolved.

  What wasn’t okay was the other two imbalances in the weight distribution of the aircraft. How would we get everyone on board safely to ground with so many problems? The ECAM kept warning us that the wings were not balanced, and we knew there were some big holes in the fuel system which meant the imbalance was growing, but we couldn’t work out whether the fuel leaks were in the engine or in the wing. If the fuel leak was in the engine, then shutting down that engine might stop the fuel leak. But we had so many other problems. Did I really want to take a bad situation and make it worse by shutting down an engine to try and isolate a fuel leak – NO!

  By this time we had developed a routine of dealing with all the external stresses – the master warning horn continued to sound frequently, but would be quickly cancelled by Matt or myself. The ECAMs kept coming, one after another, each one still serious. When would this stop and what aircraft would I be left with? I knew I was coming to the end of my tether. We were chasing a computer program around when perhaps we should have been flying the plane and just landing.

  Then both fuel quantity management computers became so confused they failed. The fuel synoptic displays showed only red double crosses ‘XX’ – no data.

  I slumped lower in my chair. I felt like a pole being driven into the ground by a pile-driver. Both fuel systems had failed. What was next? Whatever I was doing, I was not climbing back on top of the situation. I knew the
fuel imbalances would challenge our controllability for a landing, but so many other systems were failing I was losing the ability to track all the failures and work out their dependencies and consequences.

  I knew I was now overloaded. I said nothing.

  Think . . . Think . . .

  Matt soldiered on brilliantly. He followed the ECAM instructions to reset both fuel quantity management computers and, bit by bit, the fuel synoptic displays flashed back into life. It looked like the scene from Apollo 13 when the astronauts powered up the command module before entering the Earth’s orbit. That frozen dark capsule fired up into a sea of lights, dials and buttons. There was silence in the cockpit except for the continued buzz and ring of the alerts from the flight warning computers.

  I looked at the fuel synoptic page and I said loud and clear to all: ‘I’m looking at this fuel synoptic page and I don’t understand it. Does anyone understand this fuel display?’ I wasn’t trying to be smart: I didn’t know the answer and I was asking for ideas. I was asking for help.

  The rest of the pilots shook their heads. There was silence.

  My confidence in ECAM was waning. It was just a computer program, it was just a checklist. It wasn’t good enough to tell us where the leaks were, it couldn’t adapt for multiple failures in one system and it couldn’t help us fix the leaks even if it could identify them. There weren’t enough sensors – there’d never be enough sensors. And, even if there were enough sensors, we lacked crucial pumps to shift fuel, we lacked intact galleries that connected the tanks, and there were holes all over the place.

  *

  And then I had my epiphany. My mind switched.

  I inverted the logic. I remembered what Gene Kranz, NASA’s Flight Director, said during the Apollo 13 mission: ‘Hold it, gentlemen, hold it! I don’t care about what went wrong. I need to know what is still working on that space craft.’