QF32

by Richard de Crespigny

  I was initially happy to accept the computer-calculated approach speed of 166 knots, but I had this nagging thought at the back of my head: a computer using 250,000 sensors may be the greatest thing to happen to aviation, but it was still just a computer that was still subject to the rule: ‘Garbage in – garbage out!’ It couldn’t and shouldn’t override the common sense of an experienced pilot. My job was to fly the plane and apply a sense of reasonableness, not to just blindly follow commands from a computer program that had just failed to give us performance data. We had a very high approach speed, a broken aircraft, and only 100 metres of surplus runway.

  I paused and looked away. With our weight, imbalances and complex failures I now had growing doubts the aircraft would be manageable at our approach speed of 166 knots. My primary concern was whether we would have sufficient roll and pitch control. Even though the flight control software had degraded to alternate law, which meant we had no stall protections, I was not worried about this at the time because I knew the A380 had an independent stall warning system that bypassed the flight control computers, and I had told the others as much.

  I was not too worried about stalling the aircraft at that time, but I was not aware of all the damage to the wings and the flight controls.

  I asked Matt to read through our status screen, starting with the landing gear. The normal landing gear extension system had failed but we could default to a standby gravity system. It would take a few extra minutes, but we had time on our side. So we could get the wheels down, but one of the landing gear computers had failed, so we would lose half our gear indications. Bottom line: emergency gravity extension, three extra minutes, half the sensors.

  The brakes were a mess. We’d lost the auto-brakes and the anti-skid was failed on the wing brakes. Half the spoilers were failed. The brakes had reduced to the emergency system, reducing the wing brake pressure from 3000 psi to 1000 psi and we would have only six brake applications before we ran out of pressure. Bottom line: I could press hard on the brake pedals once and only after the nose wheel touches down.

  Flight controls: three fuel imbalances, centre of gravity problems, half spoilers and 35 per cent roll control. Bottom line: use the autopilot for finesse. Lock thrust levers 1 and 4, then use only Engine 3 to control the speed. This should minimise yaw-roll and flight control (aileron and spoiler) demands.

  Fuel: trashed. But we had at least two hours of fuel remaining on Engine 1 and more on Engines 3 and 4. Bottom line: sufficient fuel, but don’t go around unless absolutely necessary.

  Engines: three engines working – great. But unsure whether Engines 1 and 4 will overheat and blow up if we attempt a go-around. Bottom line: no problems, but don’t go around unless absolutely necessary.

  Flare: flare late to minimise float distance and runway stopping distance. Flare early to arrest rate of descent to less than 6 feet per second. Bottom line: don’t crush the landing gear!

  We were still left with the major headache of landing with­out stalling, breaking up or running off the end of the runway. Somehow we had to get our approach speed low enough to effect a safe landing, without flying so slow that we stalled and fell out of the sky.

  There was only one thing we could do: we’d have to con­firm the aircraft’s performance before we landed. We’d have to perform a series of control checks to set our real minimum airspeed, as opposed to our theoretical performance as stated by the computers. With 469 people on board, we’d have to see how close we really were to a stall.

  This decision to do control checks would be controversial to 90 per cent of commercial pilots. The control check involves actually inducing the aircraft to do what the controls are communicating or warning against. There is no reference in any Airbus manual for how to conduct control checks in fly-by-wire aircraft. Indeed it is a mark of the divisiveness of this issue that nowhere in Qantas literature, manuals or SOPs is there any mention of control checks. Neither is there any reference from Australia’s Civil Aviation Safety Authority (CASA) – our federal aviation safety regulator.

  Flight control checks are not spoken about. To people who don’t fly for a living, conducting a flight control check might seem reckless and inviting disaster. Even to many who do fly for a living, the idea of knowingly pushing an aircraft to the point where you might get a stall warning in the cockpit is regarded as cowboy behaviour.

  I was taught control checks in the RAAF; the idea is that if your aircraft has taken enemy fire or you’ve collided with a friendly plane while in formation, and you have a damaged airframe and/or flight controls, you have to be able to test how the aircraft performs when it approaches, slows and flares before you try to do it seven seconds and 50 feet above the tarmac. If you worry that your aircraft has damaged slats and holes in the wings, and you’re not sure how it will perform, you typically do a control check as you change to each successive configuration, all the while circling your runway at a safe height so you can accelerate and recover if you start to lose control.

  It may be, in our case, for instance, that your computers tell you that you’ll stall at 160 knots on a 3-degree approach slope. So you don’t want to fly the approach at 166 knots – you really want to do it with an extra 19 per cent margin – at 190 knots.

  So you do flight control checks at a safe altitude to see if you can gently manoeuvre the aircraft in roll, pitch and yaw. If the aircraft departs normal flight, or if a stall warning siren is triggered at any stage, then this indicates significant wing and flight control damage and so the approach speed should be increased (by about 20 per cent) to remove the risk of losing control during the approach and landing manoeuvre. I have to stress that this is my own very basic procedure based upon standards test pilots use to certify aircraft stalling speeds.

  Of course, the passengers might not have felt comfortable knowing we were about to do a control check, so that was one more announcement I kept to myself. A control check has a certain element of risk to it, sure. However, the greater risk is committing to a landing when you are not certain about the information or the integrity of the systems you are acting upon.

  To me, the control check was a must and the best option.

  CHAPTER 23

  It’s Now or Never

  I knew that Changi’s 20 Centre runway was 4000 metres long and we should come to a halt in 3900 metres if the computers were right. But I had to know how the aircraft was going to flare. The landing distance for an Airbus A380 is calculated from the point where the landing gear is 50 feet above the runway to the point where the aircraft stops. Simplistically, the test pilots are expected to have the aircraft transition from 50 feet to touchdown within about seven seconds. If you take more than seven seconds to touch down, every additional second represents 85 metres less runway available for braking and stopping. We had only 100 metres of runway to spare, so every second saved in the air would be critical. My highest priority was to do a landing as good as or better than the Airbus test pilots on their certification flights.

  As I was contemplating this challenge, my mind flashed back to 1980 when we were learning to conduct short take-off and landing (STOL) landings in the Caribous at night on grass strips only 300 metres long. All we had then were six lights and lots of adrenaline. As we descended, it was imperative to lock our eyes and our flight path to intercept the runway at an exact point, our aim point. As we transitioned through the last hundred feet of height above the runway, just as the ground expanded and exploded in your peripheral view, that was the time to lift the nose and flare the aircraft; at exactly the right height and rate. If the flare is done correctly, the rate of descent is arrested concurrent with the wheels kissing the ground. No floating, no being suspended 1 foot above the runway as precious stopping surface melts away behind you. Caribou STOL landings were precision procedures, learned through repetition until we got it right. The pressure was on. If I could eyeball land a Caribou in Tapini, I could do the same with an A380. All I had to do was to have Nancy-Bird touch down within se
ven seconds from passing 50 feet. I would need to be smooth with the controls, accurate with the speed control and eagle-eye accurate with my aim and flare point.

  Matt got on the radio to Changi Approach and asked them for a descent to intercept a ‘20 mile final at 4000 feet for Runway Two-Zero Centre’. A ‘final’ is your final approach, where your aircraft trajectory aligns with the runway centreline that has been extended out and up at a 3-degree angle. The final approach is a narrow cone that reduces your variable dimensions down to just one: speed. You are aiming to slow the aircraft and put it at a 50-foot wheel height above the runway on speed and configured to land.

  Most pilots normally intercept the ILS final approach about 10 miles from the runway at 3000 feet altitude. From here they progressively slow the aircraft, while configuring the slats, flaps and landing gear. The aim is to be in the cone, configured, on speed, with the engine thrust stable at 1000 feet above the runway. But I wanted longer finals.

  I knew we had to conduct multiple control checks as the configuration was changed. We had to lower the landing gear, then I had to do my final control check fully configured, gear down, with ‘FLAPS 3’ at 166 knots. This would be my final dress rehearsal of the landing. Once we were descending on finals, if I wanted to put on full thrust and go around I was not sure if our remaining engines would overheat, and I knew we would be unable to raise the landing gear. So in the back of my mind I was preconditioning my mindset that, once I commenced finals, I would continue to land and not go around. I thought it was best to get our landing ‘dress rehearsal’ out of the way at a safe altitude of 4000 before I committed to the approach and landing. All these thoughts flashed through my mind as we approached the finals.

  Changi tower vectored us to the north to position for a U-turn then the 20-mile approach to Runway Two-Zero Centre. They cleared us to descend to 4000 feet.

  Mark spoke up as we rounded the turn to finals: ‘Rich, do we have a commit altitude?’

  It was an excellent call from Mark, reminding me I had not sufficiently briefed the other pilots and cabin crew. I explained my reasoning and why I didn’t really want to go around, including our worsening fuel and balance condition, and left it at that. The other pilots understood; we needed to land this aircraft now.

  Finally I realised I had not warned the cabin crew that we were about to start the approach, so I sent Mark into the cabin for the last time to brief Michael von Reth on the state of the plane and the ‘best’ and ‘worst’ scenarios for what hazards the landing might produce. Those scenarios included a ‘heavy’ landing, collapse of landing gear, runway overrun, fuel fire and airframe break-up. It isn’t pretty but this is what aviation crises come down to, and it’s what we train for. Mark told Michael: ‘We might not be able to stop on the runway and there might be a passenger evacuation.’ Michael replied confidently, ‘The cabin, passengers and crew are ready.’

  The passengers knew we had circled for more than an hour before trying to land, and some were nervous, holding hands and praying, and they were being watched intently by Michael and his crew. Their interests were best served by maintaining a sense of calm and ensuring the cabin crew were prepared.

  We were also tense on the flight deck: Matt went into the pre-landing routine, actioning our deferred checklists and then our approach and landing checklists. The flaps were now extended to the first position, ‘FLAPS 1’.

  I was cautious because I didn’t trust the landing performance calculations and I had decided I was going to control-check the aircraft to satisfy myself the aircraft was controllable and we had a good margin to the stall speed. I anticipated at least one of the other four pilots might register their complaint because the discussion of control checks never arises in airline textbooks, particularly with passengers on board. I was conscious they might think I was a ‘cowboy’ and reckless.

  We were being vectored in a long, sweeping left turn onto our final heading. As we headed into the south and straightened for our final, Matt called our altitude – 4500 feet – and I said: ‘We need some control checks.’

  I heard the sound of shifting weight behind me but neither of the check pilots spoke. I don’t know if Harry and Dave wanted to stop me, but I had timed the announcement to catch them unawares. By the time they’d swapped their glances, it was too late.

  With complete silence on the flight deck, I disconnected the autopilot and I pushed the sidestick left and right carefully, then forward and backwards vigorously to ascertain that I had control of the aircraft and that it was responding to my inputs. We watched the flight control synoptic displays as they showed what was happening on the wings. Both outer ailerons and one mid aileron were unpowered and slipstreaming in airflow – at about 80 per cent full up! In addition, at least one spoiler was also unpowered and raised into the airflow. I had read about this in the aircraft manuals, but I was not ready for the shock I felt when I saw this. The conclusion was obvious: if a wing spoiler and 65 per cent of our ailerons were floating up when they were failed, then we were losing a LOT of lift over the wing forward of these surfaces. As I rolled the aircraft through about 10 degrees of roll to the left, then to the right, we could see the remaining ailerons were moving through about 60 to 70 per cent of their full travel. As I jerked the stick forward and back, I waited to see if I could feel any buffeting over the tail plane that would indicate an approach to the stall. It felt good to me. Back in the cabin, however, Second Officer Andrew Eccles recognised I was doing a control check. He would later tell me it made him feel worried about the state of the plane; it was clearly worse than he had expected. He realised our risks and pulled his seatbelt tight.

  We then extended the flaps to positions 2 and 3. I conducted a quick flight control check after each selection.

  Then we turned our attention to the landing gear. The normal gear-extension systems had failed and we had to initiate the gravity-operated emergency extension. It can take up to two minutes for the gear to fall and lock into place. And once the emergency landing system is down, it can’t be retracted. When Matt asked for confirmation, I called ‘CONFIRMED!’ Matt lifted the cover, then activated the emergency electrical switches to have the 18-tonne landing gear fall out under the influence only of gravity. What if the emergency modules were damaged by the explosion? What if our gear failed to lock down? It was a quiet time. The gear normally takes about 60 seconds to fall, and the over-centre locks fall into position before we know whether we have our 22 wheels down and locked.

  Two minutes is a long time: Matt was thinking about his wife and kids.

  We heard the ‘clunk, clunk, clunk, clunk’ as the main landing gear locked down into place. Eighty seconds had elapsed; but no nose wheel? Where’s that fifth strut?

  There was a long 20-second pause before ‘clunk’ as the final gear strut locked down. We only had half our indicators showing our landing gear positions, but we were expecting that, given that one of our landing gear control systems had failed.

  It was now five minutes before we were aiming to land: ‘QF32, Singapore Tower. G’day. The surface wind is 180 degrees at 5 knots. Runway Two-Zero Centre clear to land.’

  It was time now for the final dress rehearsal of our landing. I disconnected the autopilot again and started the last control check. Because it’s a fly-by-wire aircraft I wanted to check how much our controls had to be pushed in order to give us normal performance: would there be a lag between my sidestick and the control surfaces? Would the fly-by-wire try to protect degraded control surfaces by inhibiting my instructions to them? To test this I gave the sidestick 60 per cent of its available travel, which is a fairly dramatic movement. There was not much response from the plane’s control surfaces or the aircraft itself. It wasn’t a great result – we didn’t have normal control, but we were flying.

  If I had to narrow down any one part of the flight that I think was critical to our successful outcome, it was the flight control checks. We conducted a full dress rehearsal of the landing at 4000 feet and
the aircraft performed admirably. No matter what happened during the subsequent approach and landing, I felt I had confirmed the aircraft was safe to land.

  I reconnected the autopilot as we made our final turn onto the ILS centreline. It was time to land. But then the auto­pilot tripped out for no apparent reason. ‘Beep beep beep’ the warning horn went off for about the hundredth time so I was not really surprised, but this time the ECAM didn’t display ‘AP OFF’ (meaning auto-pilot off). Instead it displayed ‘RAT OUT’.

  I couldn’t believe it. Would this ever stop?

  The ram air turbine (RAT) is a last-ditch electrical generator that keeps the A380 on electrical ‘life support’. With the RAT deployed the aircraft would automatically degrade to provide only the essential and emergency systems. We would lose four of our seven flight control computers, all autopilots, auto-trim, all flight directors, all engine reversers, all radio altimeters and normal brakes. Our flight controls would revert to direct law, we’d have only 28 per cent of maximum braking, and the fuel cross-feed valves would open and complicate our fuel leaks.

  I couldn’t recall all of these items when the ‘RAT OUT’ message appeared on the screen, but I knew we were due for even more trouble. That pile-driver was pummelling me into my seat again and I entered a cold sweat, waiting for another barrage of bells and alarms as the aircraft would again degrade and we’d have to tackle our next series of failures. But the bells didn’t sound; the screens and radios didn’t go blank. It took a few seconds to appreciate that the ‘RAT OUT’ message was in amber – not green. The amber colour meant the RAT was being commanded out, but it had failed to deploy – hallelujah! At last, a failure that actually helped us!

  The APU was running and I thought we were saved from the total electrics failure – albeit for a little time!