QF32

by Richard de Crespigny

  Not everyone is up to this. A friend of mine, the solicitor Peter Reid, was a passenger in an aircraft that made an emergency landing on an ice-covered runway at Chicago O’Hare Airport in January 1982. The captain in­formed the passengers that the landing gear would not extend and for the purser to prepare the passengers and cabin for a belly landing. The purser cried, ‘I don’t want to die,’ before breaking down and collapsing to the floor. Peter stood up, took the instruction sheet from the purser, then read the preparation checklist over the PA to the passengers.

  It was now 11:49. We had been stopped for less than a minute actioning even more ECAM checklists. At the request of the tower controller, we shut down all the engines so the fire services could approach the aircraft. Matt dialled 128.5 into VHF radio 2 to make contact with the fire commander. It was unfortunate that we shut down the engines and contacted the fire controller at the same time.

  Now it got really stressful.

  When we moved the three remaining (1, 3 and 4) engine master switches to ‘OFF’, the high-pressure fuel valves in each engine should shut causing the engines to flame-out. As the engines wound down, the generators fell off-line, the bleed air valves closed off and, in yet another twist of the knife in our already wretched wounds, all the major power systems became unpowered. The cockpit went dark as all lights failed. This should not have happened! The aircraft was now pneumatically and electrically dead.

  The cabin crew were confused. Bells and alarms sounded throughout the cabin. Cabin lighting was flashing as the cabin crew checked their emergency exits. The cabin crew ‘evacuation’ message was displayed on the cabin screens but there was no aural alarm. All of this was happening around them, but the crew did not panic.

  We had started the auxiliary power unit (APU) over one hour previously to provide backup pneumatic and electric power, and expected the APU’s two generators to take up the aircraft’s ­electrical loads when we shut down the engines. Neither did.

  So instead of having a fully-powered flight deck as we sat on the tarmac, our beleaguered Nancy-Bird Walton’s 910kVA electrical generation capability had collapsed, either shut down or failed. Nancy-Bird, now gasping for electrical power, switched itself across to its last remaining line of defence – the ‘Electrical Emergency Configuration’, which essentially uses two car-sized batteries to power a few emergency aircraft systems.

  The A380’s Emergency Supply Centre detected the generator failures, so shut down 99 per cent of the aircraft’s electrical systems, leaving us with only the most critical of emergency systems functioning.

  We had fuel leaking out near hot brakes, we had shut down our engines and we had now lost 99 per cent of our electrics, but our situation would get worse.

  The aircraft was dark and confusing.

  Matt again tried to contact the fire controller on VHF radio 2 – no answer. He tried three times – no answer. We opened our window and yelled at the firefighters – they couldn’t hear us. We were out of luck: we were sitting in a lake of jet fuel and unable to talk to the fire crews we could see clearly outside.

  We finally realised that VHF radio 2 had failed! We swapped the VHF radio 1 to the fire controller frequency and finally got communications with the firefighters.

  That day threw up some enormous challenges: keeping the aircraft in the air was one and landing it in one piece was another. But lurking in the back of our minds was the major question of fire or, more accurately, what happens when tonnes of jet fuel meet white-hot carbon brakes and metal.

  Aviation jet turbine fuel (avtur) is kerosene. It is highly refined and expensive. Jet fuel is based on kerosene because kerosene packs 10 per cent more energy by volume than gasoline and it has a very high flash point making it safer than gasoline around the super-heated environment of a gas-turbine jet engine.

  However, jet fuel is not the ‘safe’ fuel that many people assume it as. Avtur has a flash point of plus 38 degrees Celsius and will auto-ignite if it reaches 220 degrees Celsius. On QF32 we were now carrying just over 72 tonnes of jet fuel and our overworked brakes would have already passed 500 degrees Celsius. So we had large fuel quantities and we had an ignition source that was not only greater than the 38-degree flash point, but might also be directly under the leaking fuel tanks.

  We were riding a bomb, and many of the passengers knew it.

  Dr Derwyn and Carolyn Jones, passengers behind the wing in seats 80A and 80B had seen the entire catastrophe. They had seen the explosion rip open the wing, the fuel gushing out and now that we were stopped on the runway, the situation had clearly not improved. Carolyn could see Engine 1 was still running and fuel pooling on the ground. ‘It did not take any imagination at all to work out that one spark and we were cinders,’ she said later. ‘We both thought we’ve had a great life together, we’ve got a fantastic family and if this is how it’s going to end, then so be it.’

  I was relieved to see the Singapore Emergency Services accomplish everything exactly by the book. I had stopped the aircraft to leave adequate tarmac space for the fire services that would surround us. There were six fire trucks. One truck held slightly back. This was the master fire truck, front and centre, carrying the fire controller – the only fireman who wears a white helmet and who coordinates all fire defences. The area inside 30 metres was reserved exclusively for the active fire trucks. They had the job not of putting out an aircraft fire, but of protecting the passengers as they evacuated the aircraft. If a fire started, the master fire truck would protect the slides and clear an exit path for the passengers. Backup fire trucks were positioned slightly behind. Outside 100 metres I saw the police and ambulance triage take positions.

  The alert call is the cue for the cabin crew to go to their emergency exits and check to see if there’s any reason why their emergency exit and slide shouldn’t be used, such as a fire or damage outside. Having ascertained if their door is useable for an evacuation, the cabin crew then monitor the passengers in their area and keep the calm. If an evacuation is commanded they will hear ‘EVACUATE, EVACUATE, EVACUATE’ over the PA, and then the evacuation alarm. These are the signs for the cabin crew to go into an autonomous mode.

  A passenger evacuation is a very dangerous procedure. If it’s safe to open the door and deploy their escape slide, then the cabin crew lift the doorhandle. Large motors power the door open, and when the exit is clear, compressed air turbines blast air into the slides, thrusting them out and inflating them within ten seconds. The cabin attendants scream as loudly as they can to the passengers, ‘EVACUATE, EVACUATE, UNFASTEN SEATBELTS, HIGH HEELS OFF!’ Their loud voices are meant to penetrate through the ‘frozen’ minds of those passengers paralysed with fear. When the slide has deployed, the attendants scream: ‘COME THIS WAY, FORM TWO LINES, STAY TOGETHER, KEEP MOVING, JUMP AND SIT, GET OUT! HURRY! HURRY! JUMP! JUMP!’

  All passengers are directed through their emergency exit as fast as possible. There’s no time to pause and reflect – any passenger who freezes at the door is pushed out onto the slide. That’s the theory.

  Behind me, one of the pilots asked why we weren’t doing an emergency evacuation. It was a good question. We looked at all the threats and considered all our options, and we ultimately came to a conclusion and I made the decision. My decision was simple: where are the passengers safest right now; inside or outside? Given the current situation with no fire I thought the passengers and crew were safer inside the fuselage than evacuating down the slides onto the dangerous runway.

  The QF32 flies the Kangaroo Route from London to Australia. We had wheelchair passengers and babies on board, and I knew that elderly passengers would be injured descending the slides and some would break their legs or hips as they slid to the bottom of the steep evacuation slides. Other passengers in a panic would jump from the aircraft, down the same slides, then concertina into the injured. I figured that 5 per cent of the passengers would have fractures escaping from the lower deck slides, 10 per cent from the upper deck slides; that would equate to 30 f
racture cases with our 440 ­passenger-load. But it gets worse. The passengers who survived the slides would run the risk of slipping over on fuel or foam, or could become confused and walk in front of Engine 1 that was still running and be sucked into it. Passengers who had survived to this stage might walk through jet fuel, creating a spark or taking flash photography and igniting the fuel. Even if all the passengers did get off safely, then we would have the dangerous situation of all the passengers being outside and all the supervising staff being inside the aircraft. Who would be monitoring the passengers at this time? A friend of mine commanded an evacuation of his aircraft in Osaka. After the passengers cleared the slides they ran away from the aircraft and some ran onto an active runway where a Boeing 747 was making another emergency landing.

  We had a discussion rather than an argument about it. Harry pointed at the last images to display: the wheels on the left body landing gear had reached 900 degrees Celsius – they were getting hotter. But there was no fire.

  It was a surreal feeling sitting on that tarmac. We had 440 passengers sitting patiently behind the bulkhead, while aviation fuel fell around a 900-degree ignition point.

  Although we didn’t know it at the time, Michael von Reth and his cabin crew were working hard to control the passengers. They’d just been through a harrowing flight, now they were in sight of the terminal but they were still sitting on the aircraft, and I hadn’t given the cabin crew any information to impart.

  Michael would tell me later that the passengers were fully aware of the amount of fuel pouring onto the ground and were equally – loudly – aware of the lack of fire fighting crews or water or foam. In this fuel-soaked environment, Michael’s standing order to his troops was to be vigilant in not allowing anyone to start up a phone, a camera or any other personal electronic device. He would also express his frustration at the lack of communications between the flight deck and cabin during our wait for the fire trucks.

  The passengers had become a part of the team. On the lower deck a passenger’s phone rang. Before it could be answered, every passenger within earshot yelled, ‘TURN THAT PHONE OFF!’

  Finally the firefighters arrived and we breathed a sigh of relief as we watched six fire trucks surround the left wing. But as we watched, we noticed something: they weren’t hosing down the plane.

  CHAPTER 26

  Evacuate!

  Four hectic minutes after we’d stopped on the runway, we finally made radio contact with the fire controller. The first thing the fire controller said was, ‘Shut down Engine 1!’

  I looked at Matt, who shrugged. We had shut down the engines – we were electrically ‘cold’. We looked at our engine display; no engines were running.

  Matt keyed the radio. ‘We have shut down all engines!’

  ‘Repeat,’ said the Changi fire controller, ‘number 1 engine is still running!’

  Matt and I were confused. Of the ten flight displays only one display was operating normally. We scanned it for something we may have missed. We could see that Engines 3 and 4 had shut down correctly, but the Engine 1 indications were all crossed (‘X’), the same as the indications for Engine 2 that had failed. The fire controller obviously thought Engine 1 was still turning. This is why they’d been standing clear. But we could see nothing to suggest that Engine 1 was running.

  The dispute about Engine 1 running went back and forth a few times until the fire controller got annoyed. I opened the A380’s cockpit window and stuck my head out the window. Engine 1 was indeed running – I could see it turning and I could hear it!

  I went back to my crew, asking Matt and Mark to crosscheck our systems to see if we could shut Engine 1 down. But we couldn’t switch it off and the fire crews still wouldn’t approach us. Matt recycled the engine fire switch – no joy. I found that incredible as I knew there were two independent wires running from the switch to the engine. Both must be broken. But there was another independent path.

  I looked up at the ‘Engine Fire’ pushbutton on the overhead panel. Matt’s eyes followed mine. Pausing, I then asked everyone if there was any reason they could think of why we shouldn’t use it. There was no response. ‘Hit it, Dave,’ I called. Dave lifted the large clear cover then hit the big red button in the middle of the console between the two front seats. Clunk! The switch popped out as it sent commands using scores of separate wires to close different valves to kill the engine.

  But nothing happened! Two of the most critical control switches for the engines had failed. I wondered what had happened to that wing. I asked if anyone had ideas for how to shut it down.

  ‘You could fire a bottle,’ said Harry.

  Matt’s and my eyes drifted up to the overhead fire panel. Next to the ‘Engine Fire’ switches are buttons that explosively discharge two bottles of toxic and corrosive agent around the engine’s housing. The agent would damage the engine components, but I also knew it would not enter the engine’s core and so would not shut the engine down. But we were plum out of other ideas.

  I told Matt to press the button.

  Nothing happened. The first fire extinguisher was inoperative.

  ‘Hit the other one, Matt,’ I called.

  He pressed the other button – but it failed to discharge. Nothing was working.

  *

  Meanwhile, back at Qantas headquarters in Sydney, Allan Rowlandson (Rowly), the deputy fleet manager, had been monitoring our progress and, once we had landed, called Coral at home. For Coral, Rowly’s call was the first news she received of our crisis in the air. Rowly said, ‘Coral, Rich has been in an incident, an engine exploded but I wanted to tell you that he is safe and on the ground. Don’t believe anything you see on TV.’

  A little overwhelmed at this sledgehammer news, Coral turned on the TV to see reports that we had crashed. She managed to keep her composure long enough to call my father, Alex and Sophia, but then collapsed into tears in front of the TV for the next half an hour.

  *

  At this point it finally dawned on me that multiple wiring looms in our wings must have been destroyed. So many wires must have been cut! The damage to the wing must have been enormous – it was extraordinary we’d still had thrust control of Engine 1 inflight.

  No one, not even aviation fire crews, approach a jet engine that is running, because people get sucked into them. We had to find another way to deal with the fact the engine was still running. The firefighters thought that perhaps the engine could be extinguished by spraying water into the intake. But in over 100 years of aviation, there has never been a procedure anywhere in the world detailing how fire crews might shut down an engine using water.

  It wasn’t, however, the first time rescuers had been confronted with recalcitrant engines. In September 1993, Air France 72, a Boeing 747–400 flying from Los Angeles, overran the runway while landing in Papeete (Tahiti) and ended up in a lagoon. Due to an electrical fault, Engine 1 ran for three and a half hours before it could be shut down. Passengers evacuating the aircraft from the forward left doors were lucky not to have been killed as they waded to the shore and passed too close to the running engine. In another accident, in November 2007, an Etihad A340–600 aircraft crashed in Toulouse during a ground engine test that went foul. Engines 1 and 2 shut down normally, but Engine 4 ran for two and a half hours before the firefighters managed to drown the engine with foam. Engine 3 ran for nine hours before it ran out of fuel.

  I asked Dave to call the Qantas engineers and ask how we could shut down the engine. Dave asked for a phone number. I knew the phone number was stored in the A380’s flight deck computer systems (because I had helped build that system) but the main screens to view it had failed. So I pulled out my iPad and passed Dave the phone number. It was a sad day for the A380. Nancy-Bird Walton’s information systems, with all their redundancies, had collapsed down to an iPad!

  Fire crews do not pump high-pressure water directly into the core of jet engines unless requested. But our situation was desperate, our multiple methods to shut down
the engine had failed and so more desperate measures were needed.

  I leaned out my left cockpit window again, to see what was happening. Nothing had changed. So many shutdown systems had failed and the engine was still running!

  Matt radioed the fire controller and instructed him to spray water over the hot brakes and foam over the fuel. We were very worried about the 1000-degree Celsius reading on the left-wing wheels. The temperature gauge stopped at 1000 degrees and so we assumed it was well over that. Anything combustible could be set on fire by simply going near a structure at 1000 degrees and we were very focused on what would happen if a gust of wind whipped jet fuel off the concrete and onto the super-heated brake callipers. We were lucky with the weather: it was calm.

  The twenty firemen started pumping 3600 litres of foam and 60,000 litres of water onto the landing gear and ground around it.

  The time was 11.55 am, and we had been stopped for seven minutes. Dave called the Qantas Crisis Centre to bring them into the loop.

  While we were confronting the challenges of electrical and radio failures, a runaway engine and trying to coordinate firefighters to deal with the leaking fuel, the ECAM was continuing its barrage of checklists. Matt was calling the checklists out, but by this stage I’d shifted focus from anything which was not safety related. Matt clearly hadn’t lost his sense of humour, crying out in the middle of a checklist: ‘I bet they can’t put this into a simulator session!’

  As the water and foam effused from the fire trucks, I asked Matt to pull up the emergency evacuation checklist so they were handy if we needed them. I knew the aircraft was certified to evacuate 853 passengers and twenty crew out of half (eight) the doors in the dark in just 78 seconds. We had all the slides available and only 440 passengers, so I reckoned I could comfortably have all of the passengers off QF32 in less than 45 seconds.

  Passenger evacuations are very dangerous. Even in airline training exercises, when all of the pretend ‘passengers’ are cabin crew and other employees, a broken leg or badly sprained ankle is not unusual. The video of the A380 certification trial can be viewed on the internet. It shows young, fit and prepared people evacuating the aircraft – and it’s a mess. One person broke his leg during the test. Ours was a complex situation and there were many reasons why it might not have been best to evacuate the aircraft. I knew there was an engine still running, and people might act irrationally around the aircraft and wander off or turn on mobile phones, and I knew those hot brakes could have ignited the fuel on the runway while people were trying to get themselves to safety. What’s more, we had many passengers with wheelchairs, veterans, babies and children on board. If anyone was injured on the slides, then others coming down behind would concertina into them. The slide is designed to bounce the person off their bottom into the air so they land on the ground in the running position. If people did not fall at the base of the slide, they might slip on the foam or the fuel. And if they didn’t slip on the fuel they might take a flash photograph, light a cigarette or walk in front of Engine 1 and get sucked into it. So I wanted to see if there was another safer way of getting people off this aircraft.