As the combusted air leaves the combustion chamber, its temperature cools from 2200 degrees Celsius down to about 1520 degrees as it impacts against the high-pressure turbine (producing 63,000 horsepower), and then down to 1170 degrees Celsius as it impacts against the intermediate pressure turbine.
The intermediate turbine extracts 51,000 horsepower from the flow to turn the intermediate shaft (and compressor). It was probably the heat of the oil fire that did the damage. With the extraordinary torque produced by the turbine blades and the turbine disc being softened by fire, it was inevitable and only a matter of time before the disc sheared itself off its shaft. With the turbine disconnected, the intermediate compressor was now unpowered and slowed down. This action starved the high-pressure compressor (at the front of the engine) of air, causing the engine to surge (or backfire).
‘BANG’ number 1.
Meanwhile, further aft, the fire was still alight in the combustion chamber and the engine continued to introduce more fuel. There was plenty of heat and gas flow. The high energy exhaust flow engaged with the free-wheeling intermediate turbine and the result was obvious.
The intermediate pressure turbine, disconnected from its shaft, then accelerated rapidly. The normal limit speed for this disc is 8300 RPM, and it is certified to survive when over-sped by only 25 per cent, to 11,200 RPM. But the disc had been superheated and was weakened. There are three other defences designed to de-power a runaway turbine, but they might all assume the turbine is not overheated and weakened. The overheated turbine disc overstressed and exploded before the defences de-powered the turbine.
Within one second: ‘BANG’ number 2.
The 1-metre diameter, 160-kilogram turbine fractured into many pieces that punctured their way through the engine housing, exiting the engine faster than 1.5 times the speed of sound. These pieces then impacted with the engine cowl, fragmenting into smaller pieces, creating a wall of shrapnel – a ‘cluster bomb’ that cut through the wing like it was butter and sprayed the fuselage with pieces of steel, alloy and carbon fibre. Shrapnel even hit the top of the 24 metre–high (eight-storey) tail section.
One large chunk pierced straight up through the top of the wing, ripping out flight controls and obliterating every wire in the leading edge. Another large piece flew horizontally across the underside of the fuselage, slitting through the plane’s belly and cutting at least 400 wires and numerous services. The third significant piece travelled back, splintering into five pieces that holed the forward wing spar, creating devastating shockwaves and carnage within the fuel tanks.
It was surreal. It all happened so fast and with such destruction that our flight deck indications could never give us the real picture. In quick succession ECAM displayed that we had an Engine Turbine Overheat, followed by an Engine Fire, followed by an Engine Turbine Overheat. It all happened so fast that I never saw the engine fire warning. It was as if the plane was in shock; it knew it was hurt but, like a human being when badly injured, it just lay there and slowly ‘felt’ and assessed its systems one at a time.
The rest is history. Six hundred-plus wires cut, hundreds of holes in the wing, 100 impacts on the leading edge of the wing, flaps and tail plane, 200 impacts along the fuselage. At least fourteen holes in multiple fuel tanks, cut airconditioning and pneumatic pipes, severed electric generator cables. Engine 2 was a wreck. Engine 1, that could not be shut down, nor be drowned with water, was eventually extinguished three hours and 37 minutes after QF32 landed. Spraying foam into the engine stopped it, but also committed it to a 100 per cent disassembly and overhaul.
The aircraft was in a hazardous state for five days after being towed to the airport maintenance area. It was in too dangerous a condition to power up. Fuel continued to leak from the aircraft for the first two days, after which the frustrated engineers had only been able to transfer 13 tonnes of the 72 tonnes of fuel away from the aircraft. Fuel was flooding over the ground, with the added problem of thunderstorms spreading the fuel afar and lightning igniting it. In the words of one engineer: ‘You just couldn’t believe it! The aircraft was a wreck and no one had ever seen damage like it before. All the problems we had, we couldn’t work the fuel system either. We threw our recovery and refuelling manuals out the door. It beggared belief!’
It was both an unlucky and a lucky event. It was unlucky because the engine’s many defences failed. And it was lucky that no one was killed.
This is the first turbine disc failure in an RB211 engine. The first failure in 40 years and over 200 million engine hours. Each hour of every day, Rolls-Royce engines fly more than one million miles; that’s two times to the moon and back every hour! At this very moment there are 200,000 people sitting atop Rolls-Royce engines, and up to 400,000 in peak hours. Finally, the most stringent certification standards require engines to fail not more than one in every 50,000 engine hours. But this standard is not a constraint, as I have researched engine failure rates for my technical book and found them to fail at about one in every 300,000 hours – that’s six times better than the most stringent standard.
In the end, the Rolls-Royce RB211 family, which includes the Trent 900, is one of the safest ways to fly. In an industry measured by fuel costs, hours and dollars, the facts and safety record for the RB211 speak for themselves: they are remarkably safe and this accident does not skew the statistics.
I calculate the odds of this accident happening again are ten to the power of minus fifteen, or one in a million billion. That’s one million times less likely than the most unlikely event that certifiers and aircraft manufacturers consider.
Frank Ogilvie (Director of Aerodynamics – A380 Program) sent me this message shortly after the QF32 flight:
Dear Richard,
Heading up the A380 aerodynamics team, our job was to make sure that the aerodynamics of the wing combined with the weight of the airframe provided the best possible performance for the aircraft, consistent with meeting all the certification criteria. The Airbus Handling Qualities people wanted an unusually high level of residual control in the event of systems failure cases, thus providing more resilience, but which would result in a heavier airframe. Having struggled to get close to the weight and drag targets, I was reluctant to accept this philosophy. After your incident I am very proud that I was overruled and that the Handling Quality people got their way.
I was fortunate to discuss details of the QF32 flight with Claude Lelaie, the former Senior Vice President Flight Division at Airbus, and one of the two captains on board the A380’s maiden flight on 27 April 2005. I asked Claude for his opinion for what things we might have done differently. Claude’s response was telling:
Richard I have no suggestions; we never tested the A380 with the failures that you experienced. You were on your own – outside the 10-9 safety envelope that certification provides. We designed the A380 to be strong and resilient; you proved it. Everyone at Airbus is proud that our aircraft performed so well.
The cause of the QF32 engine explosion was a badly fitted oil pipe that was supposed to supply oil to the bearing unit but instead separated and leaked oil onto very hot metal. The industry and regulators identified the problem and came together to fix it.
I’m still flying the A380, and I take Coral, Alex and Sophia with me whenever I can. I believe the combination of Qantas, Airbus and Rolls-Royce is still one of the safest ways to travel.
CHAPTER 30
Wash-up
On 4 November 2010 Qantas’s brand new Crisis Management Centre in Sydney swung into immediate overdrive – pooling every resource to manage the unravelling disaster. Engineers, customer care, public relations, safety, security, executive management, Rolls-Royce and Airbus experts bunkered down in locations around the world to establish what had just happened, and what needed to be done to avert disaster and get all crew and passengers home safely. Volunteers appeared at the airport and hotels to assist and support the passengers. The Singapore air traffic controllers, emergency staff and ground staff were also
on hand to help throughout the emergency.
But we were on our own in the air. We were oblivious to the ground support swelling for us as we prepared the aircraft to land, because most of our communications with the outside world were severed save for a radio connection to Singapore air traffic control and fire services.
In the cabin, our 24 cabin crew, despite their own fears, kept all passengers informed, calm and composed. They had trained extensively to be ready for the worst possible event, while probably thinking they would never experience it. They excelled when handling every challenge.
Carolyn and Derwyn Jones, passengers in seats 80A and 80B, recounted that a cabin attendant, Luca Morton, sat in his crew seat directly in front of them and facing them at the time of the explosion: ‘Luca didn’t have such a clear view of the rear of the engine so Derwyn asked him to phone the pilots and inform them that smoke was pouring out of the engine. Luca made the call immediately. Senior crew members also arrived very quickly to check what was happening to the engine for themselves. Luca didn’t panic, but initiated a routine he had been trained to follow, and in doing so I believe he significantly contributed to our overall safety and the eventual successful outcome that was achieved by all the pilots and crew.’
Another passenger described how they became suspicious regarding the severity of the incident because Michael von Reth kept adjourning his team behind ‘drawn curtains for extended discussions . . . When they emerged from these talks they appeared unruffled and cheerful.’
In August 2011, Leigh Clifford, the chairman of Qantas, awarded all 29 QF32 crew members the ‘Chairman’s Award’:
For valour and/or selflessness so extraordinary, that the reputation of the airline has been enhanced in the eyes of other Qantas staff and the Australian travelling public.
Other extraordinary awards have included the Polaris Award (International Federation of Air Line Pilots’ Associations), the Hugh Gordon-Burge Memorial Award (Guild of Air Pilots and Air Navigators), and the Professionalism Award in Flight Safety (International Flight Safety Foundation (FSF)). This last award is remarkable because it included Michael von Reth in the citation, the first time a cabin crew member had ever received this award in the FSF’s 65-year history.
I admire and am grateful to all the passengers who expected nothing more than a safe and smooth ride, good views, and food and entertainment, but who quickly found themselves involved in this crisis. Many witnessed the explosion and aircraft damage and most viewed the damage on their inflight entertainment systems yet, despite the opportunity to panic, all passengers remained calm. They even functioned as a team to assist us on the ground.
Most people live without ever knowing how they will perform under pressure. The crew and passengers of QF32 all had the potential to panic, but no one did. The outcome was evidence that good teams are greater than the sum of their parts, and every person should be proud to know that they remained composed in the face of danger.
Teamwork is everything! As mentioned previously, I don’t think great teamwork is an accident. It’s the result of knowledge, training and experience. As the leader of the QF32 team that day, I believe my approach was never that of a hero, but that of an experienced leader who absorbs and gains from the wisdom of those who know more than I do and who are willing to share and work as a team.
The upshot of this is that, after the accident, I felt the need to bring together all of the Qantas teams who assisted in ensuring QF32 ended well. Qantas didn’t want an official function so I organised one of my own and invited 200 people to thank the teams involved that day – crisis, operations, cabin crew and technical crew – as well as numerous individuals who helped make the incident manageable. After the crisis I had worked out there were more than 1000 people involved in and around the actual event. The Changi response team alone incorporated hundreds of personnel.
The QF32 party felt like a closing event for the whole incident. I had crystal vases engraved and high-quality A380 books sent over from France, which I handed out to the guests of this party. It was a hugely emotional and cathartic night, with many amazing speeches. All members of the teams – from flight crew to crisis management, and cabin crew to the maintenance engineers – had their say, and every discussion was extraordinary for the emotion and passion that underpinned what was a remarkable response. The cabin crew discussed how they were preparing for passenger evacuations across a lake of fire; the crisis management teams in Sydney were preparing for hundreds of phone calls to next of kin; the engineers in operations back in Sydney were frantically trying to find stairs and buses and do ‘workarounds’ after we landed. Everyone was communicating to prevent what looked like an imminent aviation disaster.
It doesn’t matter how well trained you are for these incidences; when they actually occur it leaves an emotional scar.
*
How I led the team was unfortunately lost on many friends as they started to unfold this drama immediately after we landed. Their questions and the conversation turned to who argued for what, who wanted to kick who out of the seats and who had which opinions. These were fair enough questions to ask, since they had a right to know what the ‘dynamic’ or the ‘culture’ was during that flight. I answered their questions as best I could, stressing that an aircraft’s flight deck is not a committee, and that there is a pilot-in-command. I admitted that I wanted to go to 10,000 feet so we had a chance of setting up for an Armstrong Spiral, but bowed to the majority opinion against it; I also admitted that they had wanted me to not flare at the landing, but I had done it anyway; and I confirmed I had performed control checks prior to landing, which was commented upon in the ATSB preliminary report.
One of my friends asked me why I’d ignored the advice to not flare, and before I could think I said, ‘Because we all would’ve died.’ But these discussions were blown out of proportion. I told the ATSB investigators that the flight deck atmosphere was very quiet, calm and professional. I asked if there was anything in the cockpit voice recorders that suggested otherwise.
They looked at one another and back to me. ‘Actually,’ said one of the interviewers, ‘there is no cockpit recording of the event.’
‘Why not?’ I asked.
‘Because the cockpit voice recorder only records the last two hours of a flight finishing when the last engine shuts down. Your Engine 1 didn’t shut down until three hours and 39 minutes after you had landed, so the voice recorder kept recording, overwriting your flight audio with the last two hours of ground audio.
So, to this day, the ATSB can decide how the plane was piloted from the data recorders, but it sadly can’t reveal how the human factors, management and leadership contributed because the voices on our flight were scrubbed. The investigators, therefore, have the opinions of the other pilots to rely on, and my own observations.
So from my perspective and having made it through the toughest challenge of my professional life with no injuries or deaths, I can honestly say that everyone on board was lucky that they had a crew full of knowledgeable, case-hardened, experienced pilots who worked effectively as a team as we wrestled to keep Nancy-Bird Walton in the sky then bring her back to earth. My brother Michael agreed with me. He texted me after hearing of the flight: ‘Well done, Rich, but please don’t do it again!’
I needed Matt Hicks in the right-hand seat that day; not just because he was indefatigable and calm and professional, but because, when our brains had turned to mush as we calculated and recalculated our almost impossible landing performance, he immediately ruled out a 145-knot landing. Indeed it was a payback of sorts, for Nancy-Bird Walton had helped Matt, fifteen years earlier, by providing a character reference for him when he applied to join Qantas. An FO like Matt makes every captain look good. You get a first officer like Matt because the airline recognises his role as a professional, as a ‘safety and profit centre’ not a ‘cost centre’, and therefore actively develops his excellence.
I’m very focused on teams achieving outcomes, b
ut teams need excellent members and excellence doesn’t emerge from pilot factories or cut-cost licensing regimes. So thank you, Qantas. You’ve been around for 83 per cent of the time since powered flight, and the standards set by the directors Paul McGinness and Hudson Fysh over 91 years ago have been maintained and developed to produce a record sheet we can all be very proud of. The QF32 was a great flight, but we were only one of thousands of flights that take off every day, each of which are manned with excellent crews. Now that’s a remarkable 91 years of team effort.
*
I have tried to be factual in presenting the many stories in this book. Some things I have documented may not have been ideal for me or my employer, but that’s life and I can’t and won’t hide it. There is more to be gained from the QF32 experience by providing full and open disclosure than to hide behind the pretence that I and my employers are perfect. Everyone is fallible, everyone makes mistakes and we can all improve. We should all learn from other people’s mistakes, not ridicule others for them. So I’ve presented honest stories of my past, my employers past and my personality. But I am happy to present the QF32 story ‘warts and all’ so that you can learn from my experiences, my mistakes and hopefully we can all become wiser and safer in the process.
And just so no one thinks I’m above it all, an old-fogey who’s too perfect to be questioned, I leave you with this story.
On 10 November 2010, six days after the QF32 flight, when Qantas had cleared us all back to go flying, I rang David Evans for his verdict on the route check I’d been undergoing when we flew out of Changi on 4 November 2010. Although Harry was checking me he was undertaking training, so it was David who determined whether I passed or failed. The outcome?
QF32 Page 25