Captain Richard de Crespigny, inset, and the damaged QF32. Photos / Supplied
Qantas flight QF32 took off from Changi Airport in Singapore headed for Sydney on November 4, 2010 with 440 passengers and 29 crew on-board. The weather was ideal and pilot Captain Richard de Crespigny expected an easy trip. Here is his story.
I had been flying for three-and-a-half decades when I boarded Flight QF32. First with the Royal Australian Air Force, to which I had eagerly signed up at 17, then with Australia's national carrier, Qantas, which I joined 11 years later.
I loved my job and regarded it as a privilege to make my living doing something so challenging and satisfying, accompanied by skilled and dedicated colleagues at the top of their game. I feel exactly the same pride today.
The takeoff was perfect. I pushed the thrust levers forward from their idle position. The four Rolls-Royce Trent 900 engines roared to life as 14 litres of jet fuel and 120 tonnes of air poured into them every second.
My heart rate rose, not from fear, but from anticipation. As all pilots must be, I was prepared for the worst but hoping for the best.
The 464 tonne aircraft surged down the runway. We launched into the air at 350km/h then the 22 wheels retracted. It was 9.57am and everything was running exactly to plan. We actioned the routine 'After Takeoff ' checklist.
The Electronic Centralised Aircraft Monitoring (ECAM) system gathers data from 250,000 sensors and parameters to manage 1320 checklists. For this checklist, ECAM confirmed that all systems had successfully transitioned from takeoff mode to the configurations needed for climbing, then cruising.
You never drop your guard in charge of an incredibly complex piece of machinery with four million parts, in which hundreds of people are sitting atop 108 tonnes of jet fuel. As we passed 6000 feet it really was looking like a picture-book day. We climbed up through 7400 feet and at 10.01 I was about to turn off the seatbelt sign when we heard a relatively small boom, followed one second later by a huge BOOM! which was like nothing I'd ever heard before.
Alarms rang out through the cockpit as the master warning system sprang to life. It turned out that inside engine two, a short connecting pipe that delivers lubricating and cooling oil into the centre of the engine had not been manufactured to the correct specifications.
This 'stub pipe' had fractured, allowing oil to leak out into the engine, causing a fire.
An engine fire is always potentially dangerous in the air. But it is far from unknown and the aircraft has built-in systems to deal with it, notably a cockpit-activated extinguisher inside the engines themselves.
Similarly, engine failure is an anticipated problem, with well-rehearsed procedures in place if it occurs. The A380 is designed to fly on its remaining three engines if one fails. But while neither fire nor engine failure is catastrophic, what happened next was.
Leaking engine oil created a fire front that burnt through seals, then advanced up against the intermediate turbine disc. As the overheated disc weakened it wasn't long before the 126 turbine blades, generating 51,000 horsepower, wrenched the disc free from the shaft holding it in place.
This unpowered the compressor, causing the engine to backfire. That was the first, smaller boom.
The engine was failing from the outside in, but for an unknown reason, the inner (high pressure) turbine and compressor kept operating. The engine's computers detected a thrust loss, and so did what they were programmed to do — increase the fuel flow. That's when things went from bad to worse.
The increased fuel flow generated higher gas flows that spun up the now disconnected 160kg turbine disc until it burst like a supernova. Hundreds of pieces of shrapnel blasted through the engine, travelling at more than 2.6 times the speed of sound. That was the second huge BOOM!
The usual engine failures, the ones we train so carefully to deal with, are 'contained failures', in other words something goes wrong, and the engine can no longer work but there is no external damage.
The damaged parts remain contained inside the engine housing. What we faced on QF32 was an uncontained engine failure, and it represented danger on an entirely different scale.
Of the aircraft's 22 different systems, 21 were damaged. In all, 650 wires and network cables were severed. Less than 50 per cent of our electrics and hydraulics were operational.
We had less than half our roll controls, but worse, the aircraft was out of its balance limits in three areas because computers, pumps and pipes used to redistribute fuel through the 11 fuel tanks in the wings and tail were not working. The landing gear could only be lowered using an emergency gravity option and none of the three remaining engines were operating normally.
Fuel and hydraulic fluid leaked from the badly damaged left wing. ECAM was designed to help pilots. It prioritises actions based on which system's failure presents the most immediate danger. In four years of flying A380s I'd never seen more than two or three failed systems during a flight.
But on QF32 there was so much damage to both the systems needed to fly safely and the sensors which reported problems that ECAM became ECAM Armageddon.
We faced what felt like an overwhelming barrage of urgent checklists, some replaced so quickly by the next one that we didn't have time to take them in.
The procedures I had learned to manage crises were not working. Twelve minutes after the engine exploded, the mounting and cascading failures overloaded my mind. I figured there had to be another way out of this mess.
Sometimes we have to create our own novel solutions.
The Australian Transport Safety Bureau (ATSB) spent 966 days investigating exactly what happened — the largest investigation in its history. The ATSB analysed our workflow and said we actioned 100 ECAM checklists in the air and another 20 on the ground. While this was a record, they could never measure the stress and distractions created by the loud and piercing warning bells that forewarned us every time of a deteriorating situation.
The result was that the cockpit was one of the most stressful environments it's possible to imagine.
And yet, we all worked together and drew on all our resources to find a way to save the lives of those aboard. We spent two hours in the air assessing the damage and developing plans to maximise our chances of landing safely back at Changi. We had no option but to come in too fast (with brakes malfunctioning), too heavy (because we were loaded with excess fuel we could not jettison), with a broken wing, little roll control, no autopilot or auto-thrust. And we calculated, because of these problems, that we would stop just 139m short of the end of the 4km-long runway.
If I landed hard the tail and landing gear would break off the fuselage, sending us sliding down the runway in a sea of sparks and leaking jet fuel. Because of our lack of brakes, if I didn't pull up soon enough, we would overrun the runway with disastrous consequences — beyond it was a paddock, an access road and then sand dunes and ocean.
Just before commencing the landing I followed my air force training and conducted what are called control checks — manual tests of various crucial controls — as a dress rehearsal. This is not something that would normally ever be done in an aircraft with passengers aboard, but we were a long way from normal.
Shockingly, as we descended below 1000 feet the flight warning computers blared out 'SPEED! SPEED!', something I had only ever heard before in a simulator exercise. More shockingly, just before touchdown we got an even worse warning, one no pilot ever wants to hear, 'STALL! STALL!'. Despite these warnings, the flight control checks I completed minutes earlier gave me the confidence and courage to deal with these very disturbing alarms and persist with landing at this most critical stage.
We finally came to a stop 3900m along the runway at 11.46am. Eight fire trucks immediately surrounded our smoking and leaking hull. We had landed safely but the emergency was far from over.
The warning bells and ECAM checklists kept coming at the same time the control tower instructed us to shut down our three remaining engines and radio the fire controller. When we followed their instructions, things only got worse.
Our two remaining electrical generators failed, taking out most remaining systems. More computers failed, cockpit and cabin lights went off, emergency lights illuminated, and bells and alarms started sounding throughout the cabin.
Evacuation messages began flashing up on the screens in front of passengers. Despite this, our extraordinary cabin crew managed to maintain control and keep passengers calm.
In the cockpit we were fully occupied managing the enormous risk of fire. Our brakes were white-hot, off the scale at over 995 degrees Celsius, and highly flammable aviation fuel was flooding down near them. But there was no fire, not yet. Evacuations down emergency slides are difficult and dangerous procedures, with injuries almost inevitable. So I made the complex decision that our passengers and crew were safer inside the aircraft than out of it.
At this point the Changi fire controller told us to shut down engine one. We looked at our display to double-check, and told him we had already done so. He then gave us the unwelcome news that this engine was still running.
We operated three more emergency switches to try to kill that engine, but nothing worked. There was nothing we could do to stop it, so instead the fire crews concentrated on hosing water on the brakes and covering the fuel with foam.
As the brakes cooled so did the commensurate chance of fire. But engine one was still running uncontrollably when I decided conditions were safe enough to finally begin disembarking passengers down stairs on the opposite side of the aircraft and onto buses 52 minutes after we had come to a stop.
Three-and-a-half hours after we had landed, the firefighters pumped foam into engine one, finally stopping it but destroying it in the process.
Almost two hours after stopping on the runway, the last of the passengers were safely on their way to the terminal. Ten minutes later, I set off for the terminal myself, intent on the task of debriefing everyone who had been on board.
- Extract from FLY! Life Lessons From The Cockpit Of QF32 by Richard de Crespigny
From skipping the queues to planning your parade spot, here's all you need to know.