On 4 November Qantas flight QF32, an Airbus A380 outbound from Singapore, ran into serious problems when a turbine on its Rolls-Royce Trent 900 engine suffered an uncontained failure. We caught up with one of the five pilots onboard, who describes how the crew professionally dealt with the incident, the sequence of events, and how the most dangerous period was after they had landed.

Captain David Evans is a Senior Check Captain at Qantas with some 32 years of experience and 17,000hrs of flight time. At the time of the incident he was in one of the observers’ seat, and thus had a ring-side view of the drama as it unfolded. The other flight deck crew were Richard de Crespigny (Pilot in Command, 15,000hrs), Harry Wubben (Route Check Captain, 20,000hrs) Matt Hicks (First Officer, 11,000hrs and Mark Johnson (Second Officer 8,000hrs). With the Cabin Service Manager (Michael Von Reth) this team boasted some 140 years of experience and over 71,000 flight hrs – a significant factor in the successful outcome of the incident.

We put a few questions to Captain Evans on his amazing story. (all incident pics courtesy D Evans).

ASChan: Can you tell me about your background? How long have you been at Qantas?

DE: I joined Qantas in 1984 – nearly 27 years I’ve been flying. I’ve flown the Boeing 767, 747 Classic and 747-400, Airbus A330 and now the Airbus A380 for the past two years.

ASChan: What does the conversion training to A380 consist of?

DE: In my position I was a check pilot on the 747-400 and part of the requirements were to have some Airbus experience for Australian CASA (Civil Aviation and Safety Authority). As the A380 was a new type, and we were a launch customer, they required us to have some Airbus experience. My training involved an Airbus A330 endorsement and fly that aircraft type (as it turned out for two years) mainly because the A380 was a little bit late from Airbus, and then the type conversion from 330 to 380 which was a lot easier than the 747 to A330 conversion.

ASChan: In terms of the QF32 flight itself – which seat were you on in that flight? What was your responsibility?

DE: My job on the flight was supervising check captain. We had a captain who was undergoing training to become a check captain who was doing a route check on the operating captain. So we had a normal crew of three, first officer, second officer and a captain who was undergoing training to become a check captain, under my supervision – so I was the supervising check captain.

ASChan: Can you give us the background to the flight, weather, time of day?

DE: Qantas 32 was the continuation of a flight from UK to Australia via Singapore. It arrived in the morning of Singapore, touching down around 7am. There was a crew change and basically a refuel stop. We took over to operate the service to Sydney, Australia. We departed Singapore about 9.30 in the morning on a clear, sunny tropical Singapore day. The events soon after departure, very soon after departure, required us to return to Singapore.

ASChan: Can you take us through the sequence of events as they happened?

DE: We departed normally, the aeroplane was relatively light and consequently used a relatively low thrust setting for departure. Taking off to the south-west out of Singapore requires a left turn, tracking out towards the Indonesian island of Batam. As we were climbing and accelerating – basically completing our acceleration stage to clean configuration, passing through around about 7,000ft, the No2 engine, without any warning, exploded.

ASChan: What were you and the crew’s first awareness of the problem? How did you notice it from the masses of messages you must have had?

DE: The first thing, of course, was the noise that alerted us to something had gone wrong. In my position in the second observers seat, so I didn’t have a good view of the instrumentation at that stage. Standing up and looking over the first officers shoulder, it was quite obvious we had a major problem with our No2 engine. Very soon after departure we had a number of ECAM (electronic centralised aircraft monitor) messages. The first one was ‘Engine 2 turbine overheat’. That requires the thrust lever to be reduced back to idle with a time condition, which is round about 30 seconds and wait for the turbine temperature to settle. During that 30-second period the message reconfigured to an ‘engine fire’ momentarily and then went back to the ‘turbine overheat’ message. The time condition re-set itself to another 30 seconds. The first officer had the presence of mind to start a stopwatch and it was obvious that that 30 second period had passed, so we (as in the operating crew) proceeded to shut the engine down as per the ECAM requirements.

ASChan: When you have this many crew on the flightdeck, what is the division of responsibilities in tackling the problem? Who does what?

DE: The Airbus system is you have a pilot flying and a pilot, non-flying. The Captain was the pilot flying, Richard de Crespigny, and the initial response is ECAM actions. As the pilot flying calls those responses, he assumes responsibility for flying the aircraft and the radio. The First Officer then proceeds to action the checklists. And our role, my role as an observer on the flightdeck at that point was literally supernumerary – we were watching the actions.

ASChan: How controllable was the aircraft after the incident? Do you think if it happened further into the flight, away from a diversion field the rest of the systems may have packed up?

DE: I don’t think so. The engine explosion, if it happened later in the flight, probably wouldn’t have made a lot of difference. We had a number of checklists to deal with and 43 ECAM messages in the first 60 seconds after the explosion and probably another ten after that. So it was nearly a two-hour process to go through those items and action each one (or not action them) depending on what the circumstances were. Our role in the backseat was to deal with some serious issues as we were doing each item. We were part of the CRM (Crew Resource Management) process, to either suggest to go ahead with the procedure or not. Certainly in the case of some of the fuel messages we elected not to open cross-feed valves and try and transfer fuel in a wing that had obvious damage.

ASChan: What happened next? You’re dealing with the messages one by one – take us through recovery and getting back to the airport.

DE: I think the timeframe was nearly two hours which went by in the blink of an eye really. Certainly with the obvious damage to the aircraft the first thing we needed to establish was some calming PAs to the passengers, which actually was my role and I made the first PA. Then also co-ordinate our cabin crew and basically keep the passengers informed as best we could as we went through the process. We made it quite clear it was going to take some time and we would keep them informed as best we could. The process – the first things we dealt with were the engine overheat, as I mentioned, and the shutdown of the engine. In the shutdown process the ECAM has an option of ‘damaged’ or not and of course we chose ‘damaged’ which then leads you through discharging some fire bottles and shutting the engine down with the fire shut-off switch. We did that but unfortunately we got no confirmation of any fire bottles being discharged. Subsequently that was more wiring damage that didn’t give us the indication. As it turns out, we did have one discharged bottle and one that didn’t which was comforting.

The Engine 2 was shut down. Part of the damage caused Engines 1 & 4 to go into a ‘degraded’ mode. The engines were still operating and Engine 3 was the only engine that was operating normally. Basically, dealing with all those things took some time, then the next series of messages were hydraulic problems. We had indications that the green hydraulic system was losing all its fluid. The Airbus A380 carries two and, unlike most conventional aeroplanes, most flying surfaces aren’t powered by hydraulics, they have their own electric-hydraulic actuators. There is a green and yellow system and they spilt their duties between things like brakes, undercarriage retraction/extension. With the green system out we had to deploy the nose gear and body gear using the gravity extension system. With the loss of the green system we dealt with that and curiously we had the hydraulic pumps of Engine 4 indicating failed as well. Engine 3, the trusty engine, was the only engine that was producing hydraulics for the aircraft for the yellow system.

ASChan: When this was happening, what was going through your head in terms of ‘this seems more serious than an engine shutdown’?

DE: It was getting very confusing with the avalanche of messages we were getting. So the only course of action we have is the discipline of following the ECAM and dealing with each one as we came through with them. The engine shutdown was completed, the hydraulic systems were dealt with and then the next systems we were looking at were the loss of various flight controls. This was due to the degradation and the loss of some electrical buses, bus 1 and 2 had failed. Basically, just going through the ECAM actions, acknowledging them and working through the systems display to see what was working and was not.

The next thing we were dealing with was the fuel. We had some obvious leaks, some severe, out of the Engine 2 feedtank. We dispatched the second officer back to the cabin to have a look and there was a fairly significant fuel trail behind the aircraft – or fluid trail because at that stage we couldn’t determine whether it was hydraulic fluid or fuel. We were getting messages about imbalance, losing fuel out of one side and not the other. And those messages were some of the ECAM messages that we didn’t follow. We were very concerned the damage to the galleries, the forward and aft transfer galleries, whether they were intact, whether we should be transferring fuel. We elected not to.

We ended up with quite a significant imbalance between the two – nearly ten tonnes of fuel. That took time to absorb and discuss whether we should or shouldn’t. Subsequent to the hydraulic system we lost some braking, the wing brakes went into what they call the emergency system – ‘accumulator only’- this gives about three or four applications before the accumulator runs out of brake energy. Also the anti-skid on the wing gear. Now with the antiskid being unserviceable on the wing gear its very important to have the aeroplane nose gear down that limits the braking on the wing gear to 1,000psi. If you have lift and not all the weight on the wing gear you run the risk of locking the brakes up and bursting tyres.

Then we come to the electrical system. Bus 1 and 2 we’d lost. We looked to start the APU but it wouldn’t take up any of the load. It just managed to burn fuel – that was all. Engine 1 drive had disconnected. Again there was a procedure to follow. We had pneumatic leaks. We had major air leaks, pneumatic leaks, in the left wing, Engine 2 bleed leak and outer wing leaks. The leak isolation system had taken over to seal up the holes for us – which was a good thing.

We lost one of the landing gear computers and once we’d extended the undercarriage using the alternate system we had no indication it was down until we’d gone to the system page to make confirmation of that. Happily it indicated that the remaining system told us the wing gear had extended correctly. And then the autothrust – with two engines in degraded mode (including Engine 3) we’d lost the autothrust and all the thrust control was done manually. Various vent, air conditioning and cooling systems had also failed. With Engine 1 and 4 being in degraded mode it was discussed whether or not to really use those actively and the decision was made to leave them in a particular power setting and control the aircraft’s speed with Engine 3 only – the one engine that was in a normal mode.

And once we had established all that then we had to work out whether we could actually stop on the runway that was available to us. We didn’t have the ability to dump fuel, the fuel dumping system had failed and we were about 50 tonnes over our maximum landing weight. In the Airbus and the A380 we don’t carry performance and landing charts, we have a performance application. Putting in the ten items affecting landing performance on the initial pass, the computation failed. It gave a message saying it was unable to calculate that many failures. So we then looked at them in more detail and rejected ones that we considered minor and things that were affecting landing performance on wet runways. It was a beautiful day in Singapore thankfully and not wet so it obviously wasn’t going to affect our landing performance. After we’d eliminated about three or four items the computer happily made a calculation and it gave us a touchdown speed of about 165kt and showed us about  130m of surplus runway (it’s a 4,000m runway) so basically said we could stop on the runway. We had also lost the use of our leading-edge slats which consequently with the overweight condition made our approach speed quite fast – 35kt more than normal.

The other thing we were concerned with was because we had lost the ability to transfer fuel we were concerned whether the aircraft’s centre of gravity (CoG) was going outside limits. So we ran some weight and balance applications to determine where our CoG would be and also whether or not we could keep lateral balance. Thankfully it remained within the flight envelope.

Then we elected to commence the approach. With the loss of various flight controls we decided to do control checks as each flap setting was taken. Richard, who was flying at this stage, elected to take first stage of flap and run through some manoeuvres to make sure the aircraft was controllable at each stage down to configuration 3 (or flap 3). The aeroplane seemed to handle quite well, very sluggish because of the loss of flight controls. Then we elected to extend the undercarriage on the gravity system and then do another series of flight control checks, to make sure it was flyable (which it was) and advise the air traffic control we were ready to make an approach. So we commenced our approach about 20 miles out, at about 4,000ft, giving us a nice, long, stable approach. Thankfully the weather was fine, wind was quite calm and we made the approach successfully.

ASChan: And there was no discussion to go around and try to burn more fuel off to get the weight down?

DE: Under the circumstances we were keen to get the aircraft on the ground. We’d spent nearly two hours in the air at that stage anyway and the longer we stayed in the air, the bigger the fuel imbalance was getting. We knew we could stop on the runway so there was no point in staying airborne any longer than we needed to be.

ASChan: So you landed – the next thing according to reports was one of the engines kept running?

DE: I think the biggest concern for us was when we had stopped on the runway. We’d organised the fire services to meet us at the end of the runway, which they did. We shut down in the normal way. As I mentioned earlier we had the APU running but sadly it wouldn’t take up any electrical load – so the aircraft went into ‘essential power’ or battery power, which gives you the use of only one VHF radio. That was dedicated to the fire commander, the fellow in charge on the ground. He advised us we still had an engine running. So they were very reluctant to come near the aircraft with the engine running. He also advised us we had some high-pressure fuel leaks coming out of the left-hand wing and as we had used maximum braking effort to stop the wing gear temperatures had gone over 900degs C, so raw fuel pouring on hot brakes. So our concerns were obviously fires and we ‘encouraged’ the fire service to come closer, which they did. We made all effort to try and shut down the No1 Engine but unfortunately it continued to run.

From then on, it became an exercise in preserving the passengers as best we could. We had the aircraft with no air conditioning and its about midday now in Singapore – so its getting very hot in the cabin. We’ve lost our satellite phone so the trusty mobile phones came out and called the company in Sydney to relay back to the company in Singapore, to dispatch some stairs and buses to the aircraft. We were 4,000m down the end of the runway and steps don’t go very fast so it was nearly an hour before we got the first set of stairs to the aircraft and another hour by the time the last passenger  departed the aircraft. So it was nearly two hours on the ground with major fuel leaks and engines running.

I think most probably the most serious part of the whole exercise, when you think back at it, was the time on the runway after we’d stopped. Because we were very concerned and conscious of evacuating the aircraft using slides. We had 433 passengers onboard, we had elderly, we had wheelchair passengers, so the moment you start evacuating, you are going to start injuring people. So a lot of discussion was had on the flight deck about where was the safest place for the passengers? We’ve got a situation where there is fuel, hot brakes and an engine that we can’t shut down. And really the safest place was onboard the aircraft until such time as things changed. So we had the cabin crew with an alert phase the whole time through ready to evacuate, open doors, inflate slides at any moment. As time went by, that danger abated and, thankfully, we were lucky enough to get everybody off very calmly and very methodically through one set of stairs.

ASChan: Was that a difficult decision to take to keep everyone onboard the aircraft?

DE: Well of course, you’ve managed to get this thing back on the runway in one piece but you don’t really want to hurt anybody. It’s not a difficult decision, its a process you have to go through to see where is the safest place for passengers. It was a unanimous decision it was onboard the aircraft – until things changed if they had changed. We had the cabin crew primed and ready to go if things deteriorated.

ASChan: Following the incident, what lessons have you learnt from this, what lessons has Qantas learnt from this? Is there anything you think you would have done differently or the crew should have done differently?

DE: Its one of those things that because we had five of us on the flight deck – of course there are lessons to be learned but I think on the day we did absolutely everything. In hindsight I don’t think any of us would have done anything differently. Questions were asked ‘why did we spend so long in the air’? But we had to spend that time in the air to determine the state of the aircraft and it took that long to do that. I think we made the right decision to keep everyone on the aircraft. We had the contingency to evacuate the aeroplane at any moment if things deteriorated. We had fire services in attendance. Certainly we had an engine we couldn’t shut down and that engine continued to run for another five hours before the fire services drowned it with fire retardant.

Lessons learnt – Qantas had a very sound system in place – because we’d spent nearly two hours in the air, the crisis centre in Sydney had been convened. All things were going very well from a company point of view. I think the initial reports coming through, even before we had landed, was the aircraft had crashed. The company was aware of that – because we’d lost our No2 electrical bus we’d lost the satellite phone, so we couldn’t communicate airborne directly with the company. They were getting telemetry from the aircraft that it was still flying.

ASChan: You had five crew on the flight deck. Do you think a standard crew of two would have been able to cope?

DE: That’s a very interesting question. Really we’ll never know the answer to that. In reality I would hope to believe that a normal crew complement would have dealt with it, cope with it in exactly the same way as we had. We just had the luxury of two other individuals to confirm the decisions that were being made by the operating pilots.

ASChan: So a standard crew would have done the same thing, but perhaps taken a little longer?

DE: May have done, may have done. But I think the end result would have been exactly the same.

ASChan: Going forward are there any recommendations for Qantas to modify its training, or Airbus to modify its training to perhaps generate these kind of ECAM messages in the sim?

DE: Its interesting you ask that question. We tried to recreate it in the sim and we can’t! I think it was just such an extraordinary day. Yes there are always lessons to be learnt, but training has been confirmed that we are training well. I’m sure Airbus will look back at its systems and there will probably be changes because, in our case, we had, as an example, messages that would say ‘aircraft CoG out of limits’ and was asking us to move fuel from horizontal stabiliser forward to bring it within limits and the next message would say the ‘THS transfer not available’. So one message contradicting another – that sort of thing, I’m sure would go back and be looked at. But at the end of the day common sense and airmanship takes over. We didn’t blindly follow the ECAMs. We looked at each one individually, analysed it, and either rejected it or actioned it as we thought we should. From a training point of view it doesn’t matter what aeroplane you are flying airmanship has to take over. In fact, Airbus has some golden rules which we all adhered to on the day – aviate, navigate and communicate – in that order.

ASChan: Interesting you mention airmanship. As a training/check captain are you personally worried about the next generation of pilots who may be fixated with the glass cockpits?

DE: Absolutely.  Nothing will replace experience. In a legacy airline like Qantas where we have the luxury, if you like, of very experienced pilots (the most junior pilot to the most senior all have extensive backgrounds in aviation – whether it be military or general aviation). That can’t be replaced.

ASChan: What’s your opinion of the A380’s survivability compared to other types you have flown?

DE: Well I think the Airbus A380 – it’s a testament to the aircraft that we managed to get the aeroplane successfully on to the ground. The fly-by-wire system, albeit with the damage we were in an alternate law, it still was very flyable. Now comparing that to other types I have flown I am sure that Boeing types would have been equally flyable, but they would have been a lot more difficult, I’m sure.

ASChan: Finally how does this incident rate in terms of other emergencies you have faced in your career?

DE: It’s pretty well up there! I’ve had other incidents in the past. My background is not military its general aviation- I’ve had engine failures in light twins – and aircraft that don’t perform very well. But this is probably the most spectacular by far!

ASChan: Thank you very much for your time.

 

Conclusion

As Captain Evans notes this crew had the ‘luxury’ of five experienced pilots to draw on when the incident occurred. But there are other salient points – the ‘avalanche’ of messages from the A380’s systems (some contradicting each other) meant that the crew drew on their full resources to decide which were important and which could be disregarded. Another key point was in ‘tricking’ the performance calculator to come up with an acceptable landing speed – again a demonstration of superb airmanship so vital in these incidents.

Another facet is the robust construction of the A380 – despite multiple failures in engines, hydraulics and electrics the aircraft degraded gracefully and was still flyable.

Finally Captain Evans draws attention to the training and professionalism of the 24 cabin crew, who kept anxious and increasingly hot passengers calm and under control, not only in the air but also on the ground while they waited for the stairs to arrive.

This incident then, while extremely unusual, goes to show the value of training, experience and the most professional type of CRM (Crew Resource Management) practised by Qantas.

 

For more on QF32 see this link to the documentary as broadcasted on Australian television as well as the footage from inside the passenger cabin with the announcement by the captain and the recording of the engine that would not shut down.