A Black Swan Event

Singapore — First came the matter of determining how much of the Airbus A380 was still functioning. Then the issue was maintaining control of the crippled aircraft flying on the edge of a stall during approach with marginal aileron control effectiveness. Finally there was the problem of sitting over a rapidly spreading pool of jet fuel in an aircraft with white-hot brakes and an engine that refused to shut down.

The uncontained engine failure on a Qantas A380 on Nov. 4, 2010, did not precipitate a catastrophic accident, and 469 people returned safely to the ground at Singapore, said the Qantas Flight 32 captain, Richard de Crespigny, because five experienced pilots in the cockpit — three in the regular crew and two check captains — worked as a unified team with cool heads and a singleness of purpose.

In his keynote speech opening Flight Safety Foundation’s 64th International Air Safety Seminar in Singapore in November 2011, and in an extensive interview with AeroSafety World, de Crespigny detailed the accident. What follows are just a few of the significant details of this incredibly complicated situation.

The triggering failure that launched the drama was the uncontained failure, while climbing through 7,000 ft, of the airplane’s no. 2 Rolls-Royce Trent 972 three-spool turbofan, perceived in the cockpit as “two bangs, not terribly loud,” de Crespigny said. The aircraft damage caused by the heavy, high-speed engine parts leaving the nacelle created what he called “a black swan event, unforeseen, with massive consequences.

“What did we know? We knew that engine no. 2 had failed, there was a hole in the wing, fuel was leaking from the wing and we had unending checklists. What we didn’t know is that no. 2 had had a failure of the intermediate pressure turbine, engine no. 1 had also been damaged, we had 100 impacts on the leading edge, 200 impacts on the fuselage, impacts up to the tail and seven penetrations of the wing, going right through the wing and up through the top. We had lost 750 wires…. We lost 70 systems, spoilers, brakes, flight controls. … Every system in the aircraft was affected.

“Flight controls were also severely damaged. It wasn’t just the slats; we [lost] a lot of our ailerons … lost 65 percent of our roll control,” de Crespigny said. The situation was made worse, he said, because, with fuel flowing out of the left wing, the aircraft was laterally unbalanced.

“We were getting pretty close to a [cockpit work] overload situation,” working through the checklists, canceling the alarms. “It was hard to work out a list of what had failed. It was getting [to be] too much to follow. So we inverted our logic. Like Apollo 13, instead of worrying about what failed, I said, ‘Let’s look at what’s working.’ If all we could do is build ourselves a Cessna aircraft out of the rubble that remained, we would be happy.”

Wanting to be well prepared and drop as much fuel as possible before making what would still be an overweight landing, de Crespigny entered a holding pattern. “We had seven fuel leaks coming out of multiple parts of the wing. At 50 tonnes overweight, and no [working] fuel-jettisoning system, this was our jettisoning system.”

Fortunate to have the longest runway in Southeast Asia available to them, the crew still had slim margins. Taking into account the known problems — including no slats and no drooping ailerons on final — the crew computed that the aircraft could be stopped 100 m (328 ft) before the runway end.

“We briefed the approach, and then — one of the more emotional events of the crisis — we did … three control checks. We proved the aircraft safe for landing in a landing configuration. We did a rehearsal for the landing with the gear down,” using gravity to drop the gear, he said, “flaps out and at approach speed, and the aircraft proved out.”

Knowing that the fly-by-wire stick would mask the aileron movement needed to maintain attitude, de Crespigny “went to the control page to look at the percentage of effort of the flight controls we had remaining. We had normal flight controls except for the ailerons, and there we’d lost 65 percent of our roll control, lost both outer ailerons, lost one of the mids, and we were left with … one mid and the high-speed ailerons, small and inboard.

“But we also had imbalances” due to fuel issues, he said. “I was very concerned about controllability. So we did the control check, and as I rolled the aircraft up to about 10 degrees of bank, we looked at the flight controls [ECAM page] and it looked like we were using like 60 to 70 percent of the remaining ailerons just to do a very gentle turn.

“I could easily reach maximum deflection of the ailerons, and when you reach that point, the spoilers come up next. You keep getting roll control by dumping more lift, increasing your stall speed. I was really worried, [knowing I had] to be so careful to not get the spoilers coming up. I had to keep the heading and yaw as accurate as possible, so I decided to use the automatic pilot for the approach — its accelerometers sense small changes and put in tiny corrections earlier than I will.”

Manual thrust control can allow for unbalanced thrust, which would induce destabilizing yaw. “We had a long approach, so to get stable thrust I exactly matched [engines] one and four and locked them down, and used engine three to adjust the approach speed, using that [engine] because it is inboard and produces less yaw. So I had accurate heading control, controls were not used very much, and with only one engine used to fine tune the speed, [we maintained] minus 2 kt to plus 3 kt for the whole approach.”

Another pilot in the cockpit warned, “‘Richard, you can’t be fast.’ During approach, our air speed margin was very small. Put in 3 kt, we run off the end of the runway.”

As it turned out, he couldn’t be slow, either. “I slowed down 1 kt and we got a speed warning,” he said. “That was unexpected, absolutely. We clearly didn’t have a 17 to 18 percent stall margin. We had two speed warnings” during the approach, and “in the flare, we got a stall warning.”
“We landed 40 tonnes overweight, a relatively good landing. When we stopped, the brakes said 900 degrees C (1,650 degrees F), but it takes five minutes for heat to get to the sensor, so 900 degrees on stopping meant that those brakes were going to go well beyond 2,000 degrees C.”

However, on landing “fuel sloshed to the front” and began gushing out of the holes in the wing leading edge. “The auto-ignition point of kerosene is 220 degrees C, so we were concerned.” Happily, the Singapore crash rescue crew’s response was superb, de Crespigny said. “Firemen came in and put foam down over the fuel, over the brakes, and the temps started going down.”

Finally, though, the engine no. 1 refused to shut down, further delaying evacuation. But with the threat of fire mitigated, the aircraft was evacuated before the engine was killed with massive amounts of fire-fighting foam. 

To see the video of extended interviews with Capt. Richard de Crespigny and Michael von Reth, chief of cabin service on QF32, go to Video Interviews with Crew of Qantas 32.

Download the PDF of the article.