CRM at its best: Qantas flight 32, learning from the recent past

“Let’s look at what’s working. If all we could do is build ourselves a Cessna aircraft out of the rubble that remained, we would be happy.”

qantas-1Photo:  ATSB Aviation Occurrence Investigation AO-2010-089 Final Report

In homage to an outstanding performance of an A380 flight crew facing a catastrophic failure of an inboard engine following an uncontained explosion on the morning of November 4th, 2010.

THE OCCURRENCE FLIGHT (1)

The aircraft departed Changi Airport, Singapore on a scheduled passenger flight to Sydney, Australia. About 4 minutes after take-off, while the aircraft was climbing through about 7,000 ft, the flight crew heard two ‘bangs’ and a number of warnings and cautions were displayed on the electronic centralised aircraft monitor (ECAM).

Initially, the ECAM displayed a message warning of turbine overheat in the No. 2 (inner left) engine. That warning was followed soon after by a multitude of other messages relating to a number of aircraft system problems. After assessing the situation and completing a number of initial response actions, the flight crew was cleared by ATC to conduct a holding pattern to the east of Changi Airport. While in the holding pattern, the flight crew worked through the procedures relevant to the messages displayed by the ECAM. During that time the flight crew was assisted by an additional crew that were on the flight deck as part of a check and training exercise. The aircraft sustained significant impact damage from a large number of disc fragments and associated debris. The damage affected the aircraft’s structure and a number of its systems.

A large fragment of the turbine disc penetrated the left wing leading edge before passing through the front spar into the left inner fuel tank and exiting through the top skin of the wing. The fragment initiated a short duration low-intensity flash fire inside the wing fuel tank.

Another fire has occurred within the lower cowl of the No. 2 engine as a result of oil leaking into the cowl from the damaged oil supply pipe. The fire lasted for a short time and self-extinguished.

The large fragment of the turbine disc also severed wiring looms inside the wing leading edge that connected to a number of systems.

A separate disc fragment severed a wiring loom located between the lower centre fuselage and body fairing. That loom included wires that provided redundancy (back –up) for some of the systems already affected by the severing of wires in the wing leading edge. This additional damage rendered some of those systems inoperative.

The aircraft’s hydraulic and electrical distribution systems were also damaged, which affected other systems not directly impacted by the engine failure. (Excerpted from In-flight Uncontained Engine Failure. Airbus A380-842, VH-OQA. Australian Transportation Safety Board Transport Safety Report Executive Summary)

We, aviation professionals and aviation safety scholars, sometimes tend to focus, perhaps too much, in aviation accidents and incidents. They are a great source of knowledge and learning that we later try to convert in accident prevention strategies. The human limitations, the error and its multiple causes and sometimes terrible consequences have a charming effect on us.

This time I want to do something different. This time I want to highlight the positive aspects of human performance: those unique things human beings do well, presented to us as outstanding airmanship, leadership and teamwork. All my respect to those five pilots, impeccably led by Captain Richard de Crespigny.

Next, I share the article published in AeroSafety World, with Captain de Crespigny’s first-hand testimony. All credit to the author and the publisher. The photos were added by me:

A BLACK SWAN EVENT. SAVING A CRIPPLED A380 (2)

Singapore — First, came the matter of determining how much of the Airbus A380 was still functioning. Then the issue was maintaining control of the crippled aircraft flying on the edge of a stall during approach with marginal aileron control effectiveness. Finally, there was the problem of sitting over a rapidly spreading pool of jet fuel in an aircraft with white-hot brakes and an engine that refused to shut down.

The uncontained engine failure on a Qantas A380 on Nov. 4, 2010, did not precipitate a catastrophic accident, and 469 people returned safely to the ground at Singapore, said the Qantas Flight 32 captain, Richard de Crespigny, because five experienced pilots in the cockpit — three in the regular crew and two check captains — worked as a unified team with cool heads and a singleness of purpose.

In his keynote speech opening Flight Safety Foundation’s 64th International Air Safety Seminar in Singapore in November 2011, and in an extensive interview with AeroSafety World, de Crespigny detailed the accident. What follows are just a few of the significant details of this incredibly complicated situation.

The triggering failure that launched the drama was the uncontained failure while climbing through 7,000 ft, of the airplane’s no. 2 Rolls-Royce Trent 972 three-spool turbofan, perceived in the cockpit as “two bangs, not terribly loud,” de Crespigny said. The aircraft damage caused by the heavy, high-speed engine parts leaving the nacelle created what he called “a black swan event, unforeseen, with massive consequences.qantas-2qantas-6qantas-adicional

Photos:  ATSB Aviation Occurrence Investigation AO-2010-089 Final Report

“What did we know? We knew that engine no. 2 had failed, there was a hole in the wing, fuel was leaking from the wing and we had unending checklists. What we didn’t know is that no. 2 had had a failure of the intermediate pressure turbine, engine no. 1 had also been damaged, we had 100 impacts on the leading edge, 200 impacts on the fuselage, impacts up to the tail and seven penetrations of the wing, going right through the wing and up through the top. We had lost 750 wires…. We lost 70 systems, spoilers, brakes, flight controls. … Every system in the aircraft was affected.

“Flight controls were also severely damaged. It wasn’t just the slats; we [lost] a lot of our ailerons … lost 65 percent of our roll control,” de Crespigny said. The situation was made worse, he said, because, with fuel flowing out of the left wing, the aircraft was laterally unbalanced.

“We were getting pretty close to a [cockpit work] overload situation,” working through the checklists, cancelling the alarms. “It was hard to work out a list of what had failed. It was getting [to be] too much to follow. So we inverted our logic. Like Apollo 13, instead of worrying about what failed, I said, ‘Let’s look at what’s working.’ If all we could do is build ourselves a Cessna aircraft out of the rubble that remained, we would be happy.”

Wanting to be well prepared and drop as much fuel as possible before making what would still be an overweight landing, de Crespigny entered a holding pattern. “We had seven fuel leaks coming out of multiple parts of the wing. At 50 tonnes overweight, and no [working] fuel jettisoning system, this was our jettisoning system.”

Fortunate to have the longest runway in Southeast Asia available to them, the crew still had slim margins. Taking into account the known problems — including no slats and no drooping ailerons on final — the crew computed that the aircraft could be stopped 100 m (328 ft) before the runway end.

“We briefed the approach, and then — one of the more emotional events of the crisis — we did … three control checks. We proved the aircraft safe for landing in a landing configuration. We did a rehearsal for the landing with the gear down,” using gravity to drop the gear, he said, “flaps out and at approach speed, and the aircraft proved out.”

Knowing that the fly-by-wire stick would mask the aileron movement needed to maintain attitude, de Crespigny “went to the control page to look at the percentage of effort of the flight controls we had remaining. We had normal flight controls except for the ailerons, and there we’d lost 65 percent of our roll control, lost both outer ailerons, lost one of the mids, and we were left with … one mid and the high-speed ailerons, small and inboard.

“But we also had imbalances” due to fuel issues, he said. “I was very concerned about controllability. So we did the control check, and as I rolled the aircraft up to about 10 degrees of bank, we looked at the flight controls [ECAM page] and it looked like we were using like 60 to 70 percent of the remaining ailerons just to do a very gentle turn.

“I could easily reach maximum deflection of the ailerons, and when you reach that point, the spoilers come up next. You keep getting roll control by dumping more lift, increasing your stall speed. I was really worried, [knowing I had] to be so careful to not get the spoilers coming up. I had to keep the heading and yaw as accurate as possible, so I decided to use the automatic pilot for the approach — its accelerometers sense small changes and put in tiny corrections earlier than I will.”

qantas-3qantas-4qantas-5Photos: ATSB Aviation Occurrence Investigation AO-2010-089 Final Report

Manual thrust control can allow for unbalanced thrust, which would induce destabilizing yaw. “We had a long approach, so to get stable thrust I exactly matched [engines] one and four and locked them down, and used engine three to adjust the approach speed, using that [engine] because it is inboard and produces less yaw. So I had accurate heading control, controls were not used very much, and with only one engine used to fine tune the speed, [we maintained] minus 2 kt to plus 3 kt for the whole approach.”

Another pilot in the cockpit warned, “‘Richard, you can’t be fast.’ During approach, our air speed margin was very small. Put in 3 kt, we run off the end of the runway.”

As it turned out, he couldn’t be slow, either. “I slowed down 1 kt and we got a speed warning,” he said. “That was unexpected, absolutely. We clearly didn’t have a 17 to 18 percent stall margin. We had two speed warnings” during the approach, and “in the flare, we got a stall warning.”
“We landed 40 tonnes overweight, a relatively good landing. When we stopped, the brakes said 900 degrees C (1,650 degrees F), but it takes five minutes for heat to get to the sensor, so 900 degrees on stopping meant that those brakes were going to go well beyond 2,000 degrees C.”

However, on landing “fuel sloshed to the front” and began gushing out of the holes in the wing leading edge. “The auto-ignition point of kerosene is 220 degrees C, so we were concerned.” Happily, the Singapore crash rescue crew’s response was superb, de Crespigny said. “Firemen came in and put foam down over the fuel, over the brakes, and the temps started going down.”

Finally, though, the engine no. 1 refused to shut down, further delaying evacuation. But with the threat of fire mitigated, the aircraft was evacuated before the engine was killed with massive amounts of fire-fighting foam.

qantas-ultima

Photo: ATSB Aviation Occurrence Investigation AO-2010-089 Final Report

REFERENCES

  1. In-flight Uncontained Engine Failure. Airbus A380-842, VH-OQA. Australian Transportation Safety Board. ATSB Transport Safety Report.  Aviation Occurrence Investigation AO-2010-089. Final Report 
  2. A Black Swan Event. Saving a crippled A380. DonoghueJ.A. AeroSafety World December 2011/January 2012
  3. Interview with Capt. Richard de Crespigny – Part 1
  4. Interview with Capt. Richard de Crespigny – Part 2

**********************

minime2By Laura Duque-Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@dralaurita. Human Factors information almost every day 

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s