What damage done?

Named after a legendary aviatrix Nancy- Bird Walton, VH-OQA was the pride of the fleet, the flagship of the airline’s advertising.

In aviation terms it was still factory fresh, with just 8533 hours and 1843 cycles at the time of the incident. Onboard was almost a full load of 440 passengers and 29 crew on the airline’s premier route, from London to Australia.

And on the flightdeck were some of the elite of the airline’s A380 flightcrew, with the addition of a supervising check captain and trainee check captain. Combined hours of the five cockpit crew was 72,000 hours, with almost 5000 hours on the A380.

For passengers, flying on the world’s latest and largest passenger jet, powered by Rolls-Royce engines, in the care of the world’s longest continuously operating and most experienced airline, should have been a recipe for a serene flight.

But, in a script that Hollywood would be proud of, that serenity was shattered, and set in motion both soul searching for the managements of Qantas, Airbus and Rolls- Royce, and recriminations.

QF32 took off from Singapore at 464. 8 tonnes and was airborne at UTC 0156:47 with engines developing 72 per cent thrust, according to the ATSB interim report.

Following the normal takeoff, the crew retracted the landing gear and flaps but at UTC 0200:22 and at an altitude of 5330ft, with thrust increased to 87 per cent for Climb 2 setting, the No 2 engine oil temperature and pressure values began to diverge from the recorded values of the other engines. Oil temperature was increasing to 179°C while the pressure was decreasing to 68psi.

Within 37 seconds at UTC 0200:59 and at 6620ft, vibrations started in the No 2 engine indicating problems in the HP compressor and turbine. Fluctuations also started in the HP rotor speed which is 12,200rpm at 100 per cent.

These events were quickly followed by the No 2 engine turbine overheat parameter activation followed by the Master Warning and Master Caution activation.

At UTC 0201:11 and at an altitude of 7250ft the No 2 engine intermediate turbine disc failed and the ECAM lighted up with a laundry list of failures as parts of the turbine disc ripped through the A380’s left wing.

On the flightdeck the crew reported that they heard two almost coincident “loud bangs”, while for the passengers the bangs were far louder.

PIC (pilot in command) Captain Richard de Crespigny selected altitude and heading hold on the A380 autopilot control panel, and First Officer Matt Hicks started his chronometer. The A380 gave a slight yaw and immediately levelled off, but the auto thrust system didn’t kick in to reduce power on the engines to maintain the selected 250kt. The PIC manually retarded the thrust.

Next the crew transmitted a PAN radio call to Changi air traffic control as they tried to understand what had happened.

The ECAM showed a warning indicating a fire in the No 2 engine that displayed for about one to two seconds.

The ECAM then reverted back to the overheat warning, which recommenced the 30 second monitoring procedure. But the crew suspected things were much worse and elected to shut down the No 2 engine.

However, efforts to discharge one of the engine’s two fire extinguisher bottles into the engine appeared to fail as there was no confirmation. A second attempt also failed.

According to the ATSB preliminary report, the flightcrew recalled the following systems warnings on the ECAM after the failure of the No 2 engine: • Engines No 1 and 4 operating in a degraded mode without some engine parameters available.

• Primary green hydraulic system – low system pressure and low fluid level.

• Yellow hydraulic system – engine No 4 pump errors.

• Failure of the alternating current (AC) electrical No 1 and 2 bus systems.

• Flight controls operating in alternate law.

• Wing slats inoperative.

• Flight controls – ailerons partial control only. • Flight controls – reduced spoiler control.

• Landing gear control and indicator warnings.

• Multiple brake system messages.

• Engine anti-ice and air data sensor messages.

• Multiple fuel system messages, including a fuel jettison fault.

• Centre of gravity messages.

• Autothrust and autoland inoperative.

• No 1 engine generator drive disconnected.

• Left wing pneumatic bleed leaks.

• Avionics system overheat.

According to Senior Check Captain David Evans, who was training Route Check Captain Harry Wubben, there were 43 ECAM messages in the first 60 seconds after the explosion and probably another 10 after that. In an interview with the Royal Aeronautical Society Evans said that “it was nearly a two hour process to go through those items and action each one or not action them depending on circumstances. ” In the cockpit the response was the opposite of the No 2 engine – temperature was under control but the pressure was up, but on the ground the situation was initially chaotic as Indonesia reported that Qantas aircraft parts had rained down on the island of Batam.

News flashes had a Qantas jet down, with the Qantas PR machine initially denying any aircraft had a problem. But quickly Sky News had images of Indonesians holding up pieces of wreckage emblazoned with the unmistakable red kangaroo as Qantas was still denying any problems.

Qantas had a problem. The unthinkable became fact. The pride of the fleet had suffered a major explosion and Twitter was alive with images of the A380 with fuel streaming from the wing flying overhead Batam Island, as passengers were transmitting images of holes in the wing from the cabin.

Shares in Qantas slumped five per cent in seconds on news of the “crash” but recovered as the news became somewhat better. But better was hardly the right description for Qantas which had suffered a string of high profile incidents, including an uncontained failure of a Rolls-Royce RB211 on a 747-400 out of San Francisco just months earlier.

Radio and television coverage went off the scale, given this was the flagship of the fleet and the symbol of the new Qantas with the Marc Newson designed interior.

And off the scale were the cascading problems for the flightcrew, who discussed the available options for the recovery of the aircraft, including an immediate return to Singapore, climbing or holding, and decided that the best approach would be to hold at the present altitude while they processed the ECAM messages and associated procedures.

“It was getting very confusing with the avalanche of messages,” Evans told the RAes.

Next Evans in the role of assisting the PIC addressed the passengers. In a very calm and measured voice he said: “I do apologise.

We have a technical issue with our No 2 engine. We have dealt with the situation and at this stage we are going to have to hold for some time. We need to lighten our load by dumping some fuel. As I am sure you are aware we are not proceeding to Sydney and we are returning to Singapore. Everything is secure and we will get back to you shortly with more information. ” The crew recalled to the ATSB that they were frequently assessing the amount of fuel on board, which they decided was sufficient to hold while they completed the procedures, and that the aircraft was controllable.

Evans adds perspective to this situation.

“Our role in the backseat was to deal with some serious issues as we were doing each item. We were part of the CRM process, to either suggest to go ahead with the procedure or not. ” ATC initially cleared for a holding pattern to the east of Singapore, but after further discussion the crew advised a requirement to remain within 30nm (56km) of Changi Airport in case they should need to land quickly.

At the same time ATC advised the crew that a number of aircraft components had been found by residents of Batam Island, which confirmed the gravity of the situation.

The SO, Mark Johnson, was immediately dispatched to the cabin to assess the damage to the No 2 engine and any related damage.

Another Qantas pilot who was a passenger on the flight brought the SO’s attention to the tail mounted camera view of the A380 on the IFE system which showed “some form of fluid leak” from the left wing. Once on the lower deck the SO could see for himself the fuel leak from underneath the wing.

Now more aware of the damage to the integrity of the fuel system, the crew elected not to initiate further fuel transfer in response to a number of the ECAM messages.

“We elected not to open cross-feed valves and try and transfer fuel in a wing that had obvious damage,” Evans said.

“We were getting messages about imbalance, losing fuel out of one side and not the other. And those messages were some of the ECAM messages that we didn’t follow.

We were very concerned about the damage to the galleries, the forward and aft transfer galleries, whether they were intact, whether we should be transferring fuel. We elected not to.

“We ended up with quite a significant imbalance between the two – nearly 10 tonnes of fuel. That took time to absorb and discuss whether we should or shouldn’t [transfer fuel],” Evans said.

Backing up this address the SCC and SO both visited the cabin on a number of occasions to talk to passengers while also reassessing the damage. Passengers were lyrical of the pilots’ handling of the situation. Of major concern to the flightcrew was the potential damage to the No 1 engine from the explosion and inspections were made from the rear lower deck.

Also the crew were unable to dump fuel as the fuel dump system had also failed so the A380 would be 50 tonnes over weight for the landing.

Controllability of the crippled A380 was also an issue, with the crew conducting a number of manual handling checks at the holding speed. The giant jet was controllable.

For the landing the crew had limited resources. Reverse thrust was only available from the No 3 engine (A380s have reverse thrust on the inboard No 2 and 3 engines only), no leading edge slats were available, there was limited aileron and spoiler control, anti-skid braking was restricted to the body landing gear, there was limited nose wheel steering and the nose was likely to pitch up on touchdown, while maximum braking would not be available until the nose wheel was on the runway. To complicate matters the wing flaps were only able to be extended to the No 3 position.

Evans gave some insight into the complexity of the problems to the RAes.

“Subsequent to the hydraulic system we lost some braking, the wing brakes went into what they call the emergency system – ‘accumulator only’- this gives about three or four applications before the accumulator runs out of brake energy. Also the anti-skid on the wing gear. Now with the anti-skid being unserviceable on the wing gear its very important to have the aeroplane nose gear-down – that limits the braking on the wing gear to 1000psi. If you have lift and not all the weight on the wing gear you run the risk of locking the brakes up and bursting tyres. ” In another complication Evans recounts that the landing distance performance application that calculates the landing speed spat out all the problems saying it was unable to calculate a result with that many failures. “So we then looked at them in more detail and rejected ones that we considered minor. After we’d eliminated about three or four items the computer happily made a calculation and it gave us a touchdown speed of about 165kt and showed us about 130m of surplus runway, so basically said we could stop on the runway. ” With the loss of the leading-edge slats and the overweight condition the approach speed was 35kt above normal.

The A380 touched down at UTC 0346, with the nosewheel touching down within six seconds, and the PIC commenced maximum braking and selected reverse thrust on the No 3 engine. Initially deceleration was slow but with maximum braking and reverse thrust, the aircraft began to slow.

The A380 came to a stop with just 150m of runway remaining.

But the drama was far from over. The aircraft’s No 1 engine controls were damaged, preventing the engine from being shut down, while fuel was leaking from the wing and the left body landing gear brakes were indicating 900°C.

According to the ATSB report the flightcrew commenced to shut down the remaining engines and, when the final engine master switch was selected OFF, the aircraft’s electrical system went into a configuration similar to the emergency electrical power mode. That rendered many of the aircraft’s cockpit displays inoperative, and meant that there was only one VHF radio available to the crew.

After working out which radio was functioning, the FO contacted the emergency services fire commander, who asked for the No 1 engine to be shut down. The FO reported that it had been shut down but was advised again it was still running.

The crew recycled the engine master switch to OFF, but to no avail so they tried the emergency shutoff and fire extinguisher bottles with no luck.

With the danger of the fuel leaks, hot brakes and an engine that couldn’t be shut down, passengers were held onboard for some time until the fire services had poured foam over the brakes.

One set of stairs was brought to the right side of the A380 and cabin crew were stationed at all doors ready for an emergency evacuation, and passengers started to disembark 55 minutes after the landing. It would be another hour before the last passenger had exited the jet.

All this time the No 1 engine kept running and various attempts to starve the engine of fuel and activate circuit breakers were not successful. Finally, it was decided to drown the engine with firefighting foam from the fire vehicles and the engine finally gave up at UTC 0653, about 2 hours and 7 minutes after the A380 landed.

As news of the events spread the crew immediately became heroes, spending time with the passengers in Singapore Airport lounge explaining the incident, and the PIC gave passengers his mobile phone number “in case Qantas didn’t look after them”, according to one passenger.

Underscoring the severity of the situation, Evans recounted to the RAes that the airline has tried to “recreate it in the sim and we can’t! I think it was just such an extraordinary day. ” So with the drama in the air safely over, the drama on the ground really heated up.

Within hours Qantas decided to ground its five other A380s as Rolls-Royce requested the three airlines – Qantas, Singapore Airlines and Lufthansa – operating Trent 900 powered Airbus A380s to conduct “basic precautionary engine checks. ”Qantas CEO Alan Joyce told media that A380 operations were suspended until “we are completely confident that Qantas safety requirements have been met. ” Singapore Airlines, which operates 11 A380s, delayed some flights overnight on November 4 while checks were carried out.

On the ground in Singapore ATSB inspectors, which had been given the lead role in the investigation, arrived the next day to find a severely damaged A380.

They found sections of the intermediate pressure (IP) turbine disc had penetrated the leading edge of the left wing inboard of the No 2 engine, resulting in damage to the leading edge structure, the front wing spar and the upper surface of the wing.

A small section of liberated turbine disc penetrated the left wing-to-fuselage fairing, resulting in damage to numerous system components, the fuselage structure and elements of the aircraft’s electrical wiring.

Released debris also impacted the left wing’s lower surface resulting in a leak from the No 2 engine fuel feed tank and left wing inner fuel tank.

Other impact damage was observed by inspectors to the No 2 engine support pylon, the No 1 engine, the left fuselage keel beam support splice, and the left wing false spar.

A small impact region was also observed on the left side of the aircraft’s fuselage.

Impact damage from the engine debris also affected a number of the aircraft systems.

The ATSB said that damage was observed to elements of the aircraft’s electrical wiring that affected the operation of the hydraulic system, landing gear and flight controls; a number of fuel system components; and the leading edge slat system.

The global insurance giant Aon put the repair bill at $70 million.

In Sydney and Los Angeles oil leaks showed up on other grounded Qantas A380s, which Joyce termed as “beyond normal tolerances. ” Rolls-Royce, however, was ultra conservative in its response but said in a statement it had “made progress in understanding the cause of the engine failure” and claimed that the incident was “specific to the Trent 900 engine,” and unconnected to the teststand failure of a Trent 1000 for the 787 that occurred in August.

Rolls also noted that the QF32/Trent 900 incident was “the first of its kind to occur on a large civil Rolls-Royce engine since 1994. Since then Rolls-Royce has accumulated 142 million hours of flight on Trent and RB211 engines. ” The use by Qantas of the highest thrust – 72,000lb – version of the Trent 900 on its A380s for its flights across the Pacific was immediately a focus for the investigation, along with the use by Qantas of the Climb 2 setting rather than the lower powered and recommended Climb 3.

The airline required the additional thrust for takeoffs from Los Angeles under certain wind and runway conditions and also to climb to cruise from Singapore before reaching Indonesian controlled airspace.

By Sunday November 7 engine components recovered from Batam Island had arrived at a Rolls-Royce facility in Derby, UK. Those components included a section of IP turbine disc, segments of low pressure stage-1 nozzle guide vanes, a number of segments of IP turbine blades, and parts of the outer engine casing.

The recovered section of IP turbine disc represented about one-third of the total disc and weighed in at 70kg. The balance of the disc has not been recovered.

The aircraft’s CVR was downloaded in Canberra but because of the problems with the shut down on the No 1 engine the audio at the time of the disc failure was over written.

On November 10 EASA issued an emergency airworthiness directive for all Rolls-Royce Trent 900 series engines calling for “repetitive inspections of the LP turbine stage 1 blades and case drain, HP/IP structure air buffer cavity and oil service tubes in order to detect any abnormal oil leakage. ” The AD said that “analysis of the preliminary elements from the incident investigation shows that an oil fire in the HP/IP structure cavity may have caused the failure of the intermediate pressure turbine disc. ” It added that “this condition, if not detected, could ultimately result in uncontained engine failure potentially leading to damage to the aeroplane and hazards to persons or property on the ground. ” The AD required that all engines are inspected within 10 flight cycles of the date of the AD and thenevery 20 flight cycles. Any engine off-wing must be inspected immediately.

At the time speculation emerged that Rolls Royce had been aware of oil leak issues with the Trent 900 and had made upgrades to the engine but had not informed operators. Airbus COO John Leahy, visiting Australia for Qantas’s 90th birthday, said that new versions of the Trent 900 engine had modifications to address the oil leak problems.

“We think the engines on the production line will be fine,” Leahy told media in Sydney.

“The new engines should not have that issue in terms of this one part that seems to have had a problem with leaking oil. ” Leahy was reported as saying that Rolls- Royce had made changes to some versions of the engine to prevent the problem before the November 4 incident.

However, Airbus spokesman Justin Dubon back-pedalled, saying Leahy was referring to changes to the engines being made in light of the mishap.

That Rolls-Royce declined media requests to clarify the situation only fuelled suspicion that the engine maker was aware of oil leak issues with the engine.

Appearing to confirm that Rolls-Royce was aware of an issue, subsequent ADs issued on December 2 were for ‘A mod’ and ‘B mod’ Trent 900 variants only, according to Flightglobal. “The latest variant, the ‘C mod’, is not subject to the latest findings.

This appears to indicate that RR identified the fault and fixed it on the latest engine variant,” the trade journal alleged.

From November 27 Qantas returned two of its six Airbus A380s – VH-OQF and VH-OQE – to service on the Sydney to London route after three engine changes, although the airline was limiting the takeoff thrust to 70,000lb.

Just prior to the release of the preliminary report on Thursday December 2, Rolls-Royce and ATSB investigators discovered the probable cause of the uncontained failure – fatigue cracking of the stub pipe that feeds oil into the HP and IP bearing structure.

The ATSB and CASA immediately issued recommendations and ADs calling for inspection within two flight cycles to look for “misaligned counter-boring understood to be related to the manufacturing process. ” The ATSB said the “condition could lead to an elevated risk of fatigue crack initiation and growth, oil leakage and potential catastrophic engine failure from a resulting oil fire. ” It added that the misalignment had “produced a localised thinning of the pipe wall on one side. The area of fatigue cracking was associated with the area of pipe wall thinning. ” Qantas said in response that the “revelation appeared to provide a more definitive explanation for the engine failure that occurred on QF32” and it would inspect its two flying A380s immediately.

Then in a shock move later that day, and while in still the preliminary stages of negotiations with Rolls-Royce – and allegedly without apparent warning – Qantas filed a statement of financial claim with the Federal Court against Rolls-Royce.

“Today’s action allows Qantas to keep all options available to the company to recover losses, as a result of the grounding of the A380 fleet and the operational constraints currently imposed on A380 services,” Qantas said in a statement. Rolls-Royce was dumbstruck by the move, say insiders in London.

According to the Sydney Morning Herald the documents filed in the Federal Court show that Qantas made the pre-emptive legal strike because it believed Rolls-Royce would have gone straight to the UK’s courts for an “anti-suit injunction’’ had it known the airline’s intentions.

‘’If [the anti-suit injunction had been] granted, there is a high likelihood that Qantas would not only be restrained from pursuing these proceedings but that it would also be shut out from having an Australian court determine whether or not it should entertain a significant claim,’’ an affidavit from Qantas states. ‘’It is because of this fear and concern that Qantas seeks on an interim and protective basis the [injunction]. ’’ According to the SMH Qantas’s lawyers had sought to keep parts of the affidavit confidential.

Later that evening EASA issued a Major Change Approval 10032805 that approved a Rolls-Royce change to the engine electronic control system software that incorporated an additional defence against engine intermediate pressure turbine disc overspeed conditions.

The next day, Friday December 3 ATSB chief commissioner Martin Dolan, when presenting the preliminary report, credbackited Qantas pilots with saving the A380.

Addressing media in Canberra Dolan said that “the aircraft would not have arrived safely in Singapore without the focused and effective action of the flightcrew. ” He particularly noted the crew’s “methodical assessment of a range of error reports on the status of the aircraft, their professional and focused handling of the situation. ” Interestingly, Dolan also elaborated on the discovery of the misaligned boring.

“We are not yet at the stage where we can definitively say that the potential fatigue problem with the oil pipe that has been detected is the cause of what happened over Batam Island, but we think that it is significant enough as a safety issue that it needed to be identified and safely dealt with. ” He confirmed this was only discovered in the days immediately before the interim report’s release, with up to that point a faulty pipe connector thought to be responsible for oil leaks discovered in Trent 900s inspected after the QF32 incident. Dolan said the ATSB couldn’t at that stage rule in or out a link between the two potential oil leak sources.

“We don’t have enough information at this stage to rule in or rule out that sort of relationship. Our best assessment at this point is that there are two potential points of oil leakage, one relates to a fitment of an oil tube … the second relates to this potential fatigue cracking. ” Dolan also used the report’s release to highlight the “very effective” cooperation with the investigation from Rolls-Royce.

The ATSB report also revealed that the engine that suffered the uncontained failure had been removed from the A380 to fix another problem and had only been refitted in February.

Originally the No. 2 engine was installed as the No 4 but was removed in September 2009 after metal was found in a chip detector, a magnet used to gather metal fragments. After the repair was completed in December the engine was reinstalled on the same aircraft but in the No 2 position.

At press time Qantas still only had two A380s flying with two new aircraft expected to be delivered and in service by Christmas.

The two new aircraft are the airline’s seventh and ninth A380s – VH-OQG Charles Ulm and VH-OQH Reginald Ansett. Another, VH-OQI David Warren, the airline’s 8th, was due early in January.

And in a last minute Hollywood twist on December 7, Qantas found one of the engines on Charles Ulm was a ‘mod A’ and warned Airbus it would not take delivery until a ‘mod C’ was fitted. Airbus in some deft foot work had the problem fixed within 24 hours to ensure a handover on Saturday December 11.

The investigation and recriminations into the near tragedy involving the world’s safest international airline, the world’s biggest commercial jet and one of the world’s most respected names in engineering, will play out for years, but is a sobering reminder that safety cannot be taken for granted.

It is also a reminder to the travelling public of the skill and professionalism of Qantas pilots – something that gets lost in the new era of low cost travel.

On that subject Evans has the last words: “Nothing will replace experience. In a legacy airline like Qantas, we have the luxury, if you like, of very experienced pilots. . . That can’t be replaced. ”