In his own words

With all the media attention on the extraordinary airmanship shown by the crew of QF32 on November 4 2010, one would be forgiven for thinking interest would have faded way.

But the real story of how the crew battled and overcame an avalanche of problems is only now being told with Captain Richard de Crespigny’s brilliant book QF32. Brilliant because, like the film Apollo 13, while you know the outcome it has you on the edge of your seat. You simply can’t put it down.

And first man on the moon Neil Armstrong agrees, saying the story is a gripping tale of overcoming seemingly insurmountable odds: “ In QF32, Richard de Crespigny recounts a hair raising story of responsibility and complexity as he brings 469 passengers and crew safely to Earth after encountering one of the most catastrophic in-flight disasters in aviation history,’’ he said.

That sentiment is backed by Chesley “Sully” Sullenberger, captain of US Airways Flight 1549 that ditched in the Hudson River on January 15, 2009: “Anyone who has flown or is about to fly should read this remarkable and gripping story of leadership and resilience.

“I’ve been in the captain’s seat myself when things go catastrophically wrong and Richard’s description of a well-trained crew acting to save lives gives a unique insight into how experience and judgment can avert a disaster.”

There is no doubt that only the crew’s training and cool heads brought QF32 back to Singapore — and what is now clear is that behind the unflappable professionalism and assured passenger announcements were deep and profound concerns about the deteriorating situation.

A hint of the real situation was given in the June edition of Australian Aviation with Captain de Crespigny saying that after the engine explosion the A380 was “operating outside the protected environment provided by certification requirements”. “We were on our own,” Captain de Crespigny said.

In his book QF32 Captain de Crespigny takes up the story after the engine explosion rocked the A380:

There was shock around me as the other pilots waited for me to speak. With the aircraft flying straight and level, and at a constant speed, I now focused on the engine and warning display, the top display in the middle of the instrument panel. Engine 2 looked very sick. All of the sensors for thrust, temperature and pressures were replaced with crosses telling us there was no data to display. It appeared that all the sensors had been blown off that engine. This was a catastrophic failure.

But I felt confident the plane wanted to stay in the air for now and I knew we had a serious problem with Engine 2. So I broke the silence.

‘ECAM actions,’ I said, and Matt charged into action. ECAM (electronic centralised aircraft monitoring) is a computer program that tells you what is wrong with the plane and makes suggestions about how to resolve it.

In the Airbus, the ECAM not only tells you what is wrong and gives you the ‘fix’, it also intelligently prioritises the problem, so you deal with fire, for instance, before an overheated engine, or a data link error. ECAM’s instructions evolve as the damage is detected and fixed, so you’re always fixing problems in the order Airbus intended.

The first ECAM warning checklist that morning was ‘Engine 2 turbine overheat ’. The checklist’s first instruction was to move the number 2 thrust lever to idle. Matt called the action and I moved the lever (only the flying pilot touches the thrust levers). The second item was to move the ‘Engine 2 master switch to off’ – this shuts off high-pressure fuel flow inside the engine and closes down the engine. I was guarded about that because when you shut an engine down you might lose the ability to restart it later.

Then the threat changed. Matt suddenly found himself at the top of a new checklist – ‘Engine 2 fire’. The ECAM had detected indications of a fire in Engine 2 and so prioritised that procedure to the top. The fire checklist appeared and then disappeared so quickly that I don’t remember seeing it. I was busy flying the aircraft and keeping a broad assessment of the whole situation, so I was not preoccupied with the ECAM checklists.

Fire on a plane is something to be feared, and the explosion followed by the frenetic and confusing alerts had put us in a flurry of activity, but Matt and I kept our focus on our assigned tasks. The ECAM line instructed ‘Fire bottle – push in 30 seconds’, then began counting down the time delay before we would action the checklist item. This pause gave me the ideal opportunity to notify air traffic control of our problem and to make a PAN (precautionary advisory notice) call. PAN is a message to air traffic control indicating a situation that requires priority. I pressed the transmit button on my sidestick and calmly transmitted: ‘PAN PAN PAN, Qantas 32, engine failure, maintaining 7400, and current heading.’

The Singapore Approach controller replied: ‘Qantas 32 copied.’

Air traffic control could now monitor our predicted track, vector other aircraft clear of us and keep us above any obstacles. Shortly after that I made another call: ‘QF32, Engine 2 appears failed. Heading 150, maintaining 7400 feet, we’ll keep you informed and will get back to you in five minutes.’

This call made it clear that we were now giving the instructions, not asking for them, and that, when it suited us, we would make other demands. The intent of this succinct radio call was to impress on ATC that we were focusing on the problem and didn’t want distracting radio calls from them. It worked a treat. ATC left us alone, but monitored us and notified other airport and rescue services that we had declared an emergency. In just 10 seconds we had sorted out ATC and taken control.

Aviate, navigate, communicate. With these three golden rules now satisfied, my attention was then directed back to ECAM.

The ECAM checklists started with engines, hydraulics, flight controls, then fuel, each of them with a series of fixes we had to perform to see if we could get the problem under control.

The explosions had obviously started a fire and disabled an engine, which we’d shut down, hopefully containing or extinguishing the fire. But the fix for the fire in Engine 2 was only the beginning of it: Engines 1, 3 and 4 were degraded in different forms, the fuel system was in a total mess, the hydraulics and electrics and pneumatics were plundered, and even our flight controls were compromised.

Any of these problems alone could disable an aircraft – having the hydraulics and electrics on the blink is a potentially catastrophic situation when you consider all the control surfaces in an Airbus run on hydraulics and electrics. Yet, unknown to us, we had a bigger headache.

We knew one fuel pump had failed, but after a few minutes we realised five more had also failed. This, along with other failures, prevented us shifting fuel around the aircraft to ensure the engines could keep firing.

We were barely seven minutes into this nightmare, still heading southeast with severe engine problems, and now moving on to process the hydraulic checklists. The main ECAM page was bad enough – so many serious checklists. There was a sea of red lights above us on the overhead panel, and pages of red synoptic displays spewed up failed systems from all over the plane. The problems with the fuel tanks and hydraulics, in particular, were growing. The ECAM system was becoming overwhelming.

Matt suddenly looked up from the screen. I looked over and I could see it in his eyes: he was worried. In fact he was now thinking that we could end up in the water. Matt suggested we turn back for Changi. Matt is absolutely one of the best FOs in Qantas; I had flown with him before and he had my complete respect. I had thought of turning back to Singapore at about the same time, but I did not want to stop Matt and distract him from these critical ECAM checklists while I made the ATC request. The aircraft was flying, and at that time we were safe above the hills. But I think Matt had reached his critical point and he wanted to head towards lower terrain and the security of Singapore.

By this stage to any observer, the cockpit would have appeared to be in utter chaos. We had to deal with continual alarms sounding, a sea of red lights and seemingly never-ending ECAM checklists. We were all in a state of disbelief that this could actually be happening.

When they recruit pilots, the Air Force and commercial airlines look for confident personality types that tend not to panic. As pilots, we learn to control our stress and minimise the adrenaline rush in panic situations and keep our reasoning going.

We were worried, but our training kicked in. We knew every part of the A380. I had been flying for 35 years and had over 15,000 hours of flying experience, plus at least a thousand hours in simulators experiencing stressful scenarios. The aircraft was flying and, although our heartbeats were elevated, we knew we needed to stay calm and in control.

There were five pilots on the QF32 flight deck, but we operated the aircraft exactly as per Airbus SOPs – as a two pilot aircraft. We had three extra pilots behind us as a resource – for delegated duties, monitoring and to offer assistance. In a flight deck team, you never have all pilots focusing on the same functions: you have task sharing, which means each pilot is responsible for their activity, and together they support each other. Matt’s job was to read out and action the ECAMs, and that was occupying 100 per cent of his time. My job was to fly the aircraft, maintain a global situational awareness, monitor Matt’s actions and make the radio calls to ATC. There was no confusion. The other three pilots monitored and assisted us.

There is a real danger in flight decks where there are surplus pilots. It would be easy for everyone to be distracted into looking at one area, meanwhile the aircraft flies into a hill or runs out of fuel. In an infamous accident, an aircraft did just this: the pilots were preoccupied running through a long checklist and failed to share tasks and monitor the fuel on board, so they ran out of fuel, and crashed.

Captain de Crespigny is referring to the United Airlines DC-8-61 that crashed at Portland Oregan in 1978 with a loss of 10 lives. The NTSB found that the crash was caused by “the failure of the captain to monitor properly the aircraft’s fuel state and to properly respond to the low fuel state and the crew member’s advisories regarding fuel state. This resulted in fuel exhaustion to all engines. His inattention resulted from preoccupation with a landing gear malfunction and preparations for a possible landing emergency. Contributing to the accident was the failure of the other two flight crew members either to fully comprehend the criticality of the fuel state or to successfully communicate their concern to the captain”.

A more tragic case was the loss of an Eastern Airlines Lockheed Tristar in the Florida Everglades in 1972 that saw 99 deaths. Again, all the crew were pre-occupied with a nosewheel landing light warning and failed to monitor the altitude.

Captain de Crespigny continues his story:

It is even more common for ‘group think’ syndrome to take hold, where individuals who detect faults fail to expose them because they believe the group is more intelligent and more correct. The ‘group think’ problem is remarkably prevalent in crews augmented with management and checking captains, because junior pilots feel intimidated.

I had been clear on the drive to the airport and in the discussion about Harry’s seat just before pushback of what the team responsibilities were and how the team would function. It was going to plan. I remember telling Mark when he was standing behind me: ‘If we are all looking down, then you look up. If we are all looking up, then you look down.’ Harry and Dave were watching us, Mark was supporting us, and we were working together.

I thought about Matt’s request. Returning to Singapore had to be a safer option than continuing southeastwards and trying to fix the plane. The checklists were still coming – they didn’t stop. It was like taking a plate from the top of a plate dispenser in a cafeteria – it would simply be replaced with another. We did one checklist after another, and they kept coming – serious checklists, ugly checklists. I was getting concerned at just how much of our aircraft had failed and what we’d be left with. There was no way to know if the problems could be resolved or if one of those problems would suddenly be the reason we could no longer fly the plane.

I pressed the transmit switch for VHF radio 1 to our air traffic controllers: ‘Singapore, Qantas 32, we require a left turn back towards Singapore to hold while we fix our problems.’

I breathed deeply to control my stress and proceeded to bank that huge, crippled aircraft as gently as I could. I had no idea what such a manoeuvre would do to our chances of staying in the air. The aircraft was flying smoothly, but the extent of our problems with hydraulics and electrics was so great I couldn’t determine how much it would affect our flying performance. Something as basic as a turn might cause something else to break. As we turned northward, I asked Dave to make a PA to the passengers assuring them they were safe.

Dave’s initial PA was brilliant, textbook perfect and broadcast calmly. It did a great deal early on to inform and calm both the passengers and crew. But besides telling the passengers that we were in control of the plane and were dealing with technical issues before landing, I saw no advantage in going into too much detail.

I think it was the longest banking turn ever completed in an A380, and when we were finally heading north, and everyone had stopped holding their breath, we got back to work.

The fuel system had so many failures and was leaking from so many points it was hard to know where to start. Looking at the fuel synoptic page, I thought we had leaks in the feed tanks for Engine 1 and Engine 2 as well as the transfer tank that sits in the left wing and fills the feed tanks. We had a fuel jettison valve failed open, slashed fuel transfer galleries, we had failed main and standby fuel pumps in feed tank 2, and we had failed transfer pumps for the left inner fuel tank.

We had very hot pneumatic bleed-air leaking from slashed ducts in the left wing. And a low reservoir air pressure over the hydraulic oil that prevents the hydraulic pumps cavitating, meaning degraded hydraulics. Some of our fire extinguishing systems had failed and, as we worked the lists, our control surfaces came up damaged too: aileron actuator faults, outer ailerons damaged, mid ailerons damaged, backup emergency electric aileron actuators failed. It was an extraordinary amount of damage – more than I’d ever seen or imagined before, and more damage than an Airbus aircraft had ever experienced in the air.

It was now about 12 minutes since the engine had exploded. I didn’t like the rate of fuel loss or the lack of ability to pump fuel to our engine feed tanks. So I made another decision shortly after we’d made the turn for Changi.

‘Qantas 32, request climb to 10,000 feet and keep us within 30 miles of the airport.’

I wanted enough altitude so we could glide back to Changi should we need to. Emergency glide and forced landings were part of the standard syllabus in the Air Force. In one of my early RAAF Macchi jet flights over the Indian Ocean more than 30 years earlier, our Macchi’s engine developed a vibration which got progressively worse. My instructor asked me what I wanted to do, and I said I didn’t like the sound of the engine or the way it was shaking the airframe. So I took the aircraft to altitude in preparation for an emergency glide and forced landing, should our only engine fail. Now, in the A380, I had the same instinct.

Singapore Approach replied: ‘Qantas 32 roger. Climb to 10,000 feet.’

The atmosphere in the cockpit suddenly changed. Harry and Dave, and then Matt and Mark, all said ‘No!”

And the gripping yarn just gets better and better.

Reflecting on the masterpiece Captain de Crespigny says: “The book took 18 months to produce, starting the day I returned to Sydney after the incident. That morning, a friend who advises large corporates on how to handle crises visited me at the house where I was avoiding the media.

“He spent three hours recording details of the flight and providing basic media awareness. My friend thought that there was potential for massive media coverage of the incident and advised me to document every aspect of the flight and the aftermath.

“This advice was priceless as I was quickly able to document specific details that I later found difficult to recall. I was approached by the first publisher to produce a book within three weeks of the incident but the final book deal was not signed for another six months.

“A ghost writer produced about 80,000 words which had an excellent structure but needed extensive technical changes. Pilots would never accept a book that contained factual errors and so much of the text was redrafted then proofed by the relevant authority.”

“I spent seven months editing the initial text and adding personal experiences. Luckily, due to my interest in knowledge management, all my knowledge accrued through my 26-year Qantas career had already been stored and categorised in one database — nicknamed ‘Quack’ — which I still maintain today.

“I had also been conducting extensive research for my big jets book for three years prior to the QF32 event. The big jets book documents technical information from aircraft designers, certifiers, aerodynamicists, manufacturers, airlines, test and instructional pilots. I had also studied the general familiarisation courses for the key Rolls-Royce, GE and Engine Alliance jet engines,” Captain de Crespigny points out.

“When it came time to write the QF32 book I had already sourced about 98 per cent of the required information. I only needed to research the major new topics regarding aerodynamics of the damaged wing and the Trent 900s stub pipe failure.”

Reflecting on what could be learned from QF32, he says: “Lessons for non-pilots — Leadership, safety systems, crisis management, continuous communications, full and open disclosure, debriefings and personal guarantees.

Lessons for pilots: Teamwork, knowledge, training, experience, leadership, automation (over-reliance).

Captain de Crespigny emphasises: “My thesis in the QF32 book is that it was the combined knowledge, training, experience and teamwork on board QF32 that protected the lives of 469 passengers and crew.

“More importantly, I hope the reader picks up that the skills prevalent in airline pilots such as Qantas are not the result of a simple training course and conversion but the result of extensive training and mentoring that was developed over many generations. The skills and experiences should not be taken for granted.”

But he notes: “There is a saying that a cook is only as good as his last meal. The same can be said for pilots — you are only ever as good as your last flight. Pilots should always be vigilant, never be complacent, for the Black Swan event that might beset your flight tomorrow is by definition one that you have not expected.” The pilot who is most capable of surviving a Black Swan event is well trained, knowledgeable, experienced and never gives up. These pilots have the skills to appreciate risk with the confidence to take control, make decisions and manage others — all without panicking.

These attributes also are necessary for leaders in all industries — for leaders are not born with them. Similarly, there is no such thing as a “natural born pilot”. Skills are learned and we are all learn at different rates.

The better pilots are not necessarily those who dux their conversion courses,but those who make steady and continual effort to improve throughout their careers and who ask for help when needed. These thoughts were best expressed by my friend Captain John Bartells (QF30: Oxygen bottle explosion and depressurisation, July 2008): “The harder I work, the luckier I get.”

Captain de Crespigny says that confidence comes from training and experience: “While the training is easy to specify and measure, the experience is not. This is why I included many personal experiences in the QF32 book — to expose the people and events that influenced and helped me throughout my career.

“Every aspiring pilot must gain as much experience as fast as possible. Read (Australian Aviation), study and join professional forums (such as GAPAN and the RAeS). My knowledge of inverting logic, the heading alignment cone and evacuation considerations were mostly derived from private study. The control checks were only addressed in the RAAF.

“Familiarise yourself with accident reports, talk to the pilots who have unique experiences and ask a senior pilot to be your mentor. When away from the home port go to the bar and discuss the “war stories”, don’t hide in your hotel room and play electronic games.”

For Captain de Crespigny warns: “When the dice rolls and it’s your turn to endure a Black Swan event, you have to hope that in a few seconds you are able to synthesise your life’s knowledge, training and experience to solve the problem that you never anticipated.

“Sully Sullenberger expressed this better in his new book “Making a Difference” when reflecting that he never knew if/when he might one day face some ultimate challenge. But the justification for his efforts was clear: ‘I never knew upon which three-and-a-half minutes my entire career might be judged’. Sully’s NTSB investigators had a different perspective: ‘That guy has been training for this his entire life’.”

In the book QF32 Captain de Crespigny says he tried to show that the well trained pilot uses automation as a tool, not a crutch: “No pilot should ever be afraid of their aircraft. Be prepared to recover your aircraft from a stalled, spinning or inverted situation.

“Never have overconfidence in, or over-reliance on automation. Automation enables ever more complicated aircraft to be operated by fewer crew, which is based on sound reasoning until the day of the Black Swan event when the unthinkable failure happens and the pilot finds himself alone in charge of a very complicated machine and without the luxury of pulling off the road and ‘calling a friend’ for advice.

“Finally, I hope I reinforced the essential need for effective teamwork. Big jets are not single-seat fighters. Establish your team, park your ego before you enter any aircraft and use every available team resource. The teams on board QF32 operated with such synergy and effectiveness that passenger Carolyn Jones, in her critique of the QF32 event, entitled her 40-page document ‘An exemplary management of a crisis event — A passenger’s perspective’.

“Pilots are entrusted with the absolute responsibility for the lives of their passengers. But with a glorious twist, pilots are also granted absolute authority. Passengers trust us and expect us to deliver. A crew built with good leadership, knowledge, training, experience and teamwork will always be best prepared for any contingency.”

QF32 is a stunning read and a must for anyone even remotely interested in things that fly and the men and women whose passion and commitment makes them fly.

If every Australian who was about to take a flight read QF32, Qantas would be the most profitable and successful airline in the sky.