CHAPTER 15

The Armstrong Spiral (HAC)

By this stage to any observer, the cockpit would have appeared to be in utter chaos. We had to deal with continual alarms sounding, a sea of red lights and seemingly never-ending ECAM checklists. We were all in a state of disbelief that this could actually be happening.

When they recruit pilots, the Air Force and commercial airlines look for confident personality types that tend not to panic. As pilots, we learn to control our stress and minimise the adrenaline rush in panic situations and keep our reasoning going.

We were worried, but our training kicked in. We knew every part of the A380. I had been flying for 35 years and had over 15,000 hours of flying experience, plus at least a thousand hours in simulators experiencing stressful scenarios. The aircraft was flying and, although our heartbeats were elevated, we knew we needed to stay calm and in control.

There were five pilots on the QF32 flight deck, but we operated the aircraft exactly as per Airbus SOPs – as a two-pilot aircraft. We had three extra pilots behind us as a resource – for delegated duties, monitoring and to offer assistance. In a flight deck team, you never have all pilots focusing on the same functions: you have task sharing, which means each pilot is responsible for their activity, and together they support each other. Matt’s job was to read out and action the ECAMs, and that was occupying 100 per cent of his time. My job was to fly the aircraft, maintain a global situational awareness, monitor Matt’s actions and make the radio calls to ATC. There was no confusion. The other three pilots monitored and assisted us.

There is a real danger in flight decks where there are surplus pilots. It would be easy for everyone to be distracted into looking at one area, meanwhile the aircraft flies into a hill or runs out of fuel. In an infamous accident, an aircraft did just this: the pilots were preoccupied running through a long checklist and failed to share tasks and monitor the fuel on board, so they ran out of fuel, and crashed.

It is even more common for ‘group think’ syndrome to take hold, where individuals who detect faults fail to expose them because they believe the group is more intelligent and more correct. The ‘group think’ problem is remarkably prevalent in crews augmented with management and checking captains, because junior pilots feel intimidated.

I had been clear on the drive to the airport and in the discussion about Harry’s seat just before pushback of what the team responsibilities were and how the team would function. It was going to plan. I remember telling Mark when he was standing behind me: ‘If we are all looking down, then you look up. If we are all looking up, then you look down.’ Harry and Dave were watching us, Mark was supporting us, and we were working together.

I thought about Matt’s request. Returning to Singapore had to be a safer option than continuing south-eastwards and trying to fix the plane. The checklists were still coming – they didn’t stop. It was like taking a plate from the top of a plate dispenser in a cafeteria – it would simply be replaced with another. We did one checklist after another, and they kept coming – serious checklists, ugly checklists. I was getting concerned at just how much of our aircraft had failed and what we’d be left with. There was no way to know if the problems could be resolved or if one of those problems would suddenly be the reason we could no longer fly the plane.

I pressed the transmit switch for VHF radio 1 to our air traffic controllers: ‘Singapore, Qantas 32, we require a left turn back towards Singapore to hold while we fix our problems.’

I breathed deeply to control my stress and proceeded to bank that huge, crippled aircraft as gently as I could. I had no idea what such a manoeuvre would do to our chances of staying in the air. The aircraft was flying smoothly, but the extent of our problems with hydraulics and electrics was so great I couldn’t determine how much it would affect our flying performance. Something as basic as a turn might cause something else to break. As we turned northward, I asked Dave to make a PA to the passengers assuring them they were safe. Dave’s initial PA was brilliant, textbook perfect and broadcast calmly. It did a great deal early on to inform and calm both the passengers and crew. But besides telling the passengers that we were in control of the plane and were dealing with technical issues before landing, I saw no advantage in going into too much detail.

I think it was the longest banking turn ever completed in an A380, and when we were finally heading north, and everyone had stopped holding their breath, we got back to work.

The fuel system had so many failures and was leaking from so many points it was hard to know where to start. Looking at the fuel synoptic page, I thought we had leaks in the feed tanks for Engine 1 and Engine 2 as well as the transfer tank that sits in the left wing and fills the feed tanks. We had a fuel jettison valve failed open, slashed fuel transfer galleries, we had failed main and standby fuel pumps in feed tank 2, and we had failed transfer pumps for the left inner fuel tank.

We had very hot pneumatic bleed-air leaking from slashed ducts in the left wing. And a low reservoir air pressure over the hydraulic oil that prevents the hydraulic pumps cavitating, meaning degraded hydraulics. Some of our fire extinguishing systems had failed and, as we worked the lists, our control surfaces came up damaged too: aileron actuator faults, outer ailerons damaged, mid ailerons damaged, backup emergency electric aileron actuators failed. It was an extraordinary amount of damage – more than I’d ever seen or imagined before, and more damage than an Airbus aircraft had ever experienced in the air.

It was now about twelve minutes since the engine had exploded. I didn’t like the rate of fuel loss or the lack of ability to pump fuel to our engine feed tanks. So I made another decision shortly after we’d made the turn for Changi.

‘Qantas 32, request climb to 10,000 feet and keep us within 30 miles of the airport.’

I wanted enough altitude so we could glide back to Changi should we need to. Emergency glide and forced landings were part of the standard syllabus in the Air Force. In one of my early RAAF Macchi jet flights over the Indian Ocean more than 30 years earlier, our Macchi’s engine developed a vibration which got progressively worse. My instructor asked me what I wanted to do, and I said I didn’t like the sound of the engine or the way it was shaking the airframe. So I took the aircraft to altitude in preparation for an emergency glide and forced landing, should our only engine fail. Now, in the A380, I had the same instinct.

Singapore Approach replied: ‘Qantas 32 roger. Climb to 10,000 feet.’

The atmosphere in the cockpit suddenly changed. Harry and Dave, and then Matt and Mark, all said ‘No!’ The thought of trying to climb with such a damaged aircraft seemed crazy to them – they thought I was talking about a maximum-thrust climb. They thought we were lucky enough to be in one piece and still airborne, and they didn’t want to be in the air when another engine failed or the fuel leaks increased, which a sudden change in attitude might trigger. I had the call and I had also dialled 10,000 feet into the altitude selector without discussion. But the other four pilots were adamant: they wanted to get the plane lower, not higher.

I think Dave took particular exception to my plan. From what he could see on the ECAM, he initially thought we might actually be flying on only one engine: Engine 2 had failed and showed ‘XX’ (no data). Engine 3 had been switched into an alternate mode and the thrust was degraded by 4 per cent. And although Engines 1 and 4 were notionally operating, they showed ‘XX’ in their thrust indicators – no data. Dave was technically right: it was possible we were flying on one normal engine, and trying to coax more thrust out of it to climb to 10,000 feet might have been a bridge too far. It might have forced a further incident in an already heavily compromised aircraft.

The other pilots perhaps wanted to make a sprint for Changi, but I was prepared to be slower arriving at Changi in order to have an ace up our sleeves: what I called the ‘Armstrong Spiral’.

Neil Armstrong, before he went to the moon with NASA, was a NACA test pilot who used to fly rocket-powered planes out of the Earth’s atmosphere. Once they’d spent their fuel breaking through the atmosphere, the pilots used small impulse rockets to lower the nose and steer their planes to re-enter the atmosphere and then glide back to the airfield. They performed a descending glide-spiral approach that used a reducing radius (as the speed reduced with altitude) around their air base. Neil Armstrong’s spiral glide descent was widely acknowledged as the best glide descent and was subsequently used to design the Space Shuttles’ descent approach (also called the Heading Alignment Cone).

I wanted to be in a position to glide into Changi in an Armstrong Spiral should the engines give up.

The aircraft was so injured, and so many of the 250,000 sensors were complaining, that I had reached the limit of my ability to absorb them all. The ECAM threw up so many failures, degradations and checklists – especially in the fuel system – that I could not evaluate all the interactions and consequences of the cascading failures. I just wasn’t confident how much of the aircraft we had left. So I wanted to be ready for the worst possible contingency – a no-engine landing.

But, for the others in the flight deck, my desire to climb set off alarm bells: the systems were so degraded we may have unknowingly been carrying a small fire, just waiting for fuel to explode all over the plane if we asked for too much thrust. A glide strategy would also have been, for them, the psychological point of defeat, the aviation equivalent of telling the crew and passengers to man the life rafts.

I was shocked the others didn’t agree with me, but I didn’t have time to discuss it. So I silently decided to accept their wishes and told myself that if the situation deteriorated further, I’d stop the ECAM checklists, head for overhead Changi, discuss my thoughts, and then climb to 10,000 feet, preparing for an Armstrong Spiral.

In the meantime I backed down and radioed Changi: ‘Qantas 32, disregard the climb to 10,000 feet. We will maintain 7400 feet.’

We went back to focusing on the central ECAM checklists – we were at that stage in the middle of a complicated fuel checklist and it was making us all feel stressed. It looked like we had hardly any fuel – and no access to the fuel we did have because the transfer tanks had failed. We were all wondering how much flying time we had left before we ran out of fuel – would it be enough to fix or land the plane?