CHAPTER 21

It Won’t Do It!

With ECAM phases 1, 2 and 3 completed, we’d come to a point where we had tried everything to fix the aircraft. Now it was time to take stock of what was remaining and seriously look at what we could do about landing.

In phase 4, ECAM transitions from trying to fix the errors to accepting the failures and providing advice to mediate the threats. Normally ECAM would display a maximum of two or three INFO (information and guidance) items in the case of an engine failure. On our flight, Matt read out an eye-watering two pages, each page displaying fourteen INFO items. It must be an Airbus record.

In the second part of phase 4, ECAM displays a list of redundant systems that have failed. (Redundant systems by definition have backup systems, so they should be resilient to simple failures.)

In the four years I’d been flying the A380, I don’t think I’d ever seen more than two or three failed systems in this list. On QF32 we had an unprecedented large number of failed systems. Matt started reading through the list of failed systems, one item after another. I mentally tracked each failure before acknowledging it – a sign for Matt to announce the next item. Then Matt started reading page 2 – page 2! I’d never seen two pages of faults, and it was taking Matt a long time to read through the list. As I heard each failure announced only to be followed by another, I felt that pile-driver again pushing me deeper into my seat. I was trying to fly the aircraft, monitor our environment and, at the same time, listen to Matt’s calls, but I was becoming fatigued. I’d seen the failures before in earlier parts of the ECAM and I had already decided it was better to think of what was working rather than what had failed. Then Matt called, ‘Press “More” for the next more page.’ I thought, What? Another MORE page?

Matt’s voice was hoarse, he was tired and, like me, he had also inverted his logic. Finally, as he called out more inoperative systems on page 3, his voice broke and he added, ‘Whatever.’

We had a list of failures of redundant systems that spanned three pages, each page containing two columns – another Airbus record that will hopefully never be challenged. I agreed with Matt: the list of what was not working for our landing was well established. We’d just spent the last 55 minutes trying to fix all these systems. We created a new term in the Airbus lexicon that day: ‘ECAM fatigue’. Mark could sense the stress and mental exhaustion in Matt’s eyes, so passed him a fresh bottle of water.

We progressed to the next stage of the landing prep: phase 5, and the LDPA. The LDPA is an acronym for LanDing Performance Application; a Java program that runs on our two laptops. These laptops are stored either side of the two pilots and are connected to the aircraft’s networks by a 2 metre–long umbilical cord.

The pilot enters the airport, runway, weather conditions and aircraft status, then the LDPA calculates the landing performance. It sounds simple, but it’s a very complex calculation. Luckily ECAM was designed to support the LDPA. ECAM presented a list entitled ‘ALERTS IMPACTING LDG PERF’. This list contains the names of the failures that affect our landing performance that must be entered into the LDPA. For a normal engine failure that we practise in the simulator, we might see one item in this list. But we were in for another shock that day. I’m sure I must have sighed and sunk yet lower in my seat as I viewed the list in front of us. It wasn’t just a few items, the list once again extended over two pages!

We needed a break. Matt was exhausted, I was eager to talk to ATC and the passengers, and ECAM phase 5 was now a ten-minute computer exercise. I asked Dave and Harry – two expert A380 pilots to calculate our LDPA performance.

While Dave and Harry went to work on the laptops, I handed the flying of the aircraft over to Matt. He needed to rest his voice, and flying the aircraft would be the ideal way to relax. I explained that controlling the thrust and speed would be easy if he just varied the thrust on Engine 3. I then asked Mark to monitor Matt and the aircraft.

I spoke to ATC again. I told them we would need more orbits in the holding pattern before we could start our approach, that we were still leaking fuel and possibly hydraulic oil from the left wing, that we would need a long 20-mile final for a stable approach to Runway Two-Zero Centre, and that we would need fire services to meet us at the end of the runway.

After updating ATC, I was contemplating our position, fuel and options when Dave looked up from the laptop screen and shrugged.

‘What’s wrong?’ I asked.

Dave said, ‘Richard, I’ve run an LDPA calculation and it won’t work. It won’t calculate our landing performance.’

‘Dave,’ I called, ‘take out all the crap and leave only the critical failures.’

‘I have!’ Dave said.

‘Well . . . keep trying.’

We had built ourselves an aircraft that was flying well, and we had fuel, which gave us time and options. We were safe. I needed to wait until Dave and Harry came up with a performance solution for our landing, and that would clearly take time, so I now had an opportunity to brief the passengers.

I again asked Mark to monitor Matt and the aircraft. I had to be careful. I told the pilots that everything we said from now on would be on YouTube within 30 minutes of our landing. My caution was well founded as Ulf Waschbusch (seat 55A) was recording the ‘sights and sounds’ in the cabin. I thought for a while before I keyed the cabin announcement system and commenced a long briefing to the passengers. I had to be calm and empathetic. I’d just spent the last hour overseeing a very technical response to a systems crisis on the world’s largest and most technologically advanced passenger aircraft, and I didn’t know what our landing was going to be like. But we had one of the most experienced A380 crews on the planet on board that day, we were working as an exceptional team, and I was very confident we would eventually solve the problems in front of us and get everyone off the aircraft alive. I took a few long, deep breaths, then keyed the PA.

I spoke to the passengers for about ten minutes, explaining only what they already knew: that an engine had failed, there was a hole in the wing and there were fuel leaks. I spoke in general terms about the engine because I wasn’t aware of why it had exploded. ‘Don’t be worried about the engine failure – Qantas pilots train for this type of failure every three months in the simulator, and we come out sweating, so this is just another engine failure.’ I explained how we had spent the last hour reconfiguring the aircraft, that we were flying safely, we were in control of the aircraft and that we’d need another 45 minutes to set up for our approach before we landed. Fore­most in my mind was to give the passengers the confidence that I felt – that we would be okay.

‘The A380 is the newest and most advanced aircraft in the world,’ I said, ‘and although there has been some damage, we have reconfigured the systems and the aircraft is safe – you are safe. Don’t worry when you see fire engines surround us after landing,’ I said. ‘And back in Australia, 100 people have assembled in the Qantas Crisis Centre to look at our flight and monitor us, and they are looking at your personal details now. They will look after you, so don’t worry about missing any connections.’

Privately I knew the Crisis Centre would not be worrying about passenger connections – they would be focused only on whether we would be able to land. And, of course, I didn’t have a clue what Qantas actually knew about us. Both of our satellite phones had failed, and our only contact with the outside world was via Singapore ATC.

However, I think it was comforting to tell the passengers about the Qantas Crisis Centre. In fact I had toured the centre two weeks prior to this flight, and had met and quizzed the centre’s manager, Roz Wheatley.

In closing off my very long public address, I concluded: ‘Don’t worry, you are safe. We’ve practised these procedures many times in the simulator, and so now it’s time to run the procedure. Klaus, the cabin supervisor, will take care of you now, and I’ll see you on the ground.’

My PA was technical and direct, but I’m not so sure it was empathetic. Michael von Reth sensed the atmosphere was too tense; my PA had not relaxed people sufficiently. He grabbed the PA and said, ‘Actually, folks, it’s good the captain has spoken to you, but I would like to correct two points he just made. First, my name is not Klaus, it’s Michael, and, secondly, I am not the supervisor, I am THE MANAGER!’ The cabin filled with raucous laughter. I’d mistakenly called Michael ‘Klaus’ because ‘Klaus’ was his official name on the crew list (General ­Declaration). Because he’s so good at his job, Michael saw a chance to make some fun out of my mistake and lighten an otherwise grim mood. He took people’s fear and converted it into humour. Good people like Michael are priceless.

I turned off the PA – and turned back to the flight crew. I was so fortunate to have additional pilots the calibre of Matt, Mark, Harry and Dave in the flight deck. The whole time I had been speaking to the passengers, Matt and Mark had been calmly flying the aircraft and operating the radios while Harry and Dave worked the complex performance calculations.

However, we were not sure what our performance was and how we would land the aircraft. I was worried our fuel and centre of gravity imbalances were getting worse, fuel was still leaking and the fuel feeding Engine 1 was getting lower. Now it was time for the real work to begin – it was time to land.

I rejoined the crew just as performance information for our landing was coming forward from Dave and Harry. I heard Matt being asked to enter the approach speed of 145 knots in the flight management system (FMS).

With his left hand, Matt started keying buttons, then he stopped and thought. His eyes rose up to the left looking through me in a daze, and then he said: ‘It can’t be 145 knots – it’s far too slow!’

Matt was right. At 145 knots and with our weight and configuration, we wouldn’t stay in the air, we would stall. The speed Matt had been given was the base approach speed for an aircraft with functioning slats. We had no slats. It was a simple mistake, but it would have had interesting consequences if not picked up before our approach. Heads went down again in the back.

Matt was 100 per cent on the ball. After a long hour of actioning ECAM checklists, and with a hoarse voice and a tired mind, he still had enough mental space, thought and common sense to catch what the rest of us had missed. Pilots make mistakes and they cannot process data as fast as a computer. But pilots have judgement. It was a brilliant moment from Matt.

A short time later a call came from the back with the blessing: ‘Richard, we have performance – we have 100 metres!’

We had a stop margin of just 100 metres. Changi’s longest runway is 4000 metres. An A380 at maximum landing weight requires 1800 metres on a wet runway. We would need 3900 metres to stop. If we came in 3 knots faster than 168 knots, the LDPA predicted we would overrun the runway. Clearly, maintaining an accurate speed would be critical. I think flying Iroquois helicopters had preconditioned me to flying in limiting conditions. The small speed margin on this approach would be just another limit. I was not worried; the margins were thin, but achievable.

There were many failures that pushed our usual 1800-metre stopping distance up to 3900 metres. We had a dangerous combination of being 41 tonnes over our maximum landing weight and 23 knots faster than our normal approach speed. We would be touching down with 48 per cent more kinetic energy, but with dramatically less stopping power (64 per cent full brakes, applied late, and reduced spoilers, reduced aileron brakes and reduced reverse thrust).

I had the utmost faith and respect for Harry and Dave. They knew the performance applications better than I did, and if these two check captains independently thought we could land the aircraft within the constraints of the Singapore runway, and had crosschecked their data, then that was good enough for me.

Dave had made a few changes to get the calculation. First, he realised the software had defaulted to selecting the ‘wet runway’ setting, which adds an extra 15 per cent to our landing distance. If Singapore’s Runway Two-Zero Centre had been wet then, according to the LDPA, we’d have flown off the end of the runway like a ski jumper in the Winter Olympics.

There were a number of issues we had to resolve and brief before we could start the approach: cabin preparation, fuel on board, fuel leakage, aircraft damage, aircraft weight, fuel imbalances, flight controls, control checks, emergency gravity extension of the landing gear, long stabilised approach, go-around potential (engines, partial gear retraction, fuel), landing speed, increased aircraft attitude, pitch up on touchdown, nose wheel touchdown, manual braking, runway length, taxiing potential, brake fires, fuel fire, fire engines and then the emergency evacuation.

*

When considering performance for landing, you have to assure yourself the balance of forces and energy are just right for the runway environment. Mass and velocity are not to be messed with, especially when you’re landing an overweight aircraft at 166 knots (307 kilometres per hour) with half the brakes. These may sound like brutal components of a safe landing, but every pilot must grapple with these considerations, whether they are landing a space shuttle or Dad’s single-engine Piper Arrow.

Our aircraft’s rate of descent was a critical factor. It couldn’t be so high that the landing gear collapses on touchdown. I knew that the landing gear would probably collapse if our descent rate on touchdown was more than 10 feet per second (41 tonnes overweight). But the increased weight on QF32 meant our approach speed had to be increased. Our actual rate of descent during the approach was 14 feet per second.

The approach speed was also critical. We only had a 4-knot margin in our speed during the approach. Speed was our conundrum. The speed that is your friend in the air, providing enough lift to stay airborne, becomes your enemy when you approach the tarmac and then want to stop on the preciously short runway. The runway overrun area at Changi was not bad: 300 metres of pasture, a road, then another 300 metres into the sea.

We couldn’t make ourselves lighter by dumping fuel because the jettison valves and pumps had failed; and we couldn’t burn off excess fuel by staying in the air for five hours because number one engine would run out of fuel in two hours, and fail.

We were stuck with a very high approach speed. The shrapnel damage to the leading edge of the left wing had destroyed both motors that drive the droop-nose and slats. The slats are panels at the front of the mid- and outboard wing sections, which are deployed at lower speeds to aggressively control the airflow and increase lift, and so enable the aircraft to approach at slower speeds and conduct safer landings. The airflow over the inboard sections of the A380’s wing is more aerodynamically robust and reliable, so for these sections, the complicated slats are replaced by droop-nose sections. The slats are audible when you’re a passenger: about three minutes before touching down you can hear them ‘whirring’. However the slats and droop-nose surfaces were inoperative and locked tight. We were going to have to land without those crucial components.

We had another significant problem. The plane was overweight with degraded aerodynamic and engine braking, and there was now more reliance on our degraded brakes – they would absorb 50 per cent more energy than they normally would. With the brakes working so hard to stop the aircraft, they would burn white-hot and provide a new hazard, given the amount of fuel pouring out of the wing. Fire.

Then there is the other factor that comes into play when discussing a tricky landing: stalling.