CHAPTER 22

Through the Looking Glass

Most people think that when you stall an aircraft you simply run out of speed, which means air is no longer flowing over the wing’s surfaces fast enough to create the differential pressure effects that create ‘lift’. In this case, the law of gravity takes over from the rules of aerodynamics and you crash. To be a bit more precise, an aircraft doesn’t stall – the wing stalls. It’s not a stall of the engine, but an aerodynamic stall where the wings do not have sufficient lift to support the aircraft, and an immediate increase in airspeed and a decrease in pitch attitude is needed to recover. Furthermore, the wing does not stall at a given speed, it stalls at a certain angle of attack (the angle at which the air impinges on the wing). Most commercial jet wings stall at an angle of attack of between 10 and 20 degrees.

Stalling training is a scary event for beginner pilots. Initially ignorance is bliss as you enjoy the pleasures and serenity of controlled flight, thinking ‘this is easy’. But soon enough your overconfidence is shattered, interrupted by shaking, wild oscillations and partial loss of control. Your stall training might end up as spinning training – as I discovered on my first flight with Bill Evans!

Commercial aircraft should never be flown close to the stall. Our normal minimum speeds are selected to guarantee high margins – we can lift 20 per cent more weight in the cruise and 51 per cent more weight as we approach to land. This means the aircraft can encounter turbulence and wind shears yet still have sufficient margin to accommodate the flare. The flare is when we lift the plane’s nose and consequently slow the rate of descent to touchdown. Then we present the landing gear to the tarmac and gently fly the wheels onto the runway, kissing the ground and giving that gentle landing that pilots and ­passengers like so much.

In the case where we do mishandle a degraded aircraft, the Airbus flight warning computers give us two types of warnings of an approaching stall. The first warning is a loud aural warning, ‘SPEED, SPEED’, that interrupts everything else. This warning tells you that you must add thrust immediately to speed up. If you ignore this warning and continue to slow, then a very loud ‘STALL, STALL’ deafens your senses when the angle of attack increases to within 2 degrees of the stalling angle of attack. During my 25 years of flying in Qantas, I had never heard any stall warnings except in the simulator.

Landing an A380 is a precision exercise. Pilots are trained to factor the many variables in the aircraft, runway and weather to execute a safe landing every time. The speed must be flown accurately – too slow and you might stall as you flare the aircraft to land – too fast and you might touch down on the nose wheel first and ‘trip’ the airframe over. The rate of descent is also critical. At the certified maximum landing weight of 391 tonnes, if it’s higher than 12 feet per second the landing gear will probably collapse. Then you have to touch down in the landing zone – if your wheels touch down short of the runway, they might be ripped off as you mount the lip to the runway. If you flare too high or too slowly and float along the runway, then you risk overrunning the runway. Pilots aim for a smooth touchdown on dry runways, but a firm touchdown on wet runways to prevent aquaplaning on top of the water and overrunning the runway. Finally, the A380’s long and wide airframe provides additional limitations for a safe landing. We have to ensure we touch down with the wings level and the nose not too high – otherwise we’ll scrape one of the US$18.5 million engines, the wing tips or the tail. So pilots minimise the risks by calculating their actual landing distances then factoring this distance by another two thirds.

Most of our safety margins (and factors) are reduced in the event of emergencies. The LDPA Dave and Harry used to calculate our landing parameters reduced our approach speed to give a 19 per cent speed (41 per cent weight) margin to stall instead of the usual 23 per cent speed (51 per cent weight). Also, the landing distance would not be factored – we would have to land the aircraft more quickly but just as ­accurately as the Airbus test pilots when they certified the A380.

I was acutely aware of the compounding errors that would challenge every skill I had developed in my 35-year career. We were going to be coming in too fast and landing an aircraft that was way too heavy, out of balance, with damaged wings, little rolling capability and broken wheel brakes, speed brakes and an inoperative engine reverser. Perhaps all these failures would add up to be an impossible mix. Perhaps we would be unable to stop on the runway. Perhaps we were looking at an inevitable runway overrun.

Dave and Harry’s calculations were a great relief. We had a 100-metre margin on the Changi runway. It wasn’t much, but it was sufficient.

As we discussed the approach one of the pilots said, ‘Rich, be careful – you can’t afford any excess speed. You’ll have a high nose attitude, and there’s little or no flare.’ Despite these concerns, my pragmatic conclusion was the same: we would ultimately have to land this aircraft, and there was a limit to how long we could remain airborne to look at other options. I thought we were safer orbiting Singapore than any other airport. There were no runways in Indonesia or Malaysia that were longer than Singapore’s runways and that could provide us with extra safety margins.

The ‘little or no flare’ comment also triggered danger signals in my mind. I thought, What are we going to do? Come in at 166 knots (307 kph) and not flare? There was no way I would land this A380 without flaring. We didn’t have slats and we couldn’t use full flaps – both of which would let us approach at a slower speed. And we were 41 tonnes overweight. All these factors would cause our approach speed and our rate of descent to be increased, and we could easily buckle or break the aircraft at touchdown.

I didn’t really resolve these concerns. We had full use of the elevators, which were the control surfaces used to pitch the aircraft up into the flare (or a stall if you overdid it) although our centre of gravity was close to our aft limit. We had lost 65 per cent of our aileron roll-control, so the fly-by-wire computers that lift the spoilers to initiate roll would probably work them more aggressively now. Spoilers spoil lift over the wing, and so increase the stall speed. Increasing the stall speed is not a problem when you approach to land at a speed 23 per cent faster than your stall speed, but nasty consequences were possible when our margin was reduced to 19 per cent or even lower. And I would discover later the landing performance application calculations and pilot airspeed displays were faulty.

I was initially happy to accept the computer-calculated approach speed of 166 knots, but I had this nagging thought at the back of my head: a computer using 250,000 sensors may be the greatest thing to happen to aviation, but it was still just a computer that was still subject to the rule: ‘Garbage in – garbage out!’ It couldn’t and shouldn’t override the common sense of an experienced pilot. My job was to fly the plane and apply a sense of reasonableness, not to just blindly follow commands from a computer program that had just failed to give us performance data. We had a very high approach speed, a broken aircraft, and only 100 metres of surplus runway.

I paused and looked away. With our weight, imbalances and complex failures I now had growing doubts the aircraft would be manageable at our approach speed of 166 knots. My primary concern was whether we would have sufficient roll and pitch control. Even though the flight control software had degraded to alternate law, which meant we had no stall protections, I was not worried about this at the time because I knew the A380 had an independent stall warning system that bypassed the flight control computers, and I had told the others as much.

I was not too worried about stalling the aircraft at that time, but I was not aware of all the damage to the wings and the flight controls.

I asked Matt to read through our status screen, starting with the landing gear. The normal landing gear extension system had failed but we could default to a standby gravity system. It would take a few extra minutes, but we had time on our side. So we could get the wheels down, but one of the landing gear computers had failed, so we would lose half our gear indications. Bottom line: emergency gravity extension, three extra minutes, half the sensors.

The brakes were a mess. We’d lost the auto-brakes and the anti-skid was failed on the wing brakes. Half the spoilers were failed. The brakes had reduced to the emergency system, reducing the wing brake pressure from 3000 psi to 1000 psi and we would have only six brake applications before we ran out of pressure. Bottom line: I could press hard on the brake pedals once and only after the nose wheel touches down.

Flight controls: three fuel imbalances, centre of gravity problems, half spoilers and 35 per cent roll control. Bottom line: use the autopilot for finesse. Lock thrust levers 1 and 4, then use only Engine 3 to control the speed. This should minimise yaw-roll and flight control (aileron and spoiler) demands.

Fuel: trashed. But we had at least two hours of fuel remaining on Engine 1 and more on Engines 3 and 4. Bottom line: sufficient fuel, but don’t go around unless absolutely necessary.

Engines: three engines working – great. But unsure whether Engines 1 and 4 will overheat and blow up if we attempt a go-around. Bottom line: no problems, but don’t go around unless absolutely necessary.

Flare: flare late to minimise float distance and runway stopping distance. Flare early to arrest rate of descent to less than 6 feet per second. Bottom line: don’t crush the landing gear!

We were still left with the major headache of landing with­out stalling, breaking up or running off the end of the runway. Somehow we had to get our approach speed low enough to effect a safe landing, without flying so slow that we stalled and fell out of the sky.

There was only one thing we could do: we’d have to con­firm the aircraft’s performance before we landed. We’d have to perform a series of control checks to set our real minimum airspeed, as opposed to our theoretical performance as stated by the computers. With 469 people on board, we’d have to see how close we really were to a stall.

This decision to do control checks would be controversial to 90 per cent of commercial pilots. The control check involves actually inducing the aircraft to do what the controls are communicating or warning against. There is no reference in any Airbus manual for how to conduct control checks in fly-by-wire aircraft. Indeed it is a mark of the divisiveness of this issue that nowhere in Qantas literature, manuals or SOPs is there any mention of control checks. Neither is there any reference from Australia’s Civil Aviation Safety Authority (CASA) – our federal aviation safety regulator.

Flight control checks are not spoken about. To people who don’t fly for a living, conducting a flight control check might seem reckless and inviting disaster. Even to many who do fly for a living, the idea of knowingly pushing an aircraft to the point where you might get a stall warning in the cockpit is regarded as cowboy behaviour.

I was taught control checks in the RAAF; the idea is that if your aircraft has taken enemy fire or you’ve collided with a friendly plane while in formation, and you have a damaged airframe and/or flight controls, you have to be able to test how the aircraft performs when it approaches, slows and flares before you try to do it seven seconds and 50 feet above the tarmac. If you worry that your aircraft has damaged slats and holes in the wings, and you’re not sure how it will perform, you typically do a control check as you change to each successive configuration, all the while circling your runway at a safe height so you can accelerate and recover if you start to lose control.

It may be, in our case, for instance, that your computers tell you that you’ll stall at 160 knots on a 3-degree approach slope. So you don’t want to fly the approach at 166 knots – you really want to do it with an extra 19 per cent margin – at 190 knots.

So you do flight control checks at a safe altitude to see if you can gently manoeuvre the aircraft in roll, pitch and yaw. If the aircraft departs normal flight, or if a stall warning siren is triggered at any stage, then this indicates significant wing and flight control damage and so the approach speed should be increased (by about 20 per cent) to remove the risk of losing control during the approach and landing manoeuvre. I have to stress that this is my own very basic procedure based upon standards test pilots use to certify aircraft stalling speeds.

Of course, the passengers might not have felt comfortable knowing we were about to do a control check, so that was one more announcement I kept to myself. A control check has a certain element of risk to it, sure. However, the greater risk is committing to a landing when you are not certain about the information or the integrity of the systems you are acting upon.

To me, the control check was a must and the best option.