CHAPTER 25

Round (Phase) 11

The stall warning filled all of us with disbelief. This was the first time I had ever heard a stall warning during a landing. I didn’t want to hear it now. The last control check I’d performed had provided a full dress rehearsal of the landing conditions, so I had been confident we were never going to approach the stall speed. Why were we hearing it now? There was no time to think about our condition, only time to act as the runway continued to fill the windscreen.

I was powerless to prevent the plane from crashing in a stall. It was a case of ‘Brace yourself, Nancy!’

Something was wrong with our performance – very wrong. But our flight control checks had proven our aircraft safe to fly and that was all that mattered. The speed and stall warnings were trying to tell us something that the performance and flight instruments could not, that we approached at a speed too slow to give us the regulatory margins to the stall. But if we had sped up three knots we probably would have run off the runway. The control checks saved the day.

The rapidly lifting nose during landing was creating another problem. The main landing gear trucks are mounted about 26 metres behind the pilots, well aft of the aircraft’s centre of gravity. So, as the nose lifts, the landing gear at the other end of the ‘see saw’ is thrust downwards. Now I was getting very close to runway impact, at a high rate of descent, with the stall warning blaring in my ears, and the landing gear also descending as the aircraft pitched perilously close to the ground. It was not an ideal situation, and there was only one thing to do to rescue the landing – a radical manoeuvre that has to be timed very carefully.

At a fraction of a second before I sensed the landing gear crashing down onto the runway – I pushed the side-stick full forward. This is not a trained technique as the risks of damaging the aircraft generally outweigh the benefits of the manoeuvre. And it’s not something I aim to do on any landing, but it’s a fix that works if timed accurately. As the nose lowered, the wheels behind the centre of gravity rose, and the aircraft’s rate of descent reduced as the plane settled onto a pillow of air trapped between it and the tarmac (a phenomenon pilots call Ground Effect). The fast descent rate washed off. Nancy-Bird cushioned onto the runway and we touched down at only two and a half feet per second. I was very pleased with the smooth touchdown made a short distance after passing the runway threshold.

Touchdown 11:46 am Singapore time.

It was a challenging landing, but I was pleased. I’d hit my aiming point, giving us the best chance of stopping short of the runway’s southern boundary. The flight data recorder shows we only took five seconds from 50 feet to touchdown, a fast transition, but a smooth one with no ‘float’. In fact we touched down two seconds earlier than the Airbus test pilots I was trying to mimic, so this gave us additional ground distance to stop.

The A380’s brakes were degraded from the explosion. Just like the fuel system, there were too many failures affecting the brake systems for my mind to absorb. So I had inverted my logic and reduced the braking system complexity to that of a car. I thought to myself, ‘After the main wheels touch down, I put the nose wheel down and then, and only then do I push hard on the brake pedals and leave them on until the aircraft stops. Not too early, only one application. That was understandable, that was easy!’

We only had half our thrust reversers to help us stop. The A380’s reverse thrust is only installed on Engines 2 and 3, and we’d lost Engine 2. So I selected full reverse thrust on Engine 3 and heard it roar, while feeling no discernible slowing of the aircraft. Taking a plane from 166 knots to standstill in 3900 metres is not a problem when everything is working together. Doing it when 41 tonnes overweight with only 64 per cent of your brakes and 50 per cent of spoilers and ailerons (which act as speed brakes) and reverse thrust was not fun. We had too much energy and not enough brakes. To put Nancy-Bird’s energy into perspective, my daughter Sophia, who spent a year in South Africa, tells me Nancy-Bird had the equivalent energy of 3800 stampeding male African elephants!

We were now on the ground but our problems were far from over: if I pumped the brakes, then our emergency brake accumulators would run out of pressure and the wing brakes would fail; if I applied them too early I’d blow the wing tyres. And with only 64 per cent of our total braking capability remaining, our landing distance was increased. The plane slowed, but not dramatically. I never really felt the brakes kick in.

Harry jumped in: ‘Max braking, Rich!’

Matt jumped in: ‘Brakes! Brakes! Give it full brakes, Rich!’

I replied: ‘I am!’

My feet were pushing the brake pedals hard flat against the floor. My back was being jammed back into the seat cushion. Matt didn’t believe me – the aircraft wasn’t slowing. There was just too much kinetic energy. Matt put his feet up on the brake pedals and discovered they were fully depressed hard to the floor. ‘There was nothing left,’ he would say later. There was lots of noise from the reverse thrust, but not much action. The first 1000 metres went past in a blur. I kept pushing the brake pedals hard against the floor.

Matt called out: ‘Keep it in, Rich. Hammer them!’

At the 2000-metre runway marker the plane finally started to slow to about 120 knots and I felt better. We were going to make it.

As we went past the 3000-metre mark I could see the end of the runway followed by a paddock, then the perimeter road and 300 metres of sand dunes to the ocean and the Singapore Strait. The green expanse seemed to fill my vision. I didn’t discover till later that I totally missed seeing a few fire trucks, to the left side, that we passed midway down the runway. They were positioned short in case we crashed and didn’t make it that far, but as we passed they took chase down the runway following us to our stop point. But I also knew my fear of overrunning the runway was just the adrenaline playing tricks. I was now confident we’d pull up short of the paddock, and I was looking for a large area with lots of concrete around us where the fire trucks and emergency rescue services could assemble and protect us.

As I switched Engine 3 out of reverse a rush of relief swept through the cockpit when we all realised we would be able to stop.

‘Beautiful,’ said Matt.

‘Fantastic,’ said Harry.

*

Michael von Reth was also relieved. As we slowed he jumped on the PA and, in his typically cool and unflappable dulcet tone, addressed the passengers: ‘Ladies and gentlemen, welcome to Singapore. The local time is five minutes to midday on Thursday 4 November, and I think you’ll agree that was one of the nicest landings we have experienced for a while.’

It wasn’t an easy task for a man who’d spent the past half-hour briefing his crew on their responsibilities in case of an emergency landing and an evacuation. Michael was not relaxed, yet he projected a sense of calm, confidence and control that could only come from a long and distinguished career.

But our mutual self-gratification would be short-lived. As we slowed down through 80 knots the ECAM transitioned to flight phase 11, with the result that all the ECAM checklists that had been inhibited inflight now became enabled. The calm cockpit atmosphere was suddenly pierced again by the sounds of ever-more warnings bells and ECAM checklists.

‘Bing . . . bing . . . bing . . . bing . . .’ The emergency wasn’t over yet. Far from it. It was like a bushfire; just when you think you have it under control, the wind shifts and it all changes direction.

As we came to a halt, I looked out to the runway markers: we’d pulled up just short of the 3900-metre mark. I switched the parking brake to ‘ON’, then keyed the public address pushbutton and called in a clear and deliberate voice: ‘Attention! All passengers remain seated and await further instructions!’

I commanded Matt to focus on the ECAM checklists. We had to make sure the plane was safe before we let the passengers disembark. Then I contacted the tower controller: ‘QF32, we have stopped now. Please advise fire services we have very hot brakes and fuel leaking from the left wing.’

My PA to the passengers may seem like a low-key announ­cement coming at the end of a harrowing journey, but it was just the beginning of yet another tense time for the 24 cabin crew. With those simple words, I was officially starting a formal ‘alert phase’, during which the cabin crew would prepare for a possible emergency evacuation down the escape slides.

Michael von Reth was worried. The holes in the wing that were above the fuel level in flight were now below the fuel level when the aircraft sat flat on its wheels. He looked outside to see fuel gushing even faster from about 70 holes in the wing. He knew there would be hot brakes and he knew the situation was extremely dangerous, and so he tried to contact me to tell me about these threats. He pulled out his interphone handset and pressed the ‘PRIO’ and ‘CAPT’ buttons to establish emergency communications with the flight deck. No one answered. Michael had lost communications with us again, but this time the situation outside the aircraft was dire.

Michael then turned his attention to keeping the passengers calm. Even though he couldn’t reach me, he made a PA to the passengers, announcing I’d be speaking to them soon, aware that at any time he would hear the piercing screech of the evacuation siren that signals the beginning of a dangerous passenger evacuation, when the task sharing ends and every cabin attend­ant becomes their own leader with the sole responsibility to evacuate their passengers out through their door and down the slides as rapidly as possible. Tensions were high, but no one panicked.

Not everyone is up to this. A friend of mine, the solicitor Peter Reid, was a passenger in an aircraft that made an emergency landing on an ice-covered runway at Chicago O’Hare Airport in January 1982. The captain in­formed the passengers that the landing gear would not extend and for the purser to prepare the passengers and cabin for a belly landing. The purser cried, ‘I don’t want to die,’ before breaking down and collapsing to the floor. Peter stood up, took the instruction sheet from the purser, then read the preparation checklist over the PA to the passengers.

It was now 11:49. We had been stopped for less than a minute actioning even more ECAM checklists. At the request of the tower controller, we shut down all the engines so the fire services could approach the aircraft. Matt dialled 128.5 into VHF radio 2 to make contact with the fire commander. It was unfortunate that we shut down the engines and contacted the fire controller at the same time.

Now it got really stressful.

When we moved the three remaining (1, 3 and 4) engine master switches to ‘OFF’, the high-pressure fuel valves in each engine should shut causing the engines to flame-out. As the engines wound down, the generators fell off-line, the bleed air valves closed off and, in yet another twist of the knife in our already wretched wounds, all the major power systems became unpowered. The cockpit went dark as all lights failed. This should not have happened! The aircraft was now pneumatically and electrically dead.

The cabin crew were confused. Bells and alarms sounded throughout the cabin. Cabin lighting was flashing as the cabin crew checked their emergency exits. The cabin crew ‘evacuation’ message was displayed on the cabin screens but there was no aural alarm. All of this was happening around them, but the crew did not panic.

We had started the auxiliary power unit (APU) over one hour previously to provide backup pneumatic and electric power, and expected the APU’s two generators to take up the aircraft’s ­electrical loads when we shut down the engines. Neither did.

So instead of having a fully-powered flight deck as we sat on the tarmac, our beleaguered Nancy-Bird Walton’s 910kVA electrical generation capability had collapsed, either shut down or failed. Nancy-Bird, now gasping for electrical power, switched itself across to its last remaining line of defence – the ‘Electrical Emergency Configuration’, which essentially uses two car-sized batteries to power a few emergency aircraft systems.

The A380’s Emergency Supply Centre detected the generator failures, so shut down 99 per cent of the aircraft’s electrical systems, leaving us with only the most critical of emergency systems functioning.

We had fuel leaking out near hot brakes, we had shut down our engines and we had now lost 99 per cent of our electrics, but our situation would get worse.

The aircraft was dark and confusing.

Matt again tried to contact the fire controller on VHF radio 2 – no answer. He tried three times – no answer. We opened our window and yelled at the firefighters – they couldn’t hear us. We were out of luck: we were sitting in a lake of jet fuel and unable to talk to the fire crews we could see clearly outside.

We finally realised that VHF radio 2 had failed! We swapped the VHF radio 1 to the fire controller frequency and finally got communications with the firefighters.

That day threw up some enormous challenges: keeping the aircraft in the air was one and landing it in one piece was another. But lurking in the back of our minds was the major question of fire or, more accurately, what happens when tonnes of jet fuel meet white-hot carbon brakes and metal.

Aviation jet turbine fuel (avtur) is kerosene. It is highly refined and expensive. Jet fuel is based on kerosene because kerosene packs 10 per cent more energy by volume than gasoline and it has a very high flash point making it safer than gasoline around the super-heated environment of a gas-turbine jet engine.

However, jet fuel is not the ‘safe’ fuel that many people assume it as. Avtur has a flash point of plus 38 degrees Celsius and will auto-ignite if it reaches 220 degrees Celsius. On QF32 we were now carrying just over 72 tonnes of jet fuel and our overworked brakes would have already passed 500 degrees Celsius. So we had large fuel quantities and we had an ignition source that was not only greater than the 38-degree flash point, but might also be directly under the leaking fuel tanks.

We were riding a bomb, and many of the passengers knew it.

Dr Derwyn and Carolyn Jones, passengers behind the wing in seats 80A and 80B had seen the entire catastrophe. They had seen the explosion rip open the wing, the fuel gushing out and now that we were stopped on the runway, the situation had clearly not improved. Carolyn could see Engine 1 was still running and fuel pooling on the ground. ‘It did not take any imagination at all to work out that one spark and we were cinders,’ she said later. ‘We both thought we’ve had a great life together, we’ve got a fantastic family and if this is how it’s going to end, then so be it.’

I was relieved to see the Singapore Emergency Services accomplish everything exactly by the book. I had stopped the aircraft to leave adequate tarmac space for the fire services that would surround us. There were six fire trucks. One truck held slightly back. This was the master fire truck, front and centre, carrying the fire controller – the only fireman who wears a white helmet and who coordinates all fire defences. The area inside 30 metres was reserved exclusively for the active fire trucks. They had the job not of putting out an aircraft fire, but of protecting the passengers as they evacuated the aircraft. If a fire started, the master fire truck would protect the slides and clear an exit path for the passengers. Backup fire trucks were positioned slightly behind. Outside 100 metres I saw the police and ambulance triage take positions.

The alert call is the cue for the cabin crew to go to their emergency exits and check to see if there’s any reason why their emergency exit and slide shouldn’t be used, such as a fire or damage outside. Having ascertained if their door is useable for an evacuation, the cabin crew then monitor the passengers in their area and keep the calm. If an evacuation is commanded they will hear ‘EVACUATE, EVACUATE, EVACUATE’ over the PA, and then the evacuation alarm. These are the signs for the cabin crew to go into an autonomous mode.

A passenger evacuation is a very dangerous procedure. If it’s safe to open the door and deploy their escape slide, then the cabin crew lift the doorhandle. Large motors power the door open, and when the exit is clear, compressed air turbines blast air into the slides, thrusting them out and inflating them within ten seconds. The cabin attendants scream as loudly as they can to the passengers, ‘EVACUATE, EVACUATE, UNFASTEN SEATBELTS, HIGH HEELS OFF!’ Their loud voices are meant to penetrate through the ‘frozen’ minds of those passengers paralysed with fear. When the slide has deployed, the attendants scream: ‘COME THIS WAY, FORM TWO LINES, STAY TOGETHER, KEEP MOVING, JUMP AND SIT, GET OUT! HURRY! HURRY! JUMP! JUMP!’

All passengers are directed through their emergency exit as fast as possible. There’s no time to pause and reflect – any passenger who freezes at the door is pushed out onto the slide. That’s the theory.

Behind me, one of the pilots asked why we weren’t doing an emergency evacuation. It was a good question. We looked at all the threats and considered all our options, and we ultimately came to a conclusion and I made the decision. My decision was simple: where are the passengers safest right now; inside or outside? Given the current situation with no fire I thought the passengers and crew were safer inside the fuselage than evacuating down the slides onto the dangerous runway.

The QF32 flies the Kangaroo Route from London to Australia. We had wheelchair passengers and babies on board, and I knew that elderly passengers would be injured descending the slides and some would break their legs or hips as they slid to the bottom of the steep evacuation slides. Other passengers in a panic would jump from the aircraft, down the same slides, then concertina into the injured. I figured that 5 per cent of the passengers would have fractures escaping from the lower deck slides, 10 per cent from the upper deck slides; that would equate to 30 fracture cases with our 440 ­passenger-load. But it gets worse. The passengers who survived the slides would run the risk of slipping over on fuel or foam, or could become confused and walk in front of Engine 1 that was still running and be sucked into it. Passengers who had survived to this stage might walk through jet fuel, creating a spark or taking flash photography and igniting the fuel. Even if all the passengers did get off safely, then we would have the dangerous situation of all the passengers being outside and all the supervising staff being inside the aircraft. Who would be monitoring the passengers at this time? A friend of mine commanded an evacuation of his aircraft in Osaka. After the passengers cleared the slides they ran away from the aircraft and some ran onto an active runway where a Boeing 747 was making another emergency landing.

We had a discussion rather than an argument about it. Harry pointed at the last images to display: the wheels on the left body landing gear had reached 900 degrees Celsius – they were getting hotter. But there was no fire.

It was a surreal feeling sitting on that tarmac. We had 440 passengers sitting patiently behind the bulkhead, while aviation fuel fell around a 900-degree ignition point.

Although we didn’t know it at the time, Michael von Reth and his cabin crew were working hard to control the passengers. They’d just been through a harrowing flight, now they were in sight of the terminal but they were still sitting on the aircraft, and I hadn’t given the cabin crew any information to impart.

Michael would tell me later that the passengers were fully aware of the amount of fuel pouring onto the ground and were equally – loudly – aware of the lack of fire fighting crews or water or foam. In this fuel-soaked environment, Michael’s standing order to his troops was to be vigilant in not allowing anyone to start up a phone, a camera or any other personal electronic device. He would also express his frustration at the lack of communications between the flight deck and cabin during our wait for the fire trucks.

The passengers had become a part of the team. On the lower deck a passenger’s phone rang. Before it could be answered, every passenger within earshot yelled, ‘TURN THAT PHONE OFF!’

Finally the firefighters arrived and we breathed a sigh of relief as we watched six fire trucks surround the left wing. But as we watched, we noticed something: they weren’t hosing down the plane.