Dec 3, 2010

Incredible insights into the saving of QF32 revealed in the ATSB preliminary report

Ben Sandilands — Editor of Plane Talking

Ben Sandilands

Editor of Plane Talking


This morning’s detailed preliminary report by the ATSB of the inquiry it is leading into the QF32 A380 incident of November 4 tells us experience and professionalism rather than luck, as some have written, extracted the giant airliner from its unprecedented predicament.

The release of the report also follows by less than 24 hours the identification of a likely manufacturing defect in a misaligned stub pipe counter-boring in the Rolls-Royce Trent 900 engine that failed that could on its own prove to have been the cause of the near disaster.

But the importance of this report is in its careful documentation of what happened to QF32, and what the pilots did. Was it luck that the normal flight deck crew was augmented by two more captains, one under training, and one a training and checking captain? Or was it luck that the intermediate pressure turbine that failed did not also puncture the cabin of the jet, or ignite the fuel tanks, or break out of the engine at an altitude where the air pressure differential could have lead to structural breakup?

Maybe. But after the dice rolled on November 4, there is no doubt that professional experienced piloting was the crucial factor, and the debate as to whether the extra captains were the deciding factor in the flight making it back to Changi is truly one that can only be discussed realistically by pilots themselves.

These extracts from what is a very readable report are in the order in which they appear.

1 a

What will fascinate some readers is the imprecision of the warning in that the engine fire warning was transient, and there was a period when the overheat warning was showing when a substantial parts of the engine were falling over Batam Island in Indonesia.

The alerts that came up on the Electronic Centralised Aircraft Monitor screens were as follows below.

part 2 messagespart 3 messagesThe crew workload is made apparent, but so its the methodical and logical process of trouble shooting and testing the continued controllability of the jet

part 4 response

The report brings clarity to discussions in various forums elsewhere as to why the flight remained aloft for so long, and how the crew were prepared to land much sooner if the situation deteriorated, further.

part 5 approachpart 6 touchdownpart 7 securingThe report details repeated attempts to shut down the No 1 engine by working through or around the broken systems, however eventually, after it had run for two hours and 7 minutes, it was drowned to a standstill by fire hoses.

There is also a sequence of events record which shows that the interval from the data from the No2 engine beginning to diverge from the performance figures being recorded by the other three engines up to brief abnormal vibrations followed by the breakup of the intermediate pressure turbine was 49 seconds.

It doesn’t contain all of the graphics found in the Airbus report of the damage to the A380 which appeared first in the media in this report in Plane Talking.

But it certainly brings us up to speed with what happened and how and when on November 4, as well as the other calamity that is now overtaking Rolls-Royce as Qantas pursues a very, very large claim for compensation.

(Visited 28 times, 1 visits today)


Leave a comment

32 thoughts on “Incredible insights into the saving of QF32 revealed in the ATSB preliminary report

  1. Tweets that mention Incredible insights into the saving of QF32 revealed in the ATSB preliminary report – Plane Talking -- Topsy.com

    […] This post was mentioned on Twitter by Mark Newton, travelscoop, Chris Samuel, Nicholas Gruen, Ben Sandilands and others. Ben Sandilands said: Incredible insights into the saving of QF32 A380 in ATSB report @ http://tiny.cc/8wic0 […]

  2. newformula

    Thanks, as always, for extracting the pertinent points from these reports and your astute analysis. Reading this really brings it home how both good luck and professional judgment played their parts in the QF32 drama – and how ‘the system’ as a whole, from aircraft systems, pilot training, ATC, and emergency services on the ground, can all come together to prevent disaster. It’s actually comforting reading.

    I have a request – would you mind posting these report extracts as formatted text, rather than images if possible? I often use third party services to save info I find online, and well, the images don’t end up playing nice with search and readability, and it can get a bit frustrating. Thanks!

  3. pwgallagher

    Dear Ben,

    Just found you blog. Thank you so much for terrific detail and good writing… On the A380 especially. I’m looking forward to spending more time reading back into your posts. Loved the story on your time as a ‘Shipping Cadet’ for the SMH (‘Farewell romance’.. to quote JRK).

    Like many others, I am fed up by the self-congratulatory self-importance of Qantas even in the little things like the exaggerated volume at which they shout their tedious, probably pointless ‘safety’ briefing at customers. Considering this story, I’m now alarmed (but unsurprised), to learn of the disconnect between their claims about ‘safety first’ and their willingness to pay for experienced staff.



  4. Andrew Burry

    I read the report from start to finish. It is a shame that the CVR was written over and thus we can’t hear the actual conversation that ensued following what I am sure no simulator training had previoulsy emulated. It was also eerie, in a way, to imagine being in the cockpit with 400+ people dependant, and have #2 out and #1 and #4 showing as degraded. However the calm way that the crew went through the procedures, whilst checking constantly that “the plane was controllable” was something that should inspire confidence in flying with a legacy carrier wher all pilots hours on type are in the ‘000’s.

    Most impressive for me, was the careful calculations about laniding set up that suggested that under the circumstances as they understood them, QF32 would fetch up about 100M from the end of the runway …. in reality, it turned out to be 150M. Let’s think about that in terms of Jetstar!!

  5. TomM

    The report mentions that the braking was initially under autobrake but finished with manual braking from the crew. Does this imply the braking performance was better than initially calculated and manual braking was used to bring the plane to a stop next / near to the fire trucks? It seem this point is spun by other media that the plane almost run out of runway? Do we have any indication if the 900c final temp of the brakes is outside of normal operating conditions and if the landing weight of the plane was above the normal maximum landing weight?

  6. Ben Sandilands


    Been out of range and apologise for delays in checking comments that resulted. I’m advised the brake temperatures were higher than normal and that the aircraft was above the max landing weight for the condition the jet was in, however in conversation with an A380 captain last night the excess weight was NOT out of line with what often happens in ‘overweight landings’. However so many other things were out of line with foreseeable operational issues that the weight or brake temperatures while carefully considered were not as pressing as the issue of unknown or potential controllability issues that were on the mind of the crew. There was also discussion at the event last night of the crews awareness that they would land the airliner ‘flat’ with no flare and that this would make the landing very different in handling to anything they had experienced before in their training on an A380. There is a passage in the ATSB report about this, but it doesn’t discuss this as much as some other aspects of the landing. Possibly because the jet responded well to limited reverse thrust and manual management of the braking, and didn’t exceed the calculation the crew made under such difficult circumstances. After going back over the report, and listening to professional discussion of the incident last night, my respect for the professionalism of the crew has no bounds. They did an incredible job, yet without drama.

  7. malcolmdbmunro

    Graeme Wearden at the Guardian, http://www.guardian.co.uk/world/2010/dec/03/qantas-crew-praised-engine-failure, says, “The plane was 50 tonnes heavier than its top landing weight, because it could not risk shedding fuel,”

    I wanted to pull y’alls leg because the article also says, “The Australian airline has also claimed that engine-thrust restrictions imposed since the explosion mean it can only carry 80 passengers on flights between the US and Australia, instead of the usual 450.” Is that correct? 80?

    What I really wanted to comment on is the professionalism of the ATSB. The speed at which they have reported and the depth of detail is impressive. Contrasts rather with their colleagues in a certain county in Europe.

  8. aussiepax

    Thanks for that assessment Ben. I hadn’t been able to check out the FDR data from the ATSB report yet. So what do you make of that 49 seconds of degrading # 2 engine before the explosion / burst ? Is that as much of a problem as the poorly bored oil pipe itself ? Surely the A380 software should have been able to shut down or reduce power on such an engine instead of it getting to a critical stage.

  9. malcolmdbmunro


    In response to newformula you could provide a link on your site to the report. It is at:

    I am haunted by the crew being inundated with ECAM information. ECAMs seem to start to multiply at 0201:11 UTC and continue. Assimilating the ECAM information appears to have taken a considerable length of time. The report says “It took about 50 minutes for the flight crew to complete all of the initial procedures associated with the ECAM messages.” The CVR started up at 0336.38, which suggests 90 minutes elapsed between engine failure and start of approach to Changi Airport. That would suggest 40 minutes were spent assessing the ECAMs.

    All of this required a stable aircraft. The deluge of information suggests an incredibly complex environment, an environment which is normally completely under computer control, now being subject to human assessment and decision making.

    As Figure 11 in the report indicates, shrapnel from the engine could have easily punctured the cabin. Depressurization would have called for immediate action on the part of the crew.

    Had that been the case, setting the aircraft such that a landing would have been survived seems problematic given the difficulties the crew had in achieving this in the relatively benign environment they had.

    I am haunted, because, while we know of the ACARS messages from Air France Flight 447, I can only imagine the ECAM message deluge that the Air France crew may have faced. And with a much smaller crew at that.

    Meantime, while I was over at PPRuNe looking at the comments there on the report, I thought I would share this gem, since it sounds awfully familiar: “But I do wonder sometimes if Rolls Royce make aero engines these days or just assemble them –they seem to buy in bits from all over the world. Does this strain quality control?” Flapping Madly at http://www.pprune.org/6100650-post1590.html

  10. Ben Sandilands

    Whoops. I certainly meant to hyperlink to the ATSB report, which is my own SOP in these matters, but neglected to, even though I did link to it in the earlier post. I have now fixed that omission.

    In respect to converting PDF based documents to formatting text as NewFormula very reasonably suggests, there are some practical problems. A major one is that I work alone, and if I were to manually transcribe the data my posts would be many hours later than they are now.

    Sometimes I can hack the text. There are a few( cough) scripts in the wild that try with mixed success to do this, for free, but they are underground and imperfect.

    I am keen for recommendations about Macintosh compatible programs that will do this reliably, without getting hung up on copy busting codes. For example anyone can highlight and copy the text parts of a WordPress posting or the text of many web pages, but if an attempt has been made to copy proof an item you have to find and remove the symbols that try to prevent this, and which are not visible in a browser.

  11. Ben Sandilands


    The ATSB has pointed to the defectively bored component as having the potential to have triggered the destruction of the engine in the 49 seconds that elapsed between No2 engine beginning to behave abnormally, and coming apart. In the appendices there is a table of the 49 seconds sequence of events as extracted from the data recordings.

    But investigations of this complexity always seem to spring surprises. Hence the investigators unwillingness, so it seems to me, for them to make a stronger statement about the role of that defect in the events of November 4.

  12. malcolmdbmunro


    Most pdf are not protected as is the case with the ASTB report. You can save to MS Word or similar and work from there.

    Secondly, if you copy and paste from the Web to Notepad that will get rid of any hidden code.

    While a blog is very much an individual effort, there is no reason why you could not hire an intern out of journalism school. You have an range of skills and depth of knowledge that any intern would find immensely valuable. Besides, you need to pass this stuff on, know what I mean?

    Hope you find these suggestions helpful.

  13. FlammBoy

    This is a great forum about a riveting event showing exemplary skills amidst a terrible situation. thank goodness the cabin was not harmed. It deserves the type of world-wide recognition accorded to PIC Chesney Sullenberger III for the Airbus A320 landing in New York City’s East River.

    As a Mac and PC user frequently frustrated with pdf files, here’s a link to a free service that converts pdf to doc and rtf format files. It’s about 98% spot on!

  14. Ben Sandilands

    Thanks for the suggested work arounds. It would be great to take on an assistant, but it would be quite a commute, and a costly one, to a place where you consult the weather radar before even thinking of doing the drive to either Canberra or Sydney airport or to the best railway option some days especially at some times of the year. On Friday for example, I had between posts a Crikey deadline, a podcast deadline for a closed user group overseas, and then worked on yet another deadline while on a Countrylink train which at various crucial times had no connectivity but was a damn sight more practicable in the conditions that afternoon than driving to Sydney for the first obligation I had on a packed weekend.

    If I could invest more time and effort into the appearance and formatting of Plane Talking without killing it I would, and hey, while I’m carrying on about that, anyone out there who has ever tried to deal with the quirks of WordPress will know what a minefield it can be at times.

    (End of rant.)

  15. Jack Robertson

    I’m not an airline pilot. Almost all my time is on single engine helos, a long time ago at that. So maybe I’m being ignorant and uncharitable, never an attractive mix. But I am really, really, reeeeeaaaaaallly unconvinced that any response to an engine explosion/fire shortly after take-off that sends pieces falling off your aircraft, degrades (or indicates it has degraded) other engine, hydraulic, flight control and sensory parameters so markedly, and leaves fuel streaming out of one wing…yet has you electing not to land your aircraft for the better part of two subsequent hours…should be praised in the saintly terms we’re now hearing.

    We’re being assured (now) that the continuing controllability of QF32 was always a front lobe issue for the crew. Well, maybe..but it smells a bit like retrospective hero-tweakery to me, perhaps in response to the instinctive WTF?’s many around the net have been cautiously offering up. The ‘gross error’ check doesn’t stand up to me, either: engine fire/shutdown, bits falling off, other donks & systems dodgy, losing fuel, nice bit fat international runway right there-abouts, just behind the SO’s pinhead of a pucker valve…mmmm, OK, let’s not put this beastie down until the PAX have watched the late great Lesley Nielson in ‘Airplane’ from MGM lion to final credit…in ‘big picture’ terms it just feels a bit…I dunno, out of whack. Maybe those ECAM checklists are jolly fiddly. There was certainly a genuine airmanship trade-off call to be made, of some magnitude. But nearly two hours? I’d like to hear the first cockpit conversation about whether to land immediately, but I’d especially like to hear the subsequent ‘stand back, big picture, how is this going here?’ ones as the ‘methodical and logical’ working-through of the ECAMS script ploooooodddded aloooooong – if there were any such subsequent re-discussions, of which I’d be less certain. The potential problem with an experience-heavy cockpit is that the dumb-ass smart questions – like, maybe, um…’WTF are we still doing up here exactly, guys?’ – are less likely to get arxed. I think you’ve got to at least raise a tentative query about task completion/fixation here, haven’t you? Haven’t we?

    The risk with any decision to stay airborne in order to investigate the flyability of a damaged aircraft (actually, the ‘landability’ is all you’re interested in, unless the weather is crap and you might have to go round off a missed approach), is that at some (unknowable) point the safety calculus tips you into the realm of diminishing returns. You can’t ever really be sure exactly how much damage a structural-catastrophic event – birdstrike, engine shred, extreme flight envelop breach, explosive decompression, zealot’s f*&*ing bomb – has left you with, or might lump you with in the next second/minute/hour of flight loading. Every moment you remain airborne is another moment in which you might discover that…oh bugger, t’was a lot more than you’d figured (ie as you ‘suddenly’ depart the controlled flight envelop completely, an hour and a half after that cold sweat-inducing initial ‘thump’. And, um, then crash).

    And once you decide to hang about at all, in the name of checking out how well you can hang about some more, you can easily become fixated on the secondary tasks you set yourself as part of that process, becoming incidentally lulled into assuming, the longer you remain ‘controllably’ aloft and the more self-assured you grow in your ‘professional’ and ‘proactive’ and ‘methodical’ airmanship choices, that the risk of downstream, cascading catastrophic failure, is effectively ‘reducing’. In fact, rationally, the opposite is true, or must be assumed to be so following any in-flight catastrophic failure. The ‘safest’ safe airmanship assumption is surely that an inflight aircraft that has already ‘broken itself a bit’ is more likely to break itself again than not, and a lot more, not a little more, and sooner, not later – and, surely, is never more urgently apt than when that first failure involves a fire, an exploded engine, leaking fuel…especially bits falling off anywhere where there are key inflight loads. Wings, for example, which is where engines usually hang. Had at some stage of, say, that second hour aloft post-failure, QF32 suddenly departed controllable flight, and crashed, inverted and ballistic, ten miles short of the perfectly assembled, text-book scrambled ES of Changi, with all its ECAM checklists neatly primped and preened…I suggest that no-one would be applauding the crew through all the shedding tears.

    Being authentically worried about ongoing control by definition means you’ll be wanting to land yo’ worried ass as soon as yo’ worried ass possibly can. There oughtn’t be any ifs or buts about this, and the only way to inculcate and nourish that general airmanship point across the aviation industry is to applaud it loudly when it’s given operational expression, and at the very least, query it when it is not. The problem in aspiring to this from an aviation collegiate perspective is that what you have to applaud can, in this systems-management aviation era, almost look like a quaint kind of out-dated ‘aviation anti-proficiency’: we live in a time defined mostly by the heroics of the Machine That Goes Beep Wrangler and the Systemic Hotshot, but often the most gutsy (and truly heroic, life-saving) airmanship turns upon knowing a) when to manage an aircraft, b) when to fly the f**king thing, and c) how to tell the subtle difference. I bet about two thirds of modern airline pilots have forgotten there is one. And maybe about four fifths of the senior ones. And eight ninths of the check-and-trainers. Yea verily we huddle and scuttle ‘neath the shadows of a looming systemic totalitarianism…

    *rents epaulettes, pounds dust, wails*

    On this I find the comparison somewhere above with Sully Sullenberg’s Hudson effort tellingly wrong: his crew had it easy-peasy, absolutely no airmanship decisions of any consequence to make, not really, since lacking the power to keep airborne the most basic one got made for them: forget about systems management more or less entirely, more or less straight away, ‘cuz we iz a-gunna land, boyos. So just shut up and fly the aircraft to the least-worst termination you can manage in the squiffy parameters. QF32, on the other hand – and the Concorde dudes, and the majority of heavy accidents of the last two, three decades – had big airmanship decisions to make, whoppers, curly ones, murky, subjective, and – I think – ones that needed to be grounded in basic flying instincts and ‘big picture’ perspective: how long to f**k about trying to figure out what we’re dealing with here. How long to piss about with checklists. How far to take the ‘methodical’ approach. When, um, uh, to land the broken (and breaking?) behemoth…it’s no surprise to me that they slung their stout Captain’s hats three on the superficial substance of the worked-through ECAM prompter for so long. It looks so much more professional in a cockpit under pressure, when buttons are getting clicked and levers are getting pulled. We all love a nice neat list in this digital, po-mo age.

    The reality? QF32 was lucky: nobody died because the engine shred wasn’t bad enough to do fatal damage. So think about the crew’s performance, in that context. Think through the alternative outcomes given that the failure was as it turned out never going to down the aircraft (short of the crew making such a hash of their response as to exacerbate it to the point of catastrophe). If de Crespeny had elected to abbreviate the ECAMS work-through once he was happy he could fly the aircraft to the ground (and I find it hard to believe this would have taken much longer than 30 minutes), they would have landed safely a whole hour earlier, with nothing lost except a few undusted shelves on the cockpit domestics things-to-do-today list (and perhaps this is significant, perhaps a gap or two in a checklist is, post-incident, a truly terror-some thing to have to explain these days…).

    But what if the No 2 shred had left QF32, somewhere on the inner port wing, one-hour-unstable? What was gained by that extra hour (?) aloft, busily dusting and polishing, that made taking the chance that it wasn’t…so hero-worthy?

    Like I said, Ben, maybe I don’t know shit from clay on this. I wouldn’t suggest these guys made a ‘hash’ of this, by any means. But I would say this: if QANTAS (or any other operator of contemporary, heavy aircraft) is going to teach its crews that staying airborne by choice to deal with systems management tasks for so long in this kind of non-standard, uncertain, multi-failure scenario is optimum airmanship, or even particularly sound airmanship…well, I’d be surprised, I’d be a bit worried…and I’d be suggesting that the systematic demands and established practises of the contemporary heavy aircraft and their operations are, maybe, getting a bit too much like the smart-arsed tail that wags the slightly-dumb but faithful dog, into a gradually-evolved, passive managerial stupefaction.

    To me the determined hero-hype mode that QANTAS has launched into on this one feels like too much blowing of hot air into an at-best vaguely-floatable ‘good news story’, by a company otherwise adrift and a-drownin’ just now in a whole sea of soupy PR grief.


  16. petermarsh

    dear Ben:

    I work at the Financial Times in London and with colleagues have been writing some pieces about the Qantas/Airbus A380 incident. I have been very impressed by the reports on your website & interested to some of the comments from readers.

    I’ve read the ATSB report that emerged on Friday and thought this was extremely thorough, especially given the short time since the incident. The detail in this contrasts with the sparse information given out so far by Rolls-Royce.

    See some coverage of this run of problems from the FT on Friday, prior to the unveiling of the full interim report by the ATSB but after the bureau’s summary released on Thursday. (This also has a nice graphic that gives a reasonable view of what went wrong).

    The link here is http://www.ft.com/cms/s/0/526d75b8-fe4b-11df-abac-00144feab49a.html#axzz179cSQAiv . This link will provide access to several stories related to the mishap including some coverage of what may lay behind Rolls-Royce’s reticence over providing explanations.

    The illustration which one of my graphics colleagues produced using information pieced together by the FT is the first attempt that I have seen to reproduce the likely sequence of events inside the engine on the Qantas flight in a straightforward but reasonably comprehensive way.

    See also a related video now on the FT website about the issue and Rolls-Royce’s publicity-shy stance : http://video.ft.com/v/697224824001/Rolls-Royce-likely-to-settle-out-of-court.

    I would be very interested in any answers by you or your readers in response to these questions
    1) How strongly does the evidence point to a fault in the “stub pipe” fault being the sole reason for the problem with the engine or (conversely) being just one of the several factors that were to blame?
    2) Is there any evidence to point to there being a wider “systemic problem” in the Trent 900 engine, with the defective “stub pipe” or coupling being merely a visible sign of this ? (The discussion of the pipe stub in the safety report would appear to make the systemic failing theory a bit less likely, it seems to me )
    3) What combination of errors would have caused the defects in the stub pipe (which from the photograph seem quite noticeable) ?
    4) It also seems odd that no one picked up the inadequacies in the pipe in inspection. Does anyone have any theories as to what lay behind this, apart from the obvious explanation of human error?
    5) How many of the Trent 900 engines have these defective pipe components in them? The fact that Rolls-Royce has been replacing a number of these engines indicates the component may have present in a number of them.
    6) Assuming the stub pipe is the same part that was identified by Rolls-Royce in its statement on November 12 that the problem had been identified and traced to a “single component” why did not the company say exactly what the part was back then?
    7) Which Rolls-Royce plant (or Rolls-Royce supplier) made the faulty part?

    If anyone has any theories please let me know either via your website (or if people want to write in confidence my email is [email protected])

    regards Peter Marsh

  17. Ben Sandilands


    We should learn in the very short term whether any other examples of this defect have been found in any of the engines. Once that search has been completed we will know if the defect is unique or systemic.

  18. johnny7713


    While I am still only a student of aerospace engineering I feel I may be able to answer some of your questions.

    1) My understanding is that the failure of the stub pipe leading to an oil leak followed by a fire is sufficient to explain the sequence of events. However we won’t know for sure until the ATSB has completed the detailed analysis of the engine failure mechanism/s mentioned in the ongoing investigation activities.

    2) If by ‘systemic problem’ you mean a design flaw, then possibilities are that the stub pipe requires manufacturing tolerances that are not feasible or that it is stressed in such a way that the currently specified tolerances are not sufficient. This is mere speculation on my part however (and IMO not particularly likely at that). If this incident was indeed caused by a manufacturing defect that points to a problem with the quality assurance system.

    3) Consider the scale (the diameter of the pipe is about 1,5 cm / just over half an inch) and the fact that what are seeing in figure 9 of the ATSB report is a picture of a cracked pipe (i.e. you’re looking at the inside of the pipe). The defect was probably a lot less noticable when the pipe was still in one piece. As to what may have caused it: missalignment of the counter-boring equipment. How that may occur requires detailed knowledge of the counter-boring process.

    4) To answer this question you would need to know what quality assurance system is in place for the stub pipe. It is quite possible that the stub pipes are not visually inspected, but that quality is assured in a different way. One common way is by controlling the process parameters, rather than inspecting the final products. Still that system should have detected a misalignment. Without detailed knowledge of the quality assurance system this question can’t be answered further.

    5) I haven’t seen any public statements regarding this matter, but the Rolls-Royce service bulletin NMSB G 72-G595 and the fact that the EASA AD applies to all serial numbers suggests that the answer is that no one knows at the moment. Perhaps this was a unique defect, perhaps all engines have it. [speculation] The oil leaks reported a couple of week backs during the extra inspections suggest to me that more engines suffer from this problem [/speculation]

    6) Only Rolls-Royce knows. However a possible explanation is that the evidence suggested that only a single component had failed, but it was not yet clear which component that was. Another explanation is that there were liability issues involved.

    7) Not publicly available information, so can’t help you with that I’m afraid.

  19. TomM

    Thanks for the feedback on landing issues Ben. Any idea if such overweight landings shorten the planes lifespane especially with the no or minimal flare? Also looking through the report there’s a good picture of the extensive damage to the main spar which must be a right b*tch to repair.

  20. Ben Sandilands

    Everything that happens to an airframe has to be taken into account in assessing its real rather than notional overhaul intervals and their depth. Jets used on short haul flights that make multiple landings and pressurisation cycles a day also rack up more hard landings and overweight landings all of which has to be included in the operational history of the jet so that all of the maintenance undertaken is appropriate and timely.

    In this case parts of Nancy-Bird Walton much of the jet is going to have to be completely replaced meaning its lifetime, once or IF the rebuilding is completed, is actually going to be extended.

  21. SBH

    Will this salient example of the value of building a highly skilled and experienced workforce translate into the way other parts of QANTAS train and retain their staff?

  22. johnny7713


    An overweight landing, especially without a flare, will increase the load on the landing gear and increase the amplitude of the load cycle felt by the wings. In general a higher amplitude will mean a shorter life. However a single overload can actually increase fatigue life by slowing crack growth. An overload creates a region of plasticly deformed metal in the vicinity of the crack, resulting in compressive residual stresses that reduce the effective stress amplitude experienced by the crack.
    As Ben already mentioned a hard landing (or any load not anticipated during design) will definitely affect the life of an airframe and needs to be accounted for when determining inspection periods and the like. What the exact effect is had to be determined by fatigue calculations or testing. Calculation is obviously the cheaper option, but at the moment our understanding of variable amplitude fatigue is often not sufficient, so testing is required.

  23. hiwayinthesky

    Good afternoon (writing this at 1405 U.S.. Central time).

    I am also not a transport pilot. As an aviation enthusiast primarily, I have logged a few hours on single pistons and such and some time on rotary, so my questions/comments will certainly lack professionalism. For what they are worth, here they are: I am entirely in agreement with Mr. J Robertson’s comments. To slightly expand on them: Very little had to be less than ideal and this flight would have been a tragedy. e.g. coincidentally 5 pilots trained on type on the flight deck, clear weather, daylight, short flight distance to aerodrome of origin, etc. What startles me most is the degree of damage to the avionics and control systems the aircraft sustained from one uncontained failure. The ECAM messages tell the tale quite clearly. While it is true that the weight compromises would have been significant in the original design philosophy of the A380 had AIRBUS/EADS chosen to strengthen/armor wiring, cables, hydraulic lines and the like from high velocity projectiles (in this case engine parts and debris). I shudder to think what might have happened had this been a bird strike event (or multiple bird strike events such as Sullenberger encountered departing from La Guardia)….

  24. Ben Sandilands

    I recommend reading up on the design differences in this wing and that of older Airbus and Boeing airliners. The architecture of this wing transferred the load to components able to retain their structural integrity and prevent deformation leading to destructive flutter, something which appears to be seriously in doubt in the wing of the 748 for example.

    The wing kept its ‘shape’, despite the embellishments provided by Rolls-Royce for more than 100 minutes. The aircraft remained within its control envelope, and it landed at a time chosen by the crew, and stopped 50 metres sooner than calculated, in a set of unique circumstances never rehearsed in a simulator.

    Rather than snipe at this astonishing achievement, it should be recognised as setting new standards in damage and systems tolerance, and no doubt, they will be enhanced even further as a consequence of the examinations and studies now in progress.

  25. hiwayinthesky

    I have another “afterthought” question for those who are jet air transport types: “How useful is the synoptic message “Engine No. 4 pump error”? I mean is the crew to assume that the said pump has failed or that there is a possibility of software issues? I am not sure how crews are trained to deal with that kind of phrase…Logically, I think these kinds of scenarios are plausible:

    1. Pump failed; redundant system has acquired load.
    2. Pump failed; redundant system has failed.
    3. Telemetry from pump has failed; redundant system has acquired load.
    4. Telemetry from pump has failed; redundant system has failed

    So #1 would be a lower priority message, #2 would be high priority. Likewise #3 would be low and #4 high. But qualitatively, crew action for 1 and 3 might be similar and 2 and 4 might be the same. So logically, one might only have a two message algorithm:

    1. Pump status abnormal; backup has acquired load
    2. Pump status abnormal; back up status abnormal

    Thus the need for only two abnormal checklists….

  26. Ben Sandilands

    Those are very real issues. In a conversation on Friday night I was told that one of the pilots quickly flicked away many of the messages as clutter of the type the Airbus system, in some opinions, overproduces. (As a non-pilot I have no basis for having an opinion on this.)

    That editing process enabled the crew to focus on what they saw as the flight critical issues.

    It is interesting to read through various other reports of pilot responses in Qantas and other carriers, to the prolific generation of alerts and error messages in current airliners. The ATSB reports into the oxygen bottle failure that ripped open the forward lower section of a 747 that diverted to Manila is one that is easily found with a search, as is the QF2 incident at Bangkok, another 747 that suffered major electricla system failure on approach to Bangkok in Jnauary of 2008. (Final report due in the New Year). Those incidents also confronted the pilots with more messages than could possibly be individually read and considered in the finite time in which the pilots had to take decisive action to maintain control of of their airliners.

    And of course, the ‘big one’ the control crisis that seized a Qantas A330-300 near Learmonth, Western Australia, later that year. In each of these cases the pilots quickly elected to concentrate on flying the aircraft rather than trouble shooting all of the error messages. In the case of the A333, the first officer wasn’t in the cockpit when that incident began, and the detail in the preliminary report by the ATSB casts a lot of light on the workload a single pilot had to contend with at the start of a severe, and as yet inexplicable failure of the control systems to cope with the malfunction of one of three ADIRU units on the jet.

    I would also recommend those interested in this aspect of flying computer reliant jets to extract the Air Caraibes A332 incidents involving frozen pitots which preceded the AF447 disaster, but ended without loss of life. Some of the detailed reporting is in French, and I did not keep the links, but in this age of search engine excellence, and searchable public databases by the US, EU and AU investigators, I’m sure some gripping reading in English or French is available.

  27. johnny7713

    In regard to the earlier comments: Though there was a single point of failure in the engine, calling it a single uncontained failure is not quite accurate. If I remember the reports correctly there were at least three separate projectiles. Each of those projectiles had the strength to punch straight through the wing. For all intents and purposes they were large caliber bullets, in fact I wouldn’t be surprised to find the energies involved were comparable to AAA fire.
    Armor works by putting stuff in the way of a projectile to absorb its energy. If a projectile has lots of energy (such as a piece of turbine disk) you need lots of stuff.
    Armoring wires and cables against these projectiles would most likely require at least several cm of steel or concrete, which comes at a massive weight penalty. It’s not the case of adding a few kilos here and there, we’re talking tons.
    A far more feasible strategy is to provide redundant systems with enough separation between the systems, which EADS did and which worked.
    There’s no need to shudder at what would happen in case of a bird strike. A bird strike would (probably) make a hole in the wing leading edge and that would be it. The energy involved, the characteristics of the projectile (birds can go splat, turbine disks don’t) and the trajectories are completely different in the case of a bird strike. Note only the engines failed in the Hudson river case, an A380 would have behaved exactly the same (bar some differences in glide angle perhaps).

    Regarding Mr J Robertson’s comments, aircraft have maximum landing weights for a reason. QF32 was 50 tons over its maximum landing weight when it landed as it is and landing any earlier would have made that number worse (remember the fuel jettison system could not be used). As it is the crew calculated that they would have 100m of runway remaining, that’s a safety margin of about 2.5%. If they had tried to land much earlier they would have been at a serious risk of a runway overrun, if they didn’t just snap the landing gear right off. Also the ECAMS procedures are there for a reason: they allow one to identify the extent of any problems and to attempt to create a work around to possibly restore some system functionality. Once you have determined that the situation you are in is not getting any worse, attempting to restore any functionality you can before bringing your aircraft into closer proximity with the ground sounds like a smart move to me.

    Regarding the pump error: I’m guessing the back-system for the engine no.4 pump is the engine no.3 pump. No.4 failed, no.3 not failed is basically equivalent to Pump status abnormal; backup has acquired load.

  28. hiwayinthesky

    Thank you Mr. Sandilands and Johnny7713 for both of your most informative feedback statements. Not to belabor the point about birdstrikes, my mind was drifting toward bird ingestion (which I misrepresented by saying bird strike…my bad). In the case of bird ingestion (or other significant foreign matter of enough density/mass) can one realistically not imagine an engine component failure that could also create somewhat similar problems as transpired on QF32?

    As for the failure to shut down #1 (short of drowning it with foam retardant, wasn’t it?)…I was mystified as well. I recall there being an externally accessible emergency shutdown controller for each engine on some aircraft types. My memory is quite bad about seeing something along those lines probably some 30 years ago on a Chinese built aircraft called an F-6 (essentially a post-license copy of a Soviet era Mig19)…..that could be operated by ground engineers.

  29. mrdeux

    The two hydraulic systems (G on the port side, and Y on the starboard) are powered by 2 engine driven pumps on each engine. All of the pumps operate at all times. There is such thing as an ECAM pump message that says ‘error’. The only ECAM that specifically mentions the (#4) engine driven pumps is HYD Y ENG 4 PUMP A (or B) PRESS LO, and the actions for it are to turn off the pump(s) and disconnect the drive to both (even if only one has failed).

    Mr Robertson, I find your comments to be extremely ignorant. Yes, perhaps to those who don’t fly these aircraft for a living, a quick dash to the airport may seem sensible, and there are certainly times when that would be the best course of action, irrespective of the outcome. This was not one of those times, and the crew showed immense discipline in avoiding that choice.

    Leaping into a landing when you have no idea of just what is going to work, are massively overweight, and have not had time to work through the ramifications of what has happened is a recipe for an accident. QF pilots are not taught to work through the checklist at all costs. They are taught to think….to do as much as they can to ensure the best outcome. Without working through most of the ECAMs you would not even be able to come up with an approach speed. Without thinking it through, you would not be aware that with the hydraulic and control configuration that they had that they aircraft would be quite prone to a nasty pitch up in the flare, and that just thinking the word ‘flare’ would most likely suffice. Much has been made of CofG issues, and yes, they will become an issue, but you have at least four hours of flight time before that happens…and it was within the normal range at landing.

  30. Hamish

    J. Robertson – sorry mate, you’re way out of line. Any experienced air transport pilot (as opposed to someone who logged a few hours on single-engine helos a long time ago) would be shaking their head in disbelief at the idea of throwing the thing back on the runway asap under these circumstances.

    hiwayinthesky – “I am also not a transport pilot. As an aviation enthusiast primarily, I have logged a few hours on single pistons and such and some time on rotary, so my questions/comments will certainly lack professionalism” might perhaps have been a good point to leave it….

  31. kbl

    I find it very interesting how somebody, who has obviously no clue how to fly, operate and yes, also manage a modern airliner has such a strong opinion on what to do and how to do it.
    In hindsight we can all try to optimize the handling of this “problem”, but I think as somebody who is actually flying this aircraft I can say, that the crew did a very good job of handling a very complex situation.

    😉 If it was as simple as Mr. Robertson and hiwayinthesky put, everybody could have done it. And I seriously doubt that!
    Just a thought: “I rather take the chance of breaking up in flight than have the absolute certainty of crashing on the ground!”

  32. Ready to die on an A380 (or anywhere else)? | Free Your Thought

    […] of Batam, not far from Singapore, and others tore a hole in the upper surface of the left wing. Professional and experienced piloting seems to have been a crucial factor in the survival of all on […]

Leave a comment

Share this article with a friend

Just fill out the fields below and we'll send your friend a link to this article along with a message from you.

Your details

Your friend's details