QF32 SINGAPORE
An email from one of the Qantas Pilots on the QF32 Flight Deck.
The following is an email being passed around by a friend of the Captain of the QF A380. It has been edited to remove emotion. Note that the facts stated have not been tested, it may contain inaccuracies.
The email text is printed in blue
Some of the A380’s amazing redundancy has been added, by me, in orange to show that the A380 is very safe. Where possible information has been updated with reference to the ATSB Preliminary Report.
My explanatory comments have been added in black italics.
_______________________________________
“Here are just some of the problems Richard had in Singapore last week aboard QF32 after the engine exploded.
1. Engine No.2 Failed – with damage. 2. Fuel leak in the left mid fuel tank.
The A380 has 11 tanks, including in the horizontal stabiliser on the tail, called the Trim Tank, which holds 18 tonnes of fuel – on such a short flight it would have held about 13 tonnes.
3. Fuel leak in the left inner fuel tank.
Any un-contained fuel leak is an issue, but there was no chance of the aircraft running out of fuel before returning to Singapore.
4. A hole on the flap canoe/fairing.
Unkown to crew, and of no consequence. If it had caused an issue the flaps would have frozen in position.
5. The aft gallery in the fuel system failed, preventing many fuel transfer functions.
ELEC AC BUS 1+2 Failures disable the aft Fuel Transfer pumps.
6. Fuel jettison had problems due to the aft gallery problem.
No jettison was carried-out, nor should be attempted with a fuel leak, you just don’t have enough information.
[The crew may have opted to immediately return to land – overweight – at takeoff weight without jettisoning fuel.
Unlike other brands of aircraft, the philosophy of all Airbus aircraft, including the A380, is that the aircraft is always capable of landing at the maximum takeoff weight, on the runway it just took off from, provided the runway is not contaminated.
This flight was about 120 tonnes under maximum takeoff weight. Landing distance would have been much less than the 4,000m long runway at Singapore.
It is wise, if time permits, to reduce the landing weight anytime the aircraft is crippled. In this case – on a dry runway— thrust reversers are NOT taken into account to determine landing distance.
The A380 only has reversers on Engines 2 & 3 because the outbound engines are so far out that reverse could kick up debris from the side of the runway to be ingested by the engine. Also if full reverse was applied and one side failed, it would be difficult to control the aircraft on the runway.
One reverser (#2) was inoperative with the engine failure, but the remaining one (#3) would have reduced actual landing distance moreso than indicated on the Landing Performance module, since it is not taken into account on a dry runway. Not as much as you’d think, however, as reversers only reduce the landing distance by a few hundred metres. On a dry runway their benefit is delaying the brake application, lowering the brake temperatures. ]
7.A hole in the upper wing surface.
[ This would have had little effect on the A380’s performance. It was a relatively light aircraft, and the wing is over-engineered, being designed for the longer -1000 series that has never been built.]
8. Partial failure of leading-edge slats.
Loss of Green Hydraulic system means that the Slats are only slowly-operated by an electrical pump.
9. Partial failure of speed brakes/ground spoilers.
Half would have been available.
10. Shrapnel damage to the flaps.
[Unknown to the pilots and probably did not reduce the performance. ]
11. Loss of all hydraulic fluid in the Green System (the A380 has 2 x 5,000 PSI systems, Green and Yellow).
[The remaining Yellow system provides that all surfaces are powered (except Slats). Unlike all other aircraft, the A380 has electrical-hydraulic backup to all flying surfaces as a final redundancy.
With a Green System failure the Slats are powered by an electrical pump and run at half speed. In this case the AC Bus 1+2 fault may have caused the Slats to be unpowered completely, resulting in a faster landing speed. ]
12. Manual extension of landing gear.
[Takes about 2 minutes, which is longer than normal operation, but is not an issue. The gear weighs 27 tonnes and extends by gravity.]
13. Loss of one generator.
[Three other engine-driven generators, plus the APU generator are available. All of them can be lost, leaving Emergency Electrical still available using batteries, until the Ram Air Turbine deploys, which boosts the available power until the aircraft slows to taxi speed.
Apparently No.1 generator was also disconnected when the wiring was damaged, leaving #3, #4, APU & RAT (emergency) available.
Automatic shedding of ‘commercial’ electricity would have occurred although we know that there was enough to continue to run the onboard entertainment system in this incident.
Airbus has prioritised the system so that one of the first things cut if there is an issue with lack of electrical power is the In-Flight Entertainment (IFE). Experienced A380 pilots know that, if the IFE system is working, then the electrical failure is not major.]
14. Loss of brake anti-skid system.
[Pilots have to modulate braking with reference to a pressure gauge in Alternate mode. This is practised in the simulator and has no effect on operation. It is like turning off ABS in your car, you can lock a wheel if you are not careful. Brakes still work even if the Normal system is failed. Alternate, Emergency, and Ultimate are still available, (more redundancy than any other aircraft ever certified).
In fact, one set of landing gear brakes was in Normal mode, the other in Abnormal - without anti-skid. Braking was not an issue in this incident. It appears that they braked very hard as the F.O. reported seeing a brake temperature of 900C before the screens were lost during shutdown.]
15. Unable to shutdown adjacent #1 engine using normal method after landing due to damage to the electrical harness.
[The crew had full control of Eng #1 during flight. The shutdown cabling had been destroyed, which wasn’t known until after shutdown.
The crew adopted a novel, non-Airbus, approach using manual thrust —the auto-thrust had failed— for some unknown reason the Captain left #1 & #4 thrust levers in an arbitrary position on approach, using #3 to increase and decrease speed. This is not an Airbus procedure, nor one suggested by Qantas, or any other pilot to my knowledge.
This is the reason why the aircraft dropped below VLS twice during the approach, kicking the auto-pilot out.
VLS is the lowest selectable speed in all Airbuses and the auto-pilot is not permitted to fly below it.
Using #3 to control speed, instead of #1, #2, & #3, as recommended by Airbus, allowed the aircraft speed to momentarily reduce below VLS.
The second time it happened, at about 1,000 feet, the handling pilot elected to fly manually. The Captain said he was mindful of the landing distance and was making sure he was not too fast.
QF uses Rolls Royce engines which use EPR Mode to display thrust. My airline uses EA engines which use Thrust Mode. In our emergencies, if one engine reverts to EPR mode, then we have to put all engines into EPR Mode. It appears that QF32 's crew used a combination of EPR mode on engines #1 and #4 and Thrust Mode on #3. This is yet to be confirmed.]
16. Unable to shutdown adjacent #1 engine using the fire handle after landing due to damage to the electrical harness.
[See point 15 above. The Fire Chief offered to shut down the engine by water deluge, but the crew opted to try a non-standard method of emptying the #1 Feed tank in consultation with QF Engineering in Sydney by phone. This took some time until the crew were advised that, because they had removed power from the aircraft, the idea would not work. Eventually the Fire Chief’s suggestion was adopted. ]
17. ECAM warnings about major fuel imbalance because of fuel leaks on left side, that were unable to be solved with cross-feeding.
The A380 can still fly with an imbalance, although it is not recommended.
18. Fuel trapped in Trim Tank (in the rear stabiliser). Therefore, possible Centre of Gravity out-of-balance condition for landing.
But not outside the flight envelope.
Further information has become available:
19. Bus #2 is supposedly automatically powered by Bus #1 in the event of Engine #2 failure - this didn’t happen.
AC Bus 1+2 both failed —as cabling to the #1 Generator was severed, and #2 engine was inop. The entire ship was powered by AC 3 and 4, with AC 4 powering the ESSENTIAL AC and DC Buses.
20. After some time the RAT deployed for no apparent reason, locking-out (as a load-shedding function) some still functioning services.
[It seems the aircraft dropped into Emergency Electrical configuration. The self-deployment would have arisen due to the main electrical busses not being powered. This is not mentioned in the Preliminary Report and contradicts evidence that the inflight entertainment system was still working.
It is my opinion that the speed dropping below VLS kicked-out the Autopilot and dropped the aircraft into Emergency Electrical configuration. ]
21. One of the frequently recurring messages warned of the aircraft approaching the aft CoG limit (the procedure calls for transferring fuel forward), the next message advised of fwd transfer pumps being u/s. This sequence occurred repeatedly.
Gravity feed for the fuel in the Trim Tank would have been available but it is time consuming. Airbus allows for the aircraft to land with fuel in the Trim Tank.
22. Landing / approach speeds are obtained from the FOIP, but there weren't sufficient fields to load all the defects for speed corrections - the crew loaded what they thought were the most critical ones.
[Having suffered a similar multiple-failure in an A380 —47 ECAMS— the aeroplane tells you what is important. In this case the big ticket items were: ENG 2 - FAIL, ELEC AC BUS 1+2 FAIL, and the HYD - G SYS PRESS LO.
When you get reach 800 feet on Approach the Airbus enters Phase 9, (there are 12 phases of operation in a flight). The aircraft does an instant polling of the systems and displays what is important to the pilots, and ‘inhibits’ non-essential information. This is called Landing Inhibit.
It’s at this point that the pilots know the true status of their aircraft, and can choose to go-around, if more problems need sorting-out.
In my experience, even with a major event, the idea is to prepare for the worst case, then reach 800 feet in approach and see what you’re left with. ]
23. The crew commenced an approach NOT because they'd sorted out all the problems but because they were very worried about the steadily worsening lateral imbalance.
[Wise. When fuel is pouring out of the aircraft that you cannot control, the idea is to get on the ground to let the RFF deal with it.]
24. The aircraft stopped with just over 100 metres or runway left, brakes temps climbed to 900C and fuel pouring out of the ruptured tank. Unable to shutdown #1 engine (as previously mentioned) but elected not to evacuate as the fire services were attending in great numbers.
Normal braking was available and used on two bogies and Alternate used on the other two.
[ The ‘100 metres’ statement was correct, but within hours Airbus alerted all customers by email that the had been monitoring the landing. They stated that crew modulated braking so they pulled-up near the RFF crews.
Previously, the crew had advised that they would need all of the 4kms runway to stop, so the RFF placed their vehicles at the end of the runway. If they had wished to stop in a shorter distance they could have. At the time I ran the numbers on our A380’s FOIP and calculated that they would need about 2,500 metres.
The crew had full control of Engine #1 throughout the flight, they just couldn’t shut it down.
The Fire Chief quickly advised that his crew had ‘dealt-with’ the high temperature brakes by dousing them with extinguishing agent, but the possibility of brakes igniting the pooling fuel under the front left wing concerned the crew.]
25. The source of the above comments were from someone who was on the flight deck.
[The Captain was in the left seat, First Officer in the right, Second Officer was in the right rear observer seat.
A Check & Training Captain was in the middle observer seat. He was training another Captain, (who was in the left rear observer seat,), to become a Check & Training Captain.]
Normally the entire process would have been handled by Captain and First Officer. The A380 is a two-pilot aeroplane and all operations for other airlines are handled by only two crew. (i.e. other A380 operators do not have Second Officers to do radio work).
[ THE ATSB PRELIMINARY REPORT into QF32 is HERE ]
First published Nov. 12th., 2010
The following is an email being passed around by a friend of the Captain of the QF A380. It has been edited to remove emotion. Note that the facts stated have not been tested, it may contain inaccuracies.
The email text is printed in blue
Some of the A380’s amazing redundancy has been added, by me, in orange to show that the A380 is very safe. Where possible information has been updated with reference to the ATSB Preliminary Report.
My explanatory comments have been added in black italics.
_______________________________________
“Here are just some of the problems Richard had in Singapore last week aboard QF32 after the engine exploded.
1. Engine No.2 Failed – with damage. 2. Fuel leak in the left mid fuel tank.
The A380 has 11 tanks, including in the horizontal stabiliser on the tail, called the Trim Tank, which holds 18 tonnes of fuel – on such a short flight it would have held about 13 tonnes.
3. Fuel leak in the left inner fuel tank.
Any un-contained fuel leak is an issue, but there was no chance of the aircraft running out of fuel before returning to Singapore.
4. A hole on the flap canoe/fairing.
Unkown to crew, and of no consequence. If it had caused an issue the flaps would have frozen in position.
5. The aft gallery in the fuel system failed, preventing many fuel transfer functions.
ELEC AC BUS 1+2 Failures disable the aft Fuel Transfer pumps.
6. Fuel jettison had problems due to the aft gallery problem.
No jettison was carried-out, nor should be attempted with a fuel leak, you just don’t have enough information.
[The crew may have opted to immediately return to land – overweight – at takeoff weight without jettisoning fuel.
Unlike other brands of aircraft, the philosophy of all Airbus aircraft, including the A380, is that the aircraft is always capable of landing at the maximum takeoff weight, on the runway it just took off from, provided the runway is not contaminated.
This flight was about 120 tonnes under maximum takeoff weight. Landing distance would have been much less than the 4,000m long runway at Singapore.
It is wise, if time permits, to reduce the landing weight anytime the aircraft is crippled. In this case – on a dry runway— thrust reversers are NOT taken into account to determine landing distance.
The A380 only has reversers on Engines 2 & 3 because the outbound engines are so far out that reverse could kick up debris from the side of the runway to be ingested by the engine. Also if full reverse was applied and one side failed, it would be difficult to control the aircraft on the runway.
One reverser (#2) was inoperative with the engine failure, but the remaining one (#3) would have reduced actual landing distance moreso than indicated on the Landing Performance module, since it is not taken into account on a dry runway. Not as much as you’d think, however, as reversers only reduce the landing distance by a few hundred metres. On a dry runway their benefit is delaying the brake application, lowering the brake temperatures. ]
7.A hole in the upper wing surface.
[ This would have had little effect on the A380’s performance. It was a relatively light aircraft, and the wing is over-engineered, being designed for the longer -1000 series that has never been built.]
8. Partial failure of leading-edge slats.
Loss of Green Hydraulic system means that the Slats are only slowly-operated by an electrical pump.
9. Partial failure of speed brakes/ground spoilers.
Half would have been available.
10. Shrapnel damage to the flaps.
[Unknown to the pilots and probably did not reduce the performance. ]
11. Loss of all hydraulic fluid in the Green System (the A380 has 2 x 5,000 PSI systems, Green and Yellow).
[The remaining Yellow system provides that all surfaces are powered (except Slats). Unlike all other aircraft, the A380 has electrical-hydraulic backup to all flying surfaces as a final redundancy.
With a Green System failure the Slats are powered by an electrical pump and run at half speed. In this case the AC Bus 1+2 fault may have caused the Slats to be unpowered completely, resulting in a faster landing speed. ]
12. Manual extension of landing gear.
[Takes about 2 minutes, which is longer than normal operation, but is not an issue. The gear weighs 27 tonnes and extends by gravity.]
13. Loss of one generator.
[Three other engine-driven generators, plus the APU generator are available. All of them can be lost, leaving Emergency Electrical still available using batteries, until the Ram Air Turbine deploys, which boosts the available power until the aircraft slows to taxi speed.
Apparently No.1 generator was also disconnected when the wiring was damaged, leaving #3, #4, APU & RAT (emergency) available.
Automatic shedding of ‘commercial’ electricity would have occurred although we know that there was enough to continue to run the onboard entertainment system in this incident.
Airbus has prioritised the system so that one of the first things cut if there is an issue with lack of electrical power is the In-Flight Entertainment (IFE). Experienced A380 pilots know that, if the IFE system is working, then the electrical failure is not major.]
14. Loss of brake anti-skid system.
[Pilots have to modulate braking with reference to a pressure gauge in Alternate mode. This is practised in the simulator and has no effect on operation. It is like turning off ABS in your car, you can lock a wheel if you are not careful. Brakes still work even if the Normal system is failed. Alternate, Emergency, and Ultimate are still available, (more redundancy than any other aircraft ever certified).
In fact, one set of landing gear brakes was in Normal mode, the other in Abnormal - without anti-skid. Braking was not an issue in this incident. It appears that they braked very hard as the F.O. reported seeing a brake temperature of 900C before the screens were lost during shutdown.]
15. Unable to shutdown adjacent #1 engine using normal method after landing due to damage to the electrical harness.
[The crew had full control of Eng #1 during flight. The shutdown cabling had been destroyed, which wasn’t known until after shutdown.
The crew adopted a novel, non-Airbus, approach using manual thrust —the auto-thrust had failed— for some unknown reason the Captain left #1 & #4 thrust levers in an arbitrary position on approach, using #3 to increase and decrease speed. This is not an Airbus procedure, nor one suggested by Qantas, or any other pilot to my knowledge.
This is the reason why the aircraft dropped below VLS twice during the approach, kicking the auto-pilot out.
VLS is the lowest selectable speed in all Airbuses and the auto-pilot is not permitted to fly below it.
Using #3 to control speed, instead of #1, #2, & #3, as recommended by Airbus, allowed the aircraft speed to momentarily reduce below VLS.
The second time it happened, at about 1,000 feet, the handling pilot elected to fly manually. The Captain said he was mindful of the landing distance and was making sure he was not too fast.
QF uses Rolls Royce engines which use EPR Mode to display thrust. My airline uses EA engines which use Thrust Mode. In our emergencies, if one engine reverts to EPR mode, then we have to put all engines into EPR Mode. It appears that QF32 's crew used a combination of EPR mode on engines #1 and #4 and Thrust Mode on #3. This is yet to be confirmed.]
16. Unable to shutdown adjacent #1 engine using the fire handle after landing due to damage to the electrical harness.
[See point 15 above. The Fire Chief offered to shut down the engine by water deluge, but the crew opted to try a non-standard method of emptying the #1 Feed tank in consultation with QF Engineering in Sydney by phone. This took some time until the crew were advised that, because they had removed power from the aircraft, the idea would not work. Eventually the Fire Chief’s suggestion was adopted. ]
17. ECAM warnings about major fuel imbalance because of fuel leaks on left side, that were unable to be solved with cross-feeding.
The A380 can still fly with an imbalance, although it is not recommended.
18. Fuel trapped in Trim Tank (in the rear stabiliser). Therefore, possible Centre of Gravity out-of-balance condition for landing.
But not outside the flight envelope.
Further information has become available:
19. Bus #2 is supposedly automatically powered by Bus #1 in the event of Engine #2 failure - this didn’t happen.
AC Bus 1+2 both failed —as cabling to the #1 Generator was severed, and #2 engine was inop. The entire ship was powered by AC 3 and 4, with AC 4 powering the ESSENTIAL AC and DC Buses.
20. After some time the RAT deployed for no apparent reason, locking-out (as a load-shedding function) some still functioning services.
[It seems the aircraft dropped into Emergency Electrical configuration. The self-deployment would have arisen due to the main electrical busses not being powered. This is not mentioned in the Preliminary Report and contradicts evidence that the inflight entertainment system was still working.
It is my opinion that the speed dropping below VLS kicked-out the Autopilot and dropped the aircraft into Emergency Electrical configuration. ]
21. One of the frequently recurring messages warned of the aircraft approaching the aft CoG limit (the procedure calls for transferring fuel forward), the next message advised of fwd transfer pumps being u/s. This sequence occurred repeatedly.
Gravity feed for the fuel in the Trim Tank would have been available but it is time consuming. Airbus allows for the aircraft to land with fuel in the Trim Tank.
22. Landing / approach speeds are obtained from the FOIP, but there weren't sufficient fields to load all the defects for speed corrections - the crew loaded what they thought were the most critical ones.
[Having suffered a similar multiple-failure in an A380 —47 ECAMS— the aeroplane tells you what is important. In this case the big ticket items were: ENG 2 - FAIL, ELEC AC BUS 1+2 FAIL, and the HYD - G SYS PRESS LO.
When you get reach 800 feet on Approach the Airbus enters Phase 9, (there are 12 phases of operation in a flight). The aircraft does an instant polling of the systems and displays what is important to the pilots, and ‘inhibits’ non-essential information. This is called Landing Inhibit.
It’s at this point that the pilots know the true status of their aircraft, and can choose to go-around, if more problems need sorting-out.
In my experience, even with a major event, the idea is to prepare for the worst case, then reach 800 feet in approach and see what you’re left with. ]
23. The crew commenced an approach NOT because they'd sorted out all the problems but because they were very worried about the steadily worsening lateral imbalance.
[Wise. When fuel is pouring out of the aircraft that you cannot control, the idea is to get on the ground to let the RFF deal with it.]
24. The aircraft stopped with just over 100 metres or runway left, brakes temps climbed to 900C and fuel pouring out of the ruptured tank. Unable to shutdown #1 engine (as previously mentioned) but elected not to evacuate as the fire services were attending in great numbers.
Normal braking was available and used on two bogies and Alternate used on the other two.
[ The ‘100 metres’ statement was correct, but within hours Airbus alerted all customers by email that the had been monitoring the landing. They stated that crew modulated braking so they pulled-up near the RFF crews.
Previously, the crew had advised that they would need all of the 4kms runway to stop, so the RFF placed their vehicles at the end of the runway. If they had wished to stop in a shorter distance they could have. At the time I ran the numbers on our A380’s FOIP and calculated that they would need about 2,500 metres.
The crew had full control of Engine #1 throughout the flight, they just couldn’t shut it down.
The Fire Chief quickly advised that his crew had ‘dealt-with’ the high temperature brakes by dousing them with extinguishing agent, but the possibility of brakes igniting the pooling fuel under the front left wing concerned the crew.]
25. The source of the above comments were from someone who was on the flight deck.
[The Captain was in the left seat, First Officer in the right, Second Officer was in the right rear observer seat.
A Check & Training Captain was in the middle observer seat. He was training another Captain, (who was in the left rear observer seat,), to become a Check & Training Captain.]
Normally the entire process would have been handled by Captain and First Officer. The A380 is a two-pilot aeroplane and all operations for other airlines are handled by only two crew. (i.e. other A380 operators do not have Second Officers to do radio work).
[ THE ATSB PRELIMINARY REPORT into QF32 is HERE ]
First published Nov. 12th., 2010