QF32 and the black swan

Flight Safety Australia looks back at one of its most popular articles, where Qantas pilot Richard de Crespigny’s account of the QF32 engine failure offers some useful insights that apply to all aircraft and pilots. They are about the effects of massive stress, both on complex systems and human emotions.

From Flight Safety Australia September-October 2012…

The two most celebrated airline incident survival stories of recent years have been bird strikes—sort of. US Air flight 1549 hit a flock of geese over New York in January 2009, and on November 4 the following year Qantas flight 32 hit a metaphorical bird on climb-out from Singapore—a ‘black swan’.

A black swan event is an improbable event that causes massive consequences. Like the black swans of Western Australia—which were unseen by European eyes for centuries, so all swans were presumed to be white—it exists, but can only be guessed at.

The author of The Black Swan, Nassim Nicholas Taleb, argues that it is pointless trying to predict such extreme events. All that can be hoped for is that societies and systems are robust enough and have adequate redundancy to withstand them. The crew of QF32 and the design of the Airbus A380 proved this point eloquently.

The facts at the time of writing were incomplete, pending the final Australian Transport Safety Bureau report, but the narrative is well known, and disturbing. QF32 suffered an intermediate stage turbine disc failure—the first in the 40-year and 200-million-hour history of the Rolls-Royce RB211 family of turbofan engines.

Shrapnel from the disintegrating engine cut more than 600 wires and left more than 100 impacts in the wing, about 200 impacts on the fuselage and 14 holes in the fuel tanks. The No.1 and No. 2 AC bus systems failed, the flight controls reverted to alternate law and two other engines, in addition to the destroyed one, went into what the ATSB preliminary investigation called ‘degraded mode’. Fuel was streaming from the wing. One of the projectiles that passed straight through the wing was later found to have missed the top of the fuselage by 2cm.

The captain of QF32, Richard de Crespigny, has written a book on the event. Predictably, its launch publicity on TV and radio played up the ‘steely-eyed aviator’ stereotype, but in speaking to Flight Safety Australia de Crespigny emphasised several very different messages. For a start, he says any Qantas crew would have been just as successful.

Lesson 1. The nuances of CRM

Crew resource management is a concept that de Crespigny strongly believes in. It’s a conviction that goes back to his air force days when, after a career in multi-crew aircraft (Caribou and Iroquois), he realised he had become a different sort of pilot to the fighter pilots whose ranks he had once aspired to join. But he is also aware of its limits. Because de Crespigny was undergoing a line check, there were two other pilots on the flight deck of QF32: a check captain, Harry Wubben, and a senior check captain, David Evans, supervising Wubben. With first officer, Matt Hicks, and second officer, Mark Johnson, there were five pilots on the flight deck.

De Crespigny pays tribute to his colleagues and says the successful landing was a team effort. But his point is that even a team needs a leader. ‘The flight deck is not a committee’, he says.

The pilot in command has ultimate responsibility for the aircraft. Their seat is where the proverbial buck stops. But at the same time control is often best exercised through delegation.

In the book QF32 de Crespigny writes of his standing order to the pilots in the second-row seats, ‘If we are all up front looking down, you look up. If we are all looking up, you look down.’

The ever-shifting balance between authority, delegation and consultation meant de Crespigny took some cockpit decisions himself, and consulted the entire extended crew when there was time.

Lesson 2. The cliché is true: aviate, navigate, communicate

The crew of QF32 was faced with an unprecedented number of checklists from the A380’s electronic centralised aircraft monitor (ECAM). De Crespigny estimates there were more than a hundred and twenty.

‘We were just getting checklist after checklist telling us what was going wrong. It took us an hour to know what all the threats were—then we had to mitigate them.’

Despite this, the crew adhered to one of aviation’s most hallowed (and wise) clichés: ‘aviate, navigate, communicate’, meaning that the first priority should always be to keep control of the aircraft.

‘Every 10 minutes we reassessed the fuel and we reassessed whether we should continue doing checklists, or ignore the checklists and just (somehow) get the aircraft down on the ground. We all discussed it’, says de Crespigny.

With threat and error management you have to fix the problem—or mitigate for its loss. It’s a see-saw: if the aircraft wing had been on fire I would have put it straight on the ground or into the water. But we didn’t have a wing fire so we had more time – but how much more time? ‘

The threat of landing an aircraft in an unknown state … I think if we had thrown the aircraft down straight away people might have died.’

An important principle was to act after consideration, rather than blindly obeying checklists.’ No checklist was actioned immediately,’ de Crespigny says. ‘We discussed everything. We were trying to assess the threat and either fix it, or work out how we would mitigate it.’

A habit from de Crespigny’s military career asserted itself as they made their initial approach. He insisted on a control check. ‘It’s bred into the air force psyche.’ He was also thinking of El Al flight 1862, a Boeing 747 freighter that crashed into a block of flats in Amsterdam in 1992, killing the crew and 47 people on the ground. “They slowed down to configure and because they were asymmetric, went into an unrecoverable roll. You have to check the ability of the aircraft to fly and remain in control at the speed you want to land.’

‘We did a dress rehearsal of the landing at 4000 feet. If we had been losing control we would have sped up and brought the flaps up one step. What that meant was that a few minutes later, when we got speed and stall warnings they were certainly unexpected—but deep down I knew the aircraft would fly.

De Crespigny is an enthusiast for all Airbus and Boeing and fly-by wire aircraft generally, but he says automation can make it more difficult for pilots to honour the command to always aviate.

‘Flying is getting so much harder because there is so much more automation and so many more systems. There are four million parts in an A380. Manufacturers may say automation makes flying easy, but I maintain that if pilots are to recover an aircraft from an unimaginable position they still need to have knowledge of that aeroplane, much the same as pilots did in the 70s and 80s.’

Lesson 3. It’s not over after you touch down

De Crespigny has an endearing nerdish delight in analysing complex systems. (The Singapore incident interrupted his magnum opus, a technical book on new generation fly-by-wire airliners). The aftermath of QF32 required him to turn that gaze on himself.

Weeks after the event he found himself weeping, for the first time since his mother died decades earlier, while recounting parts of the event to ATSB investigators. There was another bout of tears and a six-hour car trip where he hardly spoke to his wife, Coral. Instead he went over and over the flight in his mind. De Crespigny was confronting post-traumatic stress.

‘Pilots who have these incidents … we’ve never been told what to expect, nobody around us knows how to handle us and we’re totally blind as to how our emotions are affecting our lives and our work,’ he says.

‘Even for pilots who think they’re OK, the stress they thought they were handling can reemerge.’

‘I insisted that it go in the book. I, and all male pilots are alpha males; we think we’re indestructible. When something happens we think “let’s toughen up and get through it”.’

De Crespigny instinctively knew it was more than a question of toughening up.

I was scheduled to take delivery of a brand new A380 three weeks after QF32. I called up my manager and said, “I am not in a condition to assess whether I am safe to fly. You have to take me off this trip.” It turns out I wasn’t in a fit state at all. I was so preoccupied with the aftermath of QF32.’

He visited aviation psychologist Ron Zuessman who, with a bluntness appropriate to his speciality, said: ‘I know pilots: what’s your problem?’

Zuessman explained how de Crespigny’s tears were a delayed expression of the stress he felt during the emergency.

‘He said, “revisit it, keep doing it – it will go away – if you don’t revisit it then it will stay there in your mind for ever, and every time it re-emerges, it will be just as painful as it was the first time”.’

‘I went away, thought about it and realised the crying was just natural’.

Zuessman then started working on what de Crespigny calls ‘the loop’—his endless mental replaying of the flight. ‘He said: “You’re probably talking to investigators, or writing a book—once I clear you from the loop you’ll start forgetting things.

Do a deal with Coral that you’ll stay in the loop for another three or four weeks, as long as you need to write down all the details of the flight for the investigators. After three weeks you’ll run this process I’m going to teach you and you’ll get out of the loop and start forgetting.’

The method was simple, but took advantage of recent research on brain function: ‘Just as I’m about to serve in a game of tennis I think QF32’, or when I’m mowing the grass I suddenly think QF32, de Crespigny says. ‘Anything that needs intense concentration, I think of QF32. It’s a way of making new synapse connections and breaking the older, post-traumatic stress synapse connections in my brain.’

‘In the weeks before I returned to flying I was looking up whenever an aircraft went over: I was ready for normal flying duties. I’ve been flying now for the past sixteen months. I’m sane, content and not afraid of anything because I took time to handle the PTS. Most importantly I’m not afraid of the aircraft. My message in putting this long description of post-traumatic stress in the book was to let others know that these issues are real and that they can be fixed.’

De Crespigny’s account of QF32 is published by Pan Macmillan Australia ISBN 1742611174