With my suggestions for the Industry

Jaanus Torp writes:

Hello Richard,

I just finished your book and I might say that it is not suitable for before bed reading.  Even though I had read the final report and knew the outcome, I was still quite wired by the masterfully written gripping drama.

I have a question about matters that you might not want to discuss or have not enough information about but which were left in the air.

The ATSB’s Final Report on QF32 focuses mainly on recommendations to Rolls-Royce and touches only very lightly on Airbus’s involvement. Can you please give some insight into what Airbus learned from this flight and did they make any changes to the design and/or operations of the A380 systems/layout/automation?

Cheers,
Jaanus

Richard replies:

Hi Jaanus, thanks for your question.

Airbus learned a great deal from the QF32 incident.

I visited Airbus, Toulouse many times after the QF32 event.  I  delivered presentations about the QF32 event to the RAeS, engineers, test pilots and Airbus’ global leaders and executives.   We discussed Airbus philosophies, methods, practices and how aircraft operations might be improved.

I thanked Airbus for designing and building the A380, a remarkably resilient aircraft that in my case returned 469 passengers and crew home to their loved ones, and saved over 32,000 friends the grief that comes to others in the event of a disaster.  (a future story)

Here is a summary of my discussions and sugestions-predictions for change.

1. Philosophies:

1. 

   Photo taken by QF32 Passenger Kjell Ljungqvist

   Fly-By-Wire (FBW) flight controls, autothrust and flight management automation all  worked well and as expected. (no change)

2. Install a “LAND ASAP” push button on the ECAM control panel, that inverts the logic (QF32 p198) and gives the pilots the minimum essential instructions to land/ditch immediately.   (R&D)
   (See another discussion on this topic)
3. Install my implementation of Neil Armstrong’s Spiral (QF32 p170)  into future Flight Management Systems.  (unlikely, due to accompanying airline costs to train the manoeuvre)

2. Practices:

1. The SOPs, role and task divisions for two pilot operations worked well.   (no change)
2. Include in pilots’ manuals a detailed description about flight control checks in fly by wire aircraft (and background information about Pilot Induced Oscillations (PIOs)) – Complicated!
3. Pilot training to include Stress Free Deliberate Practice   (see my discussion about SPDP in FLY!)

3. Aircraft:

1. 

   Damaged to lift at QF32’s wing tips to streamlining ailerons (Photo Richard de Crespigny)

   Mount more cameras inside and outside the aircraft for pilots to view the cabin, cargo holds, electronics bays, wheels and engines from within the cockpit.  (a seemingly simple concept, yet it complicated in practice because of increased costs to airlines)

2. Modify ECAM displays to show the total number of pending ECAM checklists (i.e. 2 of 10).  (accomplished on the A350)
3. Selectively and progressively detune the attention-getting alarms if an ECAM checklist is in progress.  This will reduce pilot distraction.  (unknown).  Note, this is a problem in Boeing aircraft as well.
4. Very technical: Improve some of the the sensors, the CAN busses and logic in OEM systems to better discriminate between an open circuit and a zero.   This would prevent sensor failures causing incorrect monitoring, diagnosis and pilot displays (unknown)
5. I think some of the ECAM checklists produced incorrect logic (FUEL, HYD …) because of item 4 above.   This was a case of garbage (sensors) -in-garbage (logic) out.   The fuel systems were so confused by the sensor, pump,valves and duct failures  that the Fuel Quantity Management System (FQMS) computers probably needed an alternate program (like the flight controls “Alternate Law”).   I think the unusual ECAM behaviour on board QF32 was unavoidable under the circumstances, and an example of why pilots are still needed to resolve the unexpected.  (human controllers still required in High Reliability Organisations, See also:  Sully Sullenberger: Technology Cannot Replace Pilots)
6. 

   A380 (Trent 900) fan blades, showing the wide chord, forward and aft sweep, and extensive washout. (Photo: RDC)

   Technical:  Include an ECAM advisory message (like that on the B787) to advise that the flight controls are saturated (pilots should make slow and deliberate inputs).  Here is the link connecting flight control degradation to PIOs   (unknown)

7. It was bad luck that the wires to the brakes and brake temperature sensors on the left wing were cut.  The system displays and ECAM could never have fully resolved the brakes’ situation (see item 5 above) .  (no recommendation-change)
8. Very Technical:  Include an ECAM advisory message to warn that the flight controls are out of phase with the pilot’s inputs (potentially-dangerously inducing rate-limited PIOs).
9. Super Technical:  Nancy-Bird exhibited no PIO tendencies during flight.I conducted a three-year research program on PIOs in Boeing and Airbus aircraft in the early 2000s.  This was a very delicate investigation with extensive help from NASA test engineers, Boeing 787 test pilots and companies that consult on FBW and PIOs.   Although the conclusions in my report confirm my suspicions, I have never published this report.  This background story explains why I was concerned about saturated flight controls on QF32.   Frank Ogilvie was also correct, the extra resilience (mid ailerons) provided on the A380 flight controls were needed during QF32.

Note: The damage to QF32, wing and fuselage was considerably worse than the damage reported at page 38 of this 2010 report by the AIA on High Bypass Ratio Turbine Engine Uncontained Rotor Events.

4. Comments

4.1 Aerodynamic Damage

We discussed the:

1. damage to the wing, the flight controls, and its effects on the aircraft’s controllability,
2. incorrect performance calculations that produced approach speeds that were too slow and that gave insufficient margin to the stall (QF32 p259),
3. incorrect flight displays that resulted because of the aerodynamic damage to the wing, and the
4. “SPEED SPEED” and “STALL STALL” warnings that we heard during the approach when we slowed down one knot below out approach speed.

Technical:

1. 

   Simulation of upper surface exposed to battle damage (T.W. Pickhaver & P.M. Render RAeS Journal Aug2105 p937)

   Many people have tried, but there is no easy way to predict the aerodynamic effects of damage to an aircraft’s wing.   In the case where there is a hole passing through top and bottom wing panels, wind tunnel tests (see image to the right) show a pair of horse-shoe vortices starting upstream from the hole, then broadening downstream on both sides to the trailing edge.  The flow separates behind the damage and there is significant reverse flow.  The lift and aerodynamic moments are significantly affected.

2. 

   Frank Ogilvie (former Aerodynamics Director and Deputy Head of Overall Design for the A380 project) at the Airbus Wing Factory, Broughton, UK (Photo: Airbus)

   Remember that damage to one wing must be replicated (in reduced lift) to the other wing if the aircraft is to fly straight.

3. For aft loaded airfoils (such as all modern supercritical wings), their is a dramatic loss of lift when a trailing edge control surface (i.e. aileron) slipstreams.   (see the description after QF32 page 238)
4. Damage effects are amplified when the damage is located inboard on modern transonic aircraft wings (that have a triangular lift distribution).

In the event of wing damage, I think the practical solution for predicting the effects of the damage, determining the approach speeds and then flying the approach lies more with the pilot:

1. knowing the key JAR-25/CS-25 aircraft certification standards and performance margins, and
2. know the “what”, why,” “how”, and “if-thens” of controllability checks (specifically for fly-by-wire aircraft).

4.2 Electrical  Damage

We discussed the extreme number (more than 650) of wires and network cables that were cut and the loss of systems that resulted from damage inside the left wing and the belly of the fuselage.  Even though Engine number 2 exploded, the damage extended to include Engine 1.  Four separate pairs of wires that took separate paths to two independent fuel shutoff valves for Engine 1 were all cut, rendering us unable to shut down Engine 1 until three and a half hours after we landed (QF32 p323).   Four pairs of wires to two fire extinguishers on Engine 1 were also cut, rendering the Engine 1 fire extinguishers useless.  (bad luck – no suggestion)

This was very bad luck for us though it displayed the resilience of the Rolls-Royce Trent 900 engines to still control thrust after so many wires had been cut.

Technical:   I asked an ATSB QF32 investigator how many more wires we could have lost and still made it home.  He said “none to Engine 1”.  I’ll leave it to you to work logically through that “interesting” scenario.

4.3 Airline Training

Many airlines have updated their training programs to incorporate lessons learned from the QF32 incident.

I wrote an article about Resilience in modern automated aircraft for the RAeS.

I believe cabin crew training at British Airways, Air France, Lufthansa, JAL, Singapore Airlines, Virgin Atlantic and Virgin Australia have included discussions about the lessons learned from QF32.

4.4  Aviation Organisations

I have presented the QF32 story and my thoughts to the World’s most specialised aviation organisations (regulators, safety, security, pilot organisations, investigators, manufacturers, suppliers, financiers, insurers and airlines).

Summary

Jaanus, I maintain absolute respect and admiration for Airbus and the manner in which the A380 was designed, built and tested.

A380 – it’s not just a passenger magnet, it’s also a pilot magnet.

Only the most critical operational changes are ever made to aircraft after they pass certification tests.

Any damned fool can criticize, but it takes a genius to design it in the first place (Edgar Schmued)

Airbus aircraft are all designed with a common strategic and operational philosophy that extends from the first A320 FBW aircraft to its latest A350.   A philosophical change for one aircraft type would by definition need to be retrofitted to other aircraft types across the entire fleet of more than 8,000 Airbus FBW aircraft!

I am not disappointed that Airbus will probably implement few of my recommend changes.  It’s a lot easier for me to think of quick and short term narrow fixes to individual aircraft designs, than it is for Airbus to design and integrate these changes throughout all of their aircraft fleets.  I am confident that the critical changes will eventually be implemented.

Nancy-Bird suffered over 500 fuselage impacts from shrapnel. I wrote that the probability of this incident happening again is one in 10^-14.7, that is, one million times less probable than the most stringent certification standards.   The aircraft flew remarkably well, which is a testament to the Airbus designers, builders, testers and maintainers.

QF32’s successful outcome is also due to the resilience of my colleagues in the cockpit, cabin, and on the ground.   Never underestimate these people’s contribution.   This was my motivation to write about personal and corporate resilience in my second book FLY! – the Elements of Resilience.

When I have the privilege to fly Nancy-Bird, I tell my passengers before the flight that they are “lucky to be travelling on an aircraft that is dear to my heart. Nancy-Bird has been stress tested and case hardened more than any other aircraft in the sky – and it proved itself indestructible that day.”

Jaanus, I provide the feedback and lessons above to serve as tools in your toolbox of solutions you might need one day when you face the unknown unknowns.  Every incident is different.  Every incident has it’s own unique threats, risks and outcomes.  So these “Technical Lessons from QF32” should only viewed in their context as another case study and food for thought.

To every Airbus employee, thank you again for designing and building such a resilient aircraft. The A380 saved 469 passengers-crew and 32,000 loved ones from disaster and PTS.

It has been my life’s ambition to be a pilot.  It has been my pleasure and honour to fly the A380.  Come fly with me and I’ll show you why.

The A380 – it’s not just a passenger magnet, it’s also a pilot magnet.

See also:

• QF32 Hydraulics and the Fog of War
• The Empirical Skeptic (QF32 and Fuel)
• Photos – QF32 Damage
• Photos – QF32 Wing
• Photos – QF32 Repair and Return

Discussions:

• Evacuation vs Deplane with steps
• Airborne vs Land ASAP  (future)
• Aircraft Flight Control Checks  (the “what”, why,” “how”, and “if-thens”)  (future)
• Crisis management (my next book ….)
• Leadership & building resilient teams (my next book ….)

Revisions:

• Updated 12 September 2019