October 2011 Archives

Much as Qantas' Capt Richard Champion de Crespigny has praised the A380's ability to absorb massive damage and still fly safely, he says the Australian Transport Safety Bureau will provide Airbus with plenty of food for thought when it publishes the report of its investigation into the QF32 engine failure event in November last year.

It's not clear how soon publication will be, because the damage caused by the catastrophic uncontained engine failure was so extensive, and the A380 and its systems are so complex, that the primary effects of the damage would fill a thick book, but the secondary and tertiary effects could keep the ATSB busy for a lifetime if it became fixated in detail.

De Crespigny refuses to break protocol by revealing what he knows in advance of the report. But having said that, the report is scarcely going to be a surprise for Airbus, which is assisting the ATSB in the investigation, as manufacturers are obliged to do.

Some changes in the pipeline are already clear. One of the particular problems de Crespigny and his crew faced that day was the plethora of ECAM alerts: more than 60 of them.

In future, when the system is faced with multiple failures, the ECAM display will now state how many alerts there are. For example, the first of the electronically prioritised alerts on QF32 would have been labelled "No1 of 60", which would have enabled de Crespigny to decide more quickly than he actually did that this was a situation in which ordinary checklists didn't apply.

When De Crespigny realised this, he then chose to apply a reverse logic: rather than sticking to the convention of identifying and dealing with the problems (unless one of them is a fire or something that needs instant attention), the priority becomes one of  identifying and protecting the systems that are still operating.

Talking about reports, de Crespigny is writing a book. After all, Sully Sullenberger did after the Hudson River ditching, and Peter Burkill published after BA38 crash-landed at Heathrow. All three were "black swan" accidents: that is, they were caused by events that could not have been foreseen and for which there were no checklists or laid down procedures.

I have the impression that de Crespigny is thinking of filling the market space left by the fact that Handling the Big Jets (D.P. Davies), an iconic book published in 1968, was not updated beyond the early 1970s.

Things have certainly changed since then.

My colleague Max Kingsley Jones, editor of airline business, has also addressed the issue of crews being swamped with an excess of information in emergency

Last Friday Capt Richard Champion de Crespigny arrived at Qantas's London regional headquarters in Hammersmith to give the staff a personal account of the day in November 2010 when his Airbus A380 suffered a catastrophic engine failure.

I won't rehearse yet again the technical detail of this well-documented event, but I will quote de Crespigny's words to the Australian media early this year describing what happened when his No 2 engine was blown apart by an uncontained turbine disc failure: "The wing was cluster-bombed. The aircraft had phenomenal damage to all systems. But it didn't just recover, it performed brilliantly."

Sure, but the flightcrew had to deal with a badly damaged three-engined aircraft and an ECAM display continuously scrolling a total of more than 60 system failures that clamoured for attention.

This is a brief account of the human side of what happened.

It's true the A380 proved itself pretty robust, but de Crespigny and his crew managed the aircraft's performance and the passengers' wellbeing with considerable skill and judgement. Not every skipper would have achieved the outcome he did. 

I was among the audience at the Qantas London office as de Crespigny gave his presentation to the Oz carrier's European HQ team. There were about 25 of them in the room, clearly all ready to be won, but de Crespigny brought them on board from the outset. Every Qantas employee had played their part with his crew that day, he told them, and he clearly meant it.

He reminded them that, among the 469 people on board the A380 that day, not a soul was harmed, and there have been no complaints from any of them since, despite the potential trauma of what they experienced, followed by the inevitable disruption to their planned journeys.

De Crespigny began his account unsensationally, describing the routine departure from Singapore for Sydney. Then, passing 7,000ft, the steady climb was interrupted by two very loud BANGS. The intermediate turbine disc had disintegrated at 8,000rpm, sending supersonic shrapnel slicing through the left wing, piercing a fuel tank and severing electrical and hydraulic runs.

From then on, he told us, the wing was effectively "dead", electrically and hydraulically. 

He related how the accident investigators' subsequent projections had determined that, having sliced through the wing, one of three major disc fragments travelling at twice the speed of sound had missed the fuselage by 2cm.

Instantly he had told us about hearing the BANG, our briefing room was suddenly ringing with the adrenaline-charged chimes of the A380's Master Warning System, just like it had blasted the flight deck that day.

De Crespigny's calm commentary continued uninterrupted through the shrilling alarm, as if he alone was oblivious to it. We were willing it to stop.

In the aeroplane on the day: every time the crew cancelled the aural alert, new ECAM warnings re-started it.

In the Hammersmith briefing room de Crespigny suddenly cancelled the frantic chiming. It felt like it had been ringing for half an hour, but in fact it had been running less than a minute.

The audience had got the point. So you have to think straight with that going on? But how?

In the aircraft, de Crespigny's immediate reaction to the engine explosion was to command the autopilot to level the aircraft out. Simultaneously he set about assessing whether, despite whatever had happened, the aircraft was flying at a safe speed and altitude with enough power to sustain it.

It was. The electrically isolated No 1 engine had gone autonomous and was running at a useful power setting. No 2 was dead. No 3 was the only one still on autothrottle, and 4 was also running autonomously. All three live engines were running at different power settings, and at that moment it was impossible to know precisely why they were. This was just one of a thousand confusing signals.

The crew themselves didn't yet know exactly what was going on or why, but de Crespigny knew the aeroplane was still flyable. So far.

The copilot - Matt - immediately went heads down and began attending to the seemingly never-ending series of system failures. Checklist after checklist, working with de Crespigny and the three other pilots in the A380's augmented crew.

This continued for some time until de Crespigny realised so many systems and units had failed that normal procedures were no use, and might even be counter-productive.

There were no checklists for this stuff.

He realised, he told us, that instead of dealing with the failures, his crew had to determine what was still working, and just use it. "I remember saying, 'Matt, stop!'"

This flight carried an unusually large augmented crew, because a new line-check captain who was checking de Crespigny was himself being checked by a senior one. The result was that there was a spare voice to brief the cabin crew and passengers.

So as soon as it became apparent that the aircraft could be successfully controlled, one of the supernumerary pilots checked with de Crespigny, then used the cabin address system to reassure the crew and passengers that, despite the failure of an engine, the aircraft was perfectly safe, and they would return to Singapore as soon as the crew had carefully checked the aircraft and its systems. "I was, actually, confident that we were safe," de Crespigny told us.

That first cabin address took place about three minutes after the engine explosion. As a result, de Crespigny told us, for the rest of the flight "the mood in the cabin was very relaxed." He related how his cabin service director, Michael von Reth, handed over tactical operational control of the cabin to his deputy, and spent his time moving around the cabin talking to passengers. 

It was about 45min, de Crespigny admits, before he himself got to speak on the cabin address. By that time the crew had worked out how long they had before the aircraft would be down to a safe landing weight, but would still have sufficient fuel in the leaking left wing to keep No 1 engine working and maintain the aircraft's balance. They had also assessed the landing performance with no working spoilers, no leading edge slats and limited roll control. Remarkably, they had manual control of all three working engines. They calculated they would stop with about 80m of the runway to go.

All they had to do now, while still at a safe height, was to carry out low speed handling checks to determine the parameters for a safe approach. So they did that.

De Crespigny's briefing to the cabin was not only reassuring to the passengers, it was strategic from Qantas' point of view. He advised the passengers that, once safely on the ground as they soon would be, they pretty quickly would be confronted by the media who would want to know what happened. He briefed the passengers on the essentials of what had happened to the aeroplane, as well as what was yet to come during the approach and landing they were about to begin. De Crespigny was also aware that, after landing, the passengers would naturally access the social media via their smart phones, if only to reassure their families. 

The results of de Crespigny's foresight, once the passengers were safely in the terminal at Singapore, were priceless to the airline. As he pointed out to us: "The passengers became a team working for us. They were our evangelists."

The final approach to Singapore was tight work, because the airspeed margin between incipient stall and the speed above which they would overrun the runway was only a few knots. They got stall warnings at 600ft and 300ft, but on the whole it went well. The aircraft stopped within the runway distance about 1h 40min after the engine failure.

De Crespigny admits that the most difficult decisions had to be taken after the aircraft had come to a halt, surrounded by fire crews dousing the hot brakes and covering the growing pool of fuel beneath the leaking tank with foam. The No 1 engine was still running at high power and would not shut down because it was electrically isolated, and so were its fuel shut-offs. Also, the runway they had landed on was the central one of Singapore's three parallel strips, so there were active runways either side. So how to get the passengers safely out into this unfriendly environment, then safely away from it?

Eventually de Crespigny saw the entire complement of passengers and crew disembark into waiting buses via a set of steps at the forward starboard door.

De Crespigny was inevitably the lynchpin of the operation that day, but Qantas' crisis management team worked well. Back in the airport terminal at Singapore, de Crespigny and his crew stayed with the passengers, providing answers and ensuring support. But the support was there. None of the passengers had to fight for anything - accommodation, access to communications. Off duty employees all over Qantas' global network were reporting in to find out if they could do anything to help.

Right now, as I commit this story to the electronic ether, Qantas has been totally grounded as a management response to union strike threats. Be careful with your people, Qantas. A worldwide team of employees who can do this for you has taken generations to build.

My colleague Max Kingsley-Jones, editor of Airline Business has also addressed the issue of crew being swamped by an excess of information  

At the National Business Aircraft Association conference and exhibition in Las Vegas earlier this month one of the phenomena was that everyone who is anyone was offering an iPad app to enable easy access the service they provided. The premise, presumably, is that most pilots have an iPad, and anyone who doesn't soon will.

Are they right?

Yes. The most crowded event among the briefings on offer at the NBAA was the iPads in the cockpit session. Not surprising, given that pilots are among the world's greatest lovers of new toys. But there is more to it than that.

Although compact laptops have been offered as EFBs for years, there is nothing quite so compact as Apple's tablet, and on flightdecks, size matters. So airlines and business aircraft operators have been rushing to win approval for iPads in the EFB role.

Now think back only a few years. In about 2002 Boeing/Jeppesen was offering a Class 3 built-in EFB for its 777s that couldn't do any more than an iPad can now at a tiny fraction of the cost. And, since then, the software providers have been busy making paper charts and manuals of all kinds obsolete.

Now, a small, commercial-off-the-shelf (COTS) hand-held device can replace entire aircraft libraries and heavy pilot flight bags packed with paperwork that was a nightmare to keep up to date. It's a tech log, an operators manual, a digital chart library, its calculator function can carry out all the performance calculations to a degree of accuracy that use of the old paper graphs could not possibly mimic.

My point is that it's difficult to see why there is any serious point in building Class 3 EFBs into aeroplanes when they offer so little in the way of advantage and cannot possibly compete on the cost front. They may offer total integration with the aircraft systems, but how much of an advantage is that?

Not much. It's just another pilot/aeroplane interface, and who needs yet another?

Why not go for a state-of-the-art COTS tablet at Class 1+ EFB level. The "+" is a cockpit mounting point where the pilots can see the display and manipulate the device with one hand. 

I would argue that if the pilots have to enter the performance data the EFB produces into the aircraft FMS, that's not too onerous a task, and the pilot involvement is a potential net benefit. We have reached a point where the pilots are becoming (to coin a word) dis-involved, and have become disengaged as a result.

The previous blog entry, and others before it, deal with where that has been leading. 

Under existing normal training regimes pilots "are trained to be reliable, not resilient," says Mason, insisting the evidence is there to be measured. He listed some of the effects:

• crews don't check data, and don't scan their instruments;
• they don't make decisions without backup from checklists or the engine instrument and crew alerting system (EICAS)  in Boeings, or the electronic centralised monitor (ECAM) in Airbuses
• they do not question presented information.

The result of the combination of aircraft automation and systems reliability, comments Mason, is that "nowadays we don't gain experience, we just get older". The answer, he said, is for training to provide the brain food to keep the pilots' skills intact. Referring to the obsession of some regulators with experience rather than evidence-based quality, he asks: "Do we get 1500 hours experience or the same hour 1500 times?"

Mason says he operates a training package designed to produce resilience. The secret, he says, is to "select talent and train them well", using evidence based assessment and training tailored to provide a string of desirable characteristics, including "understanding and mastery; judgement, confidence and leadership; scanning and manual aircraft control; how to monitor and when to intervene; when to automate and when to fly."

Mason's description of the Emirates training regime sounds like the diametric opposite of the old "trapper/trainer" mentality, which he describes as "schematic box-ticking of training exercises...applying training exercises for exposure rather than mastery, conferring management skill rather than leadership."

Air Berlin has admitted it suffered a cabin air contamination event on an Airbus A330 flight from New York JFK to Berlin, and that it has had to report it to the investigator, the BFU.

The crew reported smoke and a "wet pullover" smell in the cockpit and cabin during climb and again during descent. They also report feeling variously dizzy, sick, and suffering numbness in their fingertips. Having reported to base by ACARS and satphone, they got a strange response from the airline's medical department: they could give no advice on cabin air contamination because such events were "political".

The airline, in its statement about the event, makes much of its dutiful action in reporting it to the authorities. Actually It had no choice, because people on board suffered medical consequences, which makes reporting compulsory.

Cabin air contamination events are widely ignored by all airlines as inconsequential, and they avoid reporting them if they can, but in this case (25 September) the crew had to receive hospital attention on landing, and the Purser was detained there for two days.

This event, like all the others, was caused by engine oil fumes entering the cabin bleed air feed because of an engine oil seal leak. Upon landing the technical staff reported visible oil leakage on the spinner and in the engine casing. 

It is well documented (not least by Flightglobal and Flight International) that these events cause pyrolised organophosphates, particularly tricresyl phosphate (TCP), to enter the cockpit and cabin. TCP is a neurotoxin that has caused many crew all over the world to lose their health and, as a result, their pilot licences or their ability to function as cabin crew.

Air Berlin has strenuously avoided answering Flightglobal's question as to whether it has warned the 262 passengers of the risk to their health. Actually there is no treatment for organophosphate poisoning, so it could be argued that there's no point in telling them. But at least they would know what might have caused a sudden deterioration in their general health and where to go for reparation. That, of course, is another reason not to tell them.

Finally, by not telling the passengers, Air Berlin would be doing no wrong according to the law, because the aviation agencies, including EASA, have strenuously avoided getting involved in the passenger and crew health aspects of bleed air contamination on the grounds that passenger and crew health is not their business. Cabin air contamination has not yet caused a crash. It nearly has, as the UK Air Accident Investigation Branch has reported, but not quite. The almost-incapacitated crew managed to land the aircraft.

The solution? Pilots should put oxygen masks on immediately they smell fumes. So that's all right then.

So, after a fume event, all the airlines have to do is to is report it, repair the oil seal and go on as if nothing has happened until the next time.

I wonder how many European passengers know that the aviation authorities say that passenger and crew health on board public transport aeroplanes is of no concern to them?