Four minutes after lifting off from Singapore Changi Airport on 4 November 2010, Qantas Flight 32 was climbing through 7,400 feet when the passengers heard it: a bang, then a second, heavier one that shuddered through the cabin. On the flight deck, Captain Richard de Crespigny heard it too. “It was louder than what I'd ever heard in the simulator,” he later recalled. “But it was obviously an engine failure.”

It was much more than that. The No. 2 Rolls-Royce Trent 900 on the giant Airbus A380 had just torn itself apart in an uncontained failure — the kind where the engine casing cannot hold the wreckage in. Fragments of a turbine disc, flung out with enormous energy, punched through the left wing, severed wiring looms and set off an avalanche of electronic failure messages that would keep the crew busy for the better part of two hours.

An Bord des weltweit neuesten Superjumbos, eines Flugzeugs, das Qantas stolz benannt hatte, befanden sich 469 Personen. Nancy-Bird Walton. That everyone walked away — calmly, down a single set of stairs — is down to one of the most remarkable displays of airmanship in modern aviation. And to a stroke of scheduling luck that put five experienced pilots on one flight deck.

Zwei Knalle über der Insel Batam

QF32 had departed Changi at 9:57 am, bound for Sydney on the second leg of its run from London. At 10:01 am, over Batam Island in Indonesia, the intermediate-pressure turbine disc of engine No. 2 let go. Investigators later established that it broke into three high-energy fragments. Pieces of engine tore through the wing skin and rained down on Batam — some landing on houses and a school. Remarkably, nobody on the ground was hurt.

In the cockpit, de Crespigny and his crew did what pilots are drilled to do: fly the aeroplane first. Altitude hold, heading select, stabilise. Only then, about 40 to 50 seconds after the explosion, came the radio call: “Pan, Pan, Pan, Qantas 32, engine failure, number two engine, maintaining 7,400 feet, maintaining current heading. Stand by for instructions.”

A “Pan” call signals urgency, one step below Mayday. It reflected the crew's early assessment: the aircraft was flying, the wings were level, and there was no need for panic. What the pilots could not yet see was the state of their machine. Fuel was streaming from holes in the left wing. One of the two hydraulic systems was gone. Around half the aircraft's computer networks had been compromised.

De Crespigny would later say that 21 of the A380's 22 major aircraft systems were damaged or degraded that morning — by his count, the only untouched system was the passenger oxygen, which was not needed because the aircraft stayed below 10,000 feet.

ECAM Armageddon

Modern Airbus cockpits are built around ECAM — the Electronic Centralised Aircraft Monitor, a system that watches roughly 250,000 sensors and parameters and serves up checklists when something goes wrong. In a bad simulator session, a crew might work through four of those checklists. On QF32, about 40 queued up within the first seconds, and roughly 60 more followed. By the time the aircraft was parked, the pilots had actioned around 100 checklists in the air and another 20 on the ground.

Manche Checklisten widersprachen den Beobachtungen der Besatzung. Durchtrennte Kabel führten dazu, dass das Flugzeug oft nicht zwischen einem defekten Sensor und einem Nullwert unterscheiden konnte, sodass das ECAM einige Systeme als intakter und andere als defekt meldete. Der Hauptwarnton ertönte unaufhörlich; jedes Mal, wenn die Besatzung ihn deaktivierte, wurde er durch einen neuen Fehler erneut ausgelöst.

The sheer volume of alerts became a threat in itself. De Crespigny has been unusually honest about the moment the flood of information overwhelmed him — a candour that made his account, later published in his book QF32, Pflichtlektüre in Cockpits und Kontrollräumen weit über die Luftfahrt hinaus.

His answer came from space-flight history. Recalling how NASA flight director Gene Kranz handled the Apollo 13 crisis — telling his engineers to stop obsessing over what had failed and focus on what still worked — de Crespigny inverted the logic. Strip away the broken systems, and what remained was, in effect, a simple aeroplane: wings, fuel, flight controls, wheels, brakes. Enough to land.

Fünf Kapitäne, ein Flugdeck

Here is the twist of fate that QF32 is famous for. A normal A380 crew is three pilots: that day it was Captain de Crespigny, First Officer Matt Hicks and Second Officer Mark Johnson. But de Crespigny was due his annual route check, so Check Captain Harry Wubben rode along to assess him — and Senior Check Captain David Evans rode along to assess Wubben. Five pilots, with tens of thousands of hours between them, on the one flight that would need every bit of it.

Rather than crowding the cockpit, the extra captains slotted into the team. Hicks worked the endless ECAM checklists. Evans was handed the landing performance calculations. De Crespigny flew — and made the judgement calls that computers could not.

Einer dieser Anrufe stammte direkt aus der Militärfliegerei. Vor dem Landeanflug bestand de Crespigny auf einem Kontrollierbarkeitstest in großer Höhe: Er wollte das beschädigte Flugzeug in Landekonfiguration verlangsamen, um zu beweisen, dass es bei Anfluggeschwindigkeit noch steuerbar war. Damals war dies weder im Airbus- noch im Qantas-Handbuch vorgeschrieben.

Das Treibstoffsystem war unterdessen im Chaos versunken: Acht von elf Tanks waren unbrauchbar, Pumpen und Transferleitungen ausgefallen, beide Treibstoffcomputer versagten, und durch den aus dem beschädigten linken Flügel austretenden Treibstoff entstand ein zunehmendes Ungleichgewicht. Als de Crespigny seine vier Kollegen fragte, ob irgendjemand das Treibstoffsystem verstünde, herrschte Stille. Sie gaben die Reparaturversuche auf und arbeiteten mit dem, was sie hatten.

Fünfzig Tonnen zu schwer

An A380 taking off for Sydney carries far more fuel than it is certified to land with. Unable to jettison fuel — that system was damaged too — QF32 would have to land roughly 50 tonnes over its maximum landing weight, fast and heavy, with degraded brakes, no anti-skid, half its roll control and none of its leading-edge slats.

When Evans fed the failures into the landing performance application, the computer simply refused to produce an answer. Only after the crew removed the wet-runway assumption — Changi's runway was dry — did it spit out a result: the A380 could stop with about 100 metres of its four-kilometre runway to spare.

After holding for the best part of two hours while the checklists were worked, QF32 turned back towards Changi. The landing gear went down on the gravity-drop backup system. Approach speed was 35 knots faster than a normal A380 touchdown. De Crespigny flared gently — against advice to plant it — judging that a hard touchdown risked collapsing the gear into the fuel-soaked wing.

Um 11:45 Uhr setzte VH-OQA auf, verlor bei einer Vollbremsung vier Reifen und kam mit noch vor sich liegender Landebahn zum Stehen. Seltsamerweise stand der schwierigste Teil des Tages noch bevor.

Der Motor, der einfach nicht sterben wollte

On stand, the crew shut down the engines — and engine No. 1 kept running. The disc fragments had cut both sets of segregated control wiring to the outer-left engine; the fuel shutoff valves, and even the fire extinguisher bottles, no longer answered. De Crespigny opened his cockpit window, looked back, and watched the fan still turning while roughly four tonnes of fuel gushed from the wing near brakes heated by maximum-effort braking.

The exchange with the fire controller has become aviation legend. “We said, 'Put water over the hot brakes, and put foam over the fuel'. They said, 'Well shut down the engines first.' And we said, 'We have!'” de Crespigny recounted. Firefighters eventually drowned the engine with foam and water — it finally flamed out more than two hours after landing.

That decision — to keep everyone seated rather than send 440 passengers down escape slides from a deck eight metres up, next to a running engine and a lake of kerosene — is now taught as a case study in risk trade-offs. When the scene stabilised, passengers walked off through one door, down one set of stairs. Injuries: zero.

De Crespigny then did something found in no manual: he followed his passengers into the terminal, briefed them in person on exactly what had happened, answered questions for the better part of an hour — and gave them his personal mobile number.

Es begann mit einer Ölleitung

Das australische Verkehrssicherheitsbüro führte den gesamten Vorfall auf ein einziges Bauteil im Inneren der Trent 900 zurück: ein Ölzulaufrohr, dessen Wandung bei der Fertigung dezentriert bearbeitet worden war, wodurch eine Seite zu dünn war. Ein Ermüdungsriss entstand, Öl trat in einen heißen Hohlraum aus und entzündete sich. Das Feuer schwächte die Mitteldruckturbinenscheibe so stark, dass sie platzte.

The fallout was industrial as well as regulatory. Qantas grounded its A380 fleet, inspections swept the world's Trent 900s — 53 engines ultimately came off wing over suspect or undocumented oil-feed stub pipes — and Rolls-Royce paid Qantas A$95 million in compensation. Repairing Nancy-Bird Walton Die Arbeiten dauerten bis 2012 und kosteten rund 139 Millionen A$, darunter sechs Kilometer neue Verkabelung im stark beschädigten linken Flügel.

De Crespigny was appointed a Member of the Order of Australia in 2016 for his services to aviation safety. The aircraft itself flew again from April 2012, its story a standing rebuttal to anyone who thinks modern airliners — or modern crews — are just systems on autopilot. When 21 of 22 systems failed, the last line of defence was never really a system at all. It was the people up front.

Sources: Australian Transport Safety Bureau Final Report AO-2010-089, Eurocontrol HindSight 29 interview with Richard de Crespigny, Royal Aeronautical Society, Wikipedia, Richard de Crespigny “QF32” (Pan Macmillan, 2012)