Four minutes after lifting off from Singapore Changi Airport on 4 November 2010, Qantas Flight 32 was climbing through 7,400 feet when the passengers heard it: a bang, then a second, heavier one that shuddered through the cabin. On the flight deck, Captain Richard de Crespigny heard it too. “It was louder than what I'd ever heard in the simulator,” he later recalled. “But it was obviously an engine failure.”

It was much more than that. The No. 2 Rolls-Royce Trent 900 on the giant Airbus A380 had just torn itself apart in an uncontained failure — the kind where the engine casing cannot hold the wreckage in. Fragments of a turbine disc, flung out with enormous energy, punched through the left wing, severed wiring looms and set off an avalanche of electronic failure messages that would keep the crew busy for the better part of two hours.

There were 469 people on board the world's newest superjumbo, an aircraft Qantas had proudly named Nancy-Bird Walton. That everyone walked away — calmly, down a single set of stairs — is down to one of the most remarkable displays of airmanship in modern aviation. And to a stroke of scheduling luck that put five experienced pilots on one flight deck.

Two Bangs Over Batam Island

QF32 had departed Changi at 9:57 am, bound for Sydney on the second leg of its run from London. At 10:01 am, over Batam Island in Indonesia, the intermediate-pressure turbine disc of engine No. 2 let go. Investigators later established that it broke into three high-energy fragments. Pieces of engine tore through the wing skin and rained down on Batam — some landing on houses and a school. Remarkably, nobody on the ground was hurt.

In the cockpit, de Crespigny and his crew did what pilots are drilled to do: fly the aeroplane first. Altitude hold, heading select, stabilise. Only then, about 40 to 50 seconds after the explosion, came the radio call: “Pan, Pan, Pan, Qantas 32, engine failure, number two engine, maintaining 7,400 feet, maintaining current heading. Stand by for instructions.”

A “Pan” call signals urgency, one step below Mayday. It reflected the crew's early assessment: the aircraft was flying, the wings were level, and there was no need for panic. What the pilots could not yet see was the state of their machine. Fuel was streaming from holes in the left wing. One of the two hydraulic systems was gone. Around half the aircraft's computer networks had been compromised.

De Crespigny would later say that 21 of the A380's 22 major aircraft systems were damaged or degraded that morning — by his count, the only untouched system was the passenger oxygen, which was not needed because the aircraft stayed below 10,000 feet.

ECAM Armageddon

Modern Airbus cockpits are built around ECAM — the Electronic Centralised Aircraft Monitor, a system that watches roughly 250,000 sensors and parameters and serves up checklists when something goes wrong. In a bad simulator session, a crew might work through four of those checklists. On QF32, about 40 queued up within the first seconds, and roughly 60 more followed. By the time the aircraft was parked, the pilots had actioned around 100 checklists in the air and another 20 on the ground.

Some checklists contradicted what the crew could see. Severed wires meant the aircraft often could not tell a dead sensor from a zero reading, so ECAM reported some systems healthier than they were, and others sicker. The master caution chime rang again and again; each time the crew cancelled it, a new failure brought it back.

The sheer volume of alerts became a threat in itself. De Crespigny has been unusually honest about the moment the flood of information overwhelmed him — a candour that made his account, later published in his book QF32, required reading in cockpits and control rooms far beyond aviation.

His answer came from space-flight history. Recalling how NASA flight director Gene Kranz handled the Apollo 13 crisis — telling his engineers to stop obsessing over what had failed and focus on what still worked — de Crespigny inverted the logic. Strip away the broken systems, and what remained was, in effect, a simple aeroplane: wings, fuel, flight controls, wheels, brakes. Enough to land.

Five Captains, One Flight Deck

Here is the twist of fate that QF32 is famous for. A normal A380 crew is three pilots: that day it was Captain de Crespigny, First Officer Matt Hicks and Second Officer Mark Johnson. But de Crespigny was due his annual route check, so Check Captain Harry Wubben rode along to assess him — and Senior Check Captain David Evans rode along to assess Wubben. Five pilots, with tens of thousands of hours between them, on the one flight that would need every bit of it.

Rather than crowding the cockpit, the extra captains slotted into the team. Hicks worked the endless ECAM checklists. Evans was handed the landing performance calculations. De Crespigny flew — and made the judgement calls that computers could not.

One of those calls came straight out of military flying. Before attempting a landing, de Crespigny insisted on a controllability check at altitude: slowing the damaged aircraft in its landing configuration to prove it would still obey the controls at approach speed. At the time, no Airbus or Qantas manual required it.

The fuel system, meanwhile, had descended into chaos: eight of eleven tanks unusable, pumps and transfer galleries dead, both fuel computers failed, and a growing imbalance as fuel poured from the punctured left wing. When de Crespigny asked his four colleagues whether anyone understood the fuel system, the answer was silence. They stopped trying to fix it and worked with what they had.

Fifty Tonnes Too Heavy

An A380 taking off for Sydney carries far more fuel than it is certified to land with. Unable to jettison fuel — that system was damaged too — QF32 would have to land roughly 50 tonnes over its maximum landing weight, fast and heavy, with degraded brakes, no anti-skid, half its roll control and none of its leading-edge slats.

When Evans fed the failures into the landing performance application, the computer simply refused to produce an answer. Only after the crew removed the wet-runway assumption — Changi's runway was dry — did it spit out a result: the A380 could stop with about 100 metres of its four-kilometre runway to spare.

After holding for the best part of two hours while the checklists were worked, QF32 turned back towards Changi. The landing gear went down on the gravity-drop backup system. Approach speed was 35 knots faster than a normal A380 touchdown. De Crespigny flared gently — against advice to plant it — judging that a hard touchdown risked collapsing the gear into the fuel-soaked wing.

At 11:45 am, VH-OQA touched down, blew four tyres under maximum braking, and came to a stop with runway still ahead of it. The hardest part of the day, strangely, was still to come.

The Engine That Would Not Die

On stand, the crew shut down the engines — and engine No. 1 kept running. The disc fragments had cut both sets of segregated control wiring to the outer-left engine; the fuel shutoff valves, and even the fire extinguisher bottles, no longer answered. De Crespigny opened his cockpit window, looked back, and watched the fan still turning while roughly four tonnes of fuel gushed from the wing near brakes heated by maximum-effort braking.

The exchange with the fire controller has become aviation legend. “We said, 'Put water over the hot brakes, and put foam over the fuel'. They said, 'Well shut down the engines first.' And we said, 'We have!'” de Crespigny recounted. Firefighters eventually drowned the engine with foam and water — it finally flamed out more than two hours after landing.

That decision — to keep everyone seated rather than send 440 passengers down escape slides from a deck eight metres up, next to a running engine and a lake of kerosene — is now taught as a case study in risk trade-offs. When the scene stabilised, passengers walked off through one door, down one set of stairs. Injuries: zero.

De Crespigny then did something found in no manual: he followed his passengers into the terminal, briefed them in person on exactly what had happened, answered questions for the better part of an hour — and gave them his personal mobile number.

It Started With an Oil Pipe

The Australian Transport Safety Bureau traced the whole event to a single component deep inside the Trent 900: an oil-feed stub pipe whose wall had been machined off-centre during manufacture, leaving one side too thin. A fatigue crack opened, oil leaked into a hot cavity and caught fire, and the fire weakened the intermediate-pressure turbine disc until it burst.

The fallout was industrial as well as regulatory. Qantas grounded its A380 fleet, inspections swept the world's Trent 900s — 53 engines ultimately came off wing over suspect or undocumented oil-feed stub pipes — and Rolls-Royce paid Qantas A$95 million in compensation. Repairing Nancy-Bird Walton took until 2012 and cost about A$139 million, including six kilometres of new wiring in the ravaged left wing.

De Crespigny was appointed a Member of the Order of Australia in 2016 for his services to aviation safety. The aircraft itself flew again from April 2012, its story a standing rebuttal to anyone who thinks modern airliners — or modern crews — are just systems on autopilot. When 21 of 22 systems failed, the last line of defence was never really a system at all. It was the people up front.

Sources: Australian Transport Safety Bureau Final Report AO-2010-089, Eurocontrol HindSight 29 interview with Richard de Crespigny, Royal Aeronautical Society, Wikipedia, Richard de Crespigny “QF32” (Pan Macmillan, 2012)