Original subtitles

Narrator: The world's largest commercial airliner

is coming apart in midair.

Man: We're losing an engine.

Man: There was fuel leaking from the aircraft.

There was damage to the aircraft flight controls.

Narrator: Pilots face an avalanche of warnings.

Man: What have you got for me now?

Narrator: Critical systems are failing

throughout the gigantic plane.

Man: What's going on up there?

Narrator: The lives of 440 passengers are at risk.

And the crisis quickly escalates from bad...

Man: It's one system after another.

Narrator: ...to catastrophic.

Man: The computer says we can't make it.

Man: Damn it!

This is like the simulator exercise from hell.

Flight attendant: Ladies and gentlemen,

we are starting our approach.

Pilot: We lost both engines!

Flight attendant: Put the mask over your nose.

Emergency descent.

Pilot: Mayday, mayday!

Flight attendant: Brace for impact!

Controller: I think I lost one.

Man: Investigation starting...

Man: He's gonna crash!

Narrator: Qantas flight 32 is making a refueling stop

in singapore.

The airbus a380 is more than halfway through

a marathon 22-hour flight,

all the way from london to sydney, australia.

After two hours on the ground,

the crew is nearly ready to get the plane back in the air.

Very few pilots are trained to captain an a380.

Former fighter pilot richard de crespigny

is in that elite rank.

Richard de crespigny: Everyone ready for takeoff?

The a380 is the latest generation of innovation,

automation and excellence.

And it's the largest, most complex aircraft in the sky.

Narrator: The main duty on this flight

for first officer matt hicks

is to monitor the vast number of electronic gauges

and computer displays needed to fly this state-of-the-art plane.

Matt hicks: Everything's looking good here, richard.

All of us had flown together at some stage.

It just makes it easier, because there's no first-day greetings,

or, you know, personality uncertainties.

Everyone knew each other pretty well.

Narrator: Mark johnson is the second officer.

De crespigny: Mark, any worries?

Mark johnson: All good back here.

Narrator: The three pilots will take turns flying the plane

during the remaining seven hours of the flight.

The gigantic a380 is a true double-decker--

the first jet ever built with two decks

running the entire length of the plane.

It dwarfs every other airliner in the sky,

with enough space for as many as 525 passengers.

Marion carroll: I hadn't realized the enormity

of how large a 380 was.

The cabin, the inside of the a380,

just everything seemed bigger, but more rows and upstairs.

Narrator: On today's flight

captain de crespigny's performance is being evaluated.

It's a yearly requirement for every qantas pilot.

The check captains performing the task

are veterans harry wubben and dave evans.

Dave evans: Some people are affected by checks.

They get a bit nervous,

so we try to keep that as easy as possible.

De crespigny: Ok, so, everyone's happy?

Hicks: Richard, obviously, just being checked,

he's a bit, you know, tentative in taxiing out.

So when he asked if everything's, everyone happy?

I said, yeah, I'm happy.

Just don't crash.

Controller: Qantas 3-2 cleared for takeoff, runway 20 center.

Hicks: Qantas 32 cleared for takeoff.

De crespigny: Ok, we're on the roll.

Hicks: Thrust set. 80 knots.

The more automated aircraft get,

it doesn't necessarily make them easier to fly,

it just makes them different to fly.

Narrator: The a380 is powered

by four massive rolls-royce engines.

Each can deliver 72,000 pounds of thrust.

De crespigny: They design wonderful engines,

very reliable.

Hicks: V-1. Rotate.

Narrator: At 9:57 a.m. Local time,

qantas 32 lifts off right on schedule.

Passengers get a unique view of the takeoff,

thanks to a camera mounted on the a380's tail.

Carroll: The atmosphere in the cabin was perfectly casual.

We were chatting away the whole time

since we, since we were seated.

Narrator: There are 250,000 sensors monitoring

every flight function on the aircraft.

De crespigny: Autopilot.

Hicks: On.

Narrator: This is by far the most automated passenger jet

in the skies.

De crespigny: Climb out checklist, please.

Hicks: Auto thrust is set and ecam is clear.

Narrator: The ecam,

or electronic centralized aircraft monitor,

keeps watch over the myriad of onboard systems

and alerts the crew to even the slightest malfunction.

It's 10:01 a.m.

The pilots are just four minutes into the flight.

Hicks: We're losing an engine.

De crespigny: Boom.

Boom.

It's like a backfire in your car.

Carroll: There was a loud explosion.

Huge explosion, and everybody just said, what was that?

My reaction immediately, I think, was,

oh, my goodness, maybe this is it.

Hicks: The first thought when it goes bang,

is engine failure, possibly severe damage.

We've lost number two.

De crespigny: Holding 7,500 feet.

Narrator: De crespigny wastes no time

taking over control from the autopilot.

35 years of flying tells him what to do next.

De crespigny: I pressed the altitude hold button,

which would cause the nose to lower and the aircraft level.

Matt, ecam actions.

Hicks: On it.

Narrator: The captain assigns hicks to decipher the ecam data.

He needs to evaluate every message

and figure out how best to react to each one.

Hicks: We had to work our way through it

and build up a picture of what was going on with the airplane.

Narrator: While the captain summons

all his skills as a pilot,

hicks needs to quickly master the plane's ecam computer.

He's facing a barrage of error messages

from seemingly unrelated systems throughout the plane.

Hicks: You can't really tell how many messages

you've got pending.

You know there's more coming,

because the screen will give you an arrow at the bottom

indicating that there is another message.

Evans: It became very confusing initially

as to why we were seeing so many of them.

Narrator: Captain de crespigny needs room to maneuver.

De crespigny: Pan, pan, pan. Qantas 32. Engine failure.

Maintaining 7,400 and current heading.

Controller: Qantas 32, copied.

Please let us know how to assist.

De crespigny: I declared a pan call,

and what that does is tell everyone who's listening,

we have a problem.

It tells air traffic control,

clear the airspace and to not annoy us with transmissions.

Let us solve the problem.

Narrator: But the ecam warnings just keep coming.

Hicks: Number two's overheating.

Narrator: Their damaged engine is dangerously hot.

This state-of-the-art plane is now in very real danger

of becoming a fireball.

Carroll: Well, we couldn't actually see the engine itself,

because it was under the wing.

Oh, my god!

But we could see the stream of the fuel coming out.

Narrator: The wings of an a380 are filled

with tons of highly flammable jet fuel.

Carroll: We were all just wondering

what was going to happen next.

Narrator: The crew wants to cut the flow of fuel

before the damaged engine catches fire.

Hicks: Number two master switch to off?

De crespigny: Confirm.

Narrator: But it's too late.

An alarm warns the crew the engine is on fire.

An in-flight fire is one of the most dangerous and unpredictable

emergencies any crew can face.

It's nearly always disastrous.

July 11, 1991.

Smoke begins seeping into the cabin of a dc-8

moments after takeoff from jeddah, saudi arabia.

As the pilots try to land,

flames sweep through the entire cabin

and consume the plane, killing all 261 people on board.

On qantas 32, the crew's only hope of putting out the fire

is to activate the emergency extinguishers

inside the burning engine...

Hicks: Fire number two. Push button?

De crespigny: Confirm.

Narrator: ...and keep their fingers crossed that it works.

Hicks: The warning's off. I think the fire's out.

De crespigny: Let's find a way to confirm that, please.

It was stressful. It was difficult.

Hicks: I mean, if you had a fire burning out on the wing

for the duration of the flight,

you'd be landing pretty quick smart

rather than taking your time flying around,

trying to solve other problems.

Narrator: Marion carroll is sitting over the left wing,

giving her a front-row seat to the unfolding calamity.

Carroll: I could see the hole that was in the wing

that had been made by the explosion.

And it seemed, from what I could see, quite a large hole,

like about a couple of feet across,

and all the metal was jagged and sticking up.

Narrator: 4,000 miles away,

the qantas operations center in sydney

is getting data transmitted live from the plane.

It's like nothing engineer alan milne has ever seen before.

Alan milne: I'm getting some odd messages off flight 3-2.

When we saw the messaging coming in from the airplane,

it was so diverse, so many systems,

we couldn't, we couldn't just put a finger on it.

Narrator: Meanwhile, on batam island, indonesia,

locals are finding evidence of an air disaster.

The wreckage sparks media speculation

that a qantas plane has fallen from the sky.

At the australian transport safety bureau,

kevin chapman gets word of disturbing media reports.

If true, he knows he'll soon be facing

the biggest investigation of his career.

Kevin chapman: The australian transport safety bureau

monitor the media,

and we were well aware through the media coverage

that there was some sort of event.

The initial event described in the media

was an airplane had crashed off indonesia.

Damn.

An a380's gone down in indonesia--qantas.

So we were quite concerned at that point.

Narrator: Explosive engine failure

has led to fatal tragedy in the past.

July 19, 1989.

A united airlines dc-10 bound for chicago

loses an engine mid-flight.

Shrapnel severs hydraulic lines,

making the plane nearly impossible to control.

The crash landing in sioux city, iowa,

kills 111 of the 296 people on board.

Back aboard the a380,

first officer matt hicks has begun working his way through

a growing avalanche of computerized warnings.

The crew must correctly react to each and every message

before moving on to the next.

Hicks: Ok, i've cleared slate one and two.

What have you got for me now?

Hydraulics.

De crespigny: It was like taking plates off a serving machine

in a restaurant, where you do one checklist,

and there's another one.

You do that, and there's another one, and another one,

and another one, and another one, another one.

Hicks: In a training environment

you probably only do two or three consecutive failures.

And in this case, I think we had 58,

so it was, yeah, a lot more than i'd ever worked through before.

Narrator: It's been five minutes

since the plane's number two engine exploded.

Qantas 32 is 43 miles south of singapore

and heading out over the open ocean.

The pilots want to turn back, but making a u-turn is risky

without knowing how badly damaged their plane is.

The list of failures continues to grow,

taxing the pilots' abilities to respond.

One wrong move on their part

could lead to one of the deadliest air disasters

the world has ever seen.

Engineers at the operations center are also trying

to make sense of the cascade of errors.

Qantas 32 seems to be failing in almost every conceivable way.

No one knows how long the plane can stay in the air.

Milne: It's one system after another.

My initial impression was that

it might have actually been an indication problem--

that the airplane was sending us false error messages.

What's going on up there?

Hicks: Degraded pneumatics, hydraulics, electrics,

power to the left wing shut down.

Flaps, slats and ailerons are damaged but operable.

De crespigny: Dave, I need you to get on the horn

to the passengers.

Let them know our situation.

Evans: Ladies and gentlemen,

we're just sorting out some engine problems.

Carroll: He was very calm and very reassuring,

and, I mean, it was his tone of voice that was very reassuring.

Narrator: Captain de crespigny knows he's running out of time.

The failures are mounting.

His plane may soon be unflyable.

He needs to get the damaged plane on the ground.

That means turning around and heading back to singapore.

De crespigny: Singapore, qantas 3-2.

We require a left turn back towards singapore.

Controller: Qantas 32, singapore.

Turn left heading 0-2-0.

Hicks: Are we stable enough for this turn?

De crespigny: We'll know pretty soon.

Narrator: De crespigny takes it inch by inch...

...knowing that he could lose control at any moment.

De crespigny: It takes time to prepare the aircraft to land,

to understand the airplane that we're going to land.

But as the time goes on, things are getting worse.

So we don't want to stay one minute more in the air

than we have to.

Narrator: Singapore is the largest airport

within 200 miles.

Its massive runway offers the best chance

of landing the plane safely.

De crespigny: Singapore runway is four kilometers long,

and we would normally need 1,800 meters to land on the runway

if we're at maximum landing weight.

But we are 40 tons over our maximum landing weight.

Narrator: De crespigny completes the turn back to singapore.

The maneuver gives the crew confidence

that they have some control over this juggernaut.

Making a left turn is one thing,

landing the crippled a380 will be quite another.

The pilots need to know more about the damage

and its possible effects.

De crespigny: Mark, why don't you go back

and take a look at that wing?

Johnson: On my way.

De crespigny: We couldn't see the wings from the flight deck.

We can't see the engines.

So mark would be our eyes and ears to the aircraft.

Carroll: After a couple of minutes,

one of the pilots came out and was looking down each window.

And I called to him and said, well, if you come down to my row

you'll get a much better view of the hole in the wing.

Narrator: The second officer gets a sobering view.

Johnson can clearly see that the wing has been punctured

straight through from below.

The cause of the damage is obvious--

the inboard left side engine is blown to pieces.

Carroll: Is it bad?

Johnson: No, we'll be fine. No worries at all.

De crespigny: What can you tell me, mark?

Johnson: Number two's blown apart,

cut holes through the wing, and we're leaking fuel.

Hicks: Good to know.

It was invaluable to send someone back

to physically eyeball the damage on the wing

and to have a pilot come back to you

and say, hey, look, this is the situation,

and especially someone you trust,

that's as good as you having a look yourself.

Narrator: The news helps explain why so many systems are failing.

Vital flight controls run through the wing.

Shrapnel from the demolished engine

has likely destroyed many of them.

Hicks: There's obviously a lot of hydraulic components

that run through the wings,

so that would make sense

that we'd have damage to the hydraulic system.

It sort of clarifies a lot of the information

that you're seeing.

De crespigny: We had so many checklists, 100 in the air,

that it took matt 55 minutes to stabilize the aircraft

so that this aircraft situation didn't get worse.

That is unprecedented in aviation history.

Narrator: Knowing why qantas flight 32 is failing

doesn't make it easier to fly.

The damaged electrical and hydraulic systems

could cause an unexpected failure

while the crew is trying to land.

The pilots decide to circle near the airport

until they can work out a plan.

De crespigny: Dave.

I need you to run the numbers on this landing.

Narrator: Check captain dave evans

is called into action.

De crespigny: Three engines, full load, all that.

Narrator: He uses the a380 landing software

to calculate how much runway they'll need

to bring the huge plane to a stop.

Evans: The computer says we can't make it.

Runway's too short.

With the nine failures that i'd put into the system

and the surface conditions in singapore,

at our maximum landing weight, I couldn't come up with an answer.

Narrator: The a380 is weighed down with fuel.

The plane has burnt almost none of the 105 tons it took on

for the flight to sydney.

De crespigny: Can we dump some fuel?

Hicks: That's a good idea, but we can't.

The fuel transfer pumps are down.

De crespigny: Damn it!

Can someone tell me what is working?

Narrator: The heavy load of flammable fuel

means any landing attempt will be extremely dangerous.

Evans: We were some 40 tons

above our maximum landing weight.

And the heavier you are, the more runway

and the higher speeds will be on your approach.

Narrator: Evans tries his calculations again.

The computer has assumed a worst-case scenario.

He now plugs in some more optimistic numbers.

De crespigny: There is a belief in part of the industry

that computers are infallible,

and you always believe a computer.

Now, we've used our computers at home to know that's not true.

Evans: Ok.

Looks like we can do it with 139 meters to spare.

139 meters surplus on a 4,000-meter runway

is a slim margin, but it's better than a minus 139 meters.

De crespigny: What do we need for our approach speed?

Evans: 146 knots.

Hicks: 146 knots? That can't be right.

It's just too slow.

He gave us that speed to input

into our flight management computer.

And before I input it, I thought,

I just had to think about it,

and I thought that just can't be right.

It's just too slow.

Narrator: Maintaining the right speed on landing is critical.

Too slow, and the plane will lose lift

and plummet to the ground.

Too fast, and they could run off the end of the runway and crash.

De crespigny: Add 20 knots. Can we still stop in time?

Evans: Good catch, matt.

Yep. 166 works.

De crespigny: I'd like to think that we sucked the brains dry

of all the pilots in the cockpit to make one massive brain,

and we used that intelligence to resolve problems on the fly,

because these were, these were unexpected events,

the unthinkable events.

Narrator: At the qantas operations center,

milne sees that qantas 32 has begun its final descent.

Now all he can do is hope the crew can safely execute

this treacherous landing.

Milne: They're doing it. Qf 3-2's coming in.

Narrator: He alerts personnel at the airport

to prepare for the emergency landing

of the biggest airliner on earth--

a landing that could end in disaster

for 469 passengers and crew.

Milne: We know these guys personally.

We know the cabin crew, and you know, it's a worry.

De crespigny: Singapore approach, qantas 32.

We're gonna need a long approach.

And you better have fire services standing by.

We're leaking fuel.

Controller: Roger, qantas 32.

You're cleared straight in on final, 20 miles.

Narrator: The five seasoned pilots now use everything

they've ever learned about flying...

De crespigny: Flaps three.

Narrator: ...to try to land their plane safely.

De crespigny: Here we go.

Narrator: De crespigny still doesn't know

if his plane is capable of the precision needed for a landing.

Hicks: 4,500 feet.

Narrator: He decides to find out

while there's still room for error.

De crespigny: Ok. I'd like to do a control check.

An aircraft where the aerodynamic ability is unknown,

you have to prove the aircraft to be safe to fly

before you land, and they are called control checks.

Ok, let's see what you can do.

Narrator: Captain de crespigny rolls the plane carefully left

to simulate lining up with a runway.

De crespigny: We had degraded roll control.

We had lost 65% of our roll control.

So I knew that we had to certify the airplane ourselves

to fly before we landed.

Ok.

Narrator: As he rolls the plane to the right,

there's barely enough control to achieve the maneuver.

He's quickly learning the limits of his damaged plane.

De crespigny: If the few flight controls that we have remaining

are working to their limit,

then clearly we have very little margin for maneuvering

when we come in to land.

Hicks: When we did those control checks,

I thought it was a bit sluggish at the time,

and I think richard did as well.

Narrator: The crew knows they'll only get one shot

at lining up with the middle of the runway.

There can be no last-minute adjustments.

Now the crew discovers

a potentially catastrophic obstacle.

Hicks: Landing gear hydraulics are still offline.

Narrator: The automated system for lowering the landing gear

is damaged.

They can only release the gear,

and hope it falls hard enough to lock itself into place.

Hicks: Landing gear down?

De crespigny: Confirmed.

Narrator: If the gear doesn't lock,

the crew has no hope of landing safely.

De crespigny: For the landing gear,

we just needed enough wheels to hold the aircraft

with enough brakes to stop us.

Narrator: It takes a full two minutes

for gravity to pull the landing gear into position.

Hicks: Full green. Confirm gear down.

Evans: You can hear the air noise change

as the wheels extend.

That's always a comforting sound to hear them come out.

Carroll: We're always told anyway

that the takeoff and the landing are more critical.

So one was...

One was conscious that we were moving

into a more dangerous time coming in to land.

Narrator: Qantas flight 32 is now just two minutes

from touchdown.

Hicks: Better watch your speed, richard.

De crespigny: Ok, just a little bit slower.

Narrator: De crespigny adjusts the throttle

so that he'll touch down at the slowest speed possible,

making it easier to stop.

Computer: Airspeed low.

De crespigny: Damn, not that slow.

Computer: Airspeed low.

Narrator: The airbus is getting close to stalling.

The plane will lose lift and drop like a stone

if the airspeed falls any lower.

Too fast, and the plane won't stop

before reaching the end of the runway.

It's a precarious balancing act.

Hicks: There it is. Speed is stable.

De crespigny: If we sped up three knots, we would run off the runway.

If we slowed down one knot, we'd get a speed warning.

Narrator: De crespigny's ability to keep his plane

lined up with the runway is severely limited.

Hicks: Singapore, what's the surface wind?

Controller: 170 degrees at five knots.

Narrator: If the crew misses the runway,

there's no way the crippled plane

can go around for another try.

De crespigny: Everybody ready?

Hicks: At the end of the day,

it just came down to, I think we've covered everything.

Can anyone think of anything?

No? Ok, let's go and do it.

Confirm fire services standing by.

Controller: Affirmative.

Computer: 100.

Hicks: You think about your kids,

you think about your wife,

and that's just what you do, and then it was game on again.

Computer: 50, 40, 30, 20.

Narrator: Just a few feet from the ground,

flight 32's stall alarm again warns of impending disaster.

De crespigny: So that threw questions up in my mind--

what is our performance?

Is our performance correct? It doesn't appear to be.

Carroll: We, as passengers, were not aware

that so many things had gone completely wrong.

Computer: Airspeed low.

Narrator: The plane is gobbling up 250 feet of runway

every second.

De crespigny: We had lost one reverser.

We had half the spoilers on the wings not working.

We had the ailerons not making a speed brake action.

Narrator: If they don't slow down quickly,

they risk overshooting the runway and hitting terrain

that could rupture the plane's heavily laden fuel tanks.

Evans: We just weren't slowing down.

Hicks: Get into it!

Evans: Matt yelled out...

Hicks: Get into it! Brakes.

De crespigny: "Brakes, brakes, rich, put on the brakes.

Pump them, push them."

Hicks: Brakes, full brakes, rich!

De crespigny: I am.

Hicks: I think I prompted him to brake harder, and he said...

De crespigny: My feet are flat to the floor!

Hicks: Keep it in, rich. Hammer them!

Narrator: Finally, after a grueling two-hour ordeal,

qantas 32 comes to a stop on the same runway it took off from,

with less than 500 feet to spare.

Woman: Hallelujah.

Hicks: Beautiful.

De crespigny: Welcome to singapore, guys.

I'm truly proud of everyone in the aircraft that day--

the technical crew, the pilots and the cabin crew,

and I'm really proud of the decisions we made,

the way we worked as a unified, cohesive team.

Carroll: I thought all,

as I'm sure all the other passengers did, too,

that the crisis was over,

that we'd landed back safely.

It seemed like that was the end of the problems.

Narrator: But with fuel leaking beside red-hot brake discs,

the danger is far from over.

Evans: There was smoke coming from

the left-hand undercarriage.

And there was fuel pouring all around it.

De crespigny: The passengers could see the fuel

coming out of the wing.

We had alarm bells in the cockpit now.

The situation was almost as bad as it was in-flight

after that engine exploded.

Narrator: A plane that made a narrow escape in the air

is now in grave danger of going up in flames on the ground.

Carroll: I kept looking at my watch at that point.

It was quite tense, for me, inside,

in that I couldn't see why we couldn't get off.

De crespigny: This is the captain.

I want the passengers in their seats

until the fire crew does its job.

Carroll: Why are they taking so long?

Evans: So it was important at that tense moment

to lay foam and reduce the possibility of fire

as best we could.

Narrator: While the fire crew lays down fire-retarding foam,

de crespigny faces a difficult decision--

keep the passengers on board, or evacuate the massive plane.

De crespigny: And the only answer I can give to anyone

saying why did or didn't we evacuate is,

with someone in your home,

are they safer in your home or are they safer somewhere else?

Narrator: The argument for getting them off?

British airtours flight 28 in 1985.

A 737 abandons takeoff

after an engine overheats and bursts into flames.

The pilots brake and steer onto a taxiway.

An evacuation gets under way in seconds.

But the fuel-fed fire is filling the cabin with smoke.

Firefighters respond quickly.

For many on board, though, it's already too late.

They've been overcome by toxic fumes.

Of the 137 people on the plane, only 82 survive.

De crespigny knows that the plane's 16 escape slides

can get all the passengers off the plane in 90 seconds.

He also knows there's a high price--

5% to 10% of his passengers will likely suffer a serious injury.

Evans: And an evacuation, once that starts, you can't stop it.

De crespigny: And we decided to keep them on board,

because the environment outside the aircraft was toxic.

Hicks: Turning engine master switches to off.

Narrator: The crew begins the routine

of shutting down their engines.

Fire chief: Qantas 32, please shut down engine number one.

Narrator: A radio call from the fire chief

alerts them to yet another problem.

Hicks: Uh, we have. We've shut them all down.

De crespigny: Damn it, he's right.

Number one is still running.

Shut it down.

Hicks: Uh, it's not...

I can't shut it down.

Narrator: The damage to the left wing

has cut through the controls

that should have shut down the outboard engine.

De crespigny: We now had an engine

that we could not shut down.

And the situation is now just getting more toxic outside.

It's not meant to happen this way.

This was like the simulator exercise from hell.

Narrator: Firefighters can't do their job

with one of the largest airplane engines in the world

still running a few feet away.

They call qantas engineer alan milne in sydney

for advice on getting it shut down.

Milne: Well, blast it with all the water you can.

They fired one of their high-rate water cannons

straight down the front of the engine.

Remembering, of course, these engines are designed to fly

through some pretty torrential rainstorms,

and no matter how hard they tried,

they could not get that engine to shut down.

Narrator: It takes a full hour,

but emergency crews finally lay down enough foam

to eliminate the risk of a fuel fire.

They move stairs into place,

which are safer than escape slides.

This will no longer be an emergency evacuation.

De crespigny: Ladies and gentlemen,

thanks for your cooperation.

The aircraft is now secure and we can let you off.

Carroll: Oh, thank god.

Narrator: It's finally safe for the passengers

to get off the plane.

Carroll: When we finally, finally walked off the plane,

there was a great sense of relief.

And I noticed my legs were shaking,

which I kind of thought, oh, why are my legs shaking?

I guess maybe I must have been a bit more nervous

than I was aware.

Narrator: All the passengers make it off the plane safely.

But engine number one still refuses to shut down.

Milne: Yeah.

Man: We're not having any luck with the fire hose.

What else can we do?

Milne: Try firefighting foam, see if that will shut it down.

Eventually, we had really no option

other than to switch to the foam,

the firefighting extinguishing foam,

and fire that down the front of the engine.

And that, that managed to shut it down.

Narrator: Three hours after their dramatic landing,

the pilots get the all-clear.

Man: Qantas 32, I'm happy to confirm

that the engine is finally shut down.

Hicks: Thank you, singapore. See you on the runway.

Evans: Good job. Harry wubben: Well done.

De crespigny: Well done, mark.

Narrator: Minutes later,

the flight crew gets its first look at the damage.

De crespigny: I was shocked.

I had never seen such extraordinary damage

to an airplane before.

Narrator: Later that day,

qantas ceo alan joyce makes a stunning announcement.

Alan joyce: We will suspend those a380 services

until we are completely confident

that qantas safe requirements have been met.

Milne: It was our ceo himself that asked the question--

can you assure me that we won't have this failure again

on one of our airplanes?

And we couldn't answer yes to that.

Narrator: The future of the entire qantas fleet of a380s

now depends on understanding what went wrong

inside one single engine.

Simon grummett: There's really only a very select number

of companies that produce the large engines,

the large turbofan engines, and rolls-royce is up at the top.

What a disaster.

I've never seen anything like it.

Narrator: Simon grummett is a materials engineer

with the australian transport safety bureau.

Grummett: Everywhere you looked,

there was, there was shrapnel debris,

and holes in this thing.

So it was quite significant.

And that was the initial response.

And from that point onwards, we knew that this was gonna be

a big investigation particularly for the atsb.

Narrator: The severity of the damage

adds pressure to find answers.

Grummett: An uncontained engine failure is a pretty rare event,

even for an investigator to,

that's performing this line of work,

to actually, this is a job, ok, this is the one that counts.

Narrator: The debris that fell to the ground

includes a broken engine turbine disk.

It's made of nickel alloy

and is one of the most robust parts of the airplane.

Grummett: Let's get this back to rolls-royce,

see what their guys think.

Chapman: We knew that we had a turbine disk failure.

The next stage was to find out

why the turbine disk had actually failed.

Narrator: The 350-pound disk is one of the most critical parts

of the engine.

Its massive fan blades can reach the speed of sound

as they move air through the engine for combustion.

In the lab at rolls-royce,

engineers compare the disk to its manufacturing records,

and notice something odd.

The disk is larger than it should be.

It tells investigators that it was spinning

at an almost unbelievable speed--

so fast that it actually began to stretch and grow wider.

Grummett: And it gets wider and wider and wider,

until the ultimate strength of the material is reached,

and the disk will generally fly apart.

It occurs with such violence

that the fragments are released with an infinite energy.

And what that means is that there will be nothing

which can stop those engine pieces.

It ripped through everything in its path--

wires, hydraulics, everything.

Narrator: Investigators trace the path of the debris

through the plane.

Pieces from the engine have clearly sliced through

the fuselage and the left wing.

Grummett: No wonder they had so many failures.

Narrator: Severing fuel lines, hydraulics and flight controls.

The damage explains why the pilots received

so many error messages after the engine exploded.

But it doesn't explain why the disk was spinning so fast

in the first place.

Investigators take the engine apart,

searching for anything that could explain

the catastrophic failure of the turbine disk.

Chapman: The disk had failed from overspeed,

and there was no contributing factors

in regards to the manufacture or design of the disk itself.

At that point, the focus went back onto the engine.

Narrator: They discover something disturbing.

Grummett: Oil fire.

Chapman: In a rolls-royce engine?

Narrator: The inside of the engine is burnt black

and covered with soot and oil.

The evidence tells grummett that the fire was fueled by oil.

The engine must have suffered an oil leak.

Grummett examines the engine further,

searching for the source of that leak.

Grummett: Kev.

It's at that point that actually

the i.i.c. Walked into the disassembly area.

And I called him over and I said...

Kev, I think we've got it.

Chapman: At that point, it was, it was, ah, wow.

This is a really important moment of the investigation.

Narrator: A narrow pipe has snapped off,

releasing oil into the area around the turbine disk.

The broken part is called a stub pipe.

Chapman: This nearly brought down an a380.

Geez, man.

Narrator: Investigators believe

that oil from the broken stub pipe ignited

and burned at more than 1,800 degrees fahrenheit.

Hicks: Fire in number two. Push button?

Narrator: The fire damaged the drive shaft,

allowing the turbine disk to spin faster and faster,

until it broke apart and tore through everything in its path.

There was nothing the crew could have done to prevent it.

Chapman: Once a fire is established

inside a gas turbine engine,

it's nearly impossible to put out,

other than physically shutting down the engine.

In this case the internal oil fire happened so quickly

and accelerated, that the crew had absolutely no opportunity

to shut down that engine before the engine failure.

Narrator: Investigators now have a prime suspect.

But what caused a simple stub pipe

made by one of the world's most esteemed engine manufacturers

to break and nearly destroy a $400 million airplane?

Investigators send what's left of the stub pipe

to its manufacturer, rolls-royce--

where a disturbing discovery is made.

One side of the pipe is much thinner than the other.

That's what allowed it to break apart,

spraying the engine with oil

and causing a near catastrophic fire.

Grummett: It's no wonder it cracked.

We're only talking, it was 0.35 millimeters in thickness.

It's a couple of sheets of paper.

Narrator: Investigators study the manufacturer's report.

They learn why one side of the stub pipe

was so dangerously thin.

It was due to a manufacturing error.

Chapman: The investigation was actually quite surprised

that such a mature organization

such as the engine manufacturer rolls-royce

could be in that situation.

Narrator: The atsb immediately takes steps

to alert other airlines that their a380s are at risk.

Just 29 days after the accident, they issue a report

warning that a faulty stub pipe caused a fire

that led to uncontained engine failure on qantas 32.

They advise airlines to inspect their fleets.

Grummett: The question that was put forward was,

what are you going to do about this?

Narrator: Atsb chief martin dolan

soon has an answer from rolls-royce.

Martin dolan: And if the problem is detected

in any of the engines,

those engines will be taken out of service.

Narrator: There are 20 a380s with the same rolls-royce engine

in service around the world.

34 engines are found to have suspect oil pipes.

Chapman: As a result of this investigation,

all engines that had non-conforming oil feed pipes

have been removed from service.

Rolls-royce have made significant changes

to their quality management system.

They introduced a software program,

which basically removes fuel from the engine

in a similar event.

Narrator: Investigators conclude that flight 32 ended safely

because the well-trained crew responded quickly

and effectively--

even when aviation's most sophisticated technology

failed them.

De crespigny: Matt, ecam actions.

He kept his calm.

He followed the procedures.

We worked the checklists.

What do we need for our approach speed?

Evans: 146 knots.

Hicks: That can't be right.

It's just too slow.

De crespigny: Add 20 knots.

Evans: 166 works.

Grummett: Now, they would have stalled at 146.

And then there's this gutsy move.

De crespigny: Ok, i'd like to do a control check.

Narrator: The captain's decision to get a sense

of what his plane was capable of at a safe altitude

gave the crew valuable information

about how their aircraft would perform on landing.

Grummett: What a crew.

Evans: A modern aircraft like the a380 is full of automation.

But like any piece of automation, it can fail.

So the human element is always necessary.

Milne: You can see the whole team working together

to deliver an outcome under adversity

in a situation such as this, and it's the right outcome.

De crespigny: It's not about me as a pilot in command of qf 32.

It's about aviation that for the last 110 years

has shared their knowledge and experience

to make aviation safer for the traveling public.

I think in every regard,

the qantas 32 story is one of aviation's finest hours.