Flight Details
Date: 17 July, 2007
Airline: TAM Airlines
Flight number: 3054
Aircraft: Airbus A320-200
Location: Overshoot of runway 35L at Congonhas Airport [CHG], Brazil
Fatalities: 199; all 187 passengers and crew, and 12 bystanders
Accident type: Runway overrun
Primary causes: Undetermined: Most likely pilot error, facilitated by several other factors.
(Aviation safety network, 20071)
Introduction
The Brazilian Aeronautical Accidents Investigation and Prevention Center [CENIPA] investigated the crash of Flight 3054 but was unable to conclusively determine a cause. However, two main hypotheses and several possible causal factors have been identified. The following is a human factors analysis of the accident which will highlight the chain of errors that took place, resulting in the crash; factual information of the sequence of events is drawn primarily from the official accident report which was composed by CENIPA (20072). To this day, Flight 3054 still has the highest fatality count of any A320 crash in the world.
Sequence of events
Disabled thrust reverser
Five minutes before landing at CHG, the captain reminded the first officer that only the number 1 thrust reverser was operating, as the number 2 reverser had been disabled by maintenance personnel due to a fault. Flight with only one thrust reverser was allowed as part of TAM's MEL, and in fact the reversers are not a compulsory system.
Weather and runway conditions
About 90 seconds before touchdown, the first officer, after being prompted by the captain, asked CHG air traffic control about the runway conditions. The reply was "it's wet and it is slippery". The captain was clearly upset by this news and exclaimed out loud "wet and slippery!". Runway 35L had recently been resurfaced, but had not been grooved. This meant that in the wet conditions, Flight 3054 would have a much lower braking coefficient, and there was a risk of aquaplaning.
Manual approach
As a result of the weather and runway conditions, thirty seconds from touchdown, the captain commenced a manual flight approach. The reason for this was that the captain, concerned about the ability of the aircraft to stop in the current conditions, wanted to touch down right on the threshold so as to have as much runway as possible to use. By flying the approach manually, the captain could touch down sooner compared to an automated approach.
Landing procedures
With respect to throttle positions, the procedure for landing with one thrust reverser inoperable was simply to move both throttles to idle, and then both to reverse, just as the procedure for both reversers being operational.
This had recently replaced an older procedure which required both throttles to be moved to idle, as in the new procedure, but then only the working reverser be activated by moving the respective throttle to reverse.
However, this new procedure resulted in an increased landing distance of approximately 55 meters over the older procedure. This is because when both throttles are moved to the reverse position, both engines initially spool up and the working (number 1) reverser deploys. A few seconds later, the engine with the disabled reverser (number 2) reduces power to idle, as the aircraft's flight computer recognises the reverse in operable. The few seconds where the number 2 engine spools up provides a small amount of additional unwanted thrust which increases the landing distance by about 55 meters. The old procedure avoids this extra thrust, as the number 2 engine would be left at idle instead of being moved to reverse.
The new procedure, while resulting in an increased landing distance, was implemented because of confusion resulting from the use of the older procedure. There had been occasions where instead of moving both throttles to idle and then one throttle to reverse, pilots had left one throttle at a partial power setting and moved the other throttle to reverse. The reason for this is due to ergonomic and cognitive reasons, as the pilot is thinking that "only one throttle needs to be moved (to reverse)", which results, indeed, in only one throttle being moved, but to idle instead of reverse, leaving the other throttle at partial power. There were cases of this happening, and, of course, landing with one engine at partial power can be extremely hazardous.
Old procedure selected
The captain was clearly concerned about the stopping ability of Flight 3054, and as a result, it is highly likely he elected to perform the old landing procedure of moving both throttles to idle, and then only number 1 engine to reverse. This, while technically a procedural violation, would reduce landing distance by 55 meters if performed correctly.
"Retard" messages
Just prior to touchdown, three"retard" aural messages were generated by the A320's flight computer. These reminded the pilots to reduce thrust to idle for landing, and at the time, engine 2 was still at a partial power setting, while engine 1 was at idle. After touchdown, engine 1 was moved to reverse, and the messages ceased, even though engine 2 was still at a partial power setting.
Events after touchdown
After touchdown, as engine 2 was still producing power, and engine 1 was in reverse, neither the spoilers or autobrake activated. As a result of the combination of number 2 engine still producing forwards thrust, and a lack of spoilers and autobraking, the A320 continued to speed down the wet runway. The pilots attempted to active the brakes manually, but this took 11 seconds from the time of touchdown, and was insufficient to slow the speeding aircraft. The first officer commented "spoilers nothing", and then "decelerate, decelerate" to which the captain replied "it can't, it can't". Ten seconds later, the A320 ran off the end of runway 35L at approximately 100kts and smashed into a TAM Airlines warehouse.
Accident causation considerations
The official accident report composed by CENIPA does not claim to provide a definite main cause of the accident. It puts forward two hypotheses: the first, that the captain left the number 2 engine at the partial power setting, and the second, that a failure of the A320's flight control system fed erroneous information to the number 2 engine, which resulted in it not decreasing to idle even though that setting was selected by the captain by moving the respective throttle control to idle. In comparing the two hypotheses, the probability of the second hypothesis occurring was calculated at 4x10-11 per flight hour. In contrast, the probability of the first hypothesis occurring is more likely, as there have similar occurrences in the past.
Active errors
Selection of old procedure
Had the captain indeed decided to perform the old procedure, it shows poor aeronautical decision making, and a hazardous anti-authority attitude. While the captain had the right intentions, of reducing the landing distance and creating a larger safety margin, to perform the old procedure was an incorrect choice.
Incorrect use of old procedure
Leaving the number 2 engine throttle at a partial power setting was a serious error on behalf of the captain.
Inadequate situational awareness
Neither the captain or first officer realised the incorrect position of the number 2 throttle, or understood the events after touchdown enough to take any adequate action in time to prevent the overrun. While manual braking was applied, maximum braking pressure was not applied until 11 seconds into the landing run, which was too little to overcome the thrust from the number 2 engine.
Latent errors
Training
The CENIPA investigation determined that while the crash aircraft had its number 2 reverser inoperable there were five different procedures used by various pilots. Obviously there is only one correct procedure, and this shows a possible failure in TAM Airlines' training programme to effectively communicated both the correct procedure to its pilots, and also the reason for only using this procedure.
Aircraft design
The fact that the A320 could be landed with one engine at a partial power setting, and as a result produce forwards thrust upon touchdown and have neither spoilers or autobrake activate is clearly a serious design flaw. The only warnings the pilots received were the "retard" messages, which were clearly inadequate, and also ceased after touchdown.
Other factors
Weather and runway conditions
The "wet and slippery" runway clearly unnerved the captain, to the extent that he both performed a manual approach, and used the old throttle procedure. While the "wet and slippery" and un-grooved runway obviously impaired the stopping ability of the A320, the aircraft would have still overrun the runway in dry conditions, due to the late action taken by the pilots, and the thrust from the number 2 engine. The aircraft would have been able to land in the conditions had a correct landing procedure been used. The most important influence that the weather conditions had was to prompt the captain to use the old throttle procedure.
Conclusion
The crash of Flight 3054 was most likely the result of the captain electing to violate procedures and use a throttle procedure that had been replaced with a safer version. This was the result of the captain's concern over, ironically, the stopping ability of Flight 3054 in the poor conditions. The combination of poor training and an inadequate design acted as latent errors to facilitate the crash.
Want to know more?
Dramatisation and video footage of Flight 3054 on Aviation Knowledge
Flight 3054 on Wikipedia
Official CENIPA report of Flight 3054
