Computer-Related Incidents with Commercial Aircraft

TAM A320, runway overrun, Sao Paolo Congonhas airport, Brazil, July 2007

17 July 2007

Synopsis TAM Flight 3054 from Porto Alegre to Sao Paolo Congonhas airport, an Airbus A320 aircraft, overran its landing runway Rwy 35L at a speed reported to have been 94 kts. Rwy 35L ends almost at the airport boundary: any overrun area is extremely limited. There is a steep slope at the airport boundary which leads down to a major road. On the other side of the road are buildings. The aircraft collided with one of the buildings. A major fire started. All aircraft occupants and some people on the ground lost their lives.

The passage of the aircraft down the runway was captured on airport surveillance video, which found its way quickly onto Brazilian television and thence onto YouTube, for example at http://www.youtube.com/watch?v=DZwb6BaLC0M. The first aircraft shown is the predecessor to TAM 3054 landing normally; the second aircraft is TAM 3054. [I advise caution in drawing conclusions from the video. Many people, including some experts, tried to draw speculative conclusions about the landing upon seeing the video. But some phenomena one thinks one sees are misleading. PBL]

The Flight Data Recorder (FDR) and Cockpit Voice Recorder (CVR) were sent to the U.S. National Transportation Safety Board for decoding and transcription. The transcripts were provided to committees of the Brazilian Parliament, who were considering of aviation and aviation infrastructure in Brazil. Shortly thereafter, both transcripts were passed to news organisations and found their way onto the WWW. Here are the CVR transcript and the FDR transcript. [For those who are not expert at interpreting either FDR or CVR transcripts, I advise considerable caution. In many countries, such data are held quite closely, in order to prevent misinterpretation by non-experts. In Brazil, the degree of urgency for a national debate apparently felt by some of those in government has led to relatively rapid release of the data. I advise those not familiar with interpreting such data to seek expert advice before drawing conclusions. PBL]

There has been extensive discussion of this accident amongst pilots and aviation experts worldwide on the "Rumors and News" section of the pilots chat room PPRuNe. Amongst the usual back-and-forth, there has been some very insightful technical contribution, especially by those concerned about general braking performance and landing risk management. Some of this technical discussion has been of the very highest quality. To date (7 September 2007) there have been over 2,000 posts and 300,000 viewings of this PPRuNe thread at TAM A320 crash at Congonhas, Brazil

Bernd Sieker of Causalis Limited, who has been participating in the discussion on PPRuNe, has analysed some of the state logic of landing with two thrust reversers not operable (which is an allowable dispatch condition under the Minimum Equipment List of the A320). His reverse-engineered Predicate-Action Diagrams (PADs) of this state logic will appear here shortly.

Bernd has also prepared a Why-Because Graph of the accident using the information available so far, using Causalis Limited's Why-Because Analysis Toolkit, specifically the graph-drawing software and report-generation tool YBT2, which we include here with his permission: Why-Because Graph of the TAM A320 Congonhas Overrun. This WBG makes extensive use of analysis which has already appeared in the PPRuNe thread, and for reasons of space (and available effort!) we don't (yet) repeat this analysis here. Jan Sanders and Jörn Stuphorn of Causalis Limited, as well as Peter Ladkin, commented extensively on this Why-Because Analysis.

Some features of the WB-Graph deserve comment.

First, this WB-Graph was designed to accomodate all current theories and questions of how the accident happened. There are thus some nodes in the WBG which are labelled as assumptions: those octagons with a double rim: (10), (11), (34), (36), (41), (42). Of these, the nodes (10), (11), (34) refer to pilot expectations, and since the pilots are no longer around to ask, they are and will remain assumptions. Node (41) refers to the possibibility of hydroplaning as contributing to the low friction force. It has to our knowledge not yet been established whether hydroplaning occurred or not.

The assumption nodes (36) and (42) refer to the information from the FDR that the thrust lever on engine #2 was left in the CL ("Climb") detent upon touchdown (a Thrust Lever Angle, TLA, of some 20+ degrees was recorded on the FDR). This would have meant that upon touchdown, the ground spoilers would not deploy (deployment requires each thrust lever to be somewhere between near-idle and max reverse) and, since autothrust would not disconnect with one lever still above idle, it would try to maintain approach speed by increasing forward thrust on the #2 engine. At the eventual disconnection of autothrust, thrust on that engine would be frozen at the current EPR value, which event can also be seen on the FDR. The aircraft was dispatched from Porto Alegre, indeed on each of its flights over the previous few days, with the #2 thrust reverse mechanism rendered inoperable (a standard maintenance procedure), which is allowed in the dispatching Mimimum Equipment List of the aircraft. Reducing both thrust levers (at least) to idle on touchdown is Standard Operating Procedure (SOP), indeed so on all aircraft, and Airbus is said to have released an all-operators Telex after the accident reminding operators of this standard procedure. It is expected that the inquiry will focus in detail on what can have happened here. One possibility is that the crew indeed left the #2 thrust lever in the CL detent. Another possibility is that something in the mechanism between thrust lever and throttle control unit (sensors, mechanical linkage, and so on) was awry and the TCU passed on a signal that the #2 lever was in this position even though it wasn't. Yet another possibility is that the #2 lever was somehow "stuck in place". All these possibilities have been discussed on PPRuNe. The WBG indicates as two assumptions two of these three cases, namely those in which the #2 thrust lever was indeed in the CL detent.

Second, there are a number of obscure-looking causal predecessors to node (17), autothrust disconnects. Bernd has discussed this phenomenon extensively with an experienced, and technically experienced, pilot with a major European airline, whose technical department has also been asked, in order to clarify the precise logic at work here. [We hope that our collaborator will allow his name to be mentioned here, to give him due credit for this work. PBL]

Third, this WBG reflects the state of knowledge at this point. That means, in specific graph-technical terms, that it is a subgraph of the what will be the final WBG. Why-Because Analysis is a technique that allows partial explanations to be built up gradually, as more information becomes available, and this WBG represents such a partial explanation. More information will add to this graph, either adding NCFs to leaf nodes or adding nodes on what was a simple edge, but will not alter its structure (unless a technical mistake has been made and needs to be corrected), as the inquiry deepens and information accumulates. The claim at this point is, then, that this causal explanation is correct, but not necessarily complete, with allowance for the assumptions.

Fourth and finally, it may be instructive to note what the "leaf nodes", the stopping points of the causal explanation, are. They are nodes (8), (14), (15), (21), (22), (23), (31), (33), (42). These refer to the state of the runway (wet, ungrooved, LDA of apprximately 1880 m, no RESA); aircraft design features (autothrust and ground spoiler logic); aircraft configuration on touchdown and crew decisions and actions (normal touchdown at 140 kts; reverse thrust selected on #1, #2 interpreted as in CL detent; autobrake selected). We anticipate that the inquiry will also address operational aspects of the airline (such as SOPs, training, operations into the airport) and more general operations (such as what kinds of airline and aircraft operations the airport can support): these aspects have already been addressed and attended to by the Brazilian polity, but we anticipate not in final form, as consequences of the parliamentary inquiry and other events. Some of these aspects, when they have become definitive, will make it into the final WBG.