TAM Flight 3054

A return flight with a deactivated reverser

On 17 July 2007, TAM Flight JJ3054 left Porto Alegre at 17:19 local time for Sao Paulo Congonhas. The Airbus A-320, registered PR-MBK, carried 181 passengers and six active crew members. The passenger total included two infants and five off-duty crew members. The pilots had already flown the aircraft from Congonhas to Porto Alegre that afternoon. They were returning to an airport whose wet-runway performance had been a recurring concern.

The right engine thrust reverser had been deactivated four days earlier after a leak in its inner actuator. The minimum equipment list permitted operation with the reverser secured out of service. Both pilots knew of the restriction. On their previous landing at Porto Alegre, at 16:34 local time, the recorder showed that they had followed the prescribed procedure: both thrust levers to IDLE before touchdown, then both to the reverse position.

Both pilots held valid licences, qualifications and medical certificates. The pilot in the right seat had recently joined TAM as a captain and had limited experience on the A-320. His preparation for acting as a co-pilot consisted of the company's right-seat certification training. CENIPA later examined how that preparation, crew pairing and monitoring affected their response during the landing roll.

Rain and the runway at Congonhas

Congonhas had reopened its main runway after resurfacing on 29 June 2007, before grooves were cut into the new pavement. Rain returned in mid-July. On the accident afternoon, runway 35L operations were suspended at 17:07 local time for an inspection of its condition. Inspectors finished at 17:20 and reported that there were no water patches or films. Operations resumed while JJ3054 was on its way from Porto Alegre.

The flight encountered adverse weather and made deviations to avoid it. Early in the climb, the crew had been told that Congonhas was unavailable with a wet and slippery runway. At 18:03 local time, Curitiba Area Control confirmed that normal operations had resumed. During the approach, the captain asked for further information about the rain and whether the runway was slippery, drawing attention to the aircraft's single available reverser. The tower passed the wet-and-slippery description supplied by preceding crews.

The aircraft was within its weight and balance limits. CENIPA calculated that its dispatch complied with the applicable performance requirements. The recorded landing weight was 63.5 tonnes, and the declared landing distance available was 1,880 metres. The investigation nevertheless identified concerns about runway condition, airport oversight and the absence of a runway end safety area. Flight-recorder braking data yielded no evidence that PR-MBK aquaplaned.

Touchdown and conflicting thrust signals

JJ3054 landed on runway 35L at 18:54 local time, after dark. The flight data recorder gave a touchdown speed of 142 knots. As the aircraft approached the surface, the left thrust lever moved to IDLE. After touchdown it moved into reverse. Throughout that sequence, the recorder continued to show the right thrust control at CL, the climb detent. Engine recordings were consistent with that signal: the right engine accelerated while the left engine entered reverse operation.

The landing-deceleration systems depended on the thrust-control inputs. A CL signal prevented automatic deployment of the ground spoilers. These panels normally reduce lift and increase drag after landing, helping the wheels brake the aircraft. Automatic braking also depended on the ground spoilers opening. With the spoilers retracted, the selected automatic-braking mode did not activate. The crew could still apply the wheel brakes through the pedals.

Moving the left lever into reverse disconnected autothrust. The thrust-lock function then held the right engine at the power it was producing, recorded as an engine pressure ratio of 1.18. CENIPA found that this forward thrust continued to the collision. The RETARD callout had sounded before touchdown as a reminder to bring the levers to IDLE. It stopped when the left lever entered reverse, although the right control signal remained at CL.

The unsuccessful attempt to stop

The right-seat pilot identified that the ground spoilers had failed to deploy. The aircraft began turning left during the landing roll. The pilots used the rudder and differential wheel braking as they tried to keep it on the runway and stop. The anti-skid system functioned normally. CENIPA found that the crew did not understand the interaction between the thrust signal, the retracted spoilers and the inactive autobrake in time to take effective corrective action.

The report's factual conclusions place the first pedal-brake application approximately six seconds after main-gear touchdown, reaching maximum pedal deflection five seconds later. The BEA subsequently pointed out that another passage used a different timing sequence. Across those descriptions, the recorded result was the same: braking and directional corrections did not arrest the developing excursion.

CENIPA calculated that, with one reverser unavailable, a wet runway and the recorded conflicting thrust settings, the aircraft would have needed more than 2,000 metres to stop. That calculation excluded the additional forward thrust from the right engine. The distance already exceeded the 1,880 metres available, showing the extent to which the missing deceleration devices had eroded the landing performance margin.

PR-MBK left the left side of the runway near the departure end, crossed Washington Luis Avenue and struck a fuel station and the TAM Express cargo building. Its recorded speed at impact was 96 knots. Impact and the ensuing fire destroyed the aircraft. All 187 occupants died, along with 12 people in the building. The cargo building sustained structural damage requiring demolition, and the fire continued for several hours.

Two explanations for the right-engine signal

Both recorders were recovered and their information retrieved. Investigators checked the flight-data recording process and considered the right-engine thrust readings reliable. They examined the command chain between the thrust lever, its artificial-feel unit, the thrust-control unit and the engine's digital controller. CENIPA excluded failures in the digital engine control and thrust-control unit, as well as a failure of the linkage between the artificial-feel unit and thrust-control unit.

One mechanical possibility remained: a failure involving the connection between the lever and artificial-feel unit, or the unit itself, could have produced a CL signal despite a different physical lever setting. The recovered components did not establish the actual lever position. CENIPA therefore retained this hypothesis, while describing such a failure at the moment of landing as statistically highly improbable.

The second hypothesis was an error in applying the procedure for landing with one reverser inoperative. Airbus had changed that procedure before the accident so that both levers were moved together through IDLE to reverse. The earlier procedure required a separate movement of the lever corresponding to the working reverser. CENIPA considered it more likely that the captain had attempted the earlier procedure and inadvertently left the right lever at CL. Application of the controls remained classified as undetermined because its contribution could not be confirmed.

Training, monitoring and the missing warning

CENIPA identified training and cockpit coordination as contributing factors. It found that computer-based theoretical instruction had not assured the quality of the knowledge acquired, and that the right-seat training had been insufficient for the emergency encountered. The pilots' monitoring did not give them an accurate understanding of the aircraft's behaviour. The investigation also identified deficiencies in management oversight and the coordination between operations and training.

The recorders provided evidence of broader inconsistency in the use of the inoperative-reverser procedure. Across 28 landings, investigators found five different procedures. The prescribed method had been used on the leg immediately before the accident, demonstrating that the crew knew it. CENIPA recommended tighter adherence, better communication of procedural changes and closer monitoring of operational deviations.

PR-MBK lacked the H2F3 flight-warning-computer improvement offered by Airbus. That modification provided a specific warning when a thrust lever remained above IDLE during landing. It had been offered through a service bulletin and had not been made mandatory by an airworthiness directive. CENIPA classified aircraft design as a contributing factor because the conflicting settings could degrade landing deceleration without an effective warning to the crew.

The participating states disagreed

Annex A records that the United States, through the NTSB, agreed with the facts, conclusions and findings. France's BEA challenged several conclusions. It argued that the surviving mechanical-failure hypothesis should be rejected as implausible and that the probable contribution of pilot actions should be reflected more clearly in the conclusions. It also disputed CENIPA's interpretation of certification requirements and the treatment of aircraft design.

The BEA explained that inhibiting spoiler deployment with a thrust lever above IDLE protected against deployment in flight. It rejected the suggestion that the system prevented the pilots from overriding it. It also challenged a recommendation to confirm spoiler deployment before selecting reverse thrust: delaying reverse, it argued, would increase landing distance and excursion risk. Those objections appear alongside CENIPA's findings and recommendations in the completed final report.

Runway, training and system recommendations

The recommendations addressed the airport, regulator, airline and manufacturer. CENIPA initially called for restricting the main runway to dry conditions and subsequently sought stronger friction and surface-texture oversight. It recommended establishing runway end safety areas at Congonhas, even if that required reducing declared runway lengths. The final report records that ANAC introduced a prohibition in April 2008 on wet-runway operations there when a thrust reverser was unavailable.

For TAM, CENIPA sought an audit of operations, training and maintenance, a reassessment of training needs, improved performance monitoring and more effective notification of procedural changes. For Airbus, it recommended a defined response to ground spoilers failing to deploy, improvement of the RETARD reminder and review of landing-deceleration logic. CENIPA approved Final Report A-N 67/CENIPA/2009 on 27 October 2009, with the participating states' comments attached.