History of Flight

At 8:26 am on October 31, 1996, a Fokker 100 airliner, operated by TAM Airlines, began a routine departure from Congonhas Airport in Sao Paulo, Brazil, for a 50-minute flight to Santos Dumont Airport in downtown Rio de Janeiro. The captain was the pilot flying, the first officer was monitoring. Systems and procedures were normal, the weather was excellent, and the cabin was nearly full.
Investigators believed that two seconds after the crew engaged the autothrottles, as the engines were accelerating, a single beep sound heard on the cockpit voice recorder, and the letters "AT" flashing on both pilots' displays, informed the crew that an autothrottle had disengaged.) This was a minor condition, affecting a non-essential system, which the crew noticed. The captain said "it's out," the first officer confirmed "it's manual," showing they both acknowledged the disengagement and that they would proceed with the takeoff. Then there was a double-beep and a brief caution light. The captain said again, "the autothrottle is out." They continued the takeoff roll. The first officer called the normal "thrust check" as the airplane accelerated through 80 knots and both engines appeared to be operating normally.

With no other indications, the crew was unaware that the autothrottle malfunction was actually a symptom of a growing problem with a thrust reverser that was not providing any indication. The single beep alerted the crew that one autothrottle channel had disengaged. The double-beep and caution light that occurred six seconds later informed the pilots that the second autothrottle channel also disengaged. Still, this was a "go" condition involving a system that was not required for flight. Investigators later determined that, the autothrottle never malfunctioned.

The flight data recorder analysis later showed momentary "in transit" electrical signals from the right thrust reverser, meaning it was unlocked although not deployed. The brief transit signals were enough to cause the autothrottles to disengage as designed, but they did not trigger a visible reverser indication on the flight deck. The reversers had not quite opened so other systems, including the engines, were not yet affected. Further, cautions relating to the unlocked reverser were suppressed when the airspeed reached 80 knots. That suppression was intentional. To protect the crew and airplane from unnecessary distractions at critical times of flight, all but the most-urgent flight deck warnings are suppressed late in the takeoff roll and restored once the airplane has climbed 1000 feet above ground. Additionally, the effects of an inflight reverser deployment were intended to be mitigated by a protective system that automatically reduced thrust to idle on the affected engine. Further, the locking systems had been designed to ensure that an inadvertent deployment was extremely improbable, and they had been effective in service. Prior to this accident, no Fokker airplane had experienced an uncommanded inflight reverser deployment.

As the takeoff continued, the first officer called "V-one" then, at 131 knots, "rotate." The captain initiated rotation, and immediately after liftoff the right thrust lever snapped back to idle. The first officer tried to push it toward the takeoff position, against heavy resistance, exclaiming, "it locked." He was able to push it forward where it remained for two seconds. The right lever was again automatically retarded, against the first officer's resistance.The investigators believed that the first officer, at this point, had his hand on both throttle levers, and when the right lever was again automatically retarded, this resulted in the left thrust lever also being pulled back to some extent. The first officer forced both levers forward, the right lever for the second time, as the captain ordered him to switch off the autothrottle.

Eleven seconds after liftoff the right thrust lever retarded for the third time. The airplane had climbed slightly, but had lost 10 knots of airspeed. At 12 seconds after liftoff, the first officer said "it's off," and was able force the right lever forward again for the third and final time. On this last push the heavy resistance suddenly gave way, and both engines accelerated to takeoff thrust.

Thirteen seconds after liftoff, the airplane had decelerated to 126 knots, and continued to decelerate. The altitude was approximately 100 feet above the runway, and both engines were indicating maximum thrust. The captain found he was able to control the airplane in a slight right bank. Both thrust levers were fully forward, not fighting to move back again, and the engines were indicating maximum thrust. The landing gear was never retracted.

The flight data recorder showed the right thrust reverser opening 16 seconds after liftoff, and the airspeed decay increased toward 2 knots per second. A witness interviewed after the crash reported seeing the right-hand thrust reverser doors cycling-opening fully and quickly closing-twice during the initial climb while the airplane was still within the airport perimeter, matching the information found on the data recorder. The crew did not know that the right thrust reverser had deployed due to a pair of electrical failures. One was leaving it unlocked and preventing the unlocked condition from being displayed to the pilots. Then a second electrical failure occurred during the takeoff rotation which commanded it to deploy just as the airplane left the ground. They crew also seemed unaware that the movement of a thrust reverser would automatically pull the same-side thrust lever to flight idle to prevent the engine from producing high thrust if a reverser accidentally opened in flight. accidentally opened in flight.

As the first officer fought the automatic retraction of the power lever, his third and final effort to restore the thrust lever to maximum, the force exerted caused the failure of a linkage in the safety cable connecting it to the reverser mechanism. Post-crash estimates showed he may have exerted a 125 pound forward force on the thrust lever. This allowed the engine to produce maximum thrust while the reverser was deployed in flight. At 19 seconds after liftoff the stick shaker (stall warning) was activated. The airplane began to roll rapidly to the right against full left control commands.

Twenty-three seconds after liftoff, as the airplane rolled through 87°, and the ground proximity warning system gave an aural warning, "Don't Sink." Impact occurred 25 seconds after liftoff, 08:27:01 a.m., as the airplane rolled past vertical to 109°, and the right wingtip clipped the rooftop of a small office building 0.8 NM from the end of the runway. The airplane fell into a residential street and burned. The impact and fire consumed the wreckage and destroyed eight homes. The field of airplane debris and damage to homes was limited to one residential block in a swath roughly 150 meters long and less than 50 meters wide. All people aboard (89 passengers, two pilots and four cabin crew) died along with four people on the ground. 

Fokker F100 Thrust Control

The Fokker F100 is powered by two Rolls-Royce Turbofan Model Tay 650 engines mounted on the aft fuselage. Thrust control is accomplished by means of thrust levers mounted in the center aisle stand, which through cables move fuel control mechanisms mounted within each engine nacelle. Both forward and reverse thrust are managed by the cockpit mounted levers. Management of forward thrust can be augmented by an autothrottle system, and is used to assist in the setting of target thrust values, and maintaining thrust settings for specific phases of flight. Each engine is equipped with a thrust reverser mounted on the aft end of the engine, and when actuated, turns the entire gas flow path, and thereby changes the thrust vector of the engine to provide a decelerative, rather than accelerative force.

Autothrottles System

The F100 is equipped with an autothrottle system that controls both engines by automatically moving the pilots' thrust levers based on commands from the autopilot system. It is intended to reduce the pilots' workload and to improve the overall fuel efficiency of the airplane. A pilot can move the levers manually even while the autothrottle is engaged. Autothrottles are generally not required for certification, or for dispatch, and are designed to fail passively. An airline flight can proceed normally if autothrottles fail.

There are two autothrottle channels in the F100 Flight Augmentation Computer. Each channel drives one thrust lever. There are two motor-and-clutch systems installed in the aisle stand, below the thrust levers. A tie clutch joins the two levers to keep them synchronized and, if one autothrottle channel fails, the tie clutch will permit the remaining channel to drive both levers. The pilots are also able to move the throttles manually while the autothrottle is engaged, and the clutch systems will "slip"to allow manual motion. Once manual motion is ceased, the throttles and engines will resume their previous positions and thrust settings.

The autothrottle system can be operated via several means:

• The ATS Engage pushbutton on the Flight Mode Panel: press to Engage (or Arm) the systems; press again to Disengage.
• The TOGA (Take Off, Go Around) triggers on the thrust levers. If AT is Armed, pulling either TOGA lever Engages the autothrottle and advances the thrust levers. This is the normal method for beginning a takeoff, and is often used in other busy situations in which the crew needs to call for maximum thrust.
• A/T Disconnect pushbuttons on the thrust levers. Either pilot, using a thumb, can squeeze one button in either throttle lever's handgrip to fully disengage the autothrottle system at any time.
• On the Overhead panel: Two lighted pushbuttons, one for each channel, can light up to indicate a Fault in an autothrottle channel. They allow either or both channels to be switched off manually. A single fault would sound a chime in addition to lighting the Fault label in a pushbutton. A double Fault will light both Fault labels and activate the master Caution alert.

To improve safety during landings and aborted takeoffs, the autothrottles automatically disengage upon touchdown or when reverse thrust systems begin to operate. For crew awareness, when the autothrottle system disengages, both pilots are alerted by a flashing "AT" indication within the Flight Mode Annunciator in the top-center of each Primary Flight Display. Disengagement is usually commanded by the crew or is automated by mode changes in other systems. If both channels fault, the autothrottle will also disengage. If a fault related disengagement occurs, it will result in an aural chime and a FAULT light.

Takeoff, and the early stages of climb are considered critical phases of flight. Takeoff safety is predicated on the capability to experience an engine failure, and either stop on the runway (engine failure prior to engine-out decision speed, V₁), or continue the takeoff and safely climb (engine failure following V₁). It is intended that the throttles remain fixed during this period. Since a malfunction of the autothrottle has the potential to affect both engines, and result in a thrust loss greater than that of a single engine failure, the system is declutched (disconnected) during this period to prevent an inadvertent thrust loss that might result from an uncommanded autothrottle movemenft. Once the thrust levers have been advanced, the autothrottles are automatically declutched (released) when airspeed reaches 80 knots. White "D"s appear on the engine instruments. Autothrottles remain declutched until the pilot or the autopilot makes the next change to their altitude command, usually at or above an altitude of 400 feet. In this accident, a few seconds into the takeoff roll, the pilots believed their autothrottle system had failed. During the remainder of the takeoff roll and after liftoff they discussed the system, disengaged it, and turned both channels off, referring to the buttons on the thrust levers and on the overhead panel.

Thrust Reversers

The F100, like most airliners, has thrust reversers on each engine to improve its stopping capability while on the ground. On this airplane a reverser is a pair of clamshell doors that open from a hinge at the rear of the engine nozzle. When the reverser clamshell doors are stowed, they form a normal part of the exhaust nozzle of the engine. When open, they divert the engine exhaust flow, deflecting and turning it so that most of the exhaust air flows forward instead of aft. The thrust produced by the engine then acts to aid in decelerating the airplane. On a dry runway, primary deceleration is provided by the braking system, installed on main landing gear wheels. If a runway is wet, or slippery, the reverser system provides a greater contribution to airplane stopping performance.

The reversers are opened and closed by power from the number 1 hydraulic system, commanded by an electrically operated selector valve. When the reversers are not in use they are held closed by electrically activated locks and, by a balance of hydraulic pressure in the reverser system. Electrical proximity switches monitor the positions of the doors and the locks. Some reversers, including early versions of the F100, also pressurize the actuator toward the stowed position.

The left and right reversers are independent of each other. Normally both are used together, but pilots can employ a single reverser during landing following an engine failure, or if one reverser has failed. Any failure in one reverser has no effect on the other.

To deploy the reversers, the thrust levers must be in the idle position, and aft movement of the reverse levers, attached to the main thrust levers, results in reverser actuation. When the reverse thrust levers are moved, and the air/ground logic system indicates that the airplane is on the ground, the locks and actuator will move to deploy the clamshell doors. Once the control system confirms that the clamshells are open, the crew can then modulate reverse thrust by moving the reverse levers. A green "R" appears at the top of the "EPR" gauge, the primary instrument for each engine, in the flight deck to inform the pilots that a reverser is deployed and functioning.

Alerts relating to an unlocked reverser are inhibited when the airspeed reaches 80 knots during takeoff. All but the most-urgent flight deck warnings are inhibited until the airplane has climbed 1000 feet above ground. An inadvertent reverser deployment was considered sufficiently remote that warning annunciation of an unlocked reverser was not considered necessary. In the event of an inadvertent reverser deployment, the green "R" indication would still be present. If a thrust reverser deploys while its thrust lever is forward of the idle position, the F100 engine control system automatically retards the engine, and the cockpit thrust lever, to idle. The green "R" on the EPR gauge will alert the pilots that a reverser has deployed. This automatic retarding function is necessary since thrust reversers that are not intended for use in flight, such as those on the F100, are required to produce no more than idle thrust if an uncommanded deployment occurs. On the accident flight, the thrust reverser on the right engine opened during the takeoff roll. A concurrent electrical failure prevented annunciation of the reverser deployment (the green "R"on the EPR gage). As the reverser deployed, the right thrust lever moved to idle, and the autothrottle system disengaged as intended. Investigators concluded that the pilots believed that the autothrottles had malfunctioned, and had been the cause of the uncommanded aft thrust lever motion. They may have been unaware of the automatic thrust reduction feature of the thrust reverser control system, since there was no indication that the reverser had deployed. An example of a similar automatic thrust retarding system can be seen in the following video. This video was created as a training aid for the Boeing 727, but the automatic thrust lever retarding function is similar to that on the F100. (View B727 Thrust Lever Operation video below).

Thrust Reverser Design Assumptions

The thrust reverse system of the Fokker F100 was intended for ground use only. There was no operational need to use reverse thrust in flight, so in-flight use would be prohibited by a combination of safety systems. During flight each reverser's hydraulic actuator would be activated toward the stowed position, commanded by an electrical solenoid, and held in the stowed position by locks. Deployment on the ground would require the pilots to move a thrust lever into reverse position, sending analog electrical signals which released the locks, pressurizing the deploy side of the actuator, and disengaging the autothrottle. Additional assumptions regarding the design include:

• Automatic Thrust Reduction - If a reverser inadvertently deployed in flight, it was believed that the airplane would still be controllable and could climb provided the engine was at idle thrust, or had been shut down. However, if an inflight deployment should occur while its throttle is not at idle, a mechanical linkage would force the throttle of the affected engine back to idle. Its cockpit thrust lever would move with it. This "throttle-grabber" system was required by regulations regardless of the probability of uncommanded deployment.
• Flight Deck Indication - It was assumed that indication and messages in the cockpit would always inform the pilots that a thrust reverser was deployed. If they had not commanded a deployment, but indications showed that a reverser had deployed, they would presume a failure had occurred, and take appropriate action, such as shutting the effected engine down.
• Probability for Uncommanded Inflight Deployment - The systems that command the reversers to stow, to lock them in place, and to inform the crew in case of movement were shown during certification to have a probability of failure on the order of one in one hundred billion per flight hour. The calculated probability was more than adequate to meet the standard of "extremely improbable," one failure per billion flight hours, that is required for protection against catastrophic failures. The automatic thrust reduction system was intended to be an additional safety feature to protect aircraft controllability during critical phases of flight such as takeoff and landing.
• Automatic Thrust Lever Movement - It was assumed that should an uncommanded deployment occur, the thrust lever would be moved by the automatic system. It was not envisioned that the flight crew would attempt to override the system in order to restore the previous level of thrust.
• Flight Crew Training - Because of the low probability of an uncommanded reverser deployment, in combination with the inherent safety features of the reverser system, it was not considered necessary to train flight crews to respond to an uncommanded reverser deployment. It was assumed that that reverser protections were sufficiently robust that a deployment would be of no more consequence than an engine failure, for which pilots are trained.

Thrust Reverser Design Modification

The original 1990 design of the F100 connected the reversers to the Essential DC bus. In flight, the left and right reverser actuators were always pressurized toward the stow position, and the stow solenoid on each actuator always used a small DC current to hold the selector valves in the stow position. A failure of the Essential bus would leave the pilots unable to use reverse thrust for landing. At the request of operators, Fokker designed an optional modification that moved the reverser control system to the emergency DC bus which would then provide multiple power options, including the airplane's main batteries, in the event of severe electrical failures.

The Emergency bus (powered by the airplanes's batteries) must be capable of supplying electrical power to essential systems (such as standby instruments) for at least thirty minutes following electrical failures. In this situation, the constant electrical power being supplied to the stow and deploy solenoids would drain the battery, and potentially prevent the thirty minute capability. As a result, Fokker added a circuit that isolated the stow and deploy solenoids except when they were energized by a deploy or stow command. After the change, the actuator was not pressurized to deploy or to stow except when it was receiving a command. The TAM F100 fleet had this modification.

Accident Failure Sequence

Investigators found that there were two latent failures in the right hand thrust reverser locking system. A proximity switch that would close when a reverser began to deploy, functioned but showed high resistance when closed due to contamination. Investigators also found a relay failure that had two effects; (1) It prevented one of the right-hand reverser's secondary locks from engaging, and (2) it prevented the signal indicating that the reverser was unlocked from reaching the flight warning system, so that the pilots did not see the unlocked status on their displays. However the faulty deployment state was still fed to other airplane systems via other wires so that, when the reverser began to move, the autothrottle disengaged as intended and the flight data recorder noted the movement.

When the reverser was stowed, or nearly stowed, the high resistance in the proximity switch allowed ambiguous low-voltage signals to flow to the stow solenoid on the actuator's selector valve. Investigators believed that, at the moment of liftoff, the modest g-loads applied to the faulty switch from the takeoff pitch maneuver, or the change in state of the air/ground sensor system, or both, induced a voltage drop in the reverser control and lock circuits. Then the failed relay left a lock partly open and not annunciated.

Hangar tests on an identical airplane with flaws inserted in the relay and switch in question showed repeatedly that this particular combination of failures, inducing stray voltages as occurred at liftoff, would cause an uncommanded rapid cycling of the reverser doors. The reversers moved far enough to trigger the throttle-grabber system and did not send a signal to the cockpit. When laboratory temperatures were below 25C (77F), the doors would cycle between three and eight times. About 25C and above, the doors did not cycle at all.

When TAM 402 took off, the outside temperature was 22C (72F). Following the first two uncommanded reductions, the first officer found resistance (he said, "it locked," once) as he tried to push the thrust lever forward again. As the reverser was cycling toward closed, it released the throttle grabber when it neared the stow position and allowed him to push the lever forward to maximum forward thrust. Then the lever came back again as the next cycle began, repeating as before. He was pushing the right thrust lever forward again after the third forced reduction, thus during the fourth uncommanded cycle of the reverser, when his combination of heavy force and opposing motion broke the throttle grabber, specifically the Quick-Disconnect coupling in the feedback cable connecting the thrust reverser doors to the thrust control mechanism on the engine. The breakage freed the thrust lever to advance, and the engine to accelerate to take-off thrust, as the reverser was cycling toward opening, and therefore generating high reverse thrust. The following link is an animation of the TAM Flight 402 accident failure sequence (View TAM Flight 402 Accident Animation below).

The airflow and pressure associated with maximum thrust then held the reverser open for the remainder of the flight. Hydraulic pressure in the reverser actuator, acting in the stow direction, was not strong enough to stow the doors with the engine running at maximum thrust. That condition had not been foreseen since the throttle grabber was intended to retard the engine to idle before the reverser doors could deploy, and when the engine was commanded to reverse, its maximum reverse pressure was somewhat lower than that of maximum normal thrust.

Fokker and TAM operating manuals recommend that flight crews will delay taking any emergency corrective actions to the airplane until reaching an altitude of 1000 feet AGL or until reaching 400 feet in the case of a fire or engine overheat. Investigators concluded that if the crew had simply flown the airplane - left the thrust lever in the idle position, and operated as though they had simply experienced an engine failure-they could have climbed to a safe altitude, shut down the malfunctioning engine, and returned to land safely at Sao Paulo.

Flight Crew/Airplane Interface Gaps

The investigation noted that TAM's pilot training also did not discuss the autothrottle de-clutching principle or the throttle grabbing mechanism that reduced an engine to idle if a reverser opened inadvertently. It was ultimately concluded that when the right thrust lever pulled itself back to idle, the crew had no knowledge of what may have caused it to move. They believed, incorrectly, that they had experienced an autothrottle fault. Due to a lack of indication, they could not have known that a reverser was deploying, and apparently did not know that a reverser deployment would pull the thrust lever to idle. Calculations and simulations conducted as part of the investigation revealed that the correct course of action would have been to leave the thrust lever alone during the critical initial climb instead of attempting to force it forward.

Back to top

Centro de Investigação e Prevenção de Acidentes Aeronáuticos (CENIPA), the Brazilian transportation accident investigation agency, wrote a lengthy set of findings about the sequence of the accident, psychological aspects of the pilots' perceptions during the accident sequence, the design and performance deficiencies in systems that played roles in the accident, and pilot training and actions at the airline. The investigation noted that the flight data recorder showed the reverser failure was beginning on previous flights and was recorded, but the prior crews were unaware because it did not affect performance. On these prior flights it was concluded that the electrical failure prevented the flight deck alert from appearing.

The complete text of the investigators' findings including the facts of the accident sequence, findings about systems, materials and operations, and the contributing factors is available at the following link: Findings

View the full accident report, translated into English: TAM 402 Accident Report

Back to top

CENIPA issued 34 specific recommendations directed to 13 sets of manufacturers, operators and government bodies, including itself. They primarily covered design practices, certification practices, redesign and inspection of the Fokker reverser control system, pilot training, crew resource management and flight procedures. Additional recommendations covered emergency response organization, funding, investigators' legal powers, organization of Brazilian oversight bodies, and record keeping.

The complete text of the recommendations is available at the following link: Recommendations

Back to top

14 CFR 25.901 Installation
14 CFR 25.903 Engines
14 CFR 25.933 Reversing Systems
14 CFR 25.1309 Equipment systems and installations
14 CFR 25.1322 Warning, caution, and advisory lights

Back to top

The automatic thrust reduction system (throttle grabber), intended to function in the case of an uncommanded thrust reverser deployment was a design feature about which flight crews had little or no awareness. The system's design intent was to provide compliance to a portion of 14 CFR 25.933 that requires thrust to be reduced to, and not exceed idle thrust in the event of an inadvertent reverser deployment. As the system was intended to function automatically, with sufficient annunciation, it was presumed that flight crews would allow the system to perform its intended function, and not intervene. Fokker, believing that the actual functioning of this system would be sufficiently rare that flight crew training relative to the system was not necessary, or could be cursory in its presentation. This was a prevailing philosophy throughout the industry, and nearly every other transport airplane that was equipped with thrust reversers incorporated a similar feature.

With the advent, and common use of full authority digital engine controls (FADEC) in the mid-1980's, it became prevalent that, in the event of an uncommanded reverser deployment, the FADEC would reduce thrust on the affected engine, but would not mechanically retard the thrust lever. This action, reducing thrust to idle without an accompanying physical thrust lever movement, was implemented in order to cause the airplane to react as if a simple engine failure had occurred. Thrust would be reduced to idle, but not distract the crew with a throttle movement that might be misunderstood.

Back to top

• A thrust reverser control system arrangement which resulted in an uncommanded thrust reverser deployment without an accompanying alert.

Back to top

• An uncommanded thrust reverser deployment was extremely improbable, owing to the design and analysis of the systems that controlled and secured it.
• In the case of an uncommanded reverser deployment, an annunciation/crew alert would accompany the deployment
• The airplane would remain controllable in the event of an uncommanded reverser deployment.
• Pilots would understand what was happening in the rare event that a throttle quickly snapped back to idle, that the reverser system was functioning as intended.
• Pilots would not need to be trained to fly after a thrust reverser deployment in flight.
• Pilots would know how the autothrottle mechanism works in normal and non-normal circumstances.

Back to top

Pacific Western 314, Cranbrook, BC, Canada. 737-200. 11 February 1978

The airplane crashed after losing control during an attempted go-around after touchdown, and after the crew commanded reverse thrust. This loss of control was the result of a thrust asymmetry following an incomplete stowage of the thrust reversers. The copilot was unknowingly fighting against a throttle grabber that was reducing thrust since one reverser was not stowed One thrust reverser did not fully stow following a late initiation of a balked landing, and the copilot fought the throttle grabber whose function he did not fully understand.

See accident module

US Air Force C-5 crashed at Rhein-Main AB, Germany

Germany, in 1990 after a thrust reverser deployed on takeoff. The crew was aware of the deployment but was unable to secure the engine before losing control, rolling and crashing. Maximum altitude had been less than 100 feet above the runway. Of 17 aboard, one crewmember and three passengers survived.

Lauda 004, Bangkok, Thailand. 767-300. 26 May 1991

The left thrust reverser deployed during climb out from Bangkok, Thailand. The reverser deployment resulted in loss of airplane control and subsequent in-flight break up. This accident resulted in an industry-wide recognition that previously held beliefs regarding the in-flight effects of a thrust reverser deployment were largely incorrect. Automatic thrust reduction was already required, but new locking requirements to prevent deployment were mandated after this accident.

See accident module

Back to top

No regulatory or policy changes were implemented as a result of this accident.

Back to top

Interim Actions 

On November 7, 1996, seven days after the accident, as the Netherlands was the country of manufacture of the F100, the Dutch civil aviation authority, the RLD, issued a Special Airworthiness Designation, or "BLA". Early in the investigation, the investigators had determined that a thrust reverser had deployed, but had not determined the related cause. To reduce the risk offurther occurrences, BLA 1996-138 required three actions:

• A revision to the Airplane Flight Manual, which enabled the flight crew to determine if the thrust reversers were properly locked prior to take-off.
• In order to operate with both autothrottle channels inoperative, thrust revesers were required to be deactivated.
• The maintenance program was revised to provide instructions for correction of thrust reverser malfunctions

Subsequently, the FAA issued Emergency Airworthiness Directive 96-23-16 restating the Dutch BLA and making it effective in the United States.

On November 25, The RLD issued BLA 1996-140. This mandated the first two Fokker service bulletins to modify the electrical wiring in the reverser control and indication systems (SB F100-78-012), and to conduct initial and repetitive (every 500 hours) inspections of reverser (SB F100-78-013). These measures were intended to be temporary, pending the final investigation results and the development of a permanent upgrade to the reverser systems. The FAA mandated the service bulletins and inspections in AD 96-24-10 on December 5, 1996. These RLD and FAA actions superseded and cancelled the earlier actions.

The FAA issued AD 96-26-03, (superseding AD 96-24-10) that required electrical modification in lieu of reverser deactivation, while maintaining the other Dutch requirements that had been previously issued.  

Final Actions

In late 1999, following the investigation, a development and test effort, and certification by authorities, Fokker issued a final modification for the reverser control and indication system. SB F100-78-014 added error detection circuitry, added a circuit to prevent cycling of the reverser selector valve, connected the reverser electrical systems to the Emergency DC Bus, and removed the need for frequent inspections. The RLD made this mandatory in an update to their BLA 1996-140. The FAA followed with AD 99-20-02.

Back to top

Airplane Life Cycle:

• Design / Manufacturing
• Operational
• Maintenance / Repair / Alteration

Accident Threat Categories:

• Uncommanded Thrust Reversal
• Flight Deck Layout / Avionics Confusion
• Landing / Takeoff Excursions
• Lack of System Isolation / Segregation

Groupings:

• Automation
• Loss of Control

Accident Common Themes:

• Flawed Assumptions
• Pre-existing Failures
• Unintended Effects

Back to top

Flawed Assumptions

The accident sequence demonstrated that several assumptions about the airplane and its operation were flawed. Among them:

• Thrust reverser deployment in flight was extremely improbable owing to the design and analysis of the systems that controlled and secured it.
• Pilots would understand what was happening in the rare event that a throttle quickly snapped back to idle, and that the reverser system was functioning as intended.
• Pilots did not need to be aware of, or trained, relative to the automatic thrust reduction system associated with an uncommanded reverser deployment.

Preexisting Failures

The relay and proximity switch had failed before the accident without being noticed by pilots or mechanics. After the accident, the flight data recorder showed that the reverser had come unlocked and been flagged as "in transit" on the flight prior to the accident flight. However, the reverser had not moved far enough to affect performance, and the failed relay prevented the prior crew from seeing it on their displays. Both failures were crucial to allowing the accident sequence to occur.

Unintended Effects

At the request of operators, Fokker designed an optional modification that moved the reverser control system to the emergency DC bus, which would then provide multiple power options, including the airplane's main batteries, in the event of certain electrical failures. In order to satisfy requirements regarding battery duration, Fokker added a circuit that isolated the reverser stow and deploy solenoids except when they were energized by a deploy or stow command. After the change, the actuator was not pressurized to deploy or to stow except when it was receiving a command. This resulted in the capability for the reverser to remain unlocked. The design change, which had been intended to enhance the availability of the thrust reverser resulted in the unintended effect of allowing additional failure modes, which led to the uncommanded deployment, and the accident.

Turk Hava 981, Paris. DC-10. 3 March 1974 and American Airlines 96 Windsor-Locks, Ontario, Canada, DC-10. 12 June 1972

In both cases while climbing through about 11,000 feet the aft cargo door blew open. The resulting decompression buckled the passenger floor, damaged primary control systems that ran beneath it and caused loss of control of the airplane. The American crew recovered and landed safely. The Turkish airplane crashed into a forest killing everyone aboard. The cause of both accidents was determined to be the incorrect engagement of the door latching mechanism before takeoff, its subsequent failure in flight, and a separation of the cargo door. Loss of the door led to decompression of the cabin, floor collapse, and damage to control cables. In the case of the Paris accident, the control cables were severed (as opposed to partially buckled in the case of the American Airlines DC-10 incident), which resulted in a loss of control, and the accident.

View American Airlines Flight 96 accident report.

See accident module

Alaska 60, Ketchikan, Alaska, 727-100. 5 April 1976

During rollout following an unstabilized approach and a long, fast touchdown on a wet runway, braking action was poor, and the crew elected to perform a go around. The thrust reversers had already been deployed. The pilots were unable to command full thrust because the thrust reversers were not fully stowed. The crew reapplied reverse thrust and braking but departed the runway at significant speed.

View accident report.

Pacific Western 314, Cranbrook, BC, Canada, 737-200. 11 February 1978

The airplane crashed after losing control during an attempted go-around after touchdown Reverse thrust was selected on both engines upon touchdown, then immediately cancelled because of a need for a go-around in order to avoid collision with a snow removal vehicle on the runway. The aircraft lifted off and cleared the vehicle. However, the thrust reverser stow sequence was interrupted at liftoff, leaving the reversers in a partially deployed position. By design, hydraulic pressure used for the thrust reverser deploy/stow cycle was shut off as the aircraft became airborne. The thrust reverser on the right engine stowed fully and regained forward thrust, while the reverser on the left engine failed to fully stow and, following liftoff, gradually deployed fully due to aerodynamic loads. The resulting thrust asymmetry caused a loss of roll control, and the subsequent crash.

See accident module

United 811, Honolulu, Hawaii, 747-100. 24 February 1989

United Airlines (UAL) Flight 811 experienced an explosive decompression at about 22,000 feet after the forward lobe cargo door suddenly opened in flight. After the door was recovered from the bottom of the ocean, it was discovered that the cargo door latches had been powered to the nearly open position, overriding and deforming the latch sectors. The investigators determined that this powered open command most likely occurred following a normal door closure but prior to an engine start. It was concluded that this "powered open" command most likely was the result of a latent failure of a power isolation switch (S2) in combination with an electrical short in a wire harness. As a contributing factor, the NTSB cited the lack of proper maintenance and inspection of the cargo door by United Airlines, and a lack of timely corrective actions by Boeing and the Federal Aviation Administration (FAA) following a previous door opening incident.

See accident module

Lauda 004, Thailand, Bangkok, 767-300. 26 May 199

A Boeing Model 767-300ER, powered by Pratt and Whitney PW4000 engines and operated by Lauda Air, experienced an uncommanded thrust reverser deployment of the left engine during climb out from Bangkok International Airport in Bangkok, Thailand. The reverser deployment resulted in loss of airplane control and subsequent in-flight break up, killing all 223 passengers and crew.

It was later determined that the engine thrust reverser's efflux pattern associated with high airspeed and high engine power caused significant airflow disruption over the upper wing surface. It was also established that this potentially catastrophic lift loss issue was not limited to the Model 767-300 but was common to many other similarly configured airplanes.

See accident module

Luxair 9642, Luxembourg, F27. 6 November 2002

On November 6, 2002, a Fokker F27 Mk 050 turboprop-powered airplane, owned and operated by Luxair and registered as LX-LGB, departed Berlin as Flight LG 9642/LH 2420 to Luxembourg. Inadequate landing visibility was reported at the destination airport and remained throughout the approach. The crew attempted an approach, but visibility remained inadequate, and a go-around was initiated. Shortly after initiation of the go-around, ATC reported that visibility had improved to above the required minimums. The captain aborted the go-around and attempted to capture the glide slope from above. In attempting to capture the glide slope, the captain moved the power levers below the flight idle detent. Moving the power levers below the flight idle detent in flight was specifically prohibited by the Airplane Flight Manual. Upon landing gear extension, a design defect momentarily released the secondary mechanical low pitch stops and allowed the propellers on both engines to transit into the reverse pitch (beta) range.

The captain recognized that reverse pitch had been attained, and moved the power levers back into the forward thrust region. However, the pitch on the right propeller continued to reduce and eventually went fully into reverse. In response to the effects of increased drag, loss of lift, and thrust asymmetry, the captain chose to shut down both engines in an attempt to maintain control. After shutdown, the left propeller feathered, but the right propeller remained in full reverse.

The airplane touched down near the edge of a highway 3.5 km short of the runway, bounced over the highway, broke up, and caught fire. Of the 19 passengers and three crew members on board, only the captain and one passenger survived.

The complete accident module for this accident may be found in this Lessons Learned from Transport Airplane Accidents library. 

See accident module

Technical Related Lessons:

The function and purpose of automatic safety systems which involve flight deck controls, such as the throttle retard function, should be made known to flight crews operating an aircraft. (Threat categories: Cockpit Layout/Avionics Confusion)

• During takeoff, a failure occurred in the right thrust reverser, causing it to cycle open and closed. A concurrent electrical failure prevented annunciation of the deployment to the crew, who instead focused on the annunciation of the disconnected autothrottle, and restoration of the right thrust lever to its takeoff position. The investigators believed that if the reverser deployment had been properly annunciated, and further, if the crew had been aware of the auto-retard function, they might have allowed the automatic function to continue, and taken other steps to avoid the accident.

Common Theme Related Lessons:

Sudden, unexpected throttle retard, especially during critical phases of flight, such as takeoff and landing, can cause flight crew confusion, and compromise primary flying duties. (Common themes: Unintended Effects)

• The investigation determined that the flight crew was confused as to why the right throttle had been regarded as the result of an apparent autothrottle failure. Lack of annunciation of the actual failure caused the crew to concentrate on restoring thrust on what they believed was a properly functioning engine. In fact, continuing to advance the throttle against the automatic retard function provided a high level of reverse thrust, and associated airplane controllability problems. If the reverser failure had been properly annunciated, the investigation believed that the flight crew would have properly identified the problem and taken other actions to maintain control of the airplane and mitigate the reverser problem.

Back to top