TAP A320 at Copenhagen on Apr 8th 2022, reverser opened on TOGA, overflew buildings at very low height on go around

Last Update: February 27, 2024 / 16:45:48 GMT/Zulu time

Bookmark this article

Photo of TAP Air Portugal CS-TNV, Airbus A320 — TAP Air Portugal CS-TNV, Airbus A320 (Photo credit: FlugZüge / Flickr / License: CC by-sa)

Incident Facts

Date of incident
Apr 8, 2022

Classification
Incident

Airline
TAP Air Portugal

Flight number
TP-754

Departure
Lisbon, Portugal

Destination
Copenhagen, Denmark

Aircraft Registration
CS-TNV

Aircraft Type
Airbus A320

ICAO Type Designator
A320

Airport
Copenhagen Kastrup Airport, Copenhagen

Airport ICAO Code
EKCH

A TAP Air Portugal Airbus A320-200, registration CS-TNV performing flight TP-754 from Lisbon (Portugal) to Copenhagen (Denmark) with 102 passengers and 7 crew, was landing on Copenhagen's runway 30 at about 12:05L (10:05Z), when according to ADS-B data transmitted by the aircraft the aircraft veered to the left, the speed over ground reduced sharply from about 133 to about 120 knots, the crew initiated a go around, the aircraft however did not climb but also did not build up speed. With the airport perimeter and houses of the Maglebylille community in the way the aircraft began to slowly climb and crossed the first houses at around 300 feet AGL, the speed over ground further reduced to 101 knots. Once the aircraft had climbed to about 900 feet AGL (1700 feet MSL according to standard pressure 1013 hPa, deduct 800 feet from all transponder altitude readings to get to AGL according to QNH 986 hPa) airspeed began to build up again. The aircraft levelled off at 3000 feet MSL and thereafter accelerated to normal speeds. The aircraft subsequently positioned for another approach to runway 22L and landed without further incident about 20 minutes after the go around.

The aircraft is still on the ground in Copenhagen on Apr 12th 2022 about 104.5 hours after landing.

Ground witnesses reported the aircraft struck its left wing onto the runway, it even appeared the left hand engine (CFM56) made contact with the runway, turned to the left, nearly collided with an antenna (editorial note: appears to be the glideslope antenna runway 12) and buildings before the aircraft finally managed to climb out to safety.

Sources at the airport report the left hand engine's reverser was damaged.

On Apr 11th 2022 Denmark's Havarikommissionen (HCL, Danish Accident Investigation Board) reported they rated the occurrence a serious incident and opened an investigation. Preliminary results suggest there was no abnormal ground contact like wing or engine pod strike, and the aircraft remained undamaged. The HCL subsequently clarified that there are no visual indications or marks indicating the wing or engine made ground contact.

On Apr 11th 2022 the airline reported the flight aborted landing due to technical reasons while already over the runway. TAP is fully collaborating with the investigation. The airline does not have any report of damage to the aircraft. The flight trajectory and performance are being analysed in the safety investigation. The aircraft is going to return to Lisbon later today.

On Apr 12th 2022 the HCL reported the crew did declare emergency due to not achieving the needed climb performance. The investigation is now looking into why the required performance was not achieved on the left hand engine.

On Apr 15th 2022 the HCL reported the captain decided to initiate a go around, upon applying TOGA one thrust reverser inadvertently opened causing control problems during the go around.

On Apr 19th 2022 the HCL released a statement saying:

Aborted landing to runway 30 in Copenhagen (EKCH)

During the landing sequence, the flight crew decided to abort the landing, and the pilot flying initiated a goaround.

Upon applying Take-off/Go-around thrust (TOGA), the aircraft at low altitude started veering to the left and did neither climb nor accelerate as expected by the flight crew, which temporarily made it difficult for the flight crew to maintain control of the aircraft.

The flight crew noticed an indication for engine no. 1 thrust reverser door(s) to be unlocked. Engine no. 1 was at idle thrust.

The flight crew regained control of the aircraft and established a single engine climb toward a safe altitude.

During the climb, the flight crew declared an emergency (“Mayday”) and performed relevant checklists.

Air Traffic Control issued radar vectors for a priority landing on runway 22L.

Without any further occurrences, the aircraft landed on runway 22L.

The serious incident occurred in daylight and under Visual Meteorological conditions (VMC).

There were no injuries to the 109 persons onboard.

Preliminary safety investigation

An external inspection of runway 30, the grass areas surrounding runway 30, and the aircraft revealed:

- No imprints of aircraft ground contact.

- No external damages to the aircraft (including aircraft fuselage, wings, tail and engine nacelles).

- Three out of four thrust reverser doors on engine no. 1 were in the fully deployed position.

In their June 2023 "Safety First" Magazine Airbus stated under the title "Thrust Reverser Selection is a Decision to Stop": "In the initial phase of the go-around, the aircraft attitude went close to wing tip and tailstrike conditions but remained within the ground clearance limits.", and described the event as follows:

The PF initiated the flare slightly above 30 ft RA, started the decrab maneuver at 24 ft RA, and set the thrust levers to idle at 11 ft RA. The left Main Landing Gear (MLG) briefly touched the runway, but was not fully compressed when the flight crew set the thrust lever to maximum reverse.

When both the left and right MLG touched the runway and were compressed, the thrust reversers began to deploy. ⑤ The flight crew then decided to perform a go-around. The left MLG was briefly uncompressed when the PF applied TOGA thrust. They selected CONF2 and applied nose-up inputs.

ENG 2 spooled up to reach TOGA thrust, but ENG 1 remained at idle with the REV indication still displayed on the Engine Warning Display (EWD). The aircraft began to veer to the left. The PF reacted and applied a half of maximum right rudder input. Both the left and right MLG were briefly compressed again. The aircraft continued to veer to the left and the ENG 1 REVERSE UNLOCKED ECAM alert triggered when the left and right MLG were uncompressed. The beta target symbol on the PFD was flagged. The aircraft overflew the left runway edge by 1 ft.

The flight crew commanded the landing gear up and the aircraft started to climb on a trajectory that was shifted by approximately 20° to the left of the runway axis.

When the landing gear was retracted and the pitch was set close to 12.5°, corresponding to the target for go-around with one engine inoperative, the vertical speed reached 1 000 ft/min.

The flight crew then set the ENG1 thrust lever to IDLE at 360 ft and shut down ENG 1, as per the ECAM procedure at 1 260 ft QNH. The beta target symbol appeared again on the PFD, which enabled the PF to correctly trim the rudder, and the autopilot was engaged. The flight crew performed a second ILS approach and manually landed the aircraft with its ENG 1 inoperative.

The aircraft arrived at the gate with three of the four ENG 1 thrust reverser blocker doors deployed and not locked. The fourth door was not deployed, but was unlocked.

Airbus described the thrust reverser logic:

When the thrust levers are moved from the REV sector to idle or forward thrust sector, the Electronic Control Unit (ECU) of each engine computes a “ground” or “flight” status using the “compressed” or “uncompressed” status for the left and right MLG. This is provided by the Landing Gear Control and Interface Unit (LGCIU).

If the computed status is "ground” when the thrust levers are moved out of the REV sector, then the ECU will send a “stow” command until the thrust reversers are stowed. If the computed status is "flight", then the ECU does not send a signal to initiate the stow sequence.

Airbus thus reasoned about why the thrust reverser #2 stowed the #1 did not:

When the PF set TOGA thrust, ECU 2 computed the “ground” status using information from LGCIU 2. This sent the “stow” command to the ENG 2 thrust reverser. The ENG 2 thrust reverser stowed and locked correctly and ENG 2 spooled up to reach TOGA thrust.

When the PF set TOGA thrust, ECU 1 computed the “flight” status using information from LGCIU 1. ECU 1 did not send a stow command to the ENG 1 reverser and its blocker doors remained deployed. The automatic idle protection activated and sent a signal to prevent ENG 1 increasing thrust.

A short asynchronism between the computation of the ground/flight status by both ECUs, combined with a bounce of the left landing gear, explains the different behaviors of the ECUs. This timing difference can be explained by the fact that thrust levers may not be closely aligned when the flight crew moves them from the REV sector to idle or forward thrust sector. In addition, a very slight delay may appear between the signals and computation chain of LGCIU-EIU-ECU, which are independent for the left and right sides.

Airbus stated that only CFM-56 engines (on A320 and A340) are affected by this potential of thrust reversers not to retract.

Airbus then stated as conclusion:

The SOP for landing also states that as soon as the flight crew selects reverse thrust, they must perform a full-stop landing. This is also highlighted for a go-around near the ground in the FCTM, which states, “the PF must not initiate a go-around after the selection of the thrust reversers.” Adherence to this SOP will avoid any repeat of the event described in this article.

On Feb 27th 2024 Denmark's Havarikommissionen released their final report concluding the probable causes of the serious incident were:

1. Based on the attitude of the aircraft during landing, the commander decided to abort the landing and moved the thrust levers fully forward (TOGA) to initiate a go-around.

2. Aborting the landing after the selection of thrust reversers was a deviation from the procedures described in the FCOM and FCTM.

3. The aircraft manufacturer identified that the CFM56 ECU software design would not latch the thrust reverser stow command in case the ECU received an air signal at the same time as the thrust lever was moved forward.

4. At the time of certification of the aircraft, no requirements existed at the certifying authorities to evaluate an aborted landing during a bounced landing scenario.

The HCL summarized the events:

During landing in gusty wind conditions, the commander felt uncomfortable with the aircraft attitude and decided, after thrust reversers had been selected, to abort the landing.

The commander moved the thrust levers fully forward (selected TOGA thrust) which deviated from the procedure in the FCOM stipulating that once thrust reversers had been selected, the landing had to be completed.

Engine #2 thrust reverser stowed, and engine #2 accelerated. Engine #1 thrust reverser did not stow, and ECU #1 commanded engine #1 to autoidle. The commander experienced difficulties in controlling and achieving the maximum capabilities of the aircraft but managed to regain control. The aircraft continued climbing and the flight crew shut down engine #1 to regain better control of the aircraft. The aircraft subsequently landed without any further occurrences.

The AIB safety investigation identified that engine #1 thrust reverser did not stow since ECU #1 did not receive a ground signal at the same time, as thrust lever #1 position signal changed from reverse to forward thrust.

The HCL analysed:

Before descent, the flight crew performed three landing performance calculations for runway 30. None of these calculations represented the actual aircraft landing configuration, but all three calculations indicated a required runway length shorter than the LDA. The AIB calculation, representing the actual aircraft landing configuration, resulted in a required landing distance of 1,540 m.

ATC requested the flight crew to vacate runway 30 via taxiway D (landing distance 1,530 m).

The commander decided that with an intended landing speed of 140 kt and a wet runway, the use of reverse thrust was necessary to comply with the ATC request.

The remaining runway length from taxiway D to the runway end was 555 m supplemented by an additional 300 m of stopway. To the AIB, there was no flight safety issue associated to the available stopping distance. It was only an operational consideration from the flight crew.

According to the stabilised approach concept, the aircraft was stabilised throughout the final approach and the flare just until touchdown, with only minor deviations in airspeed, seemingly caused by the gusting wind conditions.

Upon thrust reduction to idle and below 10 ft radio height, the aircraft drifted right, and touched down right of the centreline just after the runway aiming markings.

Go-around and flight procedures

According to the recorded data, the commander selected idle thrust at approximately 10 ft radio height and then maximum reverse thrust approximately three seconds later. Around the time of selection of maximum reverse thrust, the LH MLG left wheel had started to spin up indicating slight ground contact, and de-rotation had been initiated. But the shock absorbers had not yet compressed (no WOW).

Within two seconds after the selection of maximum reverse thrust, the aircraft/ECUs received a WOW signal and both thrust reversers started to deploy.

The first officer did not register neither ground spoiler nor reverser deployment indication and made no callouts confirming a touchdown.

The wind conditions likely affected aircraft stability during landing. The commander felt uncomfortable with the aircraft attitude and, neither being aware of the aircraft touchdown nor the selection of reverse thrust, the commander decided to abort the landing and selected TOGA thrust.

The commander handling thus deviated from the operator OM-B SOP (FCOM) and the FCTM.

The subject was also highlighted in the operator Safety bulletin 06/2022 stating that once reverse thrust was selected the landing had to be completed.

The AIB recognises that in a dynamic landing environment, it might be difficult for flight crews to distinguish between aircraft flight and landing mode based primarily upon external cues like visual impression and motion sensing (g-load).

Given the flight crew knowledge regarding the obligation to land after thrust reverser selection, the AIB finds it likely that the commander decision to abort the landing was a mistake and not an intentional violation of the SOP.

The incorrect decision-making (mistake) was likely based upon incomplete information/incorrect perception and a lack of awareness of the importance of complying with the landing SOP to keep a reliable and predictable engine/thrust reverser response during an aborted landing.

Lessons learnt from this serious incident and from the study into available flight data (deviation from SOP) suggested that flight crews might not be fully aware of the rationale behind the landing SOP.

It must be emphasised that adhering to SOPs (safety barriers) may prevent multiple unwanted flight scenarios not fully considered or evaluated during the design of the aircraft.

To the AIB, FDM can be a strong and helpful tool for operators when monitoring flight crew SOP adherence.

Engine #1 thrust reverser not stowing

After initial touchdown, the aircraft bounced slightly.

At the same time, the commander moved the thrust levers from the full aft position (maximum reverse) to the full forward position (TOGA) to abort the landing.

Due to various computing factors, ECU #1 received an air signal while ECU #2 received a ground (WOW) signal. Therefore, ECU #2 latched the stow command on engine #2 thrust reverser while ECU #1 did not latch the stow command. The result was an interruption of the stow sequence on thrust reverser #1 once the aircraft was off ground and WOW signal was no longer present. The subject is further analysed in section 2.6.

The ECU autoidle function ensured that the engine #1 did not accelerate and generate excessive reverse thrust and prevented the serious incident from escalating. Thereby, the engine autoidle function was an effective safety barrier in reducing the consequences of the inability to stow thrust reverser #1.

With three blocker doors deployed on engine #1, the commander experienced difficulties in maintaining control of the aircraft. Rudder pedal inputs were not sufficient to counteract the aircraft deviation towards the LH runway edge and the LH roll excursions induced by the asymmetrical thrust and drag configuration. The aircraft drifted left off the runway into the runway safety area (runway strip) at a very low height (approximately 10 ft radio height) and nearly collided with obstacles on the ground.

Once the landing gear was retracted, the commander increased the pitch close to 12.5°, corresponding to the target for go-around with one engine inoperative, and the vertical speed reached approximately 1,000 ft/min.

The initial climb performance was degraded by the absence of the Beta target display on the PFD. This resulted in insufficient rudder pedal inputs which did not sufficiently reduce the aircraft sideslip. The Beta target was displayed on the PFD once engine #1 was shut down at approximately 1,200 ft radio height.

Technical investigation of the engine #1 thrust reverser hardware

After the serious incident, the thrust reverser system was thoroughly tested on the aircraft.

No relevant faults were evident. The relevant thrust reverser hardware was removed from the aircraft for further inspections and tests.

After all hardware inspections and tests had been performed, the conclusion was that all thrust reverser hardware were in good condition and performed as per design requirements.

Technical investigation of the ECU software logic and system design

The aircraft manufacturer investigation of the serious incident, resulted in a hypothesis.

The hypothesis suggested that ECU #1 did not receive a ground signal (WOW) while the thrust lever was moved forward (from reverse to forward thrust position).

ECU #1 likely received the WOW signal after sensing thrust lever #1 had been moved forward to forward thrust. This resulted in ECU #1 not latching and maintain the stow command and therefore interrupting the #1 thrust reverser stow sequence (depressurising HCU #1) due to the aircraft bouncing (when the WOW signal was no longer present).

If the ECU received the WOW signal at the same time as the thrust lever was sensed moving forward (TLA from less to more than -4.2°), the ECU stow command (to the HCU) would latch and be maintained for up to eight seconds, or until the thrust reverser was fully stowed (blocker doors stow switches activated). This was the case for ECU #2 which stowed engine #2 thrust reverser.

The aircraft manufacturer testing of an ECU with the same part number and software version as involved in this serious incident, confirmed the above functioning of the ECU.

No fault codes were recorded in ECU #1 memory indicating that the thrust reverser system performed as designed during the serious incident. This supported the hypothesis.

The data from the aircraft were thoroughly analysed. The resolution and recording speed of the data were insufficient to firmly confirm the hypothesis. Furthermore, only the WOW signal from LGCIU #1 was recorded. However, the data indicated that the scenario was very likely, as the overlap between WOW signal changes and thrust lever movement was confirmed.

To further investigate the hypothesis, and to understand why engine #2 thrust reverser stowed when #1 did not, the aircraft manufacturer analysed the signal route of the thrust lever and WOW signals to the ECUs. The analysis confirmed that the input scan and output update frequency in combination with processing time of the computers made the hypothesis plausible. Potential asymmetric position between the thrust levers during forward movement would have further contributed to the difference in signals received by the ECUs.

The aircraft manufacturer concluded that the ECU software logic was the only likely explanation for thrust reverser #1 not stowing, even though thrust reverser #2 succeeded in stowing during the sequence of events. Based on safety investigation data, the AIB agrees with this conclusion.

The aircraft manufacturer design and operational review of the thrust reverser system

Based on the findings during the AIB safety investigation, the aircraft manufacturer performed a design review of the A320 family CFM56 thrust reverser system.

The design review findings included:

- The CFM56 ECU was unable to stow the thrust reverser when operated outside its intended use (defined by the landing SOP) during an aborted landing under specific conditions.
- The serious incident was the first case of this type reported on any of the aircraft manufacturer aircraft types.
- The A320 aircraft fitted with CFM56 engines entered into service in 1988 and had accumulated more than 95 million flight cycles at the time of the serious incident.
- The level of adherence to SOP, enabling flight crew to operate the thrust reversers within the intended use considered during the design, was assessed using big data representative of the A320 family aircraft operation (FDM). It indicated that the level of SOP adherence was lower than expected and represented a significant exposure.
- The vast majority of the CFM56 fleet that will remain operated in the coming years is fitted with CFM56-5B engine models.

Based in these findings, the aircraft manufacturer developed a mitigation plan to enhance both:

- Flight crew adherence to recommendations linked to the use of thrust reversers included in SOP for landing.
- Thrust reverser stow logic in the CFM56-5B ECU software.

The aborted landing scenario and non-SOP adherence rate was not considered to be specific to the A320 family aircraft. The aircraft manufacturer conducted a design review on all of the aircraft types under their responsibility. Only the CFM56 ECU software on A320 and A340 was found to be affected by the serious incident scenario.

Safety actions

Based on the design review, and to mitigate the likelihood of another event of thrust reverser(s) not stowing during an aborted landing, the aircraft manufacturer implemented safety actions. These are described in section 4.1.

Despite the safety actions implemented, aborted landings after thrust reverser selection are likely to occur in the future which can potentially result in one or more thrust reversers not stowing.

The AIB considers a modification of the CFM56 ECU software to be the most effective safety barrier against thrust reverser(s) not stowing during aborted landings. The AIB recommends aviation authorities to mandate the embodiment once the modified ECU software is available.

The AIB considers the aborted landing scenario and non-SOP adherence not necessarily to be specific to any aircraft type. The AIB therefore promotes further safety actions by encouraging design reviews on other aircraft types fitted with thrust reversers.

Certification requirements for the design of thrust reverser systems

During the AIB safety investigation, the AIB informed and consulted the A320 type certifying authority (EASA). EASA informed that at the time of type certification of the A320 family, evaluation of the aborted landing scenario was not a certification requirement.

However, the aborted landing scenario and aircraft controllability in case of an inadvertent thrust reverser deployment was considered during the design of the A320.

The guidance material in relation to evaluation of an aborted landing after thrust reverser selection scenario was largely based on the Cranbrook accident on 1-2-1978. The Cranbrook accident involved firm ground contact during TOGA selection unlike this serious incident.

EASA informed that certification requirements involving design review of the aborted landing scenario after thrust reverser selection had later been implemented after the certification A320 and were present at the time of the serious incident. These certification requirements included the Canadian AC525-005 describing the scenario from the accident involving C-FPWC (B737-200) at Cranbrook on 1-2-1978.

These certification requirements did not stipulate the consideration for bounces during the aborted landing. The A320 CFM56 ECU software was able to perform the scenario from AC525-005 (as ECU #2 successfully did during the serious incident). For that reason, the AIB does not consider the current certification requirements as an effective safety barrier for preventing thrust reversers from not stowing during an aborted landing.

The certification requirements for the design of thrust reverser systems requires revising to make sure lessons learned from this serious incident are carried into future aircraft thrust reverser designs. The AIB issues a safety recommendation to EASA to revise the certification requirements for large aeroplanes (CS-25).

Metars:
EKCH 081220Z 27022G34KT 240V300 3000 +SHRA FEW012CB BKN033 02/M00 Q0987 BECMG 9999 NSW SCT020=
EKCH 081150Z 24021KT 9999 FEW020CB SCT060 07/02 Q0985 TEMPO 3000 SHRA BKN012CB=
EKCH 081120Z 25021KT 9999 FEW020CB SCT090 06/02 Q0986 NOSIG=
EKCH 081050Z 25021KT 9999 SCT020CB FEW090 05/02 Q0986 NOSIG=
EKCH 081020Z 25021KT 8000 -RA BKN012 FEW020CB 04/01 Q0985 BECMG 9999 SCT020=
EKCH 080950Z 26016KT 8000 -RA BKN012 FEW020CB 02/01 Q0986 BECMG 9999 SCT020=
EKCH 080920Z AUTO 26022G32KT 9999 BKN036/// 06/M02 Q0985 TEMPO SCT020CB=
EKCH 080850Z AUTO 27021G32KT 9999 SCT037/// 07/M01 Q0985 TEMPO SCT020CB=
EKCH 080820Z AUTO 27023G33KT 9999 SCT040/// 06/M03 Q0985 NOSIG=
EKCH 080750Z AUTO 26021KT 9999 SCT038/// 05/M02 Q0984 NOSIG=
EKCH 080720Z AUTO 27023KT 9999 NCD 05/M03 Q0984 NOSIG=
EKCH 080650Z AUTO 27024G37KT 9999 NCD 05/M03 Q0984 NOSIG=