Failure Knowledge Database / 100 Selected Cases

China Airlines Airbus A300-600R (Flight 140) Misses Landing and Goes up in Flame at
Nagoya Airport
April 26, 1994 at Nagoya Airport
Masayuki Nakao (Institute of Engineering Innovation, School of Engineering, The University of Tokyo)
A China Airlines Airbus A300-600R (Flight 140 en route from Taipei to Nagoya) crashed and caught fire during
landing at Nagoya Airport, killing 264 and seriously injuring 7 others. It was the second biggest aircraft accident inJapan. The copilot had inadvertently activated the TAKE-OFF/GO-AROUND (TOGA) switch on the engine power
lever, causing the tail-first crash. In addition to this direct cause of mishandling, investigators noted technical andcorporate issues as indirect causes.
1. Event
A China Airlines Flight 140, Airbus A300-600R, en route from Taipei to Nagoya had 256 passengers and 15
crews on board. While the copilot was manually controlling a smooth approach to the runway of Nagoya
Airport, he inadvertently activated the GO (GO-AROUND PBL) lever 5.5km before the runway. The flightswitched to GO-AROUND mode and went into a horizontal run.
The captain cautioned the copilot three times but he failed to disengage the GO-AROUND mode andcontinued the approach. The copilot attempted to correct the situation by pushing down the control lever tolower the elevator on the horizontal tail. He then put the plane in autopilot thinking that the computer
would adjust the descent path while still in GO-AROUND mode. The plane, however, kept its nose-up posture.
The copilot continued to push the control lever down but could not correct the situation.
The captain then took over the control and finding that he could not drop the plane to landing altitude, decided
to GO-AROUND. When he engaged the GO lever, the aircraft gained thrust and the sudden lift caused it tostall. The plane went down tail first and burst into fire. The devastating crash killed 264 passengers and crew
members and seriously injured 7 others.
2. Course (Figure 1)(1) China Airlines Flight 140 aircraft approaching the Nagoya Airport passed the outer marker (the radio
beacon furthest from the runway) at 20:12:19, and started landing.
(2) The pilot was performing a normal ILS approach (ILS guides an approaching airplane to enter the runway
using radio waves) to the runway. At 20:14:05 the copilot mistakenly triggered the GO lever (a lever thatmaximizes engine thrust for take-off or GO-AROUND) and the plane entered the GO-AROUND mode
and increased its thrust. The captain cautioned the copilot that he had triggered the GO lever, andinstructed him to disengage the GO-AROUND mode. This thrust increase lifted the aircraft off the regularpath.
1

Failure Knowledge Database / 100 Selected Cases(3) The captain instructed the copilot to lower the course, and the copilot operated the control lever in the
direction to lower the nose. He also activated the auto-pilot in an attempt to engage the auto-landing mode.
The GO lever, however, kept the plane in GO-AROUND mode and the tail wing elevator (stabilizing
plate) moved against the copilot’s operation to lower the nose and suddenly move in the other direction tolift the nose. The autopilot computer was simply trying to execute GO-AROUND. The captain repeatedly
instructed the copilot to descend, and the copilot acknowledged it, however, the horizontal stabilizers wereat their other limits to lift the nose. The Autopilots were disengaged at around 14:50.
(4) The aircraft kept climbing with its pitch angle in the nose-up direction. After 14:57, the stall prevention
system, Alpha Floor function activated to prevent a stall. The function maximized the thrust and the plane
further pitched upwards. The captain took over controls at 15:03 but the aircraft’s pitch angle continued toincrease above 10 degrees.
(5) At around 15:14, the captain then gave up landing notified Nagoya tower that he will “GO-AROUND.”(6) The increase in the thrust, however, with the horizontal stabilizer at its full up position further turned theplane up. The pitch angle eventually reached 53 degrees and the aircraft stalled and crashed at around15:45.

AltitudeRoute of Flight 140
StalledNormal route

20:12:19
Nose-down at the Outer Marker.
Went Nose-up by the Autopilots.

20:14:05
Activated the GO lever.

20:15:14
GO-AROUND thrust.

Time

Figure 1. Descent path of China Airlines Flight 140 (Created referring to [4])3. Cause
The plane kept the upward path (or the posture to keep it) even when the autopilot was triggered because the
GO-AROUND mode was still engaged (or the crew could not disengage it). Pressing the control lever thencaused the horizontal stabilizer to turn towards the full nose-up direction. The aircraft then stalled and crashed.
(1) T echnical factors
2Failure Knowledge Database / 100 Selected Cases• Deficiencies between the automatic and manual operation systems• Design that prioritizes the computer commands during automatic landing and GO-AROUND modes.
The automatic flight system worked against the pilot’s intent through the control lever; the pilot firstwanted to lower the nose, whereas the computer followed the GO-AROUND instruction.
• The aircraft was not equipped with a warning device which would have alerted the pilots of the twosimultaneous control inputs, GO-AROUND and LAND.
Placed too much confidence in automation and the designers lacked sufficient assessment of theworst-case scenario.
(2) Hum an factor• The copilot had inadvertently triggered the GO lever.
There is also a technical issue about this inadvertent activation of the GO lever. The placement anddesign of the GO lever on the thrust lever may have allowed the copilot to inadvertently trigger the GO
lever when he tried to move the thrust lever to control the thrust.
• The flight crew did not sufficiently understand the Automatic Flight System.
Insufficient knowledge about the manual and the system itself• High stress from emergency circumstances impaired the flight crew’s ability to think, and made itdifficult for them to carry out an effective recovery operation.
The captain may have been unaware that the aircraft was under autopilot control, or he believed thatmanual controls input would override (or disengage) the autopilot. The copilot failed to immediately
report to the captain that he could not disengage the GO-AROUND mode and he recognized theabnormally strong resistive force of the control wheel. The captain did not properly check if his
instructions were carried out. Instead of the copilot, the captain should have taken controls of the aircraft
earlier.
(3) C orporate factor• Airbus A300-600R had three similar out-of-trim incidents reported by 1991. In 1993, Airbus Industrierecommended modifications to the Air Flight System to introduce a function that disengages theAutopilot when certain manual controls input is applied on the control wheel in GO-AROUND mode.
The Flight Control Computer manufacturer had systems ready in September 1993 for the modifications.
• The aircraft that crashed at Nagoya Airport was scheduled for the above modifications but not in time of
the accident. China Airlines judged that the modifications were not urgent and planned to implement
them when the Flight Control Computers needed repair. (China Airlines’ lack of safety awareness)• Airbus Industrie announced the Flight Control Computer modification “Recommended”, not“Mandatory”. Airbus Industrie did not explain the reasons and technical background of themodifications. Airbus Industrie’s wrong decision and bad judgment contributed to the recurrence of3

Failure Knowledge Database / 100 Selected Cases
similar incidents.
4. Immediate Action(1) The Ministry of Transport of Japan organized Aircraft Accident Investigation Commission (Chairman:
Kazuyuki Takeuchi) and assigned investigators. Two weeks after the crash, it published a draft of thefactual investigation report accompanied by the analysis of the flight and the voice recordings.
(2) On May 3, 1994, the Taiwanese civil aviation authorities ordered China Airlines to promptly implement
the modification to the Flight Control Computers following the Airbus Industrie’s modification notice. On
May 7, 1994, it also ordered China Airlines to provide supplementary training to A300-600R pilots,
re-evaluate their proficiency and submit pilot training and reevaluation plans.
(3) China Airlines carried out special inspections of engines, Flight Control Systems and autopilot systems on
all their aircrafts by May 31, 1994. It re-checked the proficiency of all their pilots. For A300-600R pilots,
officers of the Taiwanese civil aviation authorities witnessed their rechecking.
(4) On May 5, 1994, Airbus Industrie notified all A300/A310 and A300-600 aircraft operators of the hazardsof overriding the Autopilots by means of the elevators while the Autopilots are engaged in LAND or
GO-AROUND mode.
(5) On May 10, 1994, the Civil Aviation Bureau, Ministry of Transport of Japan handed Japan Air System,
which operated the same aircraft model, a notice entitled “Observance of Operating Procedures for
Automatic Flight Control System Prescribed in Aircraft Operating Manual” and requested them to file areport. The notice instructed the airline to verify selected Autopilot modes during approach, to havethorough understanding of operating procedures for disengagement of GO-AROUND mode, and tocompletely follow the cautions listed in the Airbus A300-600 operation guideline about the autopilot andother procedures.
5. Countermeasure(1) China Airlines completed the modifications to the Flight Control Computers to introduce a function thatallows disengaging the Autopilots (manual controls input overrides the Autopilots) during any flight phaseby September 7, 1994.
On December 13, 1994, Airbus Industrie re-categorized the modifications to Flight Control Computerfrom “Recommended” to “Mandatory”.
(2) Improvements were implemented to the Automatic Flight System functions, taking account of emergency
circumstances, pilot’s actions and cognitive processes.
(3) Enhancements to the pilot education and training programs• Understanding of the design concept of advanced technology aircraft and establishment of its
operational concept• Reinforcement of education and training on the Automatic Flight System
4

Failure Knowledge Database / 100 Selected Cases• Review and training on Cockpit Resource Management (See “Summary ” section below)
6. Summary
Flight deck automation in advanced technology aircrafts has been developed to cover human error and toeliminate such human error. It is designed to correct pilot’s false judgment and to assure safe operation of
aircrafts and flights. It may have been inadequate to design aircrafts to disallow override of Autopilots while in
LAND and GO-AROUND modes.
The design concept of this aircraft was to provide a robust set of programs to properly and safely carry out theimportant change of intent of retrying landing under urgent circumstances, however, the flight crew are thefinal decision makers of how to operate an aircraft thus the autopilot must not in any case fight against theflight crew’s intention. The flight crew’s control should have overridden the autopilot.
As flight deck automation and advanced technology aircrafts advance, accidents specific to them have been
increasing. This increase has started in 1970’s when automation was introduced in the flight deck. Although
the addition of flight deck automation has made significant contributions to the safety and efficiency ofoperations and accident rates for advanced technology aircraft are in fact generally lower than those ofcomparable conventional aircraft, many express concerns about flight deck automation.
Some of the reported factors found in accidents are:(1) Poor understanding of circumstances(2) Insufficient understanding of the system(3) Loss of manual flying skills and lack of proficiency(4) Inadequate operation related to a wrong signal(5) Inadequate operation due to lack of intensity in routine operation(6) Lack of precautions against dangers(7) Loss of motivation in work(8) High stress and increase in workload
These points, in fact, have contributed greatly to the accident of this report.
Advanced technology aircraft has changed the flight crew’s control tasks from safety-critical flight control to
autoflight systems management. Since 1970’s, NASA Ames Research Center has been conducting cockpit
automation and human factors researches to make improvements in safety and efficiency. Their concept,
Cockpit Resource Management (CRM) has gained increased attention from air carriers, and major air carriers
have implemented CRM programs, providing team training to educate the flight crew about general strategies
of interpersonal behavior in the cockpit and improve the operation by the flight crew. In addition to classroom
training, some programs also include full mission simulator training (Line Oriented Flight Training) where theflight crew can practice interpersonal skills without jeopardy. Improvements in the commercial aviation’s
safety record may be due, in part, to this training.
It is true that the advent of advanced technology aircraft has transferred safety-critical functions away from5

Failure Knowledge Database / 100 Selected Cases
human awareness and control, and this trend will be emphasized further in the industry as the technology
advances. Not only in the aircraft industry, other electric device industries may widely accept this trend indeveloping their digital appliances. We must always understand advanced technology’s benefits, shortcomings
and human-system interface issues to improve efficiency and safety while preventing accidents and fatality.
This aircraft accident raised the people’s awareness about developing advanced technology systems and theirinteraction with human for safety.
7. Knowledge(1) The flight crew makes the final intention and decision for operating aircrafts. The flight crew’s control
input must override the autopilot. Systems must always let human control override automation.
(2) Running automated systems requires the users’ thorough understanding of the systems.
(3) Advanced technology aircrafts have changed the flight crew’s control tasks from safety-critical flightcontrol to autoflight system management. Automation requires users’ adequate system management.
(4) An automation system requires a warning device that alerts users effectively even in emergency situations.
8. BackgroundThe crashed Airbus A300-600R is an advanced-technology, twin-engined, high-capacity commercial transport
aircraft produced by Airbus Industrie. It has a two-flight-crew cockpit, and its autoflight system is designed tocontrol takeoff, level flight and landing. It also allows manually controlled approach for normal landing.
By the time of the accident, scientists and aviation safety experts had been conducting studies on humanfactors related to advanced technology aircraft for several years to address deficiencies of flight deck
automation and to improve safety and efficiency of operation. Addressed design improvements included: 1.
Simplified control, 2. Improved redundancy, 3. Better reliability, 4. Better automation functions, 5. Better
warning devices, and 6. Less complicated emergency control tasks. However, Airbus Industrie did not adopt
these suggested design improvements in their aircrafts’ flight-crew-automation interfaces.
Billings, in his 1993 NASA Technical Memorandum document, presented principles and guidelines forhuman-centered automation in aircraft and in the aviation system.
(1) The human operators (pilots and controllers) must remain in command of flights and air traffic.
Automated systems must offer the human operators assistance or relevant advices.
(2) The human operators must be actively involved.
Automated systems must provide the human operators adequate information in a timely manner.
(3) The human operators must communicate their intent to the automated systems.
Automated systems must assist the human operator to accomplish their intended tasks.
(4) The human operators must respond promptly to resolve tactical problems as they arise.
Automated systems must monitor the human operators and assist them to accomplish their intended tasks.
(5) The human operators must understand their automated systems in use.
6

Failure Knowledge Database / 100 Selected Cases
The designer must develop intuitive and less complex automated systems and functions.
(6) The human operators must control and use all available resources to accomplish their intended tasks.
Automated systems work as effective tools, only if they are adequately designed and utilized.
These guidelines suggest the need of implementing new human-system interfaces that focus on humancognition. They are essentially different from conventional man-machine interfaces. The guidelines alsoemphasize the importance of human and machine communication.
References[1] Kanichiro Kato (2002) Koukuuki Jiko – Tugi-wa Nani-ga Okoru (Aircraft Crash - What Happens Next?),
Tokyo, Japan: Kodansha, 230-235.
[2] Aircraft Accident Investigation Commission (1996) China Airlines Airbus Industrie A300B4-622R, B1816,
Nagoya Airport, Nagoya, Japan, April 26, 1994, The Ministry of Transport of Japan.
[3] Isao Kuroda (1994) Chuuka Koukuuki-ni Omou (A Thought on the Crash of China Airlines Aircraft), Security,
July 1994, 44-47. (Isao Kuroda : Professor, School of Human Sciences, Waseda University)[4] Computer Crisis, “The Crash of China Airlines Aircraft”,
http://www005.upp.so-net.ne.jp/yoshida_n/L5_04.htm[5] The Crash of China Airlines Aircraft, http://gonta13.at.infoseek.co.jp/A300-P52.JPG

7