Crew fights the autopilot's go-around trim on approach to Nagoya; China Airlines Flight 140 stalls, killing 264

On 26 April 1994, an Airbus A300-600R operating China Airlines Flight 140 from Taipei stalled and crashed inside the perimeter of Nagoya Airport in Japan, killing 264 of the 271 people on board. Japan's Aircraft Accident Investigation Commission attributed the crash to twelve factors acting as a chain or combination, several of them crew actions and several of them design and oversight failures. Among the design failures: after the first officer inadvertently put the flight director into go-around mode and the autopilots were then re-engaged, the autopilot's auto-trim function drove the trimmable horizontal stabilizer to its full nose-up limit while the pilot held the control column nose-down against it. On that build of the aircraft, control-column force alone could not disconnect the autopilot in go-around mode, and no function directly and actively warned the crew that the stabilizer was running away from them; the trim indicators and wheels that did move sat outside their forward field of view, and the aural trim warning was inhibited with the autopilot in a command mode.

What happened on the approach

The flight was cleared for an ILS approach to runway 34 in night visual conditions, with both autopilots and the auto-throttles initially engaged. After the outer marker the first officer, who was flying, disconnected the autopilot and continued by hand. Passing roughly 1,000 feet he inadvertently triggered the GO levers on the throttles, which commanded a thrust increase and shifted the flight guidance into go-around mode, pushing the aircraft above the glideslope. The captain told him to disengage the go-around and correct back down, and while pushing the column forward the first officer re-engaged the autopilot, which was still in go-around mode, according to the US Federal Aviation Administration's case study of the accident.

From that point the automation and the pilot were fighting each other over pitch. The autopilot trimmed the stabilizer from about -5.3 degrees to its nose-up limit of roughly -12.3 degrees while the first officer applied progressively more nose-down elevator, which masked the growing mis-trim. His attempts to use the yoke trim switches did nothing, because electric pitch trim is inhibited while the autopilot holds a command mode. The stabilizer is roughly three times the elevator's area, so once the autopilot was disconnected near 700 feet the stabilizer stayed where it had been left and the elevator no longer had the authority to hold the nose down.

Reduced thrust and rising angle of attack then triggered the aircraft's alpha floor protection, which commands maximum thrust. With underwing engines, that thrust surge added still more nose-up pitch. The captain took over, was surprised by the control forces, and called for a go-around; the aircraft climbed steeply to about 1,730 feet, reached a pitch attitude near 53 degrees, stalled and struck the ground. SKYbrary's account of the investigation records that 264 of the 271 occupants were killed and that the seven survivors, all passengers, were seriously injured.

The investigation's findings

The Aircraft Accident Investigation Commission's causes section, published in the commission's final report and hosted as a scanned document by the FAA, lists a dozen contributing factors as a chain or combination. They include the physical design of the GO lever, which the commission said made inadvertent triggering possible during normal thrust lever handling; the crew's decision to engage the autopilots with go-around mode still active and continue the approach; the first officer's continued pushing on the control wheel, on the captain's instructions and despite its strong resistive force, in order to continue the approach; the conflict between stabilizer and elevator that produced the out-of-trim condition; the absence of any function that would actively alert the crew to that condition; inadequate crew understanding of flight director mode changes and the autopilot override function, which the commission tied to unclear manual descriptions; the delayed control handover; both pilots' inadequate awareness of the flight condition after the captain took over; inadequate crew coordination; and the alpha floor activation, which it found incompatible with an out-of-trim aircraft because of the large pitch-up moment it generated.

Two of the commission's listed causes are institutional rather than operational. It found that a service bulletin modification had not been incorporated into the accident aircraft, and that the manufacturer had not classified that bulletin as mandatory while the airworthiness authority of the state of design had not promptly issued a directive requiring it. Flight International reported in July 1996 that the final report apportioned blame to both Airbus, for flight-control computer design deficiencies, and China Airlines, for pilot error and training shortfalls.

A known failure mode that had already surfaced three times

The FAA case study documents three precursor events on the same family of aircraft. In March 1985 an A300 crew overrode the autopilot in altitude hold and let the stabilizer run to full nose-up before recovering. In January 1989 an A300-B4 crew near Helsinki triggered the GO levers inadvertently and ended up in a steep, low-speed climb to 2,250 feet. In February 1991 an A310 near Moscow entered a repeating stall-and-climb cycle reaching a pitch attitude of about 88 degrees and an eventual altitude of 11,755 feet before the crew recovered.

Airbus responded to those events with a flight control computer modification that would let 15 kilograms of column force disconnect the autopilot in go-around mode above 400 feet, released as a service bulletin in 1993. Because the bulletin was categorised as recommended rather than mandatory, the FAA study says, China Airlines deferred the change to the next time the computers needed work, and the accident aircraft never received it. In the commission's own framing, that classification decision and the regulator's failure to mandate the fix were themselves causes of the accident.

Regulatory response

The French Direction Generale de l'Aviation Civile issued airworthiness directive 94-185-165(B) on 17 August 1994, requiring flight manual revisions and modification of the flight control computers. Under the bilateral airworthiness agreement, the FAA followed: on 17 October 1994 it published a notice of proposed rulemaking in the Federal Register covering additional flight control computer part numbers on A310 and A300-600 airplanes, describing an accident in which a crew may have attempted a go-around while out of trim and stating that the type's design gave a pilot no way to disconnect the autopilot by column input without compromising control:

Further investigation indicates that the design of Model A300-600 series airplanes does not provide for disengagement of the autopilot in a manner that would allow for manual input from the control column without adversely affecting controllability of the airplane.

Federal Aviation Administration, Docket No. 94-NM-145-AD

The proposal, which the FAA itself called interim action, applied to an estimated 15 A310s and 36 A300-600s on the US register and had to be accomplished by an FAA-approved method because the manufacturer had not yet developed a modification for those particular computers. A separate docket handled the two part numbers Airbus had already addressed, and the FAA issued airworthiness directive 94-21-07 on 2 November 1994, mandating a flight manual limitation within 10 days and the computer modification within 60 days. Airbus reclassified the underlying service bulletin as mandatory in December 1994. The US National Transportation Safety Board separately recommended that the FAA require autopilot logic changes so the autopilot would disconnect on a specified pilot input regardless of altitude or mode, plus a perceptual alert whenever the stabilizer is in motion from any trim source.

Why it moves the needle

Nagoya is one of the foundational cases in the record of automation that keeps optimizing while a human is actively trying to countermand it. The autopilot was not malfunctioning; it was doing exactly what its go-around logic said to do, which is what made the situation so hard for the crew to diagnose. The pilots had no aural or in-field-of-view indication of the stabilizer running to its limit, the trim switches they reached for were inhibited by the automation, and the one control action pilots instinctively trust, pushing hard on the column, was specifically designed not to break the automation's grip in this mode.

The consequences reached well beyond one airline. The FAA says this accident and others like it prompted a 1994 human factors study of flight deck automation interfaces, conducted with European authorities and academia, whose 1996 report singled out pilot/autopilot interactions that create hazardous out-of-trim conditions and autopilots that attempt maneuvers a pilot would not expect. It also fed the FAA's 1999 policy on flight crew awareness during autopilot operation, later rulemaking on flight guidance systems and flight deck design, and a rewriting of stall recovery training to put autopilot disconnection and angle-of-attack reduction first. The deeper precedent is the one the commission itself named: a safety-critical automation fix existed, was known to the manufacturer, and was left optional until 264 people died.