Runway excursion, Boeing 747-438, VH-OJH, Bangkok Airport, Thailand, on 23 September 1999

Executive summary

Overview

On 23 September 1999, at about 2247 local time, a Qantas Boeing 747-438 aircraft registered VH-OJH (callsign Qantas One) overran runway 21 Left (21L) while landing at Bangkok International Airport, Thailand. The overrun occurred after the aircraft landed long and aquaplaned on a runway which was affected by water following very heavy rain. The aircraft sustained substantial damage during the overrun. None of the three flight crew, 16 cabin crew or 391 passengers reported any serious injuries. 

The Aircraft Accident Investigation Committee of Thailand delegated the investigation to the Australian Transport Safety Bureau (ATSB) on 18 November 1999. In accordance with this delegation, the ATSB conducted the investigation according to the standards and recommended practices of Annex 13 to the Convention on International Civil Aviation and the Australian Air Navigation Act 1920, Part 2A. 

In terms of overall accident statistics, runway overruns are a relatively common event. Of the 49 accidents involving western-built high-capacity jet aircraft reported during 1999, 11 were landing overruns. Landing overruns typically occur when the runway is wet or contaminated and/or the aircraft is high and fast during final approach.

The accident flight (see part 1) 

The first officer was the handling pilot for the flight. The crew elected to use flaps 25 and idle reverse as the configuration for the approach and landing, in accordance with normal company practice (since December 1996). 

At various stages during the approach to runway 21L, the crew were informed by air traffic control that there was a thunderstorm and heavy rain at the airport, and that visibility was 4 km (or greater). At 2240, a special weather observation taken at Bangkok airport noted visibility as 1,500 m and the runway visual range (RVR) for runway 21 Right (21R) as 750 m. 

The Qantas One crew was not made aware of this information, or the fact that another aircraft (callsign Qantas 15) had gone around from final approach at 2243:26. At 2244:53, the tower controller advised that the runway was wet and that a preceding aircraft (which landed at approximately 2240) reported that braking action was ‘good’. The Qantas One crew noted no effect from the weather until visibility reduced when the aircraft entered very heavy rain as it descended through 200 ft on late final approach. The aircraft then started to deviate above the 3.15 degree glideslope, passing over the runway threshold at 169 kts at a height of 76 ft. Those parameters were within company limits. (The target speed for the final approach was 154 kts, and the ideal threshold crossing height was 44 ft.) 

When the aircraft was approximately 10 ft above the runway, the captain instructed the first officer to go around. As the first officer advanced the engine thrust levers, the aircraft’s mainwheels touched down (1,002 m along the 3,150 m runway, 636 m beyond the ideal touchdown point). The captain immediately cancelled the go-around by retarding the thrust levers, without announcing his actions. Those events resulted in confusion amongst the other pilots, and contributed to the crew not selecting (or noticing the absence of) reverse thrust during the landing roll. Due to a variety of factors associated with the cancellation of the go-around, the aircraft’s speed did not decrease below the touchdown speed (154 kts) until the aircraft was 1,625 m or halfway down the runway.

The investigation established that, during the landing roll, the aircraft tyres aquaplaned on the water-affected runway. This limited the effectiveness of the wheelbrakes to about one third of that for a dry runway. In such conditions and without reverse thrust, there was no prospect of the crew stopping the aircraft in the runway distance remaining after touchdown. The aircraft overran the 100 m stopway (at the end of the runway) at a speed of 88 kts, before stopping 220 m later with the nose resting on an airport perimeter road. 

The depth of water on the runway when the aircraft landed could not be determined but it was sufficient to allow dynamic aquaplaning to occur (i.e. at least 3 mm). The water build up was the result of heavy rain on the runway in the preceding minutes, and possibly because the runway was ungrooved. 

During the examination of the performance of the aircraft on the runway, it became evident that the flaps 25/idle reverse thrust landing procedure used by the crew (and which was the ‘preferred’ company procedure) was not appropriate for operations on to water-affected runways. The appropriate approach/landing procedure was flaps 30/full reverse thrust. This had the characteristics of a lower approach speed, of being easier to fly in terms of speed control and runway aim point (for most company pilots), and of providing maximum aerodynamic drag after touchdown when the effectiveness of the wheelbrakes could be reduced because of aquaplaning. Had this configuration been used, the overrun would most probably have been avoided. 

As with other company B747-400 pilots, the crew had not been provided with appropriate procedures and training to properly evaluate the potential effect the Bangkok Airport weather conditions might have had on the stopping performance of the aircraft. In particular, they were not sufficiently aware of the potential for aquaplaning and of the importance of reverse thrust as a stopping force on water-affected runways.

Significant active failures 

Significant active failures associated with the accident flight were: 

• The flight crew did not use an adequate risk management strategy for the approach and landing. In particular, they did not consider the potential for the runway to be contaminated by water, and consequently did not identify appropriate options and/or landing configurations to deal with the situation. That error was primarily due to the absence of appropriate company procedures and training. 
• The first officer did not fly the aircraft accurately during the final approach. 
• The captain cancelled the go-around decision by retarding the thrust levers. 
• The flight crew did not select (or notice the absence of) idle reverse thrust. 
• The flight crew did not select (or notice the absence of) full reverse thrust. 
• The runway surface was affected by water. 

Significant inadequate defences 

Significant inadequate defences associated with Qantas Flight Operations Branch activities were: 

• Company-published information, procedures, and flight crew training for landing on water-affected runways were deficient. 
• Flight crew training in evaluating the procedural and configuration options for approach and landing was deficient.

Post-accident events and cabin safety issues (see part 2) 

The main areas of damage to the aircraft were the lower forward fuselage, the nose and right wing landing gear and landing gear bays, and the engines. Numerous cabin fittings dislodged during the accident sequence. As a result of the nose landing gear collapsing rearwards and upwards into the lower fuselage, the cabin passenger address system and the interphone system for communications between the flight deck and the cabin became inoperable. 

No evidence of fire was found during the post-accident examination of the aircraft. 

After the aircraft came to a stop, the flight crew initiated a process of gathering information from the cabin concerning the extent of the aircraft damage. The failure of the passenger address and cabin interphone systems was a major hindrance to the crew’s efforts to assess the situation in the cabin. Some important information regarding the cabin environment and the external condition of the aircraft did not reach the flight crew. In addition, there were gaps in the information available to the flight crew, the possible significance of which was not considered by them in deciding whether or not to keep the passengers on the aircraft. The captain assessed that the appropriate response was to wait for outside assistance and then conduct a precautionary disembarkation, rather than initiate an immediate evacuation. 

Normal radio communications between the aircraft and the control tower were lost for a few minutes after the aircraft came to a stop. Additionally, the aircraft could not be seen from the tower because of the reduced visibility and the emergency response vehicles were restricted to sealed surfaces by the wet conditions. These issues contributed to the emergency response vehicles arriving at the aircraft about 10 minutes after the accident. 

Approximately 20 minutes after the accident, the crew initiated a precautionary disembarkation from the right side of the aircraft using the emergency escape slides. Although the disembarkation was achieved largely without incident, there were arguably sufficient ‘unknowns’ concerning the condition of the aircraft, and possible related hazards, for an earlier evacuation to have been conducted. 

Significant active failures 

Significant active failures associated with the post-accident events were: 

• The cabin interphone and passenger address systems became inoperable (due to impact damage). 
• The flight crew did not consider all relevant issues when deciding not to conduct an immediate evacuation. 
• Some crewmembers did not communicate important information during the emergency period. 

Significant inadequate defences 

Significant inadequate defences associated with Qantas Flight Operations Branch activities were: 

• Procedures and training for flight crew in evaluating whether or not to conduct an emergency evacuation were deficient. 
• Procedures and training for cabin crew in identifying and communicating relevant information during an emergency were deficient

Another significant deficiency involved the aircraft cabin interphone and public address system. The redundancy provided by the normal and alternate cabin interphone and public address systems in B747-400 aircraft was compromised because some components for both systems were co-located in the same relatively damage-prone position in the lower fuselage aft of the nosewheel. Aircraft design standards in the USA and Europe currently contain no requirements for system redundancy in this sense. The report includes a recommendation to the FAA and JAA regarding this deficiency. 

Organisational factors: Qantas (see part 3) 

The ATSB investigation examined the processes of the Qantas Flight Operations Branch for any systemic organisational issues that may have allowed the deficiencies mentioned above to occur. That examination included a detailed review of the company’s introduction of the flaps 25/idle reverse procedure, as well as company procedures and training relating to water-affected runways. The aim of the new procedure was to reduce costs (e.g. brake maintenance, noise levy charges at Sydney Airport, and thrust reverser maintenance) without affecting safety levels. Examination of the project development process revealed that a proper risk assessment of the new procedure was not undertaken, and that other important considerations were overlooked. There were also significant deficiencies in the manner in which the company implemented and evaluated the new procedures. 

Overall, the investigation identified five deficiencies related to the organisational processes of the Qantas Flight Operations Branch:

• The processes for identifying hazards were primarily reactive and informal, rather than proactive and systematic. 
• The processes to assess the risks associated with identified hazards were deficient. 
• The processes to manage the development, introduction and evaluation of changes to operations were deficient. 
• The design of operational procedures and training was over-reliant on the decision making ability of company flight crew and cabin crew and did not place adequate emphasis on structured processes. 
• The management culture was over-reliant on personal experience and did not place adequate emphasis on structured processes, available expertise, management training, and research and development when making strategic decisions. 

Organisational factors: Civil Aviation Safety Authority (see part 4) 

Significant latent failures associated with CASA’s regulatory operations were: 

• The regulations covering contaminated runway operations were deficient. 
• The regulations covering emergency procedures and emergency procedures training were deficient. 
• The surveillance of airline flight operations was deficient. 

In June 1997, CASA began developing a systems-based approach to surveillance because of deficiencies with the previous approach (which focussed on the end products of the aviation system). However, the new system had not reached maturity at the time of the accident. In 1998 and 1999, there were serious shortfalls in CASA’s planned product-based surveillance of Qantas flight operations. However, because of the significant limitations in the effectiveness of product-based audits to identify the type of systemic and organisational deficiencies highlighted during this investigation, it was unlikely that a higher level of surveillance activity would have revealed these deficiencies. 

Safety action 

(see part 5) 

On 5 December 2000, Qantas advised that all deficiencies identified during the investigation and highlighted in this report either had been, or were being, addressed. Qantas Flight Operations Branch had introduced substantial changes and was examining further changes to its management policies and procedures in the following areas: 

• operational training and procedures 
• hazard identification 
• risk assessment 
• change management 
• design of procedures and training programs 
• management decision-making processes 

Some of these changes were in progress in the period before the accident. The ATSB raised a number of safety analysis deficiency notices (SADNs) concerning Qantas operations as a result of the investigation. Four of these SADNs remained open pending advice from the company on the progress of their change activities. 

CASA was also in the process of making substantial changes to its surveillance processes and the Australian aviation safety regulations. Many of these changes were in progress at the time of the accident. The ATSB made four recommendations where it considered that there remained safety matters that were yet to be adequately addressed.