Original subtitles

Every flight begins and ends here--

a strip of asphalt

scorched by jet engines and marred with rubber.

But not all runways are created equal.

One of the world's most notorious is runway 35-L

at Congonhas Airport in Brazil.

It could surprise you at any moment.

In July 2007,

TAM Airlines flight 3054 becomes its latest victim.

Decelerate!

Decelerate!

It can't! It can't!

The runway claims 199 lives.

It would be carefully scrutinized,

its history reviewed.

Investigators desperately need to know

why runway 35-L is so dangerous...

Before more lives are lost.

Ladies and gentlemen,

we are starting our approach.

We lost both engines!

Put the mask over your nose.

Emergency descent.

Mayday, mayday.

Brace for impact!

I think I lost one.

Investigation starting...

He's gonna crash!

Heavy rains pound Brazil's largest city.

Sao Paulo sees this kind of deluge regularly

during the winter rains.

The downpour snarls traffic to and from Congonhas Airport.

Almost 500 miles away,

TAM Airlines flight 3054 is en route

from the southern Brazilian city of Porto Alegre.

The Airbus A320 is headed for Sao Paulo,

90 minutes away.

For the 181 passengers on board,

it's a routine domestic flight.

But there's been an unexpected development

for Captain Henrique Stephanini di Sacco.

He and his First Officer Kleyber Lima

have just learned that the heavy rain

has temporarily shut down runway 35-L--

the main runway at their destination.

Did they say when it would reopen?

No.

Let's prepare an alternate, just in case.

Ladies and gentlemen,

it looks like, due to the weather,

we may not be able to land at Congonhas as planned.

I will keep you advised as I get more information.

Congonhas Airport is one of the busiest in the world.

Planes take off and land here every 90 seconds,

carrying a steady stream of people and cargo

into the country's economic hub.

But Congonhas is also notorious among pilots.

The airport lies at the heart of the city,

crowded on all sides by apartment buildings,

offices, and roadways.

Runway 35-L is less than 6,500 feet long--

short for large jets.

Even worse, it's built on a hilltop

with a sharp drop-off on all sides.

The risk the airport poses,

due to its construction, due to its geography,

it does not allow for simple mistakes.

Captain Carlos Camacho

is the flight safety director

of the Brazilian Pilots Union.

As you approach the runway,

your adrenaline is really pumping.

For us pilots, it's like landing on an aircraft carrier.

It makes Congonhas

one of the most treacherous airports in the world.

In fact, a Pantanal Airlines commuter plane

spun out of control while landing

just the day before.

And a few months ago, disaster was narrowly averted

when a Boeing 737 came skidding to a stop,

just inches before the steep embankment

at the end of runway 35-L.

When pilots begin landing at Congonhas,

they're more worried

than when operating at any other national airport.

Flight 3054 is at cruising altitude

south of Sao Paulo

when the crew gets news

that runway 35-L is back in operation.

3054, 35-L is the active runway.

There's no need to divert.

Ladies and gentlemen,

this is your captain speaking.

I have some good news for you.

The runway at Congonhas has reopened.

We'll arrive as scheduled, shortly before 7 p.m.

The relief of the passengers

is not shared by the pilot.

Stephanini has an additional challenge on this flight.

Remember, we only have one reverser.

Yes.

Only the left.

He will have to land

at one of the world's most challenging airports

with less than the usual amount of stopping power.

One of the Airbus' two thrust reversers

isn't working.

The devices are designed to slow the aircraft on landing

by reversing engine thrust.

If I was the pilot that day,

I would be extremely concerned

knowing that one of my reversers wasn't functioning.

TAM 3054, 35-L clear to land.

Stephanini will be landing

on the infamous runway 35-L.

The runway is wet, and it's slippery.

The wind is 330 at 8 knots.

The crew was informed

of poor braking conditions on the runway.

The Airbus is on final approach.

Even though the autopilot could get the plane to the runway,

the captain decides to take over the controls himself.

Land green, manual flight.

He wants to bring the plane in

as close to the runway threshold as possible.

He needs every inch of runway he can get.

35-L. 35-L.

The concern was that after touching down,

the pilots needed to be sure

that they would be able to stop their plane

before the end of the runway.

The passengers only know

that they'll soon be landing.

300. 300.

Now they are only 300 feet above the city.

The Airbus is lined up with the center of the runway.

Middle.

Runway conditions.

200. 200.

100. 100.

One dot now, okay?

The plane's wheels

will touch the Congonhas tarmac in seconds.

20. Retard.

As the plane touches down,

their worries about landing are only just beginning.

Captain Stephanini applies reverse thrust

to the A320's only working reverser.

The pilot would have to

activate the reverser,

on the engine that had a working reverser,

as fast as possible to initiate deceleration.

But the plane is not slowing down.

Reverse number one only.

At this rate,

it will use nearly the entire 6,400 feet of runway

in less than 30 seconds.

Decelerate!

It can't!

The pilots operated

the foot brakes with the pedals,

pressing on them for a long time.

Look at this.

Now...the aircraft mysteriously pulls to the left.

Turn! Turn!

It's almost as if it has a mind of its own.

Oh, my god! Oh, my god!

Flight 3054 has slammed

into a TAM Airlines building

and an adjacent gas station.

Nearly 200 firefighters descend on the scene.

They face a raging fuel fire

burning at over 1,800 degrees Fahrenheit.

The devastation horrifies Dr. Douglas Ferrari.

The explosion spread fire

throughout the entire area.

There was a fire in the gas station,

killing the people who were filling up their tanks,

burning the whole structure,

turning it unrecognizable.

He had hoped to treat survivors,

but now he fears there might not be any.

We had three, four cars on fire.

In one of these cars, I saw a mother with her child...

Dead.

The entire plane is engulfed in flames.

There's little hope for anyone inside.

But now there is a new danger.

Huge quantities of fuel

in the storage tanks beneath the gas station

could blow up at any moment.

The aircraft broke

its wings on impact

and spilled fuel throughout the entire area.

There was a risk of the gas station exploding.

Rescuers hope they can save people

in the TAM Airlines building.

But with the fire raging out of control,

they will have to act fast.

We tried to rescue the people

from inside the building.

I was anxious to help them.

Dr. Ferrari makes a grim find

inside the TAM Airlines offices.

The airplane wing blocked the way.

It prevented people from escaping.

I was behind the firefighter accompanying me

while he moved bodies to the sidewalk.

It was a horrible feeling.

But they do locate some office workers

in another part of the building

and rush them to safety.

On the right side of the building,

where there was no obstruction,

there was time for people to get out.

About ten or twenty people made it.

No one in the aircraft has survived.

199 people are dead,

including a dozen people in the gas station

and the TAM building.

It's the worst aviation accident in South American history.

The black boxes will not last long in the heat!

Lieutenant colonel Fernando Camargo

is an accident investigator with Cenipa,

the country's aviation safety agency.

In modern aircraft,

the recorders are the core of any investigation.

So when we arrived at the crash site

and we saw that strong fire,

we got really concerned about the integrity of the data.

He knows the intense heat could already be damaging

the plane's data and voice recorders--

valuable evidence that could help explain the crash

may already be lost.

Colonel Camargo and his team know that just the day before,

another plane slid off runway 35-L.

We knew that we would have to run

a complete investigation on the runway.

If a rain-slicked runway caused this crash,

disaster could strike again soon.

The pressure is on to figure out

exactly what happened to flight 3054.

I knew that there was a video

from the surveillance system.

That's the time of the accident. That must be it.

The airport surveillance system

captured the doomed Airbus speeding down the runway.

This video could solve a lot of issues.

Let's see it again, please.

But the crash was outside

the range of the cameras.

Can we look at this from a different angle?

Even without the crash on tape,

the video could hold important clues.

Do you have tape of other A320s landing?

Okay, go ahead and play it now.

We compared these timeframes

from one aircraft to another.

Nine seconds.

A regular landing,

the aircraft would take something about nine seconds

to pass over this camera.

Okay, now the crash plane, please.

And the accident aircraft took three seconds.

Three seconds?

That puzzled us a little bit.

Why was the crash plane going three times faster

than the regular A320 landing?

Four hours after the accident,

firefighters are still battling the intense blaze.

The fire was a strong fire,

with a lot of fuel to keep it burning.

Camargo is desperate

to gain access to the tail section,

which contains the two black boxes.

They concentrated the fight in the rear

of the aircraft.

Finally, firefighters beat back the flames enough

to get at the recorders.

But it may be too late.

They can be submitted to fire

until a certain temperature.

After that there's no guarantee

that data will be preserved.

The recorders will be sent to Washington

to be examined at the national transportation safety board.

Now investigators can focus

on the infamous runway 35-L.

They examine the surface for clues

that might explain why 3054 went so badly out of control.

We walked through the runway,

searching for evidence, marks of the aircraft,

the point where it veered off the runway.

It's still wet!

The water is pooling, creating puddles.

That shouldn't happen on a modern runway.

When this water gets in contact

with the landing gear, the tires,

it can generate what we call hydroplaning,

and this is a problem

because a pilot will have little or no control of his aircraft.

Camargo and his team wonder

why water is pooling on the runway.

They study files

from the government agency that runs Congonhas Airport.

They learn that runway 35-L had been completely resurfaced

just one month before the accident.

In 2007,

the runway at Congonhas underwent repairs.

It had been offering a very low level of traction.

There were many reports of skids.

For years, pilots had been complaining

about the slippery conditions.

They knew that the pavement

needed to be reconstructed...

Because the surface allowed

the water to accumulate.

35-L. 35-L.

The runway had been resurfaced.

That should have solved the water problem.

It reopened just weeks before the crash.

The new surface seemed to be a major improvement.

The airport operated for about a month

in dry weather, with no problems.

But then, three days before the crash,

heavy rains began.

And with the rain,

older problems that were supposed to be solved

came back.

On the night of the accident,

the biggest problem was still the water.

Aircraft were still reporting difficulties braking.

The runway's wet, and it's slippery.

In theory,

there was no more depressions on the runway

to accumulate water.

So what could cause water to accumulate?

He discovers that the repair work

lacked a critical safety feature.

"Grooving to be done at a later date."

no wonder it was wet.

Special grooves that carry away rainwater.

Without them, rain would collect in puddles.

The repairs still lacked

the necessary upgrade.

It was very difficult

to interrupt the operation of the main runway

in order to install the grooves.

Evidence is mounting

that a compromised surface on runway 35-L

played a key role in Brazil's worst airline accident.

Colonel Camargo is concerned that Brazil's notorious rains

may bring more runway disasters.

Soon after the accident,

we recommended the suspension of the operations

of regular aircraft in rainy conditions.

The airport authority complies,

shutting down runway 35-L until answers are found.

But the main runway at one of the world's busiest airports

can't stay closed for long.

They must find out what caused this accident

as soon as possible.

Their focus turns to the A320's thrust reversers.

The plane's maintenance records

reveal why only one of them was working.

Four days before the crash,

mechanics deactivated the right engine's thrust reverser

for routine maintenance.

But the aircraft had then flown without incident for four days.

"No action required"?

Not only had the plane landed repeatedly

with one thrust reverser...

It had even landed safely on runway 35-L.

This plane landed on the same runway,

on the same runway that day, with the same problems,

had only one thrust reverser,

just one thrust reverser.

No issues whatsoever.

So why had this landing gone so wrong?

Colonel Fernando Camargo

travels to Washington, D.C.

Technicians at the National Transportation Safety Board

will help him try to recover data

stored in flight 3054's badly burned flight recorders.

First, they look for a temperature-sensitive chip

that could provide a clue

as to how bad the heat damage might be.

There is an indicator that turns the color

if it was exposed

to a temperature

above that one that it was

manufactured to support.

Even though the boxes are designed

to survive a fierce fire of up to 1,800 degrees Fahrenheit,

the chip's appearance is worrying news.

These boards were submitted

to a fire that exceeded its limitation.

They test the circuit board

to see if any of the memory survived.

Without the data,

the investigation into flight 3054

would be effectively crippled.

Colonel Camargo may never know why 199 people died

at Brazil's busiest airport.

But the circuit board test provides some hope.

Okay, we got something.

Fortunately, everything works okay.

We could recover 100% of the data.

Here we go.

The information paints

a picture of the plane's performance...

The speed is fine...

...in the critical seconds before the crash.

They came down fine.

Brakes were engaged. The brakes were engaged.

The data confirms

that the foot brakes were working properly

and that the A320 did not skid or slide.

Here.

Then Camargo discovers

that the plane's two engines

were inexplicably operating against each other.

The plane's left engine was in reverse

to help slow the aircraft down.

But the right engine,

the one with the disabled thrust reverser,

was doing the opposite.

It's powering up for takeoff.

It's supposed to be idling.

Instead of winding down,

it was accelerating to climb power.

-Decelerate! -It can't!

- Decelerate! -It can't!

With one engine at full power,

the pilots didn't have a chance to stop their aircraft in time.

This aircraft was braking.

But it would take around one more kilometer

for it to stop.

The lopsided thrust pushed

the plane to the left.

The right engine really

was increasing thrust.

There was no means available

for the pilot to avoid the aircraft

to veer off to the left.

So engine two was thrusting

when it should have been idling.

That would explain the veer-off to the left, right?

So what does this mean?

Now colonel Camargo needs to figure out

why the right engine was at full power

when it should have been in reverse.

At that time, we could establish, roughly,

two main lines of investigation:

One, mechanical failure;

and the other one...

Pilot error.

Colonel Camargo

brings in human factors investigators

Lieutenant Colonel Marcia Fajer

and First Lieutenant Vanessa Dias.

The pilot is Henrique Stephanini di Sacco,

age 53, from Sao Paulo.

13,654 flight hours.

The pilot who was in command

was a very experienced pilot.

He knew the aircraft very well.

His first officer was Aguiar Kleyber Lima,

age 54, from Porto Velho.

14,760 flight hours.

He had enough training to do a good job,

including in an emergency situation.

Their job is to determine

if the crew somehow made an error

that could have caused one engine

to stay at full power.

Machines are straightforward

because they work in predictable ways.

Humans are infinitely more complex

in the way they think and act.

It's much harder to analyze their behavior in an accident.

You know, but I just... I can't believe

that this pilot would make that kind of mistake.

Okay.

The human factors team

must now conduct a psychological study of the crew

to understand how they might have committed a fatal misstep.

We attempted to reconstruct

the individual history of each crew member

and their experience.

Ladies and gentlemen,

this is your captain speaking.

I have some good news for you.

And tried to create a picture

that could help us explain what happened in the cockpit.

Colonel Camargo still believes

a mechanical failure is more likely.

He now turns his attention to the complicated mechanics

that link the thrust levers to the engines.

He must determine if a failure there

led to the mysterious power surge.

We began studying this thrust system,

each and every component of the system,

from the lever to the engine.

We've been through it...

There's nothing wrong with the engines.

That leaves only one component

that could have caused the problem:

The mechanism that links the throttles to the engines--

a device called an artificial feel unit,

or AFU.

Investigators wonder if that device failed,

leaving the engines at full power

even though the pilots set the lever to idle.

But such a failure is highly unlikely.

It's really a remote possibility--

400 billion hours of flight

for us to have one occurrence of that.

Still, he needs to rule out the AFU

as a possible cause of the crash.

But he's not sure the unit can even be found

amongst the wreckage.

Computers, all the avionics...

Everything was gone.

Luckily,

one of the few pieces to have survived the fire

is the piece investigators now need:

The AFU.

It's sent to a specialized laboratory

that can scan the metal for microscopic markings.

It got melted in such a way

that you can work with it.

So we could check something.

The 3-D scanner

allows them to look for nicks or scratches

that would indicate the unit failed.

I'm looking for any...

Any unusual marks in this area.

If we could find out any mark, any evidence

of the position of this gear,

we could go after the lever

and find out the real position of the thrust lever.

But they can find no evidence

that the AFU malfunctioned.

Ok, pack it up. Let's go home.

We found nothing.

No mark. No evidence.

Colonel Camargo concludes

mechanical failure was not to blame

for the improper power setting on the right engine.

He has to assume that for some reason

the crew left the right engine lever at full power

after the Airbus landed.

Oh, my god!

Turn! Turn! Turn! Turn!

Back in Sao Paulo,

the human factors team turns to the cockpit voice recorder,

or CVR.

They need to understand the pilots' state of mind

as they approached Sao Paulo the night of the crash.

The CVR enables us to get an idea

of the interaction between crew members.

They learn that captain Stephanini

was quite concerned about the runway conditions.

Ask them about the rain, the runway conditions,

if the runway's slippery.

TAM on final approach.

Two miles away.

Could you confirm conditions?

It's wet, and it's slippery, 3054.

Wet and slippery.

The pilot is already tense,

and then he finds out

that runway conditions are worse than usual--

slippery and rainy.

The tension can affect the pilot's perception,

his concentration.

35-L, 35-L.

It now appears that Stephanini's anxiety about 35-L,

and not the runway itself,

was the main cause of this crash.

Camargo now focuses on the crew's actions.

I think it's ready, sir.

Thank you.

He needs to understand

how the power levers were handled before the crash.

Using data from the flight recorder,

investigators focus first

on the landing just prior to the one at Congonhas.

We discover

that the same pilot, the captain,

was the one operating the aircraft

in the previous land and in Congonhas.

First, how did they land in Porto Alegre?

Okay.

Both levers full forward during approach.

They learn

that during the previous landing in Porto Alegre,

captain Stephanini pulled back both thrust levers...

...exactly the right procedure

for landing with only one reverser.

And now, both levers to reverse.

At the time of the accident,

the correct procedure

was for the pilot to take both throttles to idle

and both throttles to reverse,

as if you had no problem with the reversers.

They've established that captain Stephanini

carried out the correct procedure

for landing with one thrust reverser

on the day of the crash.

No reverser number two.

Auto brakes on.

And speed is dropping.

It puzzled me

because of the fact

that the captain knew the procedure.

He performed the correct procedure

hours before in the previous landing.

So what did he do differently

two and a half hours later in Sao Paulo?

- Okay. -Okay, now Congonhas.

Left lever to idle.

The data shows

that captain Stephanini's handling of the thrust levers...

Then reverse.

...was very different on his landing in Sao Paulo.

Instead of throttling back both levers,

he only put the left engine in idle,

leaving the right one at full power.

Then, once the aircraft had touched down,

he activated only the left reverser,

again leaving the right engine at full.

That is quite different.

I don't get it.

How could a guy that knew the aircraft,

that knew the correct procedure,

that executed a correct procedure,

how could he

do something different?

It doesn't seem to make sense...

We could really use your help on this.

...until Camargo enlists

the help of another pilot.

It's only then that he discovers an important detail

that could explain what the captain did.

It turns out there was an older, outdated procedure

for landing an A320 with a single thrust reverser.

Could you demonstrate it for me, please?

It starts out the same,

but then there's an important difference.

The former procedure

was taking

both levers to idle

and then just the lever corresponding to the engine

with the reverser operating normally--

that would be taken to reverse position.

But that is not what captain Stephanini did.

He left the right engine at full power

instead of bringing it to idle.

If he was attempting the old procedure,

he got it wrong.

Investigators learn that captain Stephanini

would not have been the first pilot

to make that mistake.

There had been several accidents around the world.

The cause was identical:

Pilots mishandling the procedure

for landing with a disabled reverser,

inadvertently leaving one thrust lever at full power.

That old procedure

led pilots to error.

Airbus finally modified the procedure

to reduce the risk of precisely that error.

The manufacturer changed

the procedure and determined that both levers

would come down together

to the idle position,

and then, right after touching the ground,

both would come down to the reverser position.

Captain Stephanini was familiar

with both the old and the new procedure

for landing with a disabled reverser.

Retard. Retard.

It now seems on flight 3054

he may have tried to use the old one.

The question for investigators is why?

Investigators still can't understand

why the crew of flight 3054

left an engine at full power after touching down.

Did they get it wrong?

But after interviewing other pilots,

they do understand why using the older procedure

would have made sense that rainy day at Congonhas.

It would bring the plane to a stop much more quickly

than the new one.

That could explain

why the captain would go

for a former procedure

that he knew was more efficient

than the current one.

Investigators theorize that in reaction

to deteriorating conditions at Congonhas...

Wet runway? One reverser?

I'm gonna buy us some runway and use the old procedure.

He was trying to ensure

that he'd have as much distance as possible

to stop on the notorious runway 35-L.

But he made a costly error.

Under those circumstances...

Remember, we only have one reverser...

One reverser... Manual flight...

Wet and slippery... One reverser...one reverser...

Manual flight.

It is completely understandable

that he had tried a former procedure,

and, under such a pressure,

made a mistake.

Lieutenant Vanessa Dias

re-creates the final moments of the flight

in a simulator.

Okay, engine one to idle. Engine two stays at climb.

She notices that in a dark cockpit,

it would have been difficult

to see the position of the thrust levers.

20. Retard. Retard.

Engine one to reverse. Don't touch number two.

Brakes.

Okay, so...wow.

In the simulator,

we were able to program in every known factor:

The chronology of events,

whether it was cloudy or raining,

the wet surface, the slippery surface,

the position of the levers.

We also went off the runway

and had an accident in the simulator.

Lieutenant Dias believes

she now understands why TAM Airlines flight 3054

ended in tragedy.

Captain Stephanini had done everything he could

to ensure the A320 would touch down on runway 35-L

with as much room ahead of him as possible.

Land green. Manual flight.

But the prospect of landing

on the treacherous runway had so unnerved him

that he bungled a simple procedure.

It's possible that tension

might block a crucial motor response.

It can affect the pilot's ability to react.

There was no alarm to warn them

that one engine was speeding up while the other was in reverse.

First officer Lima tried to figure out what was going wrong.

Decelerate.

But in a dark cockpit...

It can't.

Overwhelmed by a landing going badly...

He didn't notice the abnormal thrust lever settings.

Decelerate! Decelerate!

The pilots were unable to understand

what was happening to their aircraft.

Ah...look at this!

A runway with a dangerous reputation

so unnerved a crew

that they made a mistake...

That ended up killing 199 people.

Oh, my god! Oh, my god!

Since the crash of flight 3054,

the runways at Congonhas have been grooved

and are regularly inspected.

New rules are in place dictating

wet-weather landing procedures.

In rainy weather,

you need to have all of your reversers operating.

But despite these efforts

to improve safety at Congonhas,

many pilots doubt it's any better.

Congonhas is not safer today.

It continues to be a dangerous airport.

Only a total ban on operations in wet or rainy conditions

would improve the safety of this airport.

What's clear

is that even today,

35-L is a runway that cannot

shake its dangerous reputation.

35-L. 35-L.