The report into the accident involving an A320 of TAM, at Congonhas in July 2007 has been released. It is available at here (http://www.cenipa.aer.mil.br/cenipa/paginas/relatorios/individual.php?matricula=PR-MBK) but AFAIK is in Portuguese only at the moment.

Hopefully the doubts can now be put to rest.

My quick read was disappointing, the investigators suggest two possibilities, pilot error or equipment failure, without being able to tell us what really happened.

I have defended CENIPA in the past when their reports have been criticised, but first glance at this one doesn't inspire a great deal of confidence. Still, I'll take it to the beach for the holiday on Monday and have a more detailed read.

TTFN

..............and these guys had the black boxes. Imagine what kind of report we'll get when it comes to AF 447.

From page 118 to page 122

AIRBUS in charge of the BEA
BEA for Bureau Enquête Airbus

Not unreasonable in what the BEA say Confi

..............and these guys had the black boxes. Imagine what kind of report we'll get when it comes to AF 447.


The equipment failure possibility is VERY remote. The investigation was able to find out what happened, but it's impossible to know why one lever was on "reverse" and the other one was on "climb". The report suggests that most likely the pilot did a mistake. Anyway, the report has several recomendations that will help to prevent another crash like this one, it doesn't matter if it was a pilot error or a equipment failure...

The final report listed 8 probable causes and 84(?) recommendations to operators, ANAC and Airbus.

I didn't read the report entirely, but i'll try to make a brief translation. Have no time now for a complete (and literal) translation.

- It wasn't possible to determine the exact position of the throttles due to the force of impact, but the principal cause was the position of the TLs (one in reverse and one in acceleration).

- The pilots lost situational awarness, they didn't identify the problem in time to avoid the accident.

- It is possible to land with one TL in reverse and the other in acceleration position without any warning to the pilots.

What I could understand, the main cause was pilot error, but aircraft engineering wasn't of much help to quickly warn the pilots what was going on.

I know this was extensively discussed here, but I have a quick question.

How many inches one TL must be above idle to "transmit" to the engine the info to accelerate?

Rob

I know this was extensively discuted here, but I have a quick question.
How many inches one TL must be above idle to "transmit" to the engine the info to accelerate?
Quick answer, this is a two cases scenario :


A/THR OFF Engine output proportional to thrust lever displacement (very much conventional)

A/THR ON Engine output can be anywhere between idle and climb thrust as long as the thrust lever is not at the idle stop. As an example , one thrust lever could be only half an inch above idle stop and the engine could deliver as much as climb thrust (very unconventional)

If I am reading the report correctly, the A/T was active until it kicked off due to the split condition (EPR 1.2 vs. reverse). So scenario 2 applies, and the "offending" TL might have been out of detent fwd by only half an inch?

Any sign of it in English yet?

voltage;
If I am reading the report correctly, the A/T was active until it kicked off due to the split condition (EPR 1.2 vs. reverse). So scenario 2 applies, and the "offending" TL might have been out of detent fwd by only half an inch?
No. Scenario 2 is not accurately stated.

A half-inch thrust lever displacement would produce about 40 to 50% power if I recall. The statement that a half-inch from the IDLE detent could deliver as much as "climb thrust", is incorrect. Engine thrust is limited by the TLA even when the autothrust is ON and Active. If the thrust lever is out of the CLB, (Climb) detent, engine thrust will be limited to the thrust level equivalent to that thrust lever position and will not produce climb thrust. This is a fundamental, key understanding of the autothrust system when flying the A320/A330 series aircraft.

With the levers split as they were, the autothrust did disconnect. The reference for the #2 FADEC then was limited by the thrust lever position, which was about 24deg or essentially full thrust.

The DFDR traces were provided very soon after the accident. The engine thrust being developed by #2 engine as shown in the DFDR traces was indeed 1.2EPR, which is equivalent to about 92 to 95% N1. The report doesn't have provide the N1 traces for #1 and #2 engine. The TLA of #2 thrust lever was just below 25deg so it was in the CLB detent until the end of the recording.

The #2 engine was essentially developing almost full thrust while #1 was in full reverse, (shown by fuel flows being about the same for both engines but the TLA for #1 was about -20deg).

CONF iture:
A/THR ON Engine output can be anywhere between idle and climb thrust as long as the thrust lever is not at the idle stop. As an example , one thrust lever could be only half an inch above idle stop and the engine could deliver as much as climb thrust (very unconventional)

Sorry to disagree, but that's not truth. With A/THR ON, if you retard the thrust levers to a lower (than Climb) intermediate setting of TLU you will limit the Auto-thrust to a certain amount directly related to that particular TLU angle. A/Thrust will only be able to use an amount of thrust between Idle and that particular TLU setting.

By the way, I find the work of the Brazilian Investigators much better than expected and some issues like Human Factors were well addressed.. Some of the BEA comments are only a mirror of the widely known Airbus Industrie's incapacity (or should I say, unwillingness) for a change.

PJ2 and aguadalte,
You made me open the library … and the books support your version !
So here I stand corrected, I learn something, and I thank you for that.
... Now I have something to experiment for next flight.


Regarding the report, anyone kind enough to translate the essential of both hypotheses … ?

PS : Also, very much interested in page 115, Recommendations to Airbus ... !?

CONF iture;

That's the main purpose of the forum; glad it was of help.

Re "experimenting", in Line Indoc instructing, under appropriate circumstances I would encourage moving between fully automatic flight into fully manual flight and back again. That means disconnecting the a/p, then the autothrust, then the f/d's and then reconnecting them again.

Disconnecting the a/t's especially; I noticed that when it was the F/O's leg and I indicated that they were free to hand-fly the airplane to from takeoff to cruise and from top of descent to touchdown, most refused because I think they were uncomfortable. Good reaction in the immediate sense but I didn't think much of the lack of willingness to learn. There are a few circumstances where hand flying and manual thrust are required by the MEL and one had better know the numbers.

The other 'gotcha' which I used to emphasize and when appropriate, demonstrate so that the candidate knew what it looked like and knew what to do, is the THRUST IDLE/OPEN DESCENT mode when hand-flying and for whatever reason, not following the flight directors. Leveling off before ALT* will leave the F/Ds (and the engines) in the Open Descent mode. Since there is no capture, the power does not increase and the speed begins to bleed back for no apparent reason, (no warnings, nothing apparently wrong) and the engines remain at IDLE thrust.

This is what occurred in the accident at Madras. Airbus has since addressed this by causing the Thrust mode to revert to SPEED from THRUST IDLE at Vls + 4kts (if I recall). The sudden increase in thrust to re-capture the managed speed is very surprising, and tells the passengers that something happened up front. Deadheading Airbus guys will know. The key is to either turn off BOTH Flight Directors which causes the THRUST mode to revert to SPEED, or to disconnect the autothrust and increase the power manually.

The opposite problem occurs if one tries to control a speed problem by "disconnecting" the autothrust while leaving the thrust levers in the CLB detent. Can you imagine what would happen?!

Not activating the approach would be one more item of interest. Since this must be done manually on the FMGC, forgetting to do it means that a rapid thrust increase will occur when landing flap (Conf 3 or Conf FULL) is selected because the FMGC no longer has a speed reference for the approach, (it is still in the DESCENT mode) and so will go for the last speed it "knows"....250kts! I'm sure this was demonstrated in the sim, but if not, a swift retarding of the thrust levers to prevent an overspeed of the flaps and destabilization of the approach may rescue the situation and you can re-engage once things settle down and the approach is activated. Likely the best response is to go around but on the Quiet Bridge at SFO or the Visual onto 31 at LGA and other places, it may be a long time before you get on the ground. A go-around and a normal circuit and approach usually cost 400kg. At these places and others, it can cost more.

Sorry to drone on...this probably belongs on Tech Log forum, CONF iture.

Re recommendations to Airbus...I can say that FOQA information is invaluable in determining if there were any cases where A320 thrust levers were "split" at touchdown and if so, by how much and for how long. I would think that most airlines modified their SOPs to ensure that BOTH thrust levers were closed by touchdown and that no RETARD calls should be heard by the crew. There may even be a "SPOILERS UP" call now required, (was never called before).

As to why to high-time professionals left one thrust lever in the CLB position, that is a disturbing mystery - disturbing because by all accounts these guys were highly experienced, competent pilots with loads of time on the Airbus. In the time they had to analyze what was wrong, I'm not sure any warning would have been able to help.

My translation of p.115 (Portuguese as mother tongue, but living in the US for many years). I apologize for any incorrect technical term, but I never flew anything that didn't have a Rotax 912 in the "pointy" end.

To Airbus France SAS

It is recommended:

RSV (A) 168/A/07 - CENIPA Issued on Dec 28th 2007

The establishment of a landing procedure for A-320 aircraft defining corrective actions on the part of the crew, when ground spoilers do not deploy after touchdown.

RSV (A) 170/A/07 - CENIPA Issued on Dec 28th 2007

The optimization of the A-320 RETARD advisory (warning?) system, so that it will only execute the function for which it was designed, that is, to advise the crew to retard the thrust levers to the IDLE detent.

RSV (A) 174/A/07 - CENIPA Issued on Dec 28th 2007

The improvement of the actuation logic of those systems responsible for decelerating the A-320, so that said systems will take into account the crew's clear intention to land and will guarantee [the aircraft's] deceleration efficacy, even with the wrong positioning of the thrust levers.

RSV (A) 176/A/07 - CENIPA Issued on Dec 28th 2007

The evaluation of advantages and disadvantages of employing [thrust] reversers in the A-320, before the deployment of ground spoilers are verified (confirmed?), and the establishment of the most appropriate procedure from a Safety of Flight standpoint.

RSV (B) 27/C/08 - CENIPA Issued on Apr 18th 2008

The evaluation of any need to restructure the disposition (arrangement?) of documents within the A-320 manuals (FCOM?), making it easier to consult them, particularly in flight.

Cheerio.

CONF iture

Basically the investigators were unable to precisely determine the physical position of the thrust levers at the moment of the accident and so developed the two possibilities which were outlined during the press conference.

First hypothesis, equipment failure.

They looked at the possibility of the engine delivering a level of power that did not correspond to the position of the right thrust lever, giving climb thrust with the lever in idle. Airbus were asked about this and provided a mathematical probability of failure that was extremely low, essentially ending this line of thought. Not impossible, but unlikely.

Second hypothesis, pilot error.

They also examined the idea that the engine did what was expected of it and that the lever was left in the climb position by the crew. They produced a myriad of reasons as to why this could have happened, including modified procedures, lack of experience on type, authority issues, crew predisposition, and physical aspects (PIC reported a headache during descent). However, without the physical evidence of lever position the investigators were unable to state categorically that this was the principal cause.

On the subject of the recommendations passed to Airbus (which are an extremely small part of the total recommendations made) my impression from the press conference was that at least some of the TAM fleet have the updated software that provides a lever disagree indication, but that this particular airframe did not. IMHO the recommendations passed on to Airbus have little actual substance and as such the contribution of the aircraft systems to the accident seems to be minimized in this report, rightly or wrongly.

Of much greater concern are the recommendations made to TAM which cover almost all aspects of their operations and identify a number of significant failings within the company that contributed to this accident.

I haven't had time to do more than skim the report yet, so my initial views may be modified when I've read it in full.

PJ2, yes they had a lot of hours, but the pilot operating as co-pilot had very little time on the A320, and minimal recent experience in the role of co-pilot, points that were made several times during the press conference.

TTFN

RSV (A) 168/A/07 - CENIPA Issued on Dec 28th 2007
The establishment of a landing procedure for A-320 aircraft defining corrective actions on the part of the crew, when ground spoilers do not deploy after touchdown.

well in that case you don't have much choice but pray... If for some reason automation has decided you don't deserve ground spoilers (and auto braek for that matter) there is no way to overrule it. Given that you have probably eaten a good part of the runaway and unless a major redign of the AB logic your last "corrective action" will be to choose which obstacle will stop the run-over...

To the defense of AB it is indeed hardly conceivable that any crew - let alone an experienced one - would land without retarding both levelers. But it happened (maybe more that once ?) and at that time they where doomed.


RSV (A) 174/A/07 - CENIPA Issued on Dec 28th 2007
The improvement of the actuation logic of those systems responsible for decelerating the A-320, so that said systems will take into account the crew's clear intention to land and will guarantee [the aircraft's] deceleration efficacy, even with the wrong positioning of the thrust levers.

Again not an easy one but I'm still convinced that putting in that "big red stop button" might do more good than bad (although I'm sure it might also cause accidents by itself). The simple thought of not being able to decelerate a perfectly working aircraft just because the computer decided so (be it for crew mistake or sensor problems) is not acceptable.

A simple SOP of ensuring spoiler deployment BEFORE actuating reverse would retain the g/a option. There is far too much haste (in Boeing as well) in deploying reversers.

I apologize for jumping in, but I reviewed several of these thrust reverser accidents. To date, there have been three almost identical accidents:
Mar 98, PAL 137 @<hidden> RPVB
Oct 04 TNA 536 @<hidden> RCSS
jUL 07 tam 3054 @<hidden> SBSP

Personally, I find it incredible that one pilot would not pull both thrust levers back to idle during the flare. Airbus has a unique design where the T/L's do not move during an autothrottle approach -- however the pilot is reminded by an automatic voice commend ("Retard," which leads to many jokes.) But I can't understand why anyone would only pul one back. However, one can call it "pilot error" if one does it. The second instance calls this term into question. When we have three, I don't think we can continue to call it "pilot error."

One of the problems is the explanation given. I reviewed the TAM FCOM discussion following the Sao Paulo accident. The description several lines and I found it hard to read. I had to read it two or three times to see what they were saying. It appeared to be written in French, machine translated to German and then translated into English to be read by a non-native English speaker. (see the pattern in the accidents.)

Part of the problem is that it doesn;t really matter if the pilot pulls both into reverse on only the operating reverser. The FADECs will keep an inop T/R from being engaged. Unfortunately, the procedure keeps changing. One month the drill will be only pull the operating T/R back (into reverse) and the next month it will be pull them both back.

There was a related accident in Phoenix in Aug 02. The pilot pulled both into reverse, then remembered that the procedure was to only pull the operative T/R back. He pushed it back up -- unfortunately into enough forward thrust to cause a runway departure.

There are a number of fixes proposed -- the one that was chosen was to to put an annunciation on the ECAM and continue the "Retard" call until both were pulled to idle.. I don't know if this was mandated.

Personally, I would rather see the issue made moot by making it impossible to get one in reverse and on in significant forward thrust.

Sorry for the soapbox.

Cheers

I had a very similar experience as a junior skipper on the 320 a long time back but it's still clear in my memory - lucky in my case the runway was long.

One T/R deactivated, F/O flying, CAVOK but dark night/ cockpit. Reminded him at 1,000' of the deactivated T/R - maybe not a good thing - multi-cultural cockpit, low time FO, he reacted (I didn't see) by lifting his hand off that TL. At the Retard call he only closed the one TL, the other remained in the Climb detent. It was only at about the sixth Retard bleat and observing a clearly asymmetric condition that I realized things were amiss, took control, closed the other one and kept it on the paved surface.

Should we have gone around? Retrospectively no - the spool up time on the engine that was retarded would have proven potentially disastrous.

There, but for the grace of God, go I.

Why is so dificult for engineering to "teach" computers some simple logic, like if you have weigh on wheels, at least one TL on reverse and the pilot applying the brakes, the pilot wants to slow down?
Give the pilot spoilers, cancel the order coming from the TL not in reverse and "refuse" to give power to that engine.

I know it is hard for a computer understand why the pilot wants to stop if he continues whith one TL on climb.

On the other hand, it should be even harder for the computer understand why the pilot wants to go around with one engine engaged on reverse.

Maybe the computer could say: "Whow, this guy wants to fly with one engine on reverse. Since we are on the ground anyway, I will cut thrust on the other engine, deploy spoilers and apply full auto brakes. This guy can try this stunt another day, not with me supervising (or protecting) him...

One of the tenets of Human Factors or Safety Engineering is that the best way to prevent accidents is to make the hazard inpossible to cause an accident and the least effective way is to rely on training.

I can't think of a single reason why anybody would want one engine in climb thrust (or a significant amount of forward thrust) and one in reverse. I've asked around and no-one I've spoken to can either. Therefore, make it impossible to place (or keep) one in reverse if the other is in forward thrust above idle.


Cheers,


Dick

I'd like to discuss the circumstances with you, if you would. You're one of the surviving pilots on this type of problem.

Cheers,


Dick

Maybe the computer could say: "Whow, this guy wants to fly with one engine on reverse. Since we are on the ground anyway, I will cut thrust on the other engine, deploy spoilers and apply full auto brakes. This guy can try this stunt another day, not with me supervising (or protecting) him......as they plow into the aircraft/vehicle that inadvertently enters the active runway.

only way, you can prevent such an accident is:

manual flight-manual thrust

when you control the throttle levers manually you know in which position they are. manual flight-automatic thrust is very dangerous and in my airline(european main carrier)forbidden.

4-holer poler: interesting contribution. I would tend to think that although rare this is not such an uncommon situation as one might think (asymmetric thrust leveller at landing). Fortunately most would catch it before it's too late.


This should warrant some more investigation by AB and some redesign of the automation logic.

Personally, I find it incredible that one pilot would not pull both thrust levers back to idle during the flare. Airbus has a unique design where the T/L's do not move during an autothrottle approach -- however the pilot is reminded by an automatic voice commend ("Retard," which leads to many jokes.)According to the report, TAM had not updated the FWC to H2F3 standards. Hence the "Retard" call out stopped with only one of the levers in the idle detent. H2F3 was developed as a result of both accidents you mention. However, it came out as a SB, not an AD.

Cheers.

ULMFlyer and alemaobaiano, Obrigado for your help.


All I can see is the obvious failure of a system : The BEA should be a leader in the continuous research of SAFETY but instead they show their total inbreeding with Airbus.

Page 118 "Furthermore, the BEA thinks that the Congonhas event was not foreseeable"
Page 119 "Since the accident, Airbus has been studying new corrective actions to take in account this scenario, which is now known"

How do they dare writing that after Bacolod and Taipei ???

Already after the first accident there was a very simple modification to be applied on the RETARD callout logic to help to prevent a recurrence !

Now, as a recommendation in that direction is done once again (170/A/07 on page 115 ) Airbus simply choose to ignore it in its comments.
It is disconcerting.



Help again : In the present report, any further specific detail on what does include the FWC (H2F3) standard except the triggering of a specific warning associated to an ECAM message ENG X THR LEVER ABV IDLE ?
To my knowledge, it does not feature a modification in the RETARD callout logic (?) which is the purpose of the recommendation 170/A/07.

Help again : In the present report, any further specific detail on what does include the FWC (H2F3) standard except the triggering of a specific warning associated to an ECAM message ENG X THR LEVER ABV IDLE ?To my knowledge, it does not feature a modification in the RETARD callout logic (?) which is the purpose of the recommendation 170/A/07.
I had been under the impression that H2F3 did modify the callout logic. However, I just reread the relevant parts of the report and this is apparently not so. (The report actually reads a little ambiguously in Portuguese, but it became clearer when I was translating the relevant section on p.48 into English).

In any case, the only reference to H2F3 modifications is indeed in regard to the ECAM msg. So, I suppose you're right with respect to recommendation 170/A/07. However, another criticism in the report that also applies to this recommendation is the fact that this callout will still sound even after both levers are already in the IDLE detent, say, at 10 ft AGL during flare. In the eyes of CENIPA, the callout is not serving its purpose if it doesn't recognize that both levers have already been retarded, and this ends up leading to some complacency on the part of flight crews.

Hope this helps.

Dick Newman said:

There was a related accident in Phoenix in Aug 02. The pilot pulled both into reverse, then remembered that the procedure was to only pull the operative T/R back. He pushed it back up -- unfortunately into enough forward thrust to cause a runway departure.

Dick, that's not quite right. Here is an excerpt from the NTSB report (NTSB Identification: LAX02FA266).

Note - the #1 Thrust Reverser was MEL'd.

The captain was the flying pilot for this leg of the flight and the airplane touched down on the centerline of the runway about 1,200 feet beyond its threshold. The captain moved both thrust levers into the reverse position and the airplane began yawing right. In an effort at maintaining directional control, the captain then moved the #1 thrust lever out of reverse and inadvertently moved it to the Take-Off/Go-Around (TOGA) position, while leaving the #2 thrust lever in the full reverse position.

The thrust asymmetry created by the left engine at TOGA power with the right engine in full reverse greatly increased the right yaw forces, and they were not adequately compensated for by the crew's application of rudder and brake inputs.

I figure that any aeroplane will spear you off the runway with that sort of thrust asymmetry.

All I can see is the obvious failure of a system : The BEA should be a leader in the continuous research of SAFETY but instead they show their total inbreeding with Airbus.

Page 118 "Furthermore, the BEA thinks that the Congonhas event was not foreseeable"
Page 119 "Since the accident, Airbus has been studying new corrective actions to take in account this scenario, which is now known"

How do they dare writing that after Bacolod and Taipei ???

CONF iture, as they acknowledge Bacolod and Taipei in the very next paragraph I don't see that they are saying anything outrageous. They point out that TAM didn't have H2F3 and that the revised procedure wasn't followed, neither of which can be laid at the door of Airbus or the BEA.

I notice that you are concentrating on the technical issues with Airbus, but from my point of view the report raises many more concerns about TAM. As a frequent flier here in Brazil facts such as a failure to follow basic procedures (three different techniques in the last three landings?) do not exactly fill me with confidence when I board a flight.

TTFN

Alemaobaiano,

This is why I don't fly TAM, they are specialists in "short cuts" on training.

I heard this from pilots who quit flying TAM for this reason (not adequate training).

I like GOL's method, in the cockpit we can always see an "old" pilot and a "kid". When the kid is flying, the old captain has his eye on him.
When the old captain is flying, the kid watch and learn.

Just like with maintenance, where they never install two engines with the same flight time...

abs,
Rob

Sorry, I implied, but didn't state it was due to asymmetric thrust.

Cheers


Dick

They're not my favourite airline either Rob, I too have heard similar comments from TAM pilots, something that I don't hear as much from those at other companies. However I am sometimes obliged to fly TAM for business reasons, so I can't cut them out completely.

TTFN

Dick - my reply was not intended to extract an apology from you.

I didn't take it that way.

Cheers

CONF iture, as they acknowledge Bacolod and Taipei in the very next paragraph I don't see that they are saying anything outrageous. They point out that TAM didn't have H2F3 and that the revised procedure wasn't followed, neither of which can be laid at the door of Airbus or the BEA.
Don’t you think it’s outrageous to pretend that Congonhas was not foreseeable when you know what happened in Bacolod and Taipei ?

They acknowledge Bacolod and Taipei but outrageously pretend that Congonhas was clearly different.
How was it different ?

All of these accidents are a direct consequence of pilots forgetting to place in the IDLE detent the thrust lever corresponding to the engine whose thrust reverser was inoperative

As early as 98 after Bacolod, the Philippines investigation team clearly identified that the RETARD callout could cease without having both thrust levers in idle detent (page 8 of the Philippino report)

Six years later, after Taipei, the Taiwanese investigation team made the clear recommendation to Airbus Company (page 102 of the Taiwanese report)
Reviewing the design of stop mode of Retard warning sounds or accommodating other warning methods to ensure that the warning will
continue before the thrust levers are pulled back to Idle notch after a touchdown has affirmed

The H2F3 response is totally inappropriate.
Who need another ECAM message when the obvious logical answer is simply to not cease the RETARD callout as long as both thrust levers are not on the IDLE stop.

Now – The similar recommendation is signified ONE MORE TIME to Airbus France SAS
RSV (A) 170/A/07
The optimization of the A-320 RETARD advisory (warning?) system, so that it will only execute the function for which it was designed, that is, to advise the crew to retard the thrust levers to the IDLE detent.

What is the BEA comment on recommendation 170/A/07 ?
NOTHING – ZERO – They just ignore it – Far more easier to flee than to have to face the fact.

All I can read is on page 119
Since the accident, the manufacturer has been studying new corrective actions to take into account this scenario, which is now known
Aside from the fact that the scenario was already known before, we would like to know what will be these corrective actions ?
What about a modification of the RETARD callout … finally ?

I am not in a position to dispute your concerns on TAM but all I can say is :
TAM was not involved in Bacolod
TAM was not involved in Taipei
I don’t think 4HolerPoler was working for TAM at the time (http://www.pprune.org/rumours-news/394232-tam-3054-report-released.html#post5291234) (?)



To resume :

Total lack of discernment on the part of Airbus.
Obvious submission of the BEA.

What to expect now from AF447 'investigation' … !?

What to expect now from AF447 'investigation' … !?

If one is to go on previous experience, then I fear, unfortunately, very little.

CONF iture, you make a strong case for the sorry state of safety in our industry, but perhaps a bit one sided.
An accident investigation authority can make recommendations to a manufacturer for system change; these may or may not be accepted.
Changes can be proposed and mandated by the certification authority, although this action is unlikely without consultation with the manufacturer and more usually with other certification agencies.

The manufacturer did advise operators of the accident and the most probable cause; previously modifications had been proposed but not universally installed.

The industry and each operator have responsibility for maintaining safety, and thus with knowledge of previous problems, modification or procedural action could/should have been taken.

How was Congonhas different; for the reported conditions a normal operation may have had marginal landing distance safety factors. If the runway was flooded, then with CS25 rules, reverse could be claimed, but if not available then the landing should not be attempted.
We do not know what the crew knew or decided before landing, but on scant evidence there appears to be erroneous contributions from both the human (crew) and the wider organisational system.
We should not focus on a single entity for blame – fundamental attribution error. Nor be influenced by hindsight bias; a more open view might be that the industry still has much to learn from accident investigation and who and how remedial activities are implemented.

“You can take a horse to water, but it may not drink.”

Why System Safety Professionals Should Read Accident Reports. (www.cs.virginia.edu/~cmh7p/iet2006-reading.pdf)

What Can You Learn from Accident Reports? (www.tc.gc.ca/civilaviation/publications/tp185/3-07/Pre-flight.htm)

CONF iture

What was foreseeable was that an accident at Congonhas would happen, we had enough close calls prior to JJ3054 involving 737s and an ATR. The BEA position seems to be that:

1. TAM was well aware of the previous incidents
2. TAM knew about the modified software (not fitted due to cost)
3. TAM had adopted modified procedures as recommended (not used on this occasion)

So the BEA assertion is not unreasonable IMHO. Right or wrong is an entirely different question.

TTFN

The core issue as far as human factors is concerned,is a preocupation with not using rev thrust on deactivated side.Except in the case of a fuel leak,there is no prohibition on moving both thrust levers to reverse.In the TAM scenerio another factor was the transition capts prior experience on boeing 757s which ofcourse has much larger thrust levers.
The Yaw on the 320 with only one thrust reverser deployed,is easily managed.
So the problem is created when people over anticipate a minor control issue,and overcompensate.
The 320 is a very docile and easy a/c to fly,even with low experience on type.You (or the Automation)can easily deal with any kind of assymetry throughout the flight envelope.
So training Capts need to emphasise this to pilots transitioning from other types,that they need to relax and deal with control issues only if and when these arise, as too much anticipation(which might be required on conventional a/c) can actually be counterproductive,in a fly-by-wire a/c like the 320.
Even though she is a conventional a/c in direct law during the Take-Off or landing roll,the a/c has been easily controlled by normal line pilots on at least one case of actual thrust reverser deployment on Take-off(due incorect deactivation by engg,and subsequent ignoring of "NO GO ECAM")and many cases of engine failure on the old V2500 A1 engines.

Safetypee
You propose here really great reading.

May I understand I am part of the exception, not being an accident investigator and certainly not a lawyer, I still have natural interest in reading accident reports and so, on a regular base.

Focusing on a single entity for blame is not my intention but applying some farming logic to suit the ICAO Annex 13 would be more my register :
The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability.
In this context, the BEA is completely beside the point, and I believe it to be intentional.
How would they miss the repetitive recommendation addressed by the three different accident investigation authorities which had to deal with Bacolod, Taipei and Congonhas ?
Should we consider they are wrong the same way in Philippines, Taiwan and Brazil ?
Or could these places be far enough from Toulouse to still afford to apply and demonstrate common sense … ?

TAM knew about the modified software (not fitted due to cost)
Notwithstanding the fact that the modification is unadapted to this specific flight phase, I just find it over the top that the introduction of a brand new ECAM WARNING MESSAGE was and still is proposed merely as an option ???

To Airbus and to the concerned Authorities:
Just scrap that phony message and impose the awaited RETARD callout modification.
You will fulfill Annex 13.
You will save LIVES.

CONF iture, I don’t think that we share the same view of the responsibility of BEA (or other investigators) in this matter.
The primary responsibility for the investigation was with the state where the accident occurred; the state of manufacture/certification will be invited to help as will the manufacturer.
It is most unlikely that the investigators will have the authority (in law) to mandate design changes. Thus, your criticisms in the first instance should be made about the Brazilian authorities for the investigation, and EASA (or FAA) for the design and certification of changes.
I agree that the industry must not seek blame, and that it serves no purpose for improving safety. What this accident and the subsequent events (non actions in your argument) have shown is the weakness of the industry’s ability (regulators to operators) to learn from previous accidents.

You may have overlooked possible difficulties in achieving an adequate solution. System changes must not result in other opportunities for error and thus several alternative modifications might have to be considered. A change to procedure or automated callout might be a quick fix, but suffers weaknesses of human involvement (which you/others suggest would remain a problem). An engineering fix might be more complicated and could take time to prove and implement.
Also, as has been debated in this forum, what is the role of the pilot, how much can or should be expected of humans, particularly in stressing circumstances which may be of their own making.

Conceptually, is manually retarding thrust levers in the Airbus any different from other aircraft; the system may be different, but the concept of human involvement should not be. The various views in this area could lead from one extreme - a completely automatic aircraft to the other, requiring pilots to action everything. We have to remember, either that humans can be viewed as the cause safety problems, or that they provide the most flexible solution; ... or both.

I think that you should reconsider your criticism of BEA and Airbus – they are not the directly accountable agencies, nor do those people who work in these safety areas deserve to be cited with ‘intentionally’ delaying safety.
Our industry trusts people; we trust our crew members, we trust the aircraft designers, so too must we trust the investigators and regulators to take appropriate action.
Accidents stir many emotions, and the apparent lack of action is frustrating, but IMHO the industry has a very good system of airworthiness (still subject to human error), and there are people who can and will ensure that those accountable for action will act; it just takes time. Meanwhile operators and pilots can learn from the mistakes of others and heed the weaknesses of system designs.

http://www.caa.co.uk/docs/33/fod200732.pdf 15 Nov 2007

Safetypee,very well surmised.
Even the best designed systems have flaws or "traps" we can fall into,given a particular set of circumstances or our "baggage" of previous experience.
It is the role of the Training set up to identify and highlight these possible pitfalls....and stress which part of ones "baggage" can be usefull in flying a new type and which parts need to be "deleted" from the memory.
And Training Capts need to note that this "expertise" cant be found in the books,as the manufacturer can hardly be expected highlight his own design flaws.The only clue is the MODs which might sometimes be made after the fact.
And IMHO they have not nailed them all yet.

Page 46 of the report (with picture)

http://www.cenipa.aer.mil.br/cenipa/paginas/relatorios/pdf/RF3054.pdf

Os sensores que registram a posição dos manetes de potência no gravador de dados do vôo (FDR) estão localizados no TCU e não diretamente nos manetes de potência

Translating:

The sensors that record the TLs position for the FDR are located in the Thrust Control Unit and not at the TLs themselves

Note: When the report states "not at the TLs themselves" it probably means "not at the TLs quadrant or at the Artificial Feel Unit"

safetypee

Investigators don’t have the authority (in law) to mandate design changes, but they do have the mandate, even the duty, in the pursuit of accident prevention, to make recommendations, and that’s what the Brazilian authorities for the investigation have done, so no criticism to them.
Actually they have made one specific recommendation, and it appears the Taiwanese authorities had already made that very similar recommendation :
DO NOT STOP the RETARD callout before ALL thrust leverS are fully retarded

What could justify that the BEA does not take up this recommendation in its behalf ?

They feel the need to comment on many points but meticulously avoid to address this specific issue (?) That’s where I DO BLAME the BEA.
By their recommendations, they would have the power to put pressure on certification agencies, regulator agencies and manufacturers.


I’m afraid you put things more complicated than they are :
A simple modification of the RETARD callout logic has not much to see with an hypothetic and probable overcomplicated engineering fix …


Just one more question.
In reference to Bacolod, Taipei, Congonhas … how would you answer the following statement ?

To not cancel the RETARD callout at the time one thrust reverser was selected would have :

Prevented these accidents.
Helped to prevent these accidents.
Had no effect.
Been a nuisance.

CONF iture,

To answer your little quiz, "A" is the most likely answer, but even if it were "B" or "C" it should be done.

This type of accident really bothered me at my last position with a regulatory agency. Personally, I was flabbergasted that the scenario played out once. I can't imagine not pulling both engines to idle. The rationale behind the "Retard" call was to remind pilots to pull the T/L's back in the normal situation.

However, it it happens once, we should rethink the problem. If it happens twice, we must do something. A third or fourth time should never be allowed to happen. If I'm to believe this thread, it's happened more times than we know.

I had little luch with my former employer to correct this situation. The refrain was "stupid pilot." Even our operations inspectors would say "Well, I'd never do that."

It is axiomatic in human factors and in safety engineering, that the best way to prevent accidents is to make it impossible. This means there should be no possible way to have one engine in significant reverse thrust and the other engine at significant forward thrust. -- don't let one engine into reverse unless both T/L's are near idle.

The second best way is to warn. That's what the new Airbus mod to the software does.

The present status is to rely on pilot training. It seems clear to me that this approach isn't working as well as it should.

Sorry about the ranting -- I've been to close to this one.


Dick Newman

Hi,


Prevented these accidents.

I support that.