TAM A320 crash at Congonhas, Brazil [Archive] - Page 8

PBL

17th Aug 2007, 04:37

I don't know whether others have a similar impression to mine, that the discussion seems to be spinning its wheels now. Part of it may just be length - 1,800 messages is a lot to go through to see what was noted already and what was not.

But I must say I am not finding the discussion here of ergonomics and cognitive psychology of much help in furthering my partial understanding of this accident. I understand that stories of the sort "they would have seen this, and then they would likely have been thinking this, and then ...." are of use in seeing how one might oneself react in similar situations, but they are of limited use in explaining the accident, or in figuring out how we may change things to avoid a repeat, since there are lots of such, differing, stories and we have no way of deciding between them.

I find others of the ergononic arguments equally unpersuasive. For example, STS provides us with a Boolean expression equivalent to the condition for spoilers to be deployed, and asks us if we imagine we can understand it quickly, but fails to argue why we must judge *this* formulation rather than some other. Lemurian correctly points out that there are other, equivalent, expressions that are cognitively more straightforward to understand.
Others try to identify some "gotcha" in the spoiler operation, and fail to persuade the Airbus pilots amongst us of their point. There are two acid tests of a gotcha: either the operators agree with you, or it recurs regularly in operations. Well, the operators don't agree; what about regular recurrence? As far as we can tell something similar has happened once, maybe twice before (and we won't be able to decide that, because the one report was so sparse). Bit thin on that criterion too, it seems.

There are some pertinent ergonomical observations that don't seem to have surfaced yet. People have been talking about the braking systems and the (complex or not-complex) trigger logic, as well as evoking principles of cognitive simplicity (or complexity). But no one has yet observed that, when landing with autobrake armed, braking is cognitive simplicity itself. Your braking is concentrated in one control: your thrust levers. Pull them back, you brake; don't pull them back, you don't brake. And if this doesn't work (you don't get the "decel" light), you stomp on the pedals. It couldn't be simpler, could it?

If one is being honest about trying to figure out the ergonomics of the situation, one must take this simplicity into account when weighing up, say, whether to encourage people to grab for the spoiler handle if things aren't going right (by giving it a supplementary function on rollout which it currently does not have). My inclination would be to maintain the simplicity, and not give people lots of other options to think about in the time-constrained, critical phase of touchdown and rollout.

But what happens when this setup doesn't work? Short, slippery runway, maybe? Well, can we figure out what is "short" and what is "slippery"?

Sort-of-maybe. We can have a go at guessing parameters of "short"ness (say, length of runway needed to perform all SOP actions) "slippery"-ness (say, using rate of deceleration). For example, we can try to figure out if the TAM aircraft would have stopped had manual braking been applied ASAP. A ball-park guess would proceed along the following lines. Take the demonstrated acceleration on application of brakes, which I estimate to be about -1.26 m/s/s, and figure out how long it takes to stop from a touchdown speed of 70 m/s. (Remember calculus? Integrate a = -1.26 with respect to time to get v = -1.26.t + v0, put in v= 0 and v0 = 70 to get t, integrate again s = -1/2.(1.26) t^2 + v0.t, put in v0 = 70 again and the value of t you have just calculated).

This gives me something just over 1940 m, so the answer is probably no, it is unlikely they would have stopped. (Please don't forget this is ball-park - a good analyst will wiggle the input numbers some to see how much the answer changes, and will also not forget that constant acceleration is an approximation, but a pretty attractive one remembering the lengths to which ELAC had to go to try to estimate braking performance taking more parameters into account.)
So then one might ask at what speed they might have gone off the end. Here is how one might do that. One guesses where touchdown would have occurred (displacement from the threshold), subtract from LDA, put that distance for s in the quadratic equation above, use the Quadratic Formula to solve for t, and substitute this value of t back in the formula for v to solve for v. Say we use an s of 1600 m, meaning with an LDA of about 1880 m we are saying they touched down at about 280 m beyond threshold. Turns out to give about 30 m/s or 60 kts.

We can wonder what might have happened then if the aircraft had belly-flopped onto the road, remembering Kegworth and how many people survived that, but I think the game of "what if" gives out here, given that they still had quantities of fuel.

I think the more pertinent conclusions lie in asking how such calculations might affect operations. Acceleration of -1.26 m/s/s is degraded braking, certainly (autobrake LO has a target of -1.7 m/s/s [Edit: I changed "MED" here to "LO" after my mistake was pointed out by TripleBravo]). How often does one get that kind of degraded acceleration? Under what conditions? Never? Once in how often? Once in too-often? And at distributed airports? Or just one or two? Some data-mining in the FOQA readouts could maybe give guidance. So, for example, you find that at airport XYZ it has happened M times in N units of operation. So now you look at the LDA at XYZ, do the ball-park calculation as above to figure out how much room you need (and don't forget that couple of seconds for a leisurely application of braking after WoW) and maybe alter your ops accordingly. Maybe quite a few operators are now doing exactly these sorts of calculations.

Which, incidentally, they would not be able to do if we couldn't estimate the mean braking effectiveness but had to wait (a year? more?) for the official report. (PJ2 reminded me privately of a short note I wrote in the Risks Forum on this over a decade ago http://catless.ncl.ac.uk/Risks/18.44.html#subj4.1)

BTW, for those who haven't noticed it, there is a major difference between the Warsaw overrun accident and this one. At Warsaw, there was nothing the pilots could do to get the braking they needed. To my mind, that is why there was a deep discussion about, and a change in, the braking logic. As far as we know so far, that isn't the case in the Congonhas accident, or in its putative analogies.)

I am also somewhat sceptical, as others here (such as Lemurian) about adding warnings, such as that suggested in the Taipei-Sungshan report. Given that there is one braking control in this configuration, namely the thrust levers, and given that pilots have not responded to a *very specific* suggestion to activate it ("Retard"), one may wonder what would lead one to think that they would then respond more appropriately to a *general* warning (CRC, red master warning light), or whether the general hullabaloo would not be more likely to distract them further from the task at hand.

PBL

Dani

17th Aug 2007, 05:27

PBL, your reasoning is perfect to the detail and leaves nothing unaccounted, except the facts:

Please read the FDR readout:

At flare point, TL1 goes to idle, TL 2 stays in CLB
EPR1 goes to idle, EPR2 goes up to 1.3 and stays at 1.2 until impact.
Speed is evenly deccelerated from touchdown speed to 90 kts where it impacts.

So, forget all the far fetched theories about slipperyness, autobrake and TL potentiometers and faulty here and faulty there.
It is clear to the open mind that the TL2 remained at CLB detent, thrust never reduced, they got therefore no spoilers and no reversers, thus they never made it.

The only question that is valid: Why did he do it? I think, it's because he thought that you shouldn't touch that TL if there is something wrong with this engine. There is no other reasonable explanation for it.

The technical data is perfectly consistent and absolutly logical. This is not a technical reason, it is a CRM and a psychological reason. We have to concentrate on the human aspect (and its connection to cockpit technology) of this accident. Nothing else.

Dani

armchairpilot94116

17th Aug 2007, 06:48

re Dani

I tend to agree. Sometimes the most plausible and simplest reason IS the correct one.

PBL

17th Aug 2007, 07:03

Speed is evenly deccelerated from touchdown speed to 90 kts where it impacts.

Nope. Don't agree. The speed curve after 48:36 has a different slope from the segment before 48:36, which was the start of full manual braking.

I also don't agree that the speed goes to 90 kts on the graph.

PBL

clearedtocross

17th Aug 2007, 08:23

The only question that is valid: Why did he do it? I think, it's because he thought that you shouldn't touch that TL if there is something wrong with this engine. There is no other reasonable explanation for it.

The technical data is perfectly consistent and absolutly logical. This is not a technical reason, it is a CRM and a psychological reason. We have to concentrate on the human aspect (and its connection to cockpit technology) of this accident. Nothing else.

Exactly Dani,
I came to the same conclusion long time ago (re post #1027), but I had to recognize that pilots would rather have a technical discussion than considering human issues:)

GearDown&Locked

17th Aug 2007, 08:29

Although a 30 minute loop would probably not give us the landing briefing, I am puzzled by the 'missing' 20 minutes on the CVR? Anyone know where it went?

BOAC asks the right question.

From a different perspective it seems we are all being "led" to speculate on specifics details of this accident. These information leaks are too obvious for my taste.

I have some questions regarding the CVR transcript we had access:
-Why are we getting the "engrish version"?
-What was the PA made to the pax.
-Why did the FA asked if Congonhas was their destination? Wx or tech prob or both?
-after we are shown the first 2 minutes, it all went strangely silent (or someone kept it from expert eyes) for the following 23 minutes until suddenly HOT-1 wakes up with the startling words "REMENBER, we only haveone reverse". A bit odd don't you think?
-and then the final 5 minutes where you can even see the ATC words, the chimes, the Retard calls, even the sighs... but during 60% of the last half-hour is all silence. Who are they tring to fool?

Although I enjoy the logic /operation / psychological discussions produced on this thread (and I'm very pleased for being able to contribute) I have this strange feeling that we are being led to conclusions. And I don't like it at all.

GD&L

BOAC

17th Aug 2007, 08:40

Re: the CVR. It could be that there is 'chatter' on there which is best away from the public - who knows? Even with the full tape we will almost certainly not have the landing briefing which would normally take place around 30-45 minutes before landing. At least, unless the tape is damaged, the investigation teams will have the whole tape, and they, 'Dani' and 'clearedtocross' are the only people who can try to decide the cause, and there may well be something in the missing minutes which is important and not releasable at the moment. It would be interesting to have a Portuguese version of the transcript as mentioned before since there is doubt about the double translation of some of the words used.

Tempting as it may be to allocate an 'HF' cause here, ALL avenues must be thoroughly explored. It has always been easy to blame a dead crew,

PBL

17th Aug 2007, 09:59

Tempting as it may be to allocate an 'HF' cause here,...

There are, obviously, at least two root-causal factors in this accident and, equally obviously, one of them is not crew-HF related.

This is true even before one starts thinking about cockpit ergonomics, procedure design, and so forth.

Some of the last few posts have been speaking as though there might be just one. I hope that was just a matter of injudicious rhetoric, and not reflecting what people really think.

PBL

Dani

17th Aug 2007, 12:17

Nope. Don't agree. The speed curve after 48:36 has a different slope from the segment before 48:36, which was the start of full manual braking.
I also don't agree that the speed goes to 90 kts on the graph.

Then we have a problem here. You really want to tell me that there isn't a constant braking and that it does not stop at 90 kts? Are we talking about the same graph? Are you maybe looking at the graph of the previous flight?

Anyway, braking is absolutly irrelevant. We know that he left the runway with nearly 100 kts. This is because engine 2 was still thrusting with approach power. Can we agree on that?

All data is absolutly consistant with the only mistake this crew ever did: They never retarded TL 2.

That's what the Airbus guys realized immediatly (not after 2000 posts!!) and gave out the clear and unmistaken memo to all Airbus pilots: "At this stage of the investigation, and as already indicated in the previous AIT n°3, Airbus remind all operators to strictly comply with the following procedures:
A- During the flare at thrust reduction select ALL thrust levers to IDLE.
..." [end quote]. It could not be more precise.

Please stop all theories about what could have gone wrong inside the thrust quadrant aso, the only discussion we should continue is to why the CM1 left TL 2 in CLB detent and what ergonomic improvement could be done to avert another (a third or even more) case.

Dani

bomarc

17th Aug 2007, 12:25

Danl

so, why prior to this crash, hadn't that Airbus statement about retarding BOTH thrust levers been trained into every pilot?

If it were so well understood, why did they have to say it again? was there some room for misunderstanding in the aircraft manual?

NigelOnDraft

17th Aug 2007, 12:30

Dani... Please stop all theories about what could have gone wrong inside the thrust quadrant aso,Agreed... whilst the "theory" route I am sure will be examind by the pros, let's leave it to them. It is surely only a small probability?
the only discussion we should continue is to why the CM1 left TL 2 in CLB detent and what ergonomic improvement could be done to avert another (a third or even more) case.I am not sure we should discuss this in too much depth without the appropriate qualifications / training. As for "what ergonomic improvement... " I again do not believe much needs to be done. It has been addressed by the MEL change, and the timing of that change, and/or promulgation seem unfortunate to say the least :{

AFAIK there have been ~3 recorded instances where the failure to retard did, or might have occurred (2 x accident, 1 x experience early in this thread?). All were operating under the (now changed) MEL for 1 T/R Inop. So amongst millions of Airbus landings, we have ~3 exhibiting a common "HF error" all with one other "factor" which seems to lead to the error. Remove that factor (now done) and the driver for the "error" seems to have gone. In fact, one better, the new MEL (select full Rev on both) also improves / changes the logic trees...

I am sure there will be many other recommendations / lessons in the Final Report, but as you say, I think the Airbus advice from shortly after the accident cures the basic root causes...

NoD

marciovp

17th Aug 2007, 12:37

In Brazil there are more than one group investigating the accident and they are not necessarily people who understand aviation. We have two CPIs (House and Senate Committees), the Federal Police and of course the Air Force (CENIPA) the agency that investigates aiming at prevention. Today in the newspaper Estado de Minas it says that the Federal Police investigators believe that the cause of the accident was not human error because they have interviewed more than 20 pilots and the vast majority said that it was impossible that the two pilots would leave the right motor T/L without moving it to idle. They now want to know from TAM if some maintenance on that plane was done on the day of the accident when the plane flew first from Belo Horizonte to Congonhas with one crew and then from Congonhas to Porto Alegre and back with the new crew that died in the disaster.

NigelOnDraft

17th Aug 2007, 12:38

bomarc so, why prior to this crash, hadn't that Airbus statement about retarding BOTH thrust levers been trained into every pilot?
If it were so well understood, why did they have to say it again? was there some room for misunderstanding in the aircraft manual? All pilots are trained to retard all TLs on landing. It's rather a "given"... The Airbus goes one further with the "Retard" call due to it's non-moving TLs...

They had to say it again because it seemed to them obvious that this crew had not (as with the other) from the FDR. It is not the manual at fault, it is the "failure" (understandable IMHO) for the MEL advice not to select Rev to be understood in an HF way as leading to the chance the TL would remain in CLB.

It is incredulous to me, and no doubt many, that any pilot would leave the TL anywhere other than idle. However, it seems they did, as have others with this MEL. We are therefore into Human Behaviour factors, and let's leave the trick cyclists to delve into this. Humans are complex and make mistakes - predictable which we train for - and unpredictable, as probably here.

As above, I think the door has been closed on this one now... shame the previous accident was not better / more quickly analysed / publicised.

NoD

bomarc

17th Aug 2007, 12:45

marciovp's post needs to be answered...was mx work done on the plane prior to takeoff on the accident flight.

ambiguity in the MEL's language must also be investigated...going from french to porteugese must offer its own challenges.

clearedtocross

17th Aug 2007, 13:18

BOAC, indeed it is most likely that there was not a single hole called HF in the cheese.

But after reading nearly all the posts, most of them dealing with the logic of the airplane, some blaming the manufacturer, some defending, some highly technical, it just seems justified to point to one main factor: An essential and very basic manipulation, the retarding of one TL was not carried out by the crew.

This statement is not meant to overtake any investigation based on knowledge not available to this community and sorted out by true specialists. And most certainly it has nothing to do with blame.

I wonder why the simple reference to human factors immediately calls for an association with blame? Blame - at least in my opinion - is reserved for people acting careless or outright reckless. Human factors is not about blame, even if one accepts that a small part of Human Factors is about reckless behaviour. This is most certainly not the case in this accident.

But the HF issue is important, because it has feedback into other parts of the loop, like training, man-machine-interfaces, system logic and more. Therefore, HF probably yes, certainly no blame, and most important: learning for a lot of us. That's what I praise this thread for.

PBL

17th Aug 2007, 13:55

You really want to tell me that there isn't a constant braking

That's right, I do want to say that. Perform the regression for the points before 48:36, and then for the points afterwards. (Do I need to say: do it from the ground speed line?)

and that it does not stop at 90 kts?

Ground speed stops at 95 kts and airspeed a little earlier and a little higher.

Are we talking about the same graph? Are you maybe looking at the graph of the previous flight?

I guess it is possible that you are not working from the same graphs as I am, but I am more inclined to think the difference is that one of us is not as careful an analyst as the other.

PBL

Dani

17th Aug 2007, 14:16

PBL, you really make me laugh. Of course I'm not talking about exactly the correct value. You can't be a pilot, can you? Pilots are used to handle their tools by rules of thumbs and with approximations. Of course there are small deviations from a gradual deceleration. This is lawyer's stuff. Has nothing to do with aviation.

OK, it's 95 kts they left the runway, not 90, so they have been more dead???

Ridiculous...

Clearedtocross, excellent post. I couldn't say it better. Bravo! I think we can closed this thread.

Lemurian

17th Aug 2007, 14:53

Re: the CVR. It could be that there is 'chatter' on there which is best away from the public - who knows? Even with the full tape we will almost certainly not have the landing briefing which would normally take place around 30-45 minutes before landing.

It's a 2-hour loop recording.
WE should therefore have the whole flight on the CVR, bar damage, as you wrote.
Why am I, along with some people, interestred in the full CVR print-out - and in Brazilian - ?
It's because some of the big answers of this investigation lie in the way this crew functioned.
I have already hinted at the *unusual* or *particular* characteristic of this pairing, of which we only have fragmented and conflicting indications :
[LIST]
What was the RHS pilot real position with the airline ?
What we know is that he was newly hired, highly experienced on Boeing types, and generally regarded as a good and serious operator. Was it as a direct entry command (*), as a direct entry command on a transformation to TRI (**) or as a queue-of-the-list first officer.
why was he on the RHS ?
if (*), he had no place on that RHS
if (**), he was at one of his rightful seats -even if he was still being trained- and it could explain the close guard he had on the side-stick (and I presume on the pedals as well)
if (***), RHS was his legal position, but the same actions on the controls that could be deemed *normal* from a TRI become an indication that there was more on the flight deck authority gradient than we know so far.
What was the real pre-descent briefing about ?
What we've seen on the CVR was the Captain's concern about the runway and the sole reverse they had at their disposal. Did he insist on the drill ?...
That question seems to me important because it could give us an other look at the crew's mindset.
Why ?
The ONLY situation I know where one would operate a single throttle is the engine shut-down (Retard the throttle, try a relight....etc..) during which time the other T/L would be either in the MCT detent in automatic or handled by the HP....
Can people make mistakes that are so basic ? In this instance, I can't say but I remember an efficient crew at the end of a Four-hour sim training . They were given at the last landing a van crossing their runway which called for an immediate overshoot. On the previous go-around, they were a bit late getting the gear up. On this one, guess what ? They made a mess of the Go-around because both of them were too intent on the gear operation.Never had the right attitude, thrust was late coming...

bomarc,
the MEL's language must also be investigated...going from french to porteugese must offer its own challenges.
THe flight documents are in English, even those given to the French airlines.
Translations come later, inside the buyers' offices.

NigelOnDraft

17th Aug 2007, 15:00

Why am I, along with some people, interestred in the full CVR print-out - and in Brazilian - ?Are you aware of any accident where the whole CVR was transcribed for Joe Public tittering? Most reports I read have made have the relevant section(s) available, even then with "non-pertinent" parts removed. From some site or other:The CVR recordings are treated differently than the other factual information obtained in an accident investigation. Due to the highly sensitive nature of the verbal communications inside the cockpit, Congress has required that the Safety Board not release any part of a CVR tape recording. Because of this sensitivity, a high degree of security is provided for the CVR tape and its transcript. The content and timing of release of the written transcript are strictly regulated: under federal law, transcripts of pertinent portions of cockpit voice recordings are released at a Safety Board public hearing on the accident or, if no hearing is held, when a majority of the factual reports are made public.If there were "issues" of crew interaction / roles, examples might be pertinent... however, that I hope would be for the enquiry team to decide, not you and me :eek:

BOAC

17th Aug 2007, 15:00

It's a 2-hour loop recording. - interesting. The 30 minute'ish transcript had me fooled.:confused:

Are you certain of that? First flight 13/2/98.

NOD - I quite agree, but why was the tape up to 18:20:39.3 shown?

PBL

17th Aug 2007, 15:33

Dani,

As I said before once on this thread, I don't respond to ad hominem comments (except like this).

But I do respond to distribution of incorrect assertions by correcting them. I read you now as agreeing with my observations, but thinking them purposeless.

If you are ever, heaven forbid, in an accident situation, with your fellow pilots on PPRuNe pointing the finger at you and saying "that's the cause, end of story, not that we're blaming anyone, you understand", not to speak of your employer, his insurer, the regulatory authorities and the public prosecutor (whose job is to assign blame), then you might change your mind on the value of careful analysis. If it happens, I'll be glad to help.

PBL

slip and turn

17th Aug 2007, 16:32

Professor Ladkin

Part of a professor's role in academia, within their chosen field of expertise, is is to lead the learning and guide the thinking I believe ...

Are you comfortable leading us here ?

There has I think been some uncomfortable learning for some pilots reading the thread who as you know, routinely and constantly have to ask themselves "am I in control of and ahead of this machine and the scenarios I might encounter with it ?"

Perhaps, and maybe using something approaching Frank Plumpton Ramsey's ideas about ranking their beliefs (as introduced by you), most can confidently say "yes I am".

In the absence of conspicuous review by manufacturer's or operators since the accident, can you confirm that these pilots' own self-belief is well-placed today ? Alternatively can you summarise clearly the revision items you would concentrate on if you can think yourself into their position i.e. preparing to flying a machine like this again tomorrow ?

woodvale

17th Aug 2007, 17:19

To a great extent I think we are losing sight of what we all might learn from this accident. There is a debate about whether Boeing or Airbus have the best technology, this is rather irrelevant, we mostly either fly Boeing or Airbus and don’t have too much choice about it.
We must learn to recognise and cope with the weaknesses of our own aircraft.
Each aircraft design has good and bad points. In normal operation they mostly work perfectly well. When things go wrong it is normally due to a lack of understanding, a failure to apply SOPs or an unusual situation which was not handled correctly.
The first two of these should be dealt with by normal training events in the simulator but the third needs us all to think.
I have been flying both civil and military for40 years now, I have always looked at accident reports, both pilot error and technical defects and, wondered if I would have survived the particular incident, sometimes I believed my though processes would have avoided the accident but sometimes I could see no way that I would not have died as well. A very sobering though process.
What do you as an individual think of this accident, might it have caught you out?? For instance I will tell you what I have learnt. From now on I will brief differently for any take off or landing that involves non standard operation of the controls, I will ensure that the PNF specifically monitors my required actions in order to add his/her capacity to ensure they have been carried out. I intend to add a brief reminder of the non standard items shortly prior to their occurrence. When I am PNF I will do the same.
I don’t want to prejudge the accident investigators but if, in this instance the PF had briefed for the PNF to observe both thrust levers into reverse as per the MEL in addition to the normal landing call outs we might not be writing to each other now.
As another more simple example, if you operate a sector with the auto-throttle u/s do you brief that at every 1000ft to level off you call e.g. 6000ft for 5000ft “manual thrust”, it helps!
It is all very well to have the Operational Procedures section of the MEL but do you adjust you briefing to include how the PNF might check/confirm you actions as PF.
I hate the thought of being bid headed enough to think that “it would not have happened to me”, the biggest disservice we can pay to these poor people is to not learn from their misfortune, personally I have adjusted the way I will brief when there are similar critical items. I would like to do my best to ensure I don’t get put into a situation I can’t get out of.
Safe Flying.

PBL

17th Aug 2007, 17:40

s&t

can you summarise clearly the revision items you would concentrate on if you can think yourself into their position

I can only say what I am thinking about at the moment.

I'm thinking, for example, about the guidance concerning Loss of Braking. As in, how much extra runway might you need if you don't get the decel light (for whatever reason) and you follow the Loss of Braking SOP. Looking at data from this accident, it seems to me you could need 1950 m after TD (let's say at 250m beyond threshold), plus your procedural time for getting to stomping the pedals, which amounts to, say, 5 seconds (at 70 m/s) or 350 m. Total 2550m. You can reduce that to 2200 m if you choose to land with manual braking.

That's a lot of real estate, which not all airports have. But it seems to me those are the figures you play with if you want leeway to screw up a landing a bit and still roll out safely. And it looks somewhat different from the figures in the Ops Manual.

Now, people do screw up. And sometimes in the most incomprehensible ways. It would seem prudent to accommodate that. How could that be done? I'd like to hear some thoughts on the written guidance on landing distances, and how it could accommodate slip-ups, but it doesn't appear to be the theme du jour.

PBL

bubbers44

17th Aug 2007, 20:06

http://www.smartcockpit.com/pdf/plane/airbus/A320/systems/0022/

I googled this for us Boeing guys that don't have access to A320 systems manuals to understand the thrust control system. While doing so found another site where an A320 returned to the gate because the TL would not control the engine. I know, that could never happen.

Lemurian

17th Aug 2007, 20:46

PBL,
I'm thinking, for example, about the guidance concerning Loss of Braking. As in, how much extra runway might you need if you don't get the decel light (for whatever reason) and you follow the Loss of Braking SOP. Looking at data from this accident, it seems to me you could need 1950 m after TD (let's say at 250m beyond threshold), plus your procedural time for getting to stomping the pedals, which amounts to, say, 5 seconds (at 70 m/s) or 350 m. Total 2550m. You can reduce that to 2200 m if you choose to land with manual braking.

Would you please compare these figures with this little study I did somewhere else : ( I was off by 700 kg on the *official LW ).
"First, a few facts :
1/- The airplane landed at CGH on runway 35L.
That runway is 1940m long and the LDA - landing distance available - is 1880m.
The METAR reports at 1720 was :340/08 6000m RA BKN 900 ft OVC 7000 ft Temps 16 / 14 QNH 1018 hPa
2/- Two experienced pilots were at the controls, one TRE and a qualifying captain.
3/- 187 people were on board.
4/- The airplane stayed on the runway centerline until just reaching the end of the runway, where it veered left.
5/- It seems official that the airplane was dispatched with one - #2 - reverser inoperative.
6/- The airplane seemed very fast and apparently did not lose as much speed as it would normally do.
7/- Some pilots noticed standing water on the runway, which wasn't grooved.
I jotted a few figures, making assumptions as to the weight of the airplane :
1/- Dry operating weight 41,000 kg
2/- 181 passengers and luggage 18,000 kg
3/- Fuel remaining on board, with a planned diversion to Guarulhos 3,000 kg
The above give a landing weight at 62,000 kg or 62 tons.
At that weight, the required landing distances are :
for dry runway : 1490 m
for wet runway : 1690 m
for 3 to 6 mm of standing water : 2130 m
Those are the baseline figures for sea level and OAT < 40� C, without reversers and without auto brakes.
Congonhas being 2600 ft above sea level, a correction of 3% per thousand feet applies for a wet runway, and 4% for 3 to 6 mm of standing water.
The resulting landing distances then became :
for a wet runway : 1690 x 107.5% = 1822 m
for standing water :2130 x 110.5% = 2354 m
Compare these figures to the LDA in fact #1."

My first comment when I compare both sets of figures (mine come from an in-flight performance chart out of a QRH ) is that your results are very close to the *contaminated* runway data I obtained. Granted those are estimated performance, yours deduced from the actual braking achieved eventually by the crew.
Personally, I have never accepted the *wet* data outside big airports -those with looong runways- and at the flight preparation phase always gone *one state worse*, i.e in this case, my prep would have been with the quarter-inch standing water tables and the consequent reduction of the landing weight (fuel / freight / passengers). Furthermore, and it's one of the reasons I would dearly hear the pre-descent / landing briefing is whether they'd have been aware of the bad runway drainage and the presence, still visible the morning after the accident, of pools of water. That concept of pools of water is important for it means a risk of potential asymetric braking - a situation in which the use of autobrakes is discouraged.
I feel rather strongly about this aspect of this accident as I think that the dispatch of this flight hadn't been done with enough concern for safety. The thirty-five minute turnaround in Porto Alegre (they landed on frame 183400 and took off on frame 186060, leaving just under 45 minutes between them, to which I substracted 10 minutes taxi time.), didn't leave enough time for anything but a routine dispatch preparation.
IMO, this is an example of collective responsibility.

hetfield

17th Aug 2007, 21:01

I can't remember any aviation accident where FDR and CVR data have leaked to the public only a few days after the event like it happened in this tragical accident.

BTW, it wouldn't not surprise me at all if some of the frequent posters in this thread are paid by AB.

Lemurian

17th Aug 2007, 21:23

hetfield,
BTW, it wouldn't not surprise me at all if some of the frequent posters in this thread are paid by AB.
Where shall I go ? I want my share of the dough !:D

bubbers44

17th Aug 2007, 21:42

hetfield, I was convinced of this too and stated it on a previous post but Lemurian now claims he is not and he is one of the biggest Airbus supporters. Maybe some of them don't work for Airbus.

DozyWannabe

17th Aug 2007, 21:46

Bubbers, no-one that I'm aware of said that engine thrust not responding to TL movement was impossible, just unlikely given the circumstantial second-hand evidence available.

TripleBravo

17th Aug 2007, 21:47

remember that one of my ifs was that one of the pilots only recently had been trained to fly the A-320.I thought about that as well as about transitions from B737 to A320 at its different philosophies. But what puzzles me, as far as I remember correctly, he was PNF in the right seat, but the throttles were operated from the left seat.

autobrake MED has a target [...]Small remark: At A320, Autobrake LO has a target deceleration of 1.7 m/s², Autobrake MED 3.0 m/s². Finally found it in the documentation:

http://img253.imageshack.us/img253/2343/autobrakessd2.th.png (http://img253.imageshack.us/my.php?image=autobrakessd2.png)
Source: A320 FCOM 1.32.30

given that pilots have not responded to a *very specific* suggestion to activate it ("Retard")I feel we are going right into human factors at this one. Couldn't you get very much used to hearing that because it is heard at (almost) every landing? Once more, three times "retard" can well be heard when trying a very soft and comfortable landing and thus pulling back the levers very slowly, be it recommended or not. That is why I wouldn't be surprised when there is probably no immediate "neuron link" like "I heard retard => something is wrong".

OK, it's 95 kts they left the runway, not 90, so they have been more dead???

Ridiculous...Please note, there are pilots that are scientists or engineers at the same time. Being a pilot doesn't mean you disrespect numbers.

I agree with PBL, there is clear evidence that the manual braking had at least some effect. To add my own rough calculations for those who bother about:

The overall mean deceleration was 1.08 m/s², leading to a landing roll distance of 2.4 km. The MLG left the runway at approx. 101 knots, Accel Long and Vert give good hints that it took place at 18:48:48.5.

After applying full manual brakes, the deceleration was about 1.21 m/s². Had they applied max. brakes 5 s after MLG touchdown, i. e. 1 second after "spoilers nada" while rolling at 139 knots, they still would have left the runway 49.5 s later, but the overshooting velocity would have been something around 23 knots (42 km/h, 11.6 m/s). Assumption: Actual LDA was 1840 m, because I don't know the exact touchdown point yet. A variation of 50 m would roughly translate into 2 knots more or less.

Remember, all other parameters remain unchanged (lift dumpers, braking coefficients, thrust settings, left brakes not fully applied, ...) except the timing of applying brakes.

Jugdge yourself whether 23 versus 101 knots would have made a difference or not.

Lemurian

17th Aug 2007, 22:02

I feel we are going right into human factors at this one. Couldn't you get very much used to hearing that because it is heard at (almost) every landing? Once more, three times "retard" can well be heard when trying a very soft and comfortable landing and thus pulling back the levers very slowly, be it recommended or not. That is why I wouldn't be surprised when there is probably no immediate "neuron link" like "I heard retard => something is wrong".
Funny enough, it's the other way around : It's part of every landing : you don't hear it --> you've reduced thrust too early /too fast and 1/ you're trying for a greaser (don't like it in most circumstances) or 2/there's a heavy one coming.--> Be ready !
That's the reason I would be advocating a simple (???) change to the voice call from "Retard...to Retard ONE (TWO). I think that only at that moment the mod proposed after the TPE accident would be assimilated by the crew.
PBL has the right words to describe it.

bubbers44

17th Aug 2007, 22:02

Marciovp, post 1868, makes a statement that most of the 20 local A320 pilots interviewed did not think this crew left the #2 TL physically up in Cl. We need to let the investigators finish their job before we can conclude what happened with only part of the facts. A few here have decided the DFDR info leaked is fact and that is the end of it. Maybe we should wait for the official report.

Lemurian

17th Aug 2007, 22:16

(This time, I'm serious again )
can't remember any aviation accident where FDR and CVR data have leaked to the public only a few days after the event like it happened in this tragical accident.
Some Brazilian friends have talked about the political implications of that accident. The first people to be blamed were the government and the military. And the furore went on growing so much that it had become *the* political issue of the moment.
The release of these - partial - recordings were the political means of throwing water on the fire. They succeded as the public is quite content of the perceived official proof of a *pilot error* and won't ask any further.
We're not *just* the public, are we ?

Rob21

18th Aug 2007, 00:51

Could be a political "strategy", specially when they (government) are having a "hand" from Airbus. That statement "reminding" pilots to reduce both TLs to idle shows me Airbus knows something we don't.

Understandable? Yes, imagine grounding all A-320s around the world...

Acceptable? Not by me...

Rob

bomarc

18th Aug 2007, 01:22

nice to know that somewhere there is a previous incident of airbus thrust lever not doing what it should

I hope you post it,so that those in brazil can check it out.

all the best

PJ2

18th Aug 2007, 01:36

PBL;

I'd like to hear some thoughts on the written guidance on landing distances, and how it could accommodate slip-ups, but it doesn't appear to be the theme du jour.

The QRH data which is always employed for ECAM abnormals requiring corrections to landing distances and which, in one case, I used to calculate landing data (discussed in #113 and #120), requires a very aggressive touchdown and stopping regime. The AOM states that the distance is calculated from 50ft, that there is "little flare", followed by immediate, maximum braking until stopped. The distance does not take into account the effects of reverse thrust. Spoilers are assumed to be operating normally.

A wise crew (faced with an abnormality - not commenting on this crew), will also consult the other QRH tables which are labelled, Autoland Distance with Autobrake, (Config 3 or Full) to assess the difficulty of the landing. There are columns for Low and Med braking as well as for varying runway conditions and the inclusion of reverse, (not a high percentage, btw). I was impressed with the recently posted numbers for CGH with "no spoilers" - very interesting work.

The circumstances faced by this crew coupled with the time they had to assess deceleration rates and create alternative solutions was for all practical purposes, nil - not the actions, (which would have been immediate brake application), but the assessment and decision(s). I think the runway condition and precip certainly played a role in the accident if only in severity as did the timing of manual brake application. Like everyone else, I'm still examining the FDR traces as well. Can anyone get them to print? My pdf file won't permit it.

As to transducers, resolvers and whatnot, I have no idea, even though I have a full set of 320 AMMs on CD - the failure of such, while never impossible, is improbable, especially given industry experience.

The question of going-around has arisen from time to time through the posts with varying opinions on the potential for success. Many here are familiar with the Cranbrook 737 accident so it and the warning to never go-around after reverse has been selected need not be belaboured. Given this and the calculations made on the deceleration rates by PBL, it is likely stating the obvious (given the almost-2000 posts on the topic), but by the time the crew was aware of the seriousness of their situation (manual braking time, I suspect), the remaining time and operational circumstances they faced likely precluded a successful decision to either stop or go-around.

As to human factors and various aircraft types, I think the largest issues are training issues and not the so-called "helmet fire" syndrome. Humans make mistakes certainly but as a recent poster offered, the ejection drill was so second-nature that nothing entered the active consciousness and it was done accurately with success. The Airbus takes longer to get accustomed to (about one year) but thousands of crews have made the transition with success and without incident. The propensity of design (ergonomics) and humans to fail to interact with robust comprehension and easy success is the subject of many, many books and papers. When I first stepped into the cockpit of a 320 (after flying the B727, L1011 & B767), I frankly felt as though there was a "veil" between me and the airplane but after the transition training, and a year's time on the airplane, "what's it doing now?" was largely a humourous statement and not a real question.

The industry, not a specific aircraft design, has suffered the kind of occurence as happened at CGH and must in some way come to terms with its possibility albeit extremely rare. That said, the numbers as provided earlier regarding something like 50 million landings etc, certainly impress in terms of risk. In doing daily data analysis for a major 320 fleet, I can attest that there are far more serious issues outstanding.

TripleBravo

18th Aug 2007, 02:22

Can anyone get them to print? My pdf file won't permit it.Yes, actually your Acrobat Reader won't permit. I have opened the file with gsview (http://pages.cs.wisc.edu/~ghost/gsview/ (http://pages.cs.wisc.edu/%7Eghost/gsview/), which requires Ghostscript installed) and recoded it with FreePDF XP (http://www.shbox.de/fpxpdownload.htm , installs as a virtual printer and replaces Acrobat Distiller). This procedure re-enables the printing function in the newly generated PDF.

If that's too complicated, another idea might be trying another PDF reader like Foxit Reader (http://www.foxitsoftware.com/downloads/ ) or PDF Reader (http://www.cadkas.de/downengpdf5.php ), but I have no experience with these.

marciovp

18th Aug 2007, 03:35

Last year there was a terrible disaster in Brazil when a Boeing 737-800 from GOL Airlines collided over the jungle with a Embraer Legacy bought by US Excel Air. The Legacy was able to land safely at Cachimbo AirForce Base in Mato Grosso. The Boeing desintegrated in the air. One of the passengers at the Legacy was a journalist from NYTimes who has a blog: http://sharkeyonbrazil.*************/

Since that accident things in Brazil have been messy. The Brazilian government and the Air Force have been consistently saying that the equipment and software of the Brazilian Traffic Control is state of the art and safe. The disaster has been investigated by many groups: local police, federal police, House of Representative Committee, Senate Committee and CENIPA the Air Force investigative and preventive agency. CENIPA has not issued a final report. NTSB is helping. But the Federal Police and the House of Representative Committee have come out with final statements blaming the two Legacy pilots and four controllers in Brasilia. The controllers claimed that their equipments were faulty and they did not like being blamed by the Air Force that denies any problems with the equipments. At one point they were so scared of being criminally blamed that they made a strike and operations slowdowns... Now some of them are being persecuted by the Air Force for making a Motin. Just to give you all a taste of the political side of what goes on in Brazil.

Then came the TAM accident. The government did not want the runway at Congonhas to be blamed because it is administered by a government agency (Infraero). TAM did not want to be blamed. Airbus did not want to be blamed. The disaster has been investigated by all the agencies that got involved with the GOL disaster. CENIPA says that it will take about one year for a final report to be issued.

Since the accident TAM has decided that its planes will not longer land in wet runways with one reverser inoperant, and also that it will install the new warning signs in its planes to advise the pilots about the wrong TLs
positions. Airbus has issued a note saying that there was nothing wrong with the plane and advising again the pilots how to operate the A320 with one reverser out. Congonhas is grooving the runway and it will be done by September 8th. Today I saw in TV that they are going to install "nets"
at the ends of the runway (have no idea of how these nets will work) and also soft cement to brake the planes. (I guess paralell to the runway, in the ends).

The Minister of Defense has changed. The Chief of Infraero has changed, The officers of ANAC are under attack because they were supposed to regulate the airlines but they accepted thousand of free tickets from them. The new Minister of Defense diverted traffic from Congonhas to Guarulhos but he now wants the runway in Guarulhos also repaved and this will create problems. He doesn't want Congonhas to remain as a hub for Sao Paulo. He is also saying that he wants more space between the seats in the airplanes (indeed they have been shrinking). Some say that he wants to run for President in 2010...

Today, one month after the TAM disaster, relatives and friends of the victims made demonstrations in Congonhas, in front of the building where the plane crashed, and in Rio de Janeiro. Yes, as a said before, Policia Federal has interviewed 20 pilots and they all said that they did not believe that the two pilots at that flight would commit the elementary error that has been said they did. Also there are now reports of 11 planes that skidded in Congonhas the day before the disaster, one of them leaving the runway. On the day of the disaster also planes that landed before reported the runway as being slippery "as a soap".

To finish...I guess we will have to wait one year to hear a final report from CENIPA. Unfortunately CENIPA belongs to the Air Force that administers Traffic Controll in Brazil (military).

I guess there is a lot of work ahead before we go back to a state of art Air Traffic Control and safe airports in Brazil. Let´s hope and play that nothing else will happen in the near future.

Sometimes I see air disasters as a symptoms of larger problems involving a lot of variables.

PJ2

18th Aug 2007, 05:21

3B - Have loaded gsview and freepdf xp, converted and have printed for study. My kind thanks. PJ2.

borghha

18th Aug 2007, 09:59

woodvale wrote

From now on I will brief differently for any take off or landing that involves non standard operation of the controls, I will ensure that the PNF specifically monitors my required actions in order to add his/her capacity to ensure they have been carried out...

I think this is a very constuctive attitude to everything we have learned so far on this thread. I've wondered about the reason why these two pilots handled the throttles so differently during the two landings they made that day with 1 TR inop. Has there been any briefing? Did they talk about the MEL? Did their professional relationship and/or ranking prevent them from talking it through or didn't they deem it necessary to discuss it?
Perhaps we'll never know, unless the CVR part that was not published might give investigators further information on this.

Nevertheless, I think woodvales resolve is worth following.

alemaobaiano

18th Aug 2007, 14:17

While doing so found another site where an A320 returned to the gate because the TL would not control the engine. I know, that could never happen.

http://www.airnig.co.uk/a320.htm

Is that the one? An unofficial, unverified, anonymous email comment from 1995?

ab

SR71

18th Aug 2007, 15:16

TripleBravo,

Autobrake LO = 1.7 m/s²
Autobrake MED = 3 m/s²

Average decel between 48:29 and 48:36 =~ 0.6 m/s²
Average decel between 48:36 and 48:50 =~ 1.2 m/s²

Average decel, ~55T, 146kts touchdown, WET, with autobrake MED, no spoilers, No 1 max reverse, No 2 (EPR = 1.08) =~ 1.5 m/s² (cf. Transavia 536 Report, Pg 143)

Average decel, ~55T, 146kts touchdown, 1/4" water, with autobrake MED, no spoilers, No 1 max reverse, No 2 (EPR = 1.08) =~ 1.1 m/s² (cf. Transavia 536 Report, Pg 143)

(Note that the Transavia report suggests that if you do not touch the brakes, in the config the TAM pilots were in, they would have got no decel at all, regardless of the runway state. This seems to be the case between 48:27-29)

Time between nose gear touch down and first brake application =~2 secs.

To me its looking like the pilots were actually pretty swift in getting on the brakes, albeit not to the point where their full potential was exploited. From where I sit, the application of max manual braking would not have prevented an over-run, in their particular config, but it would have been close(r).

I note also 1/4" of water is worse than 1/2" of water in terms of its effect on LDR's.

I'm not sure what Airbus SOP is, but we normally cancel reverse at ~60kts, so I contend that they would only have needed to reduce the speed to a value approaching this for them to have had another chance to identify (if they hadn't earlier) the unusual TL position(s) and taken some further action to ameliorate the situation.

TopBunk

18th Aug 2007, 15:55

I haven't posted on this thread for about 50 pages because a lot of the arguments just go round in circles!

In any accident there are primary causes and contributory factors, imho.

In this case the primary cause was the failure of the pilots to retard both thrust levers to idle, in that if they had completed that very basic task, then whatever followed may have been avoided, but without that action the accident was guaranteed.

I would expect in the fullness of time, that the runway surface will emerge as a significant contributory factor.

There may also be recommendations re Runoff areas, pilot interface etc, but, nonetheless, the root cause was the failure to retard the thrust levers, which should be second nature to any pilot.

[I speak as someone who has considerable hours on both Airbus and Boeing product - just to clarify my credentials]

flyer146

18th Aug 2007, 19:09

Lemurian wrote p82 :
2. An important call-out is missing on the CVR : " No DECEL !", indicating the auto-brake isn't functioning as set.

I do not agree with you Lemurian.
To my understanding (and at least on A330/340), the decel green light will only come if the selected deceleration rate is effectively achieved.
No green light not meaning that the system is not functionning but merely meaning that the selected decel rate is not achieved (ref FCOM airbus).
This would be quite usual on slippery runways for example and would not be considered (alone) as a malfunction of the autobrake at first glance by the crew (probably even expecting not to see this light right away after landing on this difficult/slippery landing)! Correct me if I am wrong...

Human factors, aircraft design, weather, airport, etc... etc... etc... as in all other accidents have played a role in this tragedy and have to be analysed.

To my opinion, leaving one of the thrust lever in CLB detent during the roll out and not noticing it is a real possibility due to the focussing on the reverser problem by the PF. Although we all have learned since basics not to do so and the SOP's/MEL's being clear, it could be easily done I think in this machine even, unfortunately, by an experienced pilot.

What about the cockpit lighting at the moment of the crash ? Pedestal lighting ? I remember how an unbalance in the cockpit lighting led to a go around on one of my flights a couple of years ago. One switch controlling a lot of panels but with a big unbalance between them and you could be looking for the correct lever/switch or it could just be "hidden" of your normal scan/"view" without that you especially notice it ! And in a stress situation : even worse...(even if PF mistake ; would PNF have a chance to detect this uncorrect TL position ??? don't think so...)

Did you ever noticed how "dark" a cockpit/pedestal/TL's can be at night ? And the accident happend at night, right ?
Also, the thrust levers are "small"/short length and thus for the same angle, the displacement gives quite a reduced viewable effect.
TL's are black color in this aircraft.
No chance to notice this in the given weather conditions/runway length were the PNF having seen that something was wrong and unable to solve the problem was certainly rapidly looking outside trying to help the PF to avoid the worse...

Talking about the airbus design here above : these are facts ! Now, did they play a negative role in this accident, that's another story! Maybe this same design helped a lot of crew in difficult situations as well and you won't ever know this because not reported !
Would another configuration/design be better : long studies have probably been done before design already and prove that it's not the case. Remember, it's all about compromise...and will never be "PERFECT" cos it's human.

Nevertheless, we'll ALL have to learn something from this : that's the only thing important : let's all learn something so that the same occurance does not happen again. Let's improve our awareness, our training and of course let's improve the design if no other "too negative"effects are induced by the modifications.......... !

Flyer146

Right Way Up

18th Aug 2007, 21:31

Flyer146,
What Lemurian said is quite correct. The autobrake was not providing the decleration that was set/required! You are also correct that the autobrake could have been working but because of a slippery runway could not provide the required deceleration. However the "NO DECEL" is a standard call and was missed out! Maybe the announcement of "No spoilers" & "No decel" would have woken the PF to the real reason or prompted him to go-around.

marciovp

19th Aug 2007, 00:06

The editor of "The Controller" a magazine of the IFATCA (International Federation of Air Traffic Controllers ASSNS) in the June Issue said:
" It is all about trusting technology, similar to Airbus and Boeing pilots(People forget that the 777 and the coming 787 are using almost the same advanced automation technology as Airbus)"
Is that so?

PBL

19th Aug 2007, 07:00

In any accident there are primary causes and contributory factors

TopBunk,

I believe the ICAO agreement requires countries to identify a "probable cause" of an accident. Since most investigators realise that there is almost never just one cause of an accident, many jurisdictions now speak of "probable cause and contributing factors", and I understand the Canadians don't prioritise at all.

Most top researchers in accident causality judge that prioritising causes, as it is now performed by investigating authorities, is a matter of ranking causes according to inexplicit criteria which may be extraneous to causally explaining the accident.

Could you give your criteria for selecting "primary cause"?
Could you say, for example, why you would not consider the length of the runway as a "primary" cause? It does satisfy the Counterfactual Test, just as your chosen "primary" cause does. Why do you pick one but not the other?

One selection criterion could be: we reckon relative persistence of the phenomenon throughout successful operations counts for a lower priority. The length of the runway certainly fits this criterion for deselection - it has been used in many successful landings, including one just before the accident. So we would reckon that priority as low (as, for example, the earth bank at the end of the runway was not reckoned as a causal factor in the Warsaw report, even though it was directly causal in the two deaths that occurred), and the pilots' (in)actions in not reducing TL to idle as high.

The problem with that criterion is that it allows unsafe situations that persistently recur to achieve low priority automatically. For example, AA was warned in 1997 by AI, Boeing and the FAA in a joint letter that teaching use of rudder in their advanced piloting course could possibly lead to structural failure of an aircraft. Which happened in 2001. So this persistent phenomenon which some considered unsafe would be discounted as a causal factor according to the criterion above.

An obvious, and obviously not scientifically justifiable, selection criterion is: we discount phenomena which were "our" responsibility, and we emphasise phenomena which were the responsibility of others. This is why, for example, in many countries the investigating body is structurally independent of other government authority, for then there is not seen to be the "our"-"their" distinction on which this criterion rests. Examples of this might be (1) Warsaw; (2) in the inquiry into AA587, the NTSB Chairman complained publically about persistent interventions by the two main organisations involved in the accident; (2) concerning the 2006 Amazon midair collision, there has been suggestion by some authorities that air traffic control is not a factor, although the behavior of individual controllers might have been, despite that the displayed altitude of the Legacy on the controllers' screens at CINDACTA-1 was different from the altitude at which it was actually flying. And the investigating body is a part of the same government organisation which has responsibility for air traffic control.

PBL

PBL

19th Aug 2007, 07:25

"...(People forget that the 777 and the coming 787 are using almost the same advanced automation technology as Airbus)"
Is that so?

In general terms, yes. And the companies providing some of the automation do so to both airframe manufacturers. However, the architectures of many of the systems are different. Cary Spitzer's book, Digital Avionics Systems: Principles and Practice, 2nd Edn., McGraw-Hill 1993, talks about the overall architectures of the A320 and the B777 FCSs in Chapter 7.

PBL

Dani

19th Aug 2007, 07:26

Sorry to disagree with PBL again, but TopBunk is again absolutely correct in his analysis.

The short runway is not a cause of the accident, it's a contributing factor. It's not even a secondary cause.

You can argue endlessly about slipperyness and deceleration aso, if there wouldn't have been this TL left in CLB, none of these contributing factors would have caused an accident. Please go through the performance calculation. The only primary cause that lead to this accident was therefore the TL. I would even go so far that he would have left a dry runway.

So if the TL for itself alone could lead to an accident, it's certainly a primary cause. And since he would have been most probably able to stop with both TL in reverse, the slipperyness was only a contributing factor.

I know it is very important for you to use the correct terms and to express yourself in a scientific language, but we are not scientist and we are here to search practicable findings for pilots. It would be nice to have a down-on-earth-approach about this.

I still cannot believe that some people here in this thread - after 100 pages! - don't see the most plausible reasons behind this tragedy.

Dani

Right Way Up

19th Aug 2007, 07:57

Super VC-10

19th Aug 2007, 10:27

Dani makes an interestin point -

You can argue endlessly about slipperyness and deceleration aso, if there wouldn't have been this TL left in CLB, none of these contributing factors would have caused an accident. Please go through the performance calculation. The only primary cause that lead to this accident was therefore the TL. I would even go so far that he would have left a dry runway.

Anyone done the maths?

flyer146

19th Aug 2007, 10:27

Right way up :
Maybe the announcement of "No spoilers" & "No decel" would have woken the PF to the real reason or prompted him to go-around.

Quite correct Right Way Up; (and as you say : maybe.)

Do you ever practice in the sim landings where you must decide to go-around when on the ground already ? Just for my info because I can tell you that for me the answer is : almost NEVER if not NEVER at all.
Don't you think we should practice this more and get some confidence in going around although wheels have touched concrete already ?
Don't we "commit us to STOP" once we touch the ground ?
Of course, we have to consider : if reversers are out, brakes applied, etc... but still, it would be nice to have some practice on this and see what is possible and what is not.
What are your opinions ?

Flyer146

PBL

19th Aug 2007, 10:45

The reason the TL issue is a primary cause, but the slippery runway is only a contributary factor, is that whilst other aircraft that night landed on a slippery runway and did not crash, the only aircraft that did not retard the thrust levers did crash!

That is certainly a potential criterion. It is related to the criterion in Mill's Method of Difference. Let's look at it further.

The same reasoning exonerates any features of the design of the A320 controls, for they have been used in millions of successful landings. Given the number of people on this thread who have been arguing that the design of the A320 controls was a major factor, it would seem that they are not using this criterion for identifying main factors.

Consider the accident to AA 587. The first officer's use of rudder to control yaw at other than low speed had been noted by others he had flown with, in successful flights. Lots of people have flown A300's without the fin separating. And lots of people have encountered wake turbulence, and yaw in turbulence, without their airplanes breaking. So it seems as if this criterion is not applicable to prioritising the factors in the AA 587 accident. So it doesn't apply everywhere.

In the Warsaw accident, people had landed A320s before carrying 20 kts over VRef (it was in the Ops Manual). And the pilots performed according to SOPs and the weather info from the tower and a Pirep. And people had landed before with outdated weather information. And people had landed before him. But the front had just gone through and the wind changed. Applying the criterion, the primary cause would then be the weather, and everything else is just "contributory".

In the Strasbourg (mont St.-Odile) accident, many crews had used the V/S / descent angle controls many times successfully, as well as not paying so much attention to each other and their tasks, so again there is no application of this prioritisation criterion.

In the midair collision in Überlingen, the particular difference between this and other TCAS encounters would be that one crew thought they were in conflict with two other aircraft and resolved the conflict in favor of the "phantom" rather than the real "intruder" (in TCAS parlance). And that happened because the controller misspoke once (advising of a conflict at 2 o'clock rather than the 10 o'clock on which they had a visual).

In the Cali accident, the particular difference would be that they were withing reception range of two NDBs with the same frequency and the same identifier (that is, though, not unique - the NTSB identified two other such situations worldwide).

In the Birgenair B757 accident off the Dominican Republic, again all the factors (INOP ASI, confused crew) were not particular to that accident, so again the criterion could not be applied to prioritise.

It should now be clear through these few examples that
* the proposed criterion does not always apply to prioritise causal factors, and
* in cases in which it does apply, there are apparently other prioritisation criteria which take precedence

So why would it be the predominant prioritisation criterion in the Congonhas case?

PBL

Right Way Up

19th Aug 2007, 10:46

Flyer146,
I believe the general sim routine is flawed. We think too much inside the box i.e. with set routines, that do not stretch our decision-making or imagination. There have been incidents where lives have been saved because the crew had used the spare time at the end of their last sim to practice an real "out of the box" emergency.

filejw

19th Aug 2007, 11:10

As I read all the posts about this accident I recall that at least twice in the sim when I was on the 320 pilots did not retard the TL from the climb detent in a TR inop scenario's. Result was never pretty dry or wet R/W as the A/C is a bit hard to handle with one engine full or part power and the other in reverse.:hmm:

Dani

19th Aug 2007, 12:15

Quote from PBL:
So why would it be the predominant prioritisation criterion in the Congonhas case?
Because this predominant cause was so devastating that it broke their neck! That's why!

By the way: AA587: The malhandling of the FO's rudder was indeed the primary cause. Just because he did it before and survived doesn't mean that he always would get away with it. You are thinking very simplistic if you argue that touching a rudder, forgetting a thrust lever, misinterpreting weather aso is always the same. It always depends on how strong the mistake was and how it interacted with other, not predominant causes.

Do you want to argue that we shouldn't prioritize causes, i.e. looking at all not essential contributing factors with the same emphazis, even if their influence on the outcome was minor or even neglectable?

PBL

19th Aug 2007, 13:05

So why would it be the predominant prioritisation criterion in the Congonhas case?

Because this predominant cause was so devastating that it broke their neck!

Dani, you seem to be mixing up the two notions of *prioritisation criterion* and *cause*. I was asking about criteria. You respond with a comment about cause.

I don't think it makes much sense to discuss this unless we can agree to keep the concepts straight.

PBL

TripleBravo

19th Aug 2007, 13:17

It always depends on how strong the mistake was Where do you know what is strong and what not? Sorry to say, but what you said is a tautology. Your input serves as a measure in order to prove the input... that doesn't work out. I believe I understand your feelings, but your conclusion is not entirely derived by logic, rather feelings. As I understand, PBL is looking for the pure logical approach to distinguish between minor and major factors - and the TL in CLB cannot be sorted out to be "primary" by applying statistics or mathematical formulae.

BTW, it is not correct, that TAM 3054 was the only airplane that had problems with the length of the runway. There were problems, e. g. just the day before. Had the runway been longer, say 2400 meters (see my calculation some posts above), they would live today. To put it in your words: "Because this predominant cause was so devastating that it broke their neck! That's why!"

lomapaseo

19th Aug 2007, 13:30

PBL
I believe the ICAO agreement requires countries to identify a "probable cause" of an accident

I sure hope that you can't find anything written to support the above.

The problem that I have with a finding of Probable cause is that it attracts most of the attention to a single item that quite often does not lend itself to responding to a practical solution. The idea behind investigating in the first place is to determine any holes in the swiss cheese whereby practical (effective and quick) corrective actions can be applied to make it less likely that the accident will be repeated.

PBL

19th Aug 2007, 13:43

Anyone done the maths?

The data probably aren't there for us to answer the question how long it takes to stop an A320 at 62.7 tons from 70 kts with one engine on reverse thrust and the other at 1.2 EPR with a moderate dry-runway coefficient of friction. AI probably has the models, and I would guess someone with access to good models and a supercomputer may well try to do so in order to see how much the runway surface condition may have contributed to the overrun.

However, it is easy to say what acceleration they would have to have achieved in order to stop from a 70-kt touchdown. Acceleration of -1.5 m/s/s gives a stopping distance of about 1634 m, and acceleration of -1.4 m/s/s gives a stopping distance of 1750 m.

So if you have them planning manual braking, getting WoW at 1650 m remaining and taking a second to react with manual brakes, then they would have needed to achieve about 20% more deceleration than they actually did achieve with manual braking in order to stop within the asphalt.

I don't know whether that will turn out to have been possible, but from what we know at this point I consider it plausible that that could have been achieved on a dry runway.

PBL

Dani

19th Aug 2007, 13:55

TripleB, your if"s and when's and why's - you and PBL try to hide the un-nice cause behind all kind of nice words and theories.

This might be usful in a school lesson about logic and mathematical evidence. But we have here a case it couldn't be clearer.

Yes, you're darn right if you say that my reasoning is based on feelings. I feel that force of that engine (two of them) every day, and I know, that if they are not on idle, they pull me forward like crazy!!

Of course they would have been able to stop the aircraft on a longer runway. If their engine would have been in the TOGA detent, they might even have been able to stop it on 10 000m.

If you ask me, you don't see the wood for the trees. This case is so simple it can be: The thrust on engine 2 remained on 1.2-1.3 (PBL would give me 3 digits behind the dot - thaaaank you!), the runway was short and slippery. So what else do you need to discuss about?

Give it up with your far fetched theories. There is only one mistake they did, and that was that TL. Close that thread finally!

Dani <angry>

PBL

19th Aug 2007, 14:14

I sure hope that you can't find anything written to support the above.

lomapaseo,

your hope is justified. I was mistaken. The version of Annex 13 which is in force since 1 November 2001 says, concerning the format of the report, "3. Conclusions. List the findings and causes established in the investigation. The list of causes should include both the immediate and deeper systemic causes"

The problem that I have with a finding of Probable cause is that it attracts most of the attention to a single item that quite often does not lend itself to responding to a practical solution.

Yes. I would go further. The problem I have with it is that there are usually multiple causes, and multiple systemic causes, amongst the facts that one has selected as being pertinent. (The selection of pertinent facts is another area which lends itself to manipulation and confirmation biases.)

The idea behind investigating in the first place is to determine any holes in the swiss cheese

It may be worth pointing out that Reason's model, which has been around for some twenty years now and has shown its worth, is no longer the latest and greatest. The ATSB, which has used it for a decade, has been concerned about its weaknesses and moved to Andrew Hopkins's Accimaps to explain the Lockhart River accident. Accimaps are very similar to Why-Because Graphs (WBGs), but they summarise the factors (so there are fewer nodes: 20-30 instead of 80-100), and additionally classify into categories reflecting whatever general categories of systemic causes one considers to have been pertinent. There is a paper on my WWW site from December 2005 comparing the two methods on the Glenbrook, NSW rail accident.

PBL

PBL

19th Aug 2007, 14:29

Dani,

I may be missing your point, but I am having a problem seeing anything constructive behind your interventions. You have fingered the cause of the accident, and apparently would prefer others not to discuss it further (your comments about closing the thread).

Supposing we appointed you to be the investigating committee, all by yourself. So you can write what your best judgement tells you. What safety recommendations would you come up with "for the purpose of accident prevention and any resultant corrective action"? And how could you persuade us they would work to aid safety?

PBL

Dani

19th Aug 2007, 14:43

PBL, I understand your fine irony, but finally you showed some emotion and they lead you on the correct way:

You as a specialist should ask *yourself* exactly that question you asked me:.

Recommendations how to detect such errors
How to overcome such problems
Corrective actions in training, cockpit design, CRM
aso

But, please!!!, stop all this endless reasoning about the causes, may it be primary, secondary, contributing, fitting a criterion or not.

Dani

GlueBall

19th Aug 2007, 16:25

There's space to extend the overrun by 500' across the road by building up the end zone and constructing a tunnel for the vehicular traffic. Additioanlly, the frangible rocks arresting system [already operationally proven at JFK] could be included in the extension.

PBL

19th Aug 2007, 17:56

* Recommendations how to detect such errors
* How to overcome such problems
* Corrective actions in training, cockpit design, CRM
aso

Sorry, that won't do. You're copping out with that "aso". If you look at ICAO-standard accident reports, none of them have "and so on" at the end.

You are also not going to be much help if you concentrate just on trying to get the pilots to not make that kind of error. For the best pilots in the world will screw up royally two or three times in their career, and flight safety means providing an environment which doesn't let those occasions develop into broken metal and broken bones.

You will find getting rid of that "and so on" a little harder than you think. That is why no one really concerned with learning from this accident will

...... stop all this endless reasoning about the causes .......

at the moment, or indeed anytime soon.

(I might say that I find your idea of emotions a bit odd!)

PBL

TopBunk

19th Aug 2007, 18:10

PBL

You can wrap it up any way that you wish, and yes there will be lessons learnt that will feed back into:

manufacturers design considerations,
airport operators/federal bodies requirements,
operators/manufacturers limitations/operating procedures and indeed into
recurrent training and information dissemination requirementsbut at the end of the day, whatever we do to try to stop another accident like this happening in future, which is what we need now to do, in my view it is becoming indisputable that the first/primary/root cause of the problem in getting the aircraft stopped on the paved surface was the failure to reduce the forward thrust by the inaction of the crew to retard the thrust levers, which everyone surely must agree is learnt in basic training?

FI: on my fleet we are just completing recurrent training involving late go-arounds / balked landings (before reverse selection) / etc - and very rewarding it was too.

PBL

19th Aug 2007, 18:44

in my view it is becoming indisputable that the first/primary/root cause of the problem in getting the aircraft stopped on the paved surface was ....

TopBunk,

if you would respond to my questions about how you prioritise causes, I might be able to agree with you (or not).

But until you say how you prioritise causes, and can demonstrate conclusively to people that your characterisation follows from your criterion, I can propose from experience that there is not the slightest hope that your suggestion will become "indisputable" any time soon.

I can even guess who can and very likely will dispute it in public. TAM's insurance company.

PBL

slip and turn

19th Aug 2007, 18:44

...becoming indisputable that the first/primary/root cause of the problem in getting the aircraft stopped on the paved surface was the failure to reduce the forward thrust by the inaction of the crew to retard the thrust levers, which everyone surely must agree is learnt in basic training? ... I for one don't agree. I do conclude that had the engine management, aircraft braking and ground spoiler logic all received and correctly processed a signal indicating thrust had been retarded to idle on engine 2 that the first/primary/root cause most probably would have been removed from the chain of events.

I would agree that actions like
FI: on my fleet we are just completing recurrent training involving late go-arounds / balked landings (before reverse selection) / etc - and very rewarding it was too. should be mandatory as operations and investigation continue.

marciovp

19th Aug 2007, 20:41

I understand they are planning to build a steel net in both ends of the runway in Congonhas. Also soft cement as a escape.

NigelOnDraft

19th Aug 2007, 20:57

flyer145 / Lemurian / What Lemurian said is quite correct. The autobrake was not providing the decleration that was set/required! You are also correct that the autobrake could have been working but because of a slippery runway could not provide the required deceleration. However the "NO DECEL" is a standard call and was missed out! Maybe the announcement of "No spoilers" & "No decel" would have woken the PF to the real reason or prompted him to go-around.I trust the criticisms you make of deceased pilots is made from 100% knowing this call is a TAM SOP requirement :eek:

That call is NOT an SOP in BA for instance...

lomapaseo

19th Aug 2007, 20:58

if you would respond to my questions about how you prioritise causes, I might be able to agree with you (or not).

But until you say how you prioritise causes, and can demonstrate conclusively to people that your characterisation follows from your criterion, I can propose from experience that there is not the slightest hope that your suggestion will become "indisputable" any time soon.

PBL

I support this provocation to all the posters. Unless and until those proposing blame and/or corrective action for this accident address your issues above, This thread will stay endlessly mired in speculative issues.

I can even guess who can and very likely will dispute it in public. TAM's insurance company.

PBL

on this last point, the insurance carrier really doesn't have much to say other than to argue among themselves as members of consortiums carrying the insurance for all potential parties. In the end they will simply apportion percentages of the final setllements of all claims.

ChristiaanJ

19th Aug 2007, 21:07

I understand they are planning to build a steel net in both ends of the runway in Congonhas. Also soft cement as a escape.Ah yes. And install arrester wires, like on an aircraft carrier, and require all aircraft landing at Congonhas to be equipped with an arrester hook.

Maybe Congonhas could get their runway grooved?
And maybe the airlines flying into CGH could get their procedures sorted out?
And maybe there should be far more stringent restrictions on operation with one TR locked out?

Arrester barriers are for the military.

NigelOnDraft

19th Aug 2007, 21:14

CJ And maybe there should be far more stringent restrictions on operation with one TR locked out?I'd agree with your post apart from this bit... It has been extensively discussed above that 1 T/R U/S has little effect on LDR, especially if you ignore contaminated runways - and then they are duly allowed for if required. Whilst the T/R Inop seems likely to be implicated @ CGH, it is as a side effect, not a performance issue...

As you say, the EMAS / barriers / overruns might help with the previous minor excursions. The TAM aircraft left the runway at nearly 100K :{

BOAC

19th Aug 2007, 22:09

I have again to take issue over the general question of reverser effectiveness. It seems that the 320 requires an increase of only 55m in LDR for all runway conditions according to the TAM MEL. I must therefore assume that the 320 reversers are almost ineffective. The Boeing 737-700 requires an additional 370m for braking action 'Poor' with 1 u/s and 970m for both, which is far from 'little effect'.

ChristiaanJ

19th Aug 2007, 22:20

Nigel,
I've read most of the 1900+ posts.
Shoot me down any time, but the way I read it all, it is as simple as this.

One TR locked out... rather unusual, but they have flown with that before.
Now, short, slippery runway.... oh sh!t.
What's the SOP about one TR inop? We won't get the same decel with one TR!
Oh, don't pull that engine into reverse, then.

.....

And somehow, instead of doing what should be ingrained: slamming both TLs to reverse, never mind if one TR is inop, they don't touch the #2 TL.

The rest is a sad history.

NigelOnDraft

19th Aug 2007, 22:20

BOAC... I think you are either misunderstanding something, or using differently based data :confused:

BA QRH A320 IAE 2 Rev Operative, Max Manual Braking, improves LDR from 50' by 5% (Dry) to 24% Ice over no Rev.

NB there might still be issues between a 1980s modern certification rules aircraft, and a 1960s retread hiding under some Grandfather rules :) :oh:

bomarc

19th Aug 2007, 22:25

christian j

<< And somehow, instead of doing what should be ingrained: slamming both TLs to reverse, never mind if one TR is inop, they don't touch the #2 TL.>>

did you mean slamming to idle? reverse woud have been icing on the cake.

NigelOnDraft

19th Aug 2007, 22:28

CJ... Sorry - don't 100% understand your post...
What's the SOP about one TR inop? We won't get the same decel with one TR!
Oh, don't pull that engine into reverse, then.That was the old MEL... hardly affects LDR. However, seems an "HF issue" meant that maybe this crew, and others, were led into not even selecting idle in this engine, and leaving it not far off Climb Power :{

Reason for the MEL advice was to avoid the "locked out" Eng slightly increasing Fwd Thrust as engine went to "Rev Idle" EPR / RPM - a little higher than "Ground Idle".
And somehow, instead of doing what should be ingrained: slamming both TLs to reverse, never mind if one TR is inopThe new MEL, and unfortunately the change was prior CGH, but maybe too late in distribution / publication / understanding :eek:
The rest is a sad history. It is, but nothing to do with "1 Rev U/S" performance IMHO. It seems an HF issue, now corrected I think...

PAXboy

19th Aug 2007, 22:31

marciovpI understand they are planning to build a steel net in both ends of the runway in Congonhas. Also soft cement as a escape.Are the politicians still saying that they will find a new site for a new airport 'within 90 days', as they did within a week of the crash?

BOACIt seems that the 320 requires an increase of only 55m in LDR for all runway conditions according to the TAM MEL. I must therefore assume that the 320 reversers are almost ineffective. The Boeing 737-700 requires an additional 370m for braking action 'Poor' with 1 u/s and 970m for both, which is far from 'little effect'.(non pilot speaking) I wonder if that is based on 'idle reverse'?? I often see reference to that, as opposed to some level of increased thrust for reverse. It is possible that Airbus designed reverse to be used at idle, so as to keep noise levels down, something that has always been a key factor for them. Just a thought.

Carnage Matey!

19th Aug 2007, 22:44

As NoD alludes to above it is more likely that the A320 was certified to operate with no reversers and their availability is a bonus. The 737 BOAC flies is based on a 40 year old design and may have required reversers to effect a stop in the 1960's. The current incarnation of the design may still be able to rely on the reversers for stopping power due to historical 'grandfather' rights whereas the more modern 320 must demonstrate it's stopping ability on brakes alone.

HowlingWind

19th Aug 2007, 23:34

I understand they are planning to build a steel net in both ends of the runway in Congonhas. Also soft cement as a escape.If you have one of these, I can't quite fathom what the point would be of having the other.

The "net" really intrigues me, however, and I'd like to know more about this scheme, if it's anything more than someone's blue skies idea. Active? Passive? It seems like it could cause as many problems as it might solve.

Does anybody really think having a net at the end of 35L would have changed much? I believe it might have saved some folks on the ground, but maybe not even that. IIRC, the TAM flight exited the runway to the left prior to the threshhold.

bomarc

19th Aug 2007, 23:43

when you have an airport with a shear drop on both ends, a horizontal net might make some sense. certainly not a vertical net...like the "barrier" on some carriers.

while not intended for the job, the approach lighting pier at KLGA supported a 737-400 which went off the runway and would surely have ended up in the bay were it not for the above.

bubbers44

20th Aug 2007, 00:18

If we are going to nets, horizontal or vertical, to stop airplanes from going off the end of runways I think first we need to let the pilots get it down to 30 knots or so before going off, not 90+. I won't say it again so find a way to let a runaway airplane be controlled by pilot input.

marciovp

20th Aug 2007, 01:35

Tam has decided:
To buy the new software with prolonged warning (light and sound) to pilots when one TL is on forward and the other in REV. (US$5000.00)
to install in all A-320
Not to land in Congonhas with one reverser locked up

The Infraero is deciding:
The steel net
The grooving will finish on September 8
Congonhas no longer will be a rub
Less flights to Congonhas
Soft cement at the ends
Perhaps privatize some or all airports

The Minister of Defense
No longer talking about a new airport
Will divert Congonhas flights to Guarulhos and Campinas.
Will work on both these sirports to accomodate the traffic and passengers (the longer runway in Guarulhos is going to be reccaped)
Wants less passenger in the planes with more distance between the seats
Will talk with the controllers who want to be heard

The Air Force
I guess will continue to administer Air Traffic Control although there has been talks to make it civilian. Will receive more money from the Federal Government.

And so on...

Rob21

20th Aug 2007, 01:41

Soft cement at the ends?
Does this mean the runway will be shorter?

GlueBall

20th Aug 2007, 03:27

Engineered Material Arresting System (EMAS)

In the USA, the FAA requires that commercial airports, regulated under Part 139 safety rules, have a standard Runway Safety Area (RSA) where possible. At most commercial airports the RSA is 500 feet wide and extends 1000 feet beyond each end of the runway. The FAA has this requirement in the event that an aircraft overruns, undershoots, or veers off the side of the runway. The most dangerous of these incidents are overruns, but since many airports were built before the 1000-foot RSA length was adopted some 20 years ago, the area beyond the end of the runway is where many airports cannot achieve the full standard RSA. This is due to obstacles such as bodies of water, highways, railroads, and populated areas or severe drop-off of terrain.

The FAA has a high-priority program to enhance safety by upgrading the RSAs at commercial airports and provide federal funding to support those upgrades. However, it still may not be practical for some airports to achieve the standard RSA. The FAA, knowing that it would be difficult to achieve a standard RSA at every airport, began conducting research in the 1990s to determine how to ensure maximum safety at airports where the full RSA cannot be obtained. Working in concert with the University of Dayton, the Port Authority of New York and New Jersey, and the Engineered Arresting Systems Corporation (ESCO) of Logan Township, NJ, a new technology emerged to provide an added measure of safety. An Engineered Materials Arresting System (EMAS) uses materials of closely controlled strength and density placed at the end of a runway to stop or greatly slow an aircraft that overruns the runway. The best material found to date is a lightweight, crushable concrete. When an aircraft rolls into an EMAS arrestor bed, the tires of the aircraft sink into the lightweight concrete and the aircraft is decelerated by having to roll through the material.

Benefits of the EMAS Technology
The EMAS technology provides safety benefits in cases where land is not available, where it would be very expensive for the airport sponsor to buy the land off the end of the runway, or where it is otherwise not possible to have the standard 1,000-foot overrun. This technology is now in place at 18 airports with installation under contract at six additional airports. A standard EMAS installation extends 600 feet from the end of the runway. An EMAS arrestor bed can still be installed to help slow or stop an aircraft that overruns the runway, even if less than 600 feet of land is available.

Current FAA Initiatives
The Office of Airports prepared an RSA improvement plan for the runways at approximately 575 commercial airports in 2005. This plan allows the agency to track the progress and to direct federal funds for making all practicable improvements, including the use of EMAS technology.

Presently, the EMAS system developed by ESCO using crushable concrete is the only system that meets the FAA standard. However, FAA is conducting research through the Airport Cooperative Research Program (project number 07-03) that will examine alternatives to the existing approved system. The results of this effort are expected in 2009. More information on the project can be found at the Transportation Research Board website at http://www.trb.org/CRP/ACRP/ACRP.asp.

EMAS Arrestments
To date, there have been four incidents where the technology has worked successfully to keep aircraft from overrunning the runway and in several cases has prevented injury to passengers and damage to the aircraft.

May 1999: A Saab 340 commuter aircraft overran the runway at JFK
May 2003: Gemini Cargo MD-11 was safely decelerated at JFK
January 2005: A Boeing 747 overran the runway at JFK
July 2006: Mystere Falcon 900 airplane ran off the runway at the Greenville Downtown Airport in South Carolina

EMAS Installations

Currently, EMAS is installed at 24 runway ends at 19 airports in the United States. With plans to install 12 additional EMAS systems at seven more U.S. airports.

BOAC

20th Aug 2007, 08:04

Paxboy - I believe you are correct. I have no access to any AB perf figures and it would have been more constructive of NOD and CM to have offered such information rather than reacting in the instant 'AB Defence' mode when no attack was made. Whether or not I fly a canvas covered 737, I am trying to caution against the OVERALL impression that has appeared often here that T/Rs are 'irrelevant' - that may be so for the AB family but it is certainly not irrelevant for many other types. As quoted before, on anything other than dry runways, my 737 QRP LDRs are based on 2 reversers at 'No 2 detent' (around 70%N1). I again reiterate that you will NOT easily stop any aeroplane on braking action 'poor' with wheelbrakes alone. Without T/Rs, in the presence of aquaplaning or an otherwise slippery surface, there is a severe risk of 'going off the end'. Indeed NOD quotes BA's figures as a 24% increase in LDR with no reversers on a slippery runway (but does not specify the level of reverse:confused:). That would certainly knacker a BA 320 in CGH on a slippery runway. I see another operator quotes 23%.

So the message for all is to make sure you have read the 'small print' in your performance tables regarding reverse, and thought SERIOUSLY about runway surface/braking action and how you expect to retard the beast before you plant your a/c on it, especially if the ba is nil to poor.

PS NOD - there are no 'grandfather' rights involved for the 737-700 LDRs. It is indeed a 'new 'certification' andThe 737 BOAC flies is based on a 40 year old design and may have required reversers to effect a stop in the 1960's. No sir, in the "60's" the Classic was certified to stop without reversers. It was the introduction of the NG which produced LDRs WITH reverse. That is an important message for 737 NG drivers if no-one else.:ugh:

NigelOnDraft

20th Aug 2007, 08:29

BOAC NOD quotes BA's figures as a 24% increase in LDR with no reversers on a slippery runway (but does not specify the level of reverse).Not so - I quoted a 24% decrease with 2 "Revs Operative". Since we are talking "absolute minimum LDR" we can safely assume "full reverse" ;) A 24% decrease equates to a 31.5% increase.
PS NOD - there are no 'grandfather' rights involved for the 737-700 LDRs.I did say maybe, since there are many areas the 737 is still a 1960s design apparently for certification - or at least Boeing ask for it:Brown also points out that Boeing's product strategy is really questionable when it comes to the certification of its new airliners: "A new aircraft design should meet the safety requirements of the time. Derivatives of older aircraft usually only required the implication of new regulations if major changes to the design were made. Other than that, the old law from the time of the first certification applied. While our competitor does not miss an opportunity to promote the alleged modern high-tech design of its new 737 generation, Boeing is more then eager to claim the "grandfather's rights" of the very first 737 for its newest product-line. The basic 737 was certified in 1967 according to annex 15 of the federal airworthiness directives. Numerous safety requirements were added in the following 20 years, according to which the A320 was certified in 1988 (annex 56). Now, another ten years later, Boeing is demanding the certification according to the 30 year old derivative rights for the new 737, even though it has larger wings, another structure, new high-lift devices, new engines, a new empenage, a new landing gear, a new electrical system, as well as, significantly modified fuselage sections, entirely new avionics, and a new cockpit. Although Boeing is asking for 15 exemption to the total of 377 sections of the current regulations, exactly these 15 points, in my point of view, are a major concern to flight safety."
According to Brown, Boeing is trying to gain a competitive advantage against Airbus by asking for the 1967 standards for the cabin doors and the emergency evacuation system, which gives the 737-800, as the largest member of the new 737 family, a capacity of 189 seats. This is nine more seats than the A320 can offer, which has larger exits according to the newest regulations.
Furthermore, Boeing wants an exemption for the required accelerate stop distance, which would give the Seattle product a significant advantage in take-off performance.
The demands of the US company even include "relaxed" criteria concerning the damage tolerance limits and the demand to keep the old cabin pressure decompression system, although Boeing plans a higher cruise altitude for the new 737.
For Brown, these are only a few examples for Boeing's dubious product philosophy. Other points concern the resistance against higher inertial forces during emergency landings, the design of the flight control system, warning systems, and the general design of the safety systems. In all of these points the A320 had to adhere to the new regulations, while Boeing is willing to accept outdated safety standards to gain a competitive advantage.
"The catalogue of exemptions mounts in the birdstrike regulations While all modern airliner must be able to return safely to the ground after the stabilizer has been hit by an eight pound bird, Boeing is asking to be released from this regulation", Brown gets worked up.
at http://www.flug-revue.rotor.com/frheft/FRH9611/FR9611b.htm

I still think we are on a red herring over LDR :ugh: There is no performance data available for 1 Eng in Reverse, 1 Eng at nearly Climb Power (Fwd), no GS, delayed braking etc. for obvious reasons ;)

BOAC

20th Aug 2007, 08:39

OK - 31.5% even worse without. QED?

I do not agree that LDR is irrelevant. If we are to believe the 'story' of the same a/c the day before, which, landing 500' 'early', only just stopped at the end, the a/c was probably operating OUTSIDE LDR for the runway condition.

Can we please drop the 'Boeing certification' issue? It is even less relevant in this thread and I only responded to correct the errors made. By all means start an anti-Boeing thread elsewhere.

GlueBall

20th Aug 2007, 10:46

". . . the 737-800, as the largest member of the new 737 family, a capacity of 189 seats. This is nine more seats than the A320 can offer, which has larger exits according to the newest regulations.

Actually, AirAsia A320 configuration has 186 seats! [Black leather type]. :ooh:

flyer146

20th Aug 2007, 12:20

NigelOnDraft :

flyer145 / Lemurian / Quote:
What Lemurian said is quite correct. The autobrake was not providing the decleration that was set/required! You are also correct that the autobrake could have been working but because of a slippery runway could not provide the required deceleration. However the "NO DECEL" is a standard call and was missed out! Maybe the announcement of "No spoilers" & "No decel" would have woken the PF to the real reason or prompted him to go-around.
I trust the criticisms you make of deceased pilots is made from 100% knowing this call is a TAM SOP requirement :eek:

That call is NOT an SOP in BA for instance...
-------------------------------------------------

Nigel, thank you, that was actually my point cos neither was it an SOP call in my previous airline! Except if judging by all clues you would judge a real decel problem; in that case of course it would be mandatory to call it out. But this has not only to do with the green light coming on or not.
To my opinion, the crew made adequate call outs as they stated "no spoilers" and a "NO DECEL" call by calling "decelerate, decelerate!". I don't know their SOP's either...
You'll all probably agree that the call out's seems at least very CLEAR to both of them and that other calls wouldn't have changed much here: the crew rapidly understood it was ALL GOING VERY WRONG.
They were faced with something they did not understand : LDG all GREEN which means all the required systems are working normally and then no spoilers and no deceleration on this bloody short and slippery runway !!!!!!!
Easy to analyse afterwards, it will probably be... but let's not jump to conclusions and let's wait the specialists final report.

flyer146 (not 145 nigel, unfortunately if you see what I mean!:))

marciovp

20th Aug 2007, 13:57

Soft cement at the ends?
Does this mean the runway will be shorter?

I have no idea. Had the same doubt. Will see what will come out.

Insofar as number of passengers for the A320 I did a research in all companies flying the A320 and the vast majority fly with 150-5 passengers.

borghha

20th Aug 2007, 16:13

Soft cement at the ends?
Does this mean the runway will be shorter?

Soft cement at the ends yes, but only on the sides ot the RWY. Nets at the ends themselves, if a read well.

ELAC

20th Aug 2007, 19:32

Indeed NOD quotes BA's figures as a 24% increase in LDR with no reversers on a slippery runway (but does not specify the level of reverse). That would certainly knacker a BA 320 in CGH on a slippery runway. I see another operator quotes 23%.

BOAC,

You are confusing your terms. NOD did not quote BA figures as saying there was a 24% increase in landing distance on a slippery runway, what he wrote was:

BA QRH A320 IAE 2 Rev Operative, Max Manual Braking, improves LDR from 50' by 5% (Dry) to 24% Ice over no Rev.

An Icy runway is a whole different beast from what we are discussing here. By Airbus' definition "Icy" is "a condition where the friction coefficient is 0.05 or below" (FCOM 2.04.10 P1). This is a value well below that which would be considered allowable for landing in normal operations by any operator that I know of, and it certainly isn't relevant to the current case.

The numbers you quoted for the B737:

The Boeing 737-700 requires an additional 370m for braking action 'Poor' with 1 u/s and 970m for both, which is far from 'little effect'.

are for braking action "Poor" which is generally understood to be less than or equal to a coefficient of .25. Airbus equates this as being analogous to "a runway covered with standing water with risk of hydroplaning or wet snow" (FCOM 2.04.10 P11).

A wet runway, which was what was reported at CGH (albeit with the modifier "slippery" which has an unknown value) is described in terms of its effect on performance by Airbus as "A runway is considered wet when the surface has a shiny appearance due to a thin layer of water. When this layer does not exceed 3mm in depth, there is no substantial risk of hydroplaning." (FCOM 2.04.10 P1). A wet runway is one where the friction coefficient is .40 or greater and is analogous to a braking action report of "Good".

Though we'll have to wait for the completion of the investigation to know for sure, previous discussions regarding the effect of reverse on stopping distance have been predicated on the runway condition being as it was reported by the tower, i.e. wet but not contaminated. If it turns out that this was not the case in reality then the calculations are not relevant, and a prime question would become why the surface was below the stated condition when it had apparently been tested only minutes before the accident. Obviously, if the runway was contaminated with significant standing water then the case for making any landing at all there that night becomes open to question.

Referring to your post it's a bit unclear, but if the figures you quote are coming from the B737 MEL they would likely relate to additives to RLD which is a factored value. Quite possibly the additives are factored as well as, in that they are additives implies that the use of reverse was considered in the original calculation of RLD for this aircraft. Quite possibly the effect of reverse on the published ALD values is less, but not having a B737 manual at hand I don't know.

On the Airbus I think the documentation bias is to the conservative side. The figures published for both RLD and ALD under any runway condition do not take any credit into account for reverse, so the numbers are valid for a stop made with both engines providing forward idle thrust. From the ALD values a decrement is then provided to account for the use of both reversers, should you wish to consider their use. As it's a decrement, the lower the percentage value the more conservative the estimated effect of reverse. For the airplane I fly the range is from -2% to -7% for 2 reversers operative in all cases except the "Icy" condition (coeff. = .05!) where the value is 19%. Possibly the actual effect of reverse thrust on the landing distance may be slightly greater, but if so that’s an unplanned bonus to stopping distance and not the opposite.

Going through Airbus’ performance document “Getting to Grips With Aircraft Performance” I also came across the following statement:

"In other words, the aquaplaning speed is a threshold at which friction forces are severely diminished. Performance calculations on contaminated runways take into account the penalizing effect of hydroplaning." 5.5.2.4 Page 82

The particular sentence was included in a section of the document discussing aquaplaning and its effect on takeoff performance, but I suspect that the statement is equally valid for landing performance calculations, which aren’t generally as limiting in the first place. So, when you look at the factors relating to the effect of reverse thrust on Airbus stopping distances what you are seeing is a value to which it is quite likely a greater degree of conservatism has been applied than may be the case with the B737 numbers you quoted.

Also, while looking into Airbus' recommended braking techniques on another matter I came upon the following in the FCTM which might help explain how the general effect of reverse thrust is considered from a performance perspective and why in a previous post I referred to the effect of one reverser below 100 kts as being negligible:

THRUST REVERSERS

Thrust reverser efficiency is proportional to the square of the speed. So, it is recommended to use reverse thrust at high speeds.

Pull to reverse IDLE at main landing gear touchdown (not before). When REV is indicated in green on ECAM, MAX reverse may be applied.

The maximum reverse thrust is obtained at N1 between 70% and 85% and is controlled by the FADEC. Below 70 kts, reversers efficiency decreases rapidly, and below 60 kts with maximum reverse selected, there is a risk of engine stall. Therefore, it is recommended to smoothly reduce the reverse thrust to idle at 70 kts. However, the use of maximum reverse is allowed down to aircraft stop in case of emergency.

If airport regulations restrict the use of reverse, select and maintain reverse idle until taxi speed is reached.

Stow the reversers before leaving the runway to avoid foreign object ingestion. (FCTM 02.160 P7)

ELAC

BOAC

20th Aug 2007, 20:07

ELAC - thanks for a comprehensive post. You appear to have missed "NOD's" reply where he corrected my post, but I appreciate your pointing it out again. It does show the degredation of stopping distance with defective reversers on a poor surface. He deduced a 31.5% increase. I have used 'icy' figures as those are the only ones that I have been given here for the AB on degraded surfaces, whereas I have access to the 73 figures which have a whole range of penalties from good to icy.

Personally, looking at the 'history' of the new runway surface in CGH and other 'new' surfaces I believe it was indeed 'poor', as I think the day's previous landing of this hull and the ATR showed, and I remain firmly unconvinced that a 55m increase in LDR was appropriate. Although the term 'slippery' is, indeed as you say unquantified, in the MELs I am acquainted with it is sufficient to preclude landing with a u/s reverser.

Operations on slippery runways or runways contaminated by snow, slush or standing water are PROHIBITED.

(737-700)

The addition for u/s reverser/s come from the 737 performance manual (not MEL) and as I stated the use of reverse WAS "considered in the original calculation of RLD for this aircraft". The point I was trying to make, rather than throw loads of % figures around, is that if there is poor or little braking action then reversers are all you have until you can get the wheels to grip - negligible or not.

The reverse handling techniques you quote are pretty much universal for wing-mounted engines

While you are there, what EPR would you expect to see using max reverse on a 320? 1.02?

ELAC

20th Aug 2007, 21:50

BOAC,

I appreciate your point but I think we are talking in circles here.

I did see NOD's reply when I was half way through with my own, but I didn't think he caught the essential distinction that in your post you took a value that applies to a condition (icy - .05) well below acceptable normal limits and applied it to the undefined subjective condition of "slippery", which it seems was deemed within normal limits by the operators using the runway that night. The comparison is invalid and so then is the use of the figure of 24% in any discussion regarding what the effect of reverse might be in this case. If slippery were in fact anything approaching a coefficient of .05 every airplane that landed would have gone off the end, not just this one.

In respect of the effect of reverse on landing distance I can't quote you exact figures for the A320, but figures for the A330 which are in a roughly similar range are as follows:

Runway Condition vs.
Effect of Reverse

Dry -1%
Wet -4%
1/4" Water -7%
1/2" Water -7%
1/4" Slush -7%
1/2" Slush -6%
Compacted Snow -6%
Ice -19%

As you can see, the effect of reverse on all contaminated surfaces other than ice is fairly much the same and is in a consistent range of 6%-7%. For the 320 the range is probably a bit higher, say 10%, but that would cover all contaminants with a friction coefficient of .20 or higher and very likely includes an allowance for hydroplaning.

As far as the actual runway condition being "poor" that's definitely open for investigation, but there was a very recent runway test and there will be several previous flights data to be examined. However, I don't think that the second previous landing's (the one at CGH) FDR data provides any indication of less than normal braking earlier in the day. The traces show a consistent 2.32 m/sec deceleration in response to 40º (about 50%) manual brake pedal application. Held all the way to 0 kts. that flight would have required about 1050m of ground roll to stop which I suspect would be within the normal distance for the force applied. As to the ATR landing the previous day, the number of factors differentiating that from this are too great to make meaningful correlation, but I'd wager my months pay packet that it takes more than braking action poor for an ATR to use 1800m+ on landing to stop.

Regarding operations with one reverse inoperative, this is not PROHIBITED in the Airbus MELs that I have seen. The MEL guidance says:

"One or both may be inoperative ... Provided that no operation or procedure is predicated on their use"
Followed by Operational Procedure guidance:
"Refer to Operational Regulations for performance on wet, contaminated and slippery runway."

For the Airbus at least there is no prohibition, unless it is otherwise required by the regulator or the operator. This is probably a reflection of the fact that reverse wasn't used in calculating the basic performance in the first place.

In practice an operator would require a specific takeoff performance calculation to be done if they proposed a takeoff as the standard allowances consider reverse to be operative, but there is no similar limitation in terms of considering a landing, which is what we are talking about here.

I do understand the point that you are trying to make regarding the use of reverse. The problem is that you are basing that point on procedures and figures that don't apply to this aircraft and relating it to conditions that it does not yet appear applied to this landing. From my perspective the use of reverse, particularly as it was on just the one engine, is likely to be entirely irrelevant to the outcome here, save for the investigation into the presumed confusion about how the PF handled the thrust levers.

ELAC

PS - Not having used these engines I don't have any info as to what the EPR would be for max. reverse, sorry.

BOAC

21st Aug 2007, 06:40

Agreed, we can stop 'circling':). A few points to clarify, though.

I have made it clear that my comments on reverse were general and not particularly accident specific.

The 'previous' landing of MBK I referred to was the previous day where it appeared to require 500' more LDA than there was (as 'reported' here).

The ATR 'excursion' was 'analysed' here on PPrune as aquaplaning at http://www.pprune.org/forums/showthread.php?t=284262.

Rob21

21st Aug 2007, 09:55

The crew that flew before (2nd previous landing) stated that they chose to use the previous MEL - one TL at reverse and one at idle - for safety reasons.
The captain said that doing so on that situation (short and slippery runway) was safer than bringing both TLs to reverse.

marciovp

22nd Aug 2007, 19:14

Is there a possibility, not likely, almost impossible to happen, that the pilots placed the left TL in reverse and the right on on Idle (or reverse) and... for some reason the right one went back to forward and stuck there?

Just a possibility, almost impossible?... Silly question?

atakacs

22nd Aug 2007, 19:22

Is there a possibility, not likely, almost impossible to happen, that the pilots placed the left TL in reverse and the right on on Idle (or reverse) and... for some reason the right one went back to forward and stuck there?

however unlikely this would be traced in the FDR readings... and there is absolutely not hint that something like this happened.

alf5071h

23rd Aug 2007, 00:29

With hindsight the aircraft should not have made the approach due the combination of runway / airport conditions and aircraft configuration. Thus a conclusion could be that there was a failure in risk assessment.
Recent posts focussed on error prevention and recovery (systems failure), but these depend on error detection which suffers from a wide range of human limitations – focussed attention, reduced hearing, or not able to recall memory items. There was a dual human failure in the overall operating system – both pilots ‘failed’ to notice, to act, react, etc.

The reasons for many of the human contributions might be found in a wider view of ‘automation/technology’ and everyday operations.
Auto brake (in part) originated from a need to improve human performance during RTOs (incorrect application of brakes). In this sense, autobrake is an essential safety system. Its subsequent use for passenger comfort – landing braking levels, and the attempt to calculate runway distance remaining (Boeing computer / 737 Midway accident) can create a false perception of the system’s capability. The emphasis on braking for comfort might bias pilots from full manual brake when required.
The routine use of auto thrust with manual flight can also lead to a false sense of security in unusual situations – expecting the ‘auto’ system to look after the thrust levers; familiarity or laziness?
Were the conditions for operation of the ‘fully automatic’ spoiler system really understood; were the implications of any remote failure known – a deficiency of SOPs, training, memory, or recall?
Was the challenge of this ‘carrier sized’ airport (fun, exciting, and demanding even on a good day), transferred into a subconscious ‘press-on’ attitude, strengthened by the presence of two Captains neither whishing to fail or be outdone? Were the crew conditioned to always land at this familiar airport irrespective of the differences in this situation; did anyone with a controlling influence in this operation stop to think?

Much has been said about landing distances, but how often do crews assess their landings against the requirements? Do crews routinely assess if the aircraft was capable of stopping within the safety margins provided for a limiting runway? Do crews check what % of max landing weight they are at, or how much additional runway they have/have not for a normal landing? Most landings are made on non limiting runways thus crews have few references as to how close they were to the required limiting performance, particularly in less than ideal conditions. This too can bias pilot’s judgement to a false sense of security.
Do crews check the validity of computerised landing data or the dispatcher’s advice; or like some aspects of regulation or management do crews also pass down their accountability for these aspects of safety to a lower level – other people/computers – a form of pre-emptive blame?
The lack of accurate (meaningful) runway braking reports further complicates the issue. 3 mm of water is neither safe/unsafe; once the runway is wet the safety margin is literally on a ‘downhill slide’. The ill-defined Boeing ‘slippery’ runway has merit when considered as the range braking conditions between wet and icy - the view taken in some documents where decreasing mu is correlated with descriptions ranging ‘good’ to ‘poor’. On a wet slippery runway how wet is wet, how slippery is slippery in comparison with a normal operation? Then we tend to forget aquaplaning – “you don’t notice it on grooved runways” myth or mystery? (And the critical speed may be nearer 7xSQR P than 9xSQR P).

Normal operations set the ‘comparative’ ground rules for human assessment and behaviour. Management and pilots rarely consider that the many assumptions they make in forming their idea of ‘normal’ operations (habit / expectation) will not apply in adverse conditions, particularly with the already reduced safety margins hidden in regulation. This enables opportunities for errors of judgement, mistakes in decision making – and that’s even before the start the approach and any other erroneous opportunities. Did everyone in the decision process fail to think – were they self satisfied (complacent) with their normal operation?

Reconsidering the circumstances of this accident without hindsight, it could be concluded there were sufficient cues available to both management and crew to indicate that this specific operation should not have been conducted. The investigation (and thread speculation) should focus on why these cues were not recognised or why judgement failed; were these deficiencies in individual, organisational, regulatory or industry-wide knowledge and thinking.

Recent activities appear to be ‘closing the stable door’, but at least they recognise some of the problems. Crews might learn from these and redatum their habits and take more notice of normal operations – build experience. Operators must consider the risks at all airports and their use of MEL – clear / accurate SOPs which everyone understands and has been exposed to in training – training which encourages change or removal of previous habits.
Every runway end should have a safety area, but the call for special nets, etc, could also be met by further reducing landing weight or limiting the conditions in which operations occur e.g. LCY no tailwind (RJ100) and no contaminated ops, or touchdown by a specific point. Change requires thought, and thinking requires a change in the way we behave.

People have to take more responsibility for safety in their operation – be accountable before the fact; if they don’t then unfortunately we have these sad opportunities to learn from their errors – that’s hindsight.

marciovp

24th Aug 2007, 03:44

TAM pilot who landed on Congonhas the day before the disaster with a A320 with the two reversers working, said that the airplane acquaplaned three times in the runway very wet and heavy rain and that he was only able to brake on his fourth trial, about 200 or 300 meters from the end of the runway. He claims that he notified this to control tower.

PBL

24th Aug 2007, 07:07

I think the most important single feature of alf5071h's message is the emphasis on risk management. I pondered if I had anything worthwhile to add. And I think I do: risk is the subject of half of my core class, and in my experience most people do not know about the technical meanings of the word until they encounter them in some such context.

Risk management is becoming part of the development and operations of most civil safety-critical systems nowadays, partly thanks to new international standards (in areas other than aviation) that countries are slowly getting around to adopting ("adopting" means not just saying "it's here, use it", but also enforcing its provisions).

However, ten years ago no one knew what risk management was except for a few experts. (Jim Reason's "Managing the Risks of Organisational Accidents" from 1997 was one of the first general-interest tomes on the topic.) Even nowadays, I suspect that few people at the pointy end (e.g., pilots, ATC) think of their critical jobs in such terms.

Framing the issues in terms of risk management changes the terms of debate. People often use success as the sole criterion: trying to decide "is this OK; is this not OK" along with the inference that if one succeeds, choosing to do it must have been OK. Risk management more often involves deciding how risks have changed; what risk factors are present/absent and in which quantity. Not whether you make it or not, but rather how your chances of success have improved or worsened in the given situation.

So, for example, one can succeed despite poor risk management: the Korean Air pilot who strayed into Russian airspace, refused the interception, was shot down, and put the airplane down successfully on a frozen lakebed without killing anybody. Success yes, but exceptionally poor risk management (and in other situations, in other professions,
grounds for firing or even, in some jurisdictions, criminal prosecution). And, on the other hand, one can also manage risks well, but fail to succeed: the Warsaw pilots who carried the then-allowed VRef + 20 onto the runway, expecting wind shear based on a wind report and a confirming pirep from the guy in front, but who ended up floating down most of the runway. If some of your biggest risks are unknown, as in this case, your judgement is likely to be inaccurate.

Risk management is, though, notoriously part of a "safety culture". If there is one thing on which almost all human- and social-factors people agree, it is that a risk-management approach to critical operations can only effectively be implemented top-down in an organisation, with a high (indeed, some say overriding) priority set by the highest management level. The reason, I suspect, is rather simple. I pointed out that success-oriented and risk-management methods can conflict, so if a company is predominantly success-oriented (as many are, because their most active managers are personally success-oriented and the company inherits the personal characteristics of its most successful managers), it is ipso facto unlikely to be risk-management oriented.

There is a sustained argument for risk management, from another sector, financial markets, in Nassim Nicholas Taleb's best-seller Fooled by Randomness (available in the U.K. from Penguin; I believe from Random House in the U.S.). He shows the pitfalls of success-orientation by recounting tale after tale of high-flying dealers who tank. It seems to be endemic in the financial sector.

One of the best arguments from risk management in commercial aviation that I have seen recently is in the Überlingen report's consideration of the risk management at Skyguide. The report leaves much to be desired in other areas, but their consideration of risk management on that fateful evening at Skyguide is exemplary.

TAM implicitly acknowledged there was a risk-management issue by changing their procedures for landing at Congonhas (changing procedures is one way to manage risks differently).

So I sympathise with alf's plea to reframe the terms of the debate, although I myself prefer to consider *all* aspects, including some that may be passe. I agree with alf that in the case of landing at Congonhas in weather, there is an argument to be made that the pertinent risks were indeed known but apparently misjudged (by many different people and organisations). It will be interesting to see if CENIPA takes this line in their report. One interesting feature of this form of framing is that it is very hard to disagree with a well-performed assessment of risk management, as one may notice while reading the Überlingen report.

PBL

John Farley

24th Aug 2007, 16:39

Thank you PBL

That sort of post makes reading PPRuNe worthwhile

JF

flt_lt_w_mitty

24th Aug 2007, 17:09

I have been 'sitting out' watching the infighting, tech 'to-ing and fro-ing' and the rest but thought I'd pop back in to say good post Alf - I guess we both agree with my last line way back in #316.

PBL - all very true, and I trust airline managements are reading as well as pilots and manufacturers. As you say, 'top down'.

bomarc

24th Aug 2007, 21:46

D.P. Davies, author of the fine book, "handling the big jets" wrote of assesing the criticality of the approach some 40 years ago.

With data available to the pilots prior to approach clearance, this would have to be considered an approach with certain critical features and requirements.
Whether the pilots called it risk management, or assesing the criticality of the approach...they knew it was a landing they would have to be vigilant on.

does anyone know when the FINAL report/cause(s) will be made public?

Flight Safety

25th Aug 2007, 17:24

I've come very late to the discussion of this accident, as I've had a busy schedule. I tried to read the whole thread, but simply ran out of time. Regarding the mistake the pilots made in leaving ENG2 throttle in the Climb power position upon landing, I've come to think there's a design flaw in the AB throttle system. This accident and the nearly identical 1998 Philippines and 2004 Taipei accidents seem to illustrate this.

The following discussion is about modeless primary control design, which I’m applying to the AB throttle system).

The following Human Machine Interface (HMI) design rules are from a Dutch design engineer. These design rules apply to primary machine controls, and in my view especially apply where safe machine operation is ia concern. In the following descriptions, the word “gesture” means “control action”. Rule 1a in particular, is the most relevant design rule to this accident.

Rule 1. An interface should be habituating.
If the interface can be operated habitually then, after you have used it for a while, its use becomes automatic and you can release all your attention to the task you are trying to achieve. Any interface will have elements that are habituating, but the principle here is to make the entire interface habituating.

Rule 1a. To make an interface habituating, it must be modeless.
Modes exist where the same gesture (control action) yields different results depending on system state at a time when your attention is not on system state. In the presence of modes, you will sometimes make mode errors, where you make a gesture intending to have one result but get a different and unexpected result, distracting you from your task.

Rule 1b. To make an interface habituating, it must be monotonous.
"Monotony" here is a technical term meaning that you do not have to choose among multiple gestures to achieve a particular sub-task. Crudely, there should be only one way to achieve a single-gesture subtask.

In the application of these HMI rules to primary controls on automobiles, we have the following primary control behaviors, which all of us who drive are familiar with:

Primary Auto Control – Steering Wheel (primary directional control)
This control is modeless and habituating on all autos I’m aware of, as the operating mode of the steering wheel never changes. The basic relationship of the wheel’s position to directional control does not change. To go straight, hold the wheel straight. To turn the auto left or right, turn the wheel left or right. To increase the rate of turn, turn the wheel more. All control actions are habituating, and comply with the above design rules.

Primary Auto Control – Gas Pedal (primary speed control)
This control is modeless and habituating on all autos I’m aware of, as the operation mode of the Gas Pedal never changes. Even the presence of a cruise control system (auto throttle) does not change the basic operating mode of the Gas Pedal. The basic relationship of the pedal’s position to engine power (speed) does not change. To hold speed (or power output) hold the pedal in the same position. The increase speed (power), press farther on the pedal. To reduce speed (power), lift pressure from the pedal. All control actions are habituating, and comply with the above design rules.

Primary Auto Control – Brake Pedal (other primary speed control)
This control is modeless and habituating on all autos I’m aware of, as the operation mode of the Brake Pedal never changes. The basic relationship of the pedal’s position to speed reduction does not change. To hold speed, do not press on the pedal. To decrease speed gradually, press lightly on the pedal. To decrease speed more strongly, press more firmly on the pedal. All control actions are habituating, and comply with the above design rules.

One can argue that the sudden loss of power assist of the steering wheel or brake pedal changes the forces involved on operating these primary controls, but the basic mode of operations of these controls does not change.

Now to airplanes, we have the throttle system, a primary speed control on an airplane.

Primary Airplane Control – Engine Throttle (primary power and speed control)
On nearly all models of airplanes, this control is modeless and habituating, as the operating mode of the throttle(s) does not change. Even the present of an auto throttle systems does not change the basic operating mode of the throttle. The basic relationship of the throttle position to engine power (speed) does not change. To hold engine power (speed), hold the position of the throttle. To increase engine power (speed) move the throttle forward. To decrease engine power (speed) move the throttle aft. On most airplanes, all control actions are habituating, and comply with the above design rules. On some airplanes, the throttle movement is the reverse of that described, but even for these airplanes, the control actions do not change.

On the A320, we have something different. We have a throttle system with more than one mode, which violates the basic HMI design rules listed above. The throttle system on an A320 is still a safety related Primary Control for this airplane. The main problem as far as I can see, is a mode change occurs at touchdown, when auto throttles are used on approach. There’s a mode where throttle position must be in climb detent on approach (where throttle position does NOT relate to engine power), then when auto throttles disconnect at touchdown, a sudden mode change occurs where now throttle position DOES equate to engine power”. The very failure possibility mentioned in rule 1a is at work here.

The mental mistakes introduced by this design have happened before, and will happen again on the A320, as long as this multimode throttle system exists. A Rube Goldberg machine if I ever saw one.

ELAC

25th Aug 2007, 18:42

A Rube Goldberg machine if I ever saw one.

Just curious FS ... did you ever fly one?

ELAC

Mad (Flt) Scientist

25th Aug 2007, 18:47

@FS - an interesting analogy, but I'm not sure it's quite so straightforward; if one considers a manual (standard) transmission, then the relationship between throttle position and speed is only monotonic for any single gear, and to accelerate further one must change mode - i.e. gear shift - and in order to do so one must reduce power in order to clutch, shift, clutch then apply power again.

Now this is entirely natural and instinctive for someone TRAINED on a manual, but for someone who's only ever driven an automatic, the notion of decreasing throttle to accelerate is of course unnatural. Yet there are if anything, it seems, more errors in automatics - how many accidents does one read of where people stupidly leave the car in-gear in an automatic and go barrelling through shop windows?.

Similarly, one cannot decouple the accelerator and brake pedals; there is an implicit requirement to "disable" the "accel" mode - by lifting one's foot off the accelerator - when applying brakes. And vice versa. Yet I personally have driven a hundred yards or so with the parking brake on while trying to accelerate and thinking "bit sluggish today". Now it turns out it was my brain that was sluggish, but there's nothing inherent in a car's controls that prevents mode confusion; again, in theory it's trained out, but my training failed that morning....

Regarding the AB AT, I'm noty sure its such a grevious violation of the design principles, especially compared to other types. As I understand it the mode change on the throttle which was not retarded occurred because the OTHER throttle WAS retarded. This seems analogous to pressing the brakes, hoping to slow down, while not really letting up on the gas. The aircraft receives an ambiguous signal as to the crew's intention, and tries to respond to that ambiguous instruction regarding speed control, just as a car would apply throttle and brakes in the analogous condition. In both cases I find it hard to fault the design for not understanding what the operators actual intent was.

atakacs

25th Aug 2007, 18:53

@FlightSafty

The mental mistakes introduced by this design have happened before, and will happen again on the A320, as long as this multimode throttle system exists. A Rube Goldberg machine if I ever saw one.

Very aptly put IMHO.

I already asked and ask again: what was the design consideration that let AB install those non-moving, multi mode T/L ?

Mad (Flt) Scientist

25th Aug 2007, 19:02

"let"?

They chose a non-back-drive design I believe because it's mechanically simpler and thus inherently more reliable than a back-driven system.

They could fit them because they are deemed certifiable per FAR/JAR 25 etc. (Otherwise they wouldn't be used, basically)

PBL

25th Aug 2007, 19:10

Flight Safety produces a set of "design principles" for a human-machine interface, shows the A320 throttle system does not conform, and condemns it.

As any human-machine-interface specialist will tell you, that is easy to do. Any graduate student in human-machine interfaces can come up with a set of design principles which look plausible until you confront them seriously. What is hard to do is to come up with a set of principles with which many or most experienced human-machine interface specialists agree, which most designs accepted intuitively as "good" more or less fit.

Does the "Dutch design engineer" who devised these principles have a name?

I might suggest that all design principles which require that the interface be modeless
* assume that the state space of the control system is quite small;
* will thereby condemn most control systems to be found in the cockpits of the latest generation of commercial airplanes

The technical reason there are "modes" in the control systems is that a flat state space is simply too large and one needs to structure it hierarchically for any human being to be able to operate it.

PBL

bubbers44

26th Aug 2007, 01:16

Atakacs, somebody said it earlier, cost was the reason the TL's don't have feedback when power changes with the AT system and the TL's don't move.

ELAC

26th Aug 2007, 10:44

Atakacs, somebody said it earlier, cost was the reason the TL's don't have feedback when power changes with the AT system and the TL's don't move.

bubbers,

For Pete's sake!

Do you really believe what you've written?

I mean really, your credulous bias towards believing anything negative you hear about an Airbus from sources likely so varied as to include your cousin's niece's nanny's boyfriend is obvious, but even you have to have a limit to your gullibility somewhere.

Somebody who? Where exactly? And with what actual knowledge of the Airbus design objectives? Cost differentials based on what set of manufacturing and operating processes?

Is posting "somebody said .." a reflection of the limit of your analytical skills? If you think it's true then investigate. Find the facts that support the position and post those. Show some depth of thought instead of being a simple reflection of what some unknown somebody might have said somewhere sometime.

I sure hope you don't carry the same unchallenging acceptance of hearsay into the cockpit with you.

ELAC

ELAC

26th Aug 2007, 12:32

I-Ford,

An interesting article, thanks.

Having said that the pedigree of the opinion is no more or less worthy than many you'll find here on PPRuNe:

Given the ardent nature of the comments, we asked Alex Paterson to respond to this question: For all the thousands of hours devoted to cockpit design, do good designs result?

Paterson is a retired Australian airline pilot with some 7,000 mostly shorthaul hours of experience flying many different types of aircraft, from the relatively simple DC-9 to the 'glass cockpit' B767. His extended response, paraphrased greatly here, reflects the insight borne of accumulated experience punctuated by the occasional hard lesson.

I wonder if his insight regarding autothrottles reflects accumulated experience using both systems, or like some of our posters here is the result of experience with one system and assumptions about the other?
ELAC

Flight Safety

26th Aug 2007, 13:10

PBL, my apologies, the design engineer is American, not Dutch (happens when you research and post in a hurry). His name is Jef Raskin (now deceased) and he was a software design engineer.

I find I agree with the design rules as they were stated by Raskin. The personal experience of 4poleholer in post #412 and the following 2 accidents, has led me to believe there's a design issue.

2004 Taipei accident
http://www.asc.gov.tw/acd_files/189-c1contupload.pdf

1998 Philippines accident
http://aviation-safety.net/database/record.php?id=19980322-0

All 3 of these incidents are identical in failure mode. With one TR inop per MEL, upon landing, the TL of the unaffected engine is pulled back into reverse, but the other TL is left in the climb power detent. All three experienced no spoilers and asymmetric thrust (one engine in reverse and one at climb power).

You have to ask yourself a few questions about this.

Q1. Why would any pilot leave the engine with the TR inop in the climb power detent after touchdown? To me, this is THE major question of this accident.

Q2. How could any pilot NOT pull all power back after touchdown, since he must stop before the end of the runway?

Q3. Why does Airbus have to send out notifications to remind pilots to pull ALL thrust levers back to idle upon touchdown, when EVERY pilot should instinctively know to do this?

A1. I believe the answer lies with the mode (or state) change that occurs at touchdown with the A320 throttle system. When looking at the CVR transcript and FDR data, it's clear the pilots were concerned about stopping before the end of the runway in the present conditions, just prior to touchdown. In anticipation of the need to apply maximum braking, a pilot moved the TL of ENG1 back to idle just prior to touchdown. In doing so, he left the TL of ENG2 (with TR inop) in the climb power detent, which probably seemed to be the correct setting for TL ENG2 at that moment, because the AT was engaged at that moment. However, having started this TL movement early, the pilot is now setup to miss the state change when WOW occurs (and AT disengages), because of the intense focus on deploying the TR of ENG1 as quickly as possible. When WOW occurred and the AT disengaged (though probably disengaged when TL ENG1 was retarded), the Climb Power setting of TL ENG2 now meant climb power. To me, both pilots simply missed the state change, as Raskin said would happen in Rule 1a.

A2. I think the answer to this question lies in the fact that there's a mental habituating disconnect between throttle position and engine power on the A320. If throttle position does not always equate to engine power, then it’s possible to have a confused moment under pressure, and to forget the current mode. In throttle system design, TL position and power either ALWAYS equate to each other (single mode, which is habituate and forget) or they do not (multimode, which cannot be fully habituated and must be mentally processed at times). When flying Auto throttle to touchdown, on approach the AT is reducing power for the landing (when TL position does not equate to power and the AT is performing the power reduction). But at touchdown, the pilot has to take over (when TL position suddenly does equate to power and the pilot has to perform the remaining power reduction). I personally think the TL position mode change is the more significant state change at touchdown, as all pilots who fly auto throttle know they have to take over power reduction after touchdown.

A3. The answer to this question should be obvious by now.

fyrefli

26th Aug 2007, 17:50

is an interesting point of view about Airbus TL philosophy, written in year 2000.

Please be aware that the link you pasted tries to install Drive Cleaner on your system and buggers around with your browser. Info on Drive Cleaner here:

http://www.symantec.com/security_response/writeup.jsp?docid=2006-062217-0726-99

PBL

26th Aug 2007, 19:36

the design engineer [whom I referred to] is Jef Raskin

Jef Raskin was Apple's chief user interface designer and has a wonderful book on principles of interface design. For desktop computers. Yes, modes are awful in desktop computer SW, as anybody trying to do something less than trivial in Word or OpenOffice knows. We avoid them too, rigorously, in our WB-Graph-drawing SW.

Taking design principles for desktop-computer user interfaces and transferring them to critical systems with professional operators does not work.

Raskin was assuming untutored users on general-purpose computers with potentially unbounded functionality and varying degrees of creativity on the part of the users. Safety-critical control system interfaces assume professional users, a fixed number of well-defined and tested functions, and no creative use of the system. They are very different design spaces.

Since you apparently didn't understand the point I made earlier, I will repeat it. The reason modes are needed is that the flat state space is too large to expect an operator to negotiate it in real time. Please understand this: mode-less does not work.

You can show this to yourself. Go to my 1994 paper on the (pre-Warsaw) A320 braking logic. Compare the trivial factored state spaces (easy to understand) with their product (the flat state space). Look at the product for 15 minutes, and then attempt to draw it from memory on a clean sheet of paper. If you didn't get it quite right, you may rest assured that you are in the majority. And designing user interfaces for critical operations is all about ensuring that the professional operators get it right. So, no flat state spaces.

PBL

Lemurian

27th Aug 2007, 00:30

The following is just my assessment of the Airbus FBW philosophy as I have discovered that there is a lot that non-airbus pilots and other posters ignore - or chose for different reasons to ignore-.
1/- I believe, with more than ten years of experience of the airplane, that the non-moving throttle choice was the result of the envelope protection decision, and particularly the Alpha floor, in which an automatic application of go-around thrust, along with the reduction of the AoA happens.
A surprised crew would, in all probability, react first toward grabbing the T/Ls moving to full thrust, thus denying the safety philosophy of the system.
(For those still interested in the Ford Trimotor-type set-up, this can be disabled but the Habsheim accident proves that it is not generally a good idea to do so ).
2/- Quite a few comments were made about the *CLB* detent. To a certain point, I agree that *CLB* could be a misnomer...until one realises that these detents -*CLB*, *FLEX-MCT*, *TOGA* - give accurately to the pilot the maximum thrust setting one would achieve on manual throttle on different phases of flight.
I have thought of another way to call them and failed so far.
As for throttles giving an accurate idea of the actual engine output, let's just think of an engine failure after V1 : the throttles are walled, how do you determine which engine has quit ?..
Another example : the Air China 747 SP. All throttles were indicating full thrust, one engine had flamed out and they found out that the 74 could be barrel rolled.
And finally, in order to show the "seriousness" and the objectivity of some references given in this thread,this is a link to the articles written by Mr Alex Paterson on quite a few subjects, from religion to politics, science and aviation ( I recommend particularly the "Longbow versus crossbow, an analogy with FBW Airbus ", worth a laugh).
Alex Paterson's site (http://www.vision.net.au/~apaterson/index.htm#HEALTH%20ARTICLES).
Cheers

alf5071h

27th Aug 2007, 01:01

The discussion drifts back to automation and system design, but these may not be significant contributors to the “cause” of the accident.
Using the description of an accident as “a collection of seemingly unconnected contributing factors, where the absence of any one would have avoided it”, then from the information presented so far there appears to have been a high probability of overrunning without the human-thrust lever problems.

It can be assumed that the crew were familiar with moving the thrust levers rearwards and selecting reverse – they did it on every normal landing. Failure to retard the TL would probably be detected by the inability to select / lack of reverse – similar to other aircraft types. I discount the Retard call as auditory sensing is weak and usually the first sense to deteriorate with high workload, stress, fatigue, etc.
The specific difference in this landing was that one reverse was inoperative. The crew procedure required both TL to be selected to reverse in the same way as in normal operations,this provides normal detecting / monitoring cues for erroneous operation. The ‘error’ appears to originate the use of a non-standard or old procedure. Although the lack of reverse was in the briefing, the exact procedure was not discussed which deprived the handling pilot opportunity to visualise his intended actions (recall and refresh from memory), and for the monitoring pilot to both understand the ‘plan’ (what he would be monitoring) and an opportunity to interject if the briefed procedure was incorrect. The possibility that neither crew member knew of the revised procedure remains open, but they had landed in this configuration previously – what procedure was used then? Thus the error may have involved a failure to recall / monitor actions after touchdown, probably due to human factors issues, which could have been exacerbated by stress induced by a demanding (risky) situation.

Post#1893 reports an earlier A320 incident; considering the previous ATR incident and an earlier excursion with a 737, then the indications of this operation was one of high risk. Only a small change in the circumstances could have resulted in any aircraft experiencing an overrun:- heavier rainfall, worn tyres, a little more rubber on the runway, higher weight, longer touchdown point, less wind, and of course an MEL item effecting retardation.
So why didn’t everyone get upset about the 737 excursion; … non fatal? Were crew fortunate or skilled in being able to turn onto the grass preventing the drop onto the road, which perhaps reflects the difference between an ‘overrun’ incident and a fatal accident? Did the other A320 (#1893) ‘depend’ on reverse for a safe landing or the 737 use a computed landing distance based on reverse (cf Midway)?
Thus from this aspect it could be argued that human-thrust lever interface only contributed to the severity of the accident and was not “a causal” contribution. The MEL’ed reverse and associated procedure appears to be more important.

So why didn’t the 737 overrun (or previous ATR, F100 incidents) ring the safety alarm bells, trigger a risk assessment and the reconsideration of operations during the temporary conditions affecting the runway?
Why did the TAM overrun generate 1900+ PPrune posts vs 11 for the 737? Are we misjudging the important aspects of safety, being biased by fatalities, or incorrectly focussing on the ‘bright’ or emotive aspects of automation?
The apparent discarding of near misses without learning from them will perpetuate the risks for others, and as in this case with more severe results. Are we inadvertently thinking that the 737 event or similar “couldn’t happen to us” or “I wouldn’t make that mistake”; and then when we err, we look to the tools for ‘blame’ and not the human contribution.
The risk assessment reflected in this thread appears to be biased, if true then is this due to a failure in our beliefs, knowledge, training, safety management culture or just another facet of human behaviour?

RobertS975

27th Aug 2007, 01:50

Great post, alf! You really hit the nail on the head in many ways. We ignore, for the most part, the near accidents... we learn little from them, we pay so little attention to them. And they would have been serious, fatal accidents but for what... luck? I am so taken back to a book I first read when I was about 12 years old, Ernie Gann's Fate is the Hunter.

Oh, and after reading the Alex Patterson article on the Longbow vs the crossbow, I have finally learned the origin of the digital indicator of displeasure, giving the middle finger!

Al Zimer

27th Aug 2007, 06:30

As a SLF and long time lurker I am very hesitant to post - but here goes anyway.
Perhaps there is a problem in the thrust control mechanism that, despite the pilot retarding the TL correctly, the thrust control has stayed at the CLB level.
In post no. 1580 VAPILOT describes the control system as -
Each thrust lever is connected by a pushrod to the
input of an artificial feel unit. This unit provides friction
and the detents throughout the motion of the thrust levers.
The artificial feel unit's output shaft is connected
to the thrust control unit via a second pushrod.
Within each thrust control unit are 6 potentiometers
and 2 thrust angle resolvers.
I presume the artificial feel unit and the thrust control unit are on the same mounting.
Could this mounting have come adrift from its moorings in such a way that, as the TL is retarded the mounting is pulled (or pushed) from its position, but subsequently when the TL is advanced, the mounting is pushed (or pulled) back 'home.' Thus the second pushrod doesn't move after the time the mounting leaves its home position.
I can't recall there being any mention of what the original problem was with the thrust reverser - or when it happened. Could this have been the first time the problem occurred? Say the mounting came loose when the TL was moved from reverse idle to full reverse, and they received only idle reverse. Or if it came loose from the idle position, the reverser would not have deployed at all.
This also explains why in the last three landings there have been apparently three different ways of handling the TL, while probably the pilots followed SOPs.
One problem though. If this is the case, there would be no feedback from the artificial feel unit to the TL once the mounting has left home. Would this be noticed by the pilot? Take into account the faulty TL is being moved in unison with the good TL which is receiving feedback, and this was occurring at the busiest part of the flight.
When the PNF called "look this", was he showing the PF that the TL could be moved without resistance?

bsieker

27th Aug 2007, 08:22

1/- I believe, with more than ten years of experience of the airplane, that the non-moving throttle choice was the result of the envelope protection decision, and particularly the Alpha floor, in which an automatic application of go-around thrust, along with the reduction of the AoA happens.

A surprised crew would, in all probability, react first toward grabbing the T/Ls moving to full thrust, thus denying the safety philosophy of the system.

Interesting way to look at it. This is supported by the fact that the locked TOGA thrust ("TOGA LK" FMA display after Alpha floor condition is resolved), unlike other thrust-lock situations, cannot be cancelled be simply moving the thrust levers: autothrust has to be disconnected explicitly. (I could not find whether instinctive disconnect and/or moving levers to idle will suffice -the latter might be impossible, since Alpha-floor protection will activate even with levers in idle-, or if disarming it with the A/THR pushbutton is required.)

Do you know of any statistics about how often the Alpha-Floor-Protection was activated "in anger"? I. e. to save an aircraft inadvertently manoeuvred into the near-stall region of the flight envelope?

(For those still interested in the Ford Trimotor-type set-up, this can be disabled but the Habsheim accident proves that it is not generally a good idea to do so ).

Strictly speaking, in Habsheim it did not matter, since they were flying below 100ft RA, where alpha-floor-protection is inhibited. That they still had pulled the circuit breaker indicated that they had planned to fly higher, but it was not causal to the accident.

Bernd

ELAC

27th Aug 2007, 09:20

alf5071h,

Definitely some important points to consider. For discussion:

Although the lack of reverse was in the briefing, the exact procedure was not discussed which deprived the handling pilot opportunity to visualise his intended actions (recall and refresh from memory), and for the monitoring pilot to both understand the ‘plan’ (what he would be monitoring) and an opportunity to interject if the briefed procedure was incorrect.

Unless we are looking at different documents there was no briefing included in the CVR Transcript. It starts 30 minutes prior to the event with the Captain's PA to the passengers. There is a 22 minute gap from 18:22:39-18:43:04, but it has to be assumed that this because there was nothing pertinent recorded in this interval. Quite possibly the briefing took place just prior to the PA, which is often the case, and was either no longer on the recording or has not been released for some reason.

The possibility that neither crew member knew of the revised procedure remains open, but they had landed in this configuration previously – what procedure was used then?

The FDR data for the previous landing at Porto Allegre shows that the movement of the 2 TL's was synchronous from CLB to IDLE to REV IDLE to MAX REV and back to IDLE. I believe that it has been established that this landing was accomplished by the same crew with the other pilot handling the aircraft.

Post#1893 reports an earlier A320 incident; considering the previous ATR incident and an earlier excursion with a 737, then the indications of this operation was one of high risk. ...

So why didn’t the 737 overrun (or previous ATR, F100 incidents) ring the safety alarm bells, trigger a risk assessment and the reconsideration of operations during the temporary conditions affecting the runway?

How do we know that the bells weren't rung in some quarters? Is it possible that factors other than changes to the runway surface condition were present in the other two incidents (as is the case here) and were quickly determined to have been the deciding factors in those incidents? If so a decision to continue normal operations may not have been unreasonable. How many pilot reports regarding low runway friction were received prior to the event and how were those investigated?

Why did the TAM overrun generate 1900+ PPrune posts vs 11 for the 737?

Well, of course there is the "sensational" aspect which attracts a great degree of attention, but the other reason why this accident is generating so many posts is the unusual amount of factual data that has been released publically in advance of the completed investigation. That amount of data is not available with respect to the other incidents so there is nothing there for qualified observers to consider. In the case of the B737 there's a picture of where the aircraft ended up, but very little information about how it actually got there.

Are we misjudging the important aspects of safety, being biased by fatalities, or incorrectly focussing on the ‘bright’ or emotive aspects of automation?

Of course we are. Public (as in where there is the attention of the general population as opposed to just industry professionals) attention is always biased towards the tragic results of a process gone wrong and not the indicators of risk that a process is going wrong that appear before the tragic result. That is human nature, but it doesn't preclude that there may have been significant discussions occuring pre-event among the professionals involved in operations at CGH. What those discussions may have been and what conclusions may have been drawn would certainly add a great deal to the discussion here. So far though, aside from a few generally attributed "A XXX pilot said this ...", there has been no real reporting of what was happening at CGH prior to the accident.

I would agree that the focus on "the ‘bright’ or emotive aspects of automation" is for the most part a misplaced one that seems mostly to have been introduced by observers who don't have personal knowledge of the automation. How the automation works in practice for someone trained in its use versus how the automation is supposed by someone who has no experience with it in reality are two very different things, and that split is clearly shown by the difference in comments here between those who have that experience and those that don't.

The risk assessment reflected in this thread appears to be biased, if true then is this due to a failure in our beliefs, knowledge, training, safety management culture or just another facet of human behaviour?

Perhaps so. Each of our backgrounds biases the direction from where we perceive the greatest risk might have been. For bubbers et al it's clearly simply in flying an Airbus with non-moving thrust levers. For others it relates primarily to the runway length and condition, and some like yourself see the MEL’ed reverse and associated procedure as having a higher level of precedence in the chain of causation. My interpretation of the information available leads in the direction of the braking procedures being a key link in the risk assessment chain.

In a previous post you said:

With hindsight the aircraft should not have made the approach due the combination of runway / airport conditions and aircraft configuration. Thus a conclusion could be that there was a failure in risk assessment.

Personally, I don't think that this case has been made as of yet. To me, the degree to which the availability of the TR's is relevant to the decision is directly related to the degree of certainty that the crew believed they had in the condition of the runway. The TR's don't factor into the aircraft's assessed stopping capability though they do provide an increased margin against limiting conditions. Suggesting that the go/no-go decision should have been made with the availibility of reverse as a primary basis of consideration would be to suggest that the current regulated operating margins are insufficient. Perhaps that is true, but if it is I think it would be a bit unfair to assess a failure of adequate judgement to the crew (as opposed to the manufacturer/regulator/operator) for not demanding a higher margin than regulations require.

To me, a key point in the land/divert judgement was the crew's assessment of the runway condition based on the available information. How often is CGH reported as "wet and slippery" and what meaning did those words have from the crew's perspective? Experience biases our judgement and a man who has done many landings at CGH, and likely received many "wet and slippery" reports there, has probably built a particular model of stopping performance expectations. We'll never know for this particular crew, but important related questions that I see are:

What level of degradation in performance do pilots at CGH practically associate with a "wet and slippery" report and how does that align with the reference values of "wet" in use to determine the aircraft's capability? If they typically associate this with lower performance than "wet" then there's a clear indication of a risk not adequately assessed by the operator as well as the crews.

What was the actual friction coefficient at the time and how well did it align with the "wet and slippery" report issued by the tower? Does "wet and slippery" have the same meaning for the issuers of the report as it does for the recipients?

How much effect did the resurfacing work have on braking conditions and how well was this reflected in modifications to braking action conditions reported by the tower or assessed by pilots?

Overall, what level of confidence did the pilots have in correlating runway condition reported to actual braking action experienced?

If the pilots had a high degree of certainty about the stopping action they expected and that that level was within the documented safe range for operating the aircraft, then I don't think the aircraft condition with respect to reverse plays much of a factor. However, if the opposite is true, that the pilots had a lowered level of confidence about the stopping action, then I would agree that the aircraft configuration with respect to reverse becomes a key consideration in the risk assessment and decision making process that took place prior to the landing.

Much has been said about landing distances, but how often do crews assess their landings against the requirements? Do crews routinely assess if the aircraft was capable of stopping within the safety margins provided for a limiting runway? Do crews check what % of max landing weight they are at, or how much additional runway they have/have not for a normal landing? Most landings are made on non limiting runways thus crews have few references as to how close they were to the required limiting performance, particularly in less than ideal conditions.

This is, in my opinion, an critical set of questions. The answers in this case might tell us alot about the delay in the application of manual braking on landing. The basic performance data available makes it clear that landing at CGH in wet conditions is an operation that approaches the limits of the aircraft's performance, and the pilot's decision to go below the G/S to achieve an early touchdown supports that he was aware of that fact. So, why then did he consider it acceptable to wait for confirmation of autobraking as opposed to considering it neccessary to apply manual braking right from the moment of touchdown?

I don't mean this to imply criticism of the pilot specifically, it may have more to do with manufacturer or company training or standard procedures, but if there's a clear failure of risk assessment evident in the information so far available it is the failure to appreciate the importance of ensuring (not assuming) immediate braking on landing when operating into a runway which is close to the limiting conditions of the day.

Researching what printed guidance there was on the subject I came up with the following from the Airbus FCTM (02.160 P6-8):

BRAKES

The use of auto brake versus pedal braking should observe the following guidelines:

The use of A/BRAKE is usually preferable because it minimizes the number of application of brake and thus reduces brake wear. Additionally, the A/BRAKE provides a symmetrical brake pressure application which ensures an equal braking effect on both main landing gear wheels on wet or evenly contaminated runway. More particularly, the A/BRAKE is recommended on short, wet, contaminated runway, in poor visibility conditions and in Auto land. The use of LO auto brake should be preferred on long and dry runways whereas the use of MED auto brake should be preferred for short or contaminated runways. The use of MAX auto brake is not recommended.

On very short runways, the use of pedal braking is to be envisaged since the pilot may apply full pedal braking with no delay after touch down.

So, questions from this might be:

How much of this advice makes into line training?

What differentiates a very short runway from a short runway?

Did TAM make this distinction with regard to CGH?

What if any training occurs to help aid the pilot in making the distinction when conditions vary?

It seems from the FDR data available that immediate manual braking in itself would not have prevent the accident when the thrust component of engine 2 is considered, but it would have changed the dynamics of the overrun significantly. As others have calculated previously, with maximum manual braking from just after touchdown the overrun would have been at a significantly lower speed given the actual deceleration rate experienced when the brakes were fully applied. And, depending on what level of reduced braking coefficient is ascribed to the runway condition it is possible that a stop on the runway could still have occurred had the runway been dry.

ELAC

BOAC

27th Aug 2007, 10:00

I think it would be a bit unfair to assess a failure of adequate judgement to the crew (as opposed to the manufacturer/regulator/operator) for not demanding a higher margin than regulations require.- I have supported this from the start, and I believe the crew operated IAW the information (and probably training) they had. It is the second part of the quote where I feel the results should focus, and I support the call for all new runway surfaces to be 'reclassified' when wet particlarly until grooving is complete.

I have to say that like others I would probably not have tried to land there that evening in that aircraft.

An interesting point arises from the AB FCTM: I was always taught (Boeing) to use autobrake when conditions might be marginal (since application of 'manual' braking can be delayed sometimes if you finish up doing a 'soft-shoe-shuffle' on the rudder pedals) and then to apply the required foot pressure. Has this advice now dropped out of the frame?

EMIT

27th Aug 2007, 10:22

The question of BOAC in post 1916 is interesting because it shows how difficult communication really is at all levels.

The post of ELAC, that BOAC refers to, mentions that on very short runways, manual braking is "envisaged". The question of BOAC seems to imply that this term means that autobraking is not to be used.

NOT SO! There is every reason to set the heaviest practical autobrake level (but Airbus states that MAX should not be used for landing), but then to try to manually win from the autobrakesystem by applying brakes quicker and harder. The "footshuffle" that BOAC mentions, probably leads to the practical result that autobrake applies brakes quicker, but pilot then counters with heavier brake pressure than autobrake would have given (don't managers call that a win-win situation?)

The reading but perhaps not fully understanding of what is written can be observed more often in the postings - I can recall from a long way back that a B-757 driver quoted his FCOM as stating the thrust leverS have to be in idle before the reverse leverS can be raised. He did not quote however a paragraph from a few pages earlier stating that each engine has its' INDIVIDUAL CONTROL (= thrust lever) on the flight deck. (individual means independant of each other).

BOAC

27th Aug 2007, 10:37

It certainly does not read that way. I would have preferred to see clear emphasis on using A/Brake and then, asap, applying 'manual' brakes. What is actually taught by AB?

ELAC

27th Aug 2007, 10:58

BOAC,

I support the call for all new runway surfaces to be 'reclassified' when wet particlarly until grooving is complete.

I think there are good questions to ask about the characteristics of newly paved surfaces. If there are differences that occur in the "curing" process then they should be identified and accounted for in performance planning. I suspect one of the problems would be that different processes in different places will have different results, so a rule based response might not be as good as a test or observation based response.

There is also the matter of the number of ungrooved runways that still exist and the higher risk they impose on operations. Why do regulators allow that risk to continue when there must be some practical grooving methods that can be applied even to older and sub-standard runway surfaces? Your concerns regarding hydroplaning are most particularly apt in respect of the combination of non-grooved, questionably crowned runways in areas of poor drainage, and there are quite a few of those still out there.

I have to say that like others I would probably not have tried to land there that evening in that aircraft.

Nor likely would I have, but I do respect that specific training and experience with that operation would make me approach the judgement differently. The answer for me might have remained the same, but possibly not.

An interesting point arises from the AB FCTM: I was always taught (Boeing) to use autobrake when conditions might be marginal (since application of 'manual' braking can be delayed sometimes if you finish up doing a 'soft-shoe-shuffle' on the rudder pedals) and then to apply the required foot pressure. Has this advice now dropped out of the frame?

No, I don't think so. The guidance for the planned use of autobrake in most situations where significant braking is required is sensible since it provides a quicker and more consistent start to braking than the pilot is likely to achieve and can help with directional control issues when braking coefficients are low. I think that the last bit about the use of manual braking on very short runways is meant to cater to instances when you are operating at or near the limits of the aircraft's performance where there may not be a sufficient margin between the required and the available distances to permit a failure of the automated system to occur, be recognized and be responded to safely. Hence the recommendation to plan manual braking which is consistent with what is written a bit later and which applies to all of us whether Airbus, Boeing or of any other stripe:

Auto-brake does not relieve the pilot of the responsibility of achieving a safe stop within the available runway length.

Personally I take a belt and suspenders approach. If the approach is a difficult one the manual braking can get delayed so I'd want the autobrake backing me up in case my planned manual braking was delayed. For a situation similar to this I would have had the autobrake armed at medium, but intended to use it only as a backup to manual braking commencing at touchdown. If you look at the FDR data for the previous landing at CGH you will see that this is how the pilot who did that landing approached the situation as well. Why the pilot in this case didn't choose the same approach is, to me, a critical question.

ELAC

bsieker

27th Aug 2007, 12:26

The post of ELAC, that BOAC refers to, mentions that on very short runways, manual braking is "envisaged". The question of BOAC seems to imply that this term means that autobraking is not to be used.

NOT SO! There is every reason to set the heaviest practical autobrake level (but Airbus states that MAX should not be used for landing), but then to try to manually win from the autobrakesystem by applying brakes quicker and harder. The "footshuffle" that BOAC mentions, probably leads to the practical result that autobrake applies brakes quicker, but pilot then counters with heavier brake pressure than autobrake would have given (don't managers call that a win-win situation?)

As we are witnessing here, manual braking will not give higher deceleration than even autobrake LO would have provided (we observe an average of 1.26m/s^2, with a peak close to 2.0 at the beginning of manual braking). Deceleration force delivered by the wheel brakes is limited by the friction coefficient (and the normal force on the wheels). Anti-skid keeps brake pressure near the optimum, regardless of autobrake or manual brake.

What can make a (possibly crucial) difference is that manual braking can be commenced with maximum pressure (limited by anti-skid) as soon as MLG touches down, before the nosewheel touches down. (This precedure is explicitly allowed, discouraged only for comfort reasons).

(Leaving aside possible foot shuffle; if necessary the PNF could prepare for manual braking while the PF is keeping the A/C straight with the rudder. Forgive me if this is so far outside SOPs as to be not considered.)
Autobrake MED has a 2 second delay (usually enough for a quick derotation), and LO has a 4 second delay (allowing for a slower, smoother derotation) after MLG touchdown; both apply pressure "progressively", which I read as slowly increasing.

I also understand "use of manual brake should be envisaged" as "watch autobrake closely and use manual braking as soon as possible when necessary". Except in the case of an autobrake failure I don't see the benefit of this course of action on slippery surfaces, since it will not give higher deceleration (assuming the friction coefficient tlimits deceleration to less than 3.0 m/s^2, and autobrake MED selected).

Bernd

PAXboy

27th Aug 2007, 13:21

(non-pilot speaking) Yesterday I has a most interesting example of the way in which human audio processing is inhibited during times of sudden crisis.

In the car approaching a complicated, but to me well known, traffic intersection. I was listening to a spoken word radio programme and was following the conversation. As I moved into the junction, a car on my left made an erratic movement and threatened to enter the road space that I was driving into. At the same moment, I saw a Police car parked on the far side with it's blue lights on and I had to assess what the problem was and how it would affect me, as well as avoiding being hit by the car on my left.

Fortunately, all went well and I exited from the junction without incident. This was not a crisis, just a momentary every day traffic problem but, as I drove away, I realised that I had 'lost' about 7 seconds of the radio programme as my brain focused on the problem.

Professional pilots are, of course, trained rigorously to be able to maintain sensory input but it was a fascinating example of how easily the hearing function is 'downgraded' by the brain. Which led me to think that enhanced audio prompting as suggested in this thread, "Retard Two, Retard Two" may not have the desired effect. Of course, that is no reason not to implement it as we cannot know how we are going to react when faced with 'the real thing'.

Lemurian

27th Aug 2007, 16:22

the locked TOGA thrust ("TOGA LK" FMA display after Alpha floor condition is resolved), unlike other thrust-lock situations, cannot be cancelled be simply moving the thrust levers: autothrust has to be disconnected explicitly. (I could not find whether instinctive disconnect and/or moving levers to idle will suffice -the latter might be impossible, since Alpha-floor protection will activate even with levers in idle-, or if disarming it with the A/THR pushbutton is required.)

The only way of exiting TOGA LK is by pressing the A/THR switchlight. It has to be a determined and conscious way.

Few Cloudy

27th Aug 2007, 16:51

Pax Boy,
A nice analogy, which just shows how the brain prioritises events.
However the likely scenarios on the road are myriad - on a sterile runway much less so - and those that do exist are often trained for in detail.
Also there are two pilots but only one "pilot" in your car, so the back up system is not in place (unless your mother in law is in the back seat...)
Here are two professionals, with an out of the ordinary situation, who have to assess the situation on the basis of trained emergencies and system knowledge and come up with a procedure, possibly also based on trained procedures to deal with it.
If they had managed it, this thread would not be here. As they didn't, it is. It is a fine line...

TyroPicard

27th Aug 2007, 17:07

Lemurian
The only way of exiting TOGA LK is by pressing the A/THR switchlight.
Not true. You use the A/THR disconnect pushbutton on the thrust levers.
TP

W Weasel

27th Aug 2007, 17:28

Looks like some pretty good info here. I tend to agree.
http://brazil.suite101.com/article.cfm/tam_3054_crash_investigation
The data shows important information that will most likely be listed as a primary contributor to the cause of the accident.
* The aircraft failed to decelerate due to failure of the brakes and ground spoilers to actuate early in the landing roll. This was caused by failure to retard the #2 engine to idle thrust.

Lemurian

27th Aug 2007, 17:49

You use the A/THR disconnect pushbutton on the thrust levers.
OOOOPS ! Was busy concentrating on the T/L movement.
Owe you one.

PBL

27th Aug 2007, 18:37

I'm having a little bit of a problem; maybe someone can help. The TAM president told Congress recently that TAM was going to implement the latest SB from Airbus, which includes a warning about mismatched thrust levers. The operation of the warning was published by, for example, Veja about a week ago. The SB is supposedly 31-1267, issued 13 November 2006. It replaces FWC standard H2-F2 with standard H2-F3.

Revision 2 of SB 21-1267 is dated 16 July 2007, the day before the Congonhas crash. But I cannot find anything about a warning system for thrust-lever mismatch in the description. Can anybody who *knows* please say whether it is there or not in 31-1267, or Revision 1 or Revision 2?
If not, is there by any chance a Revision 3 which includes it? With which date?

PBL

leilas23

27th Aug 2007, 19:27

PBL- TAM distributed Rev 2 to the press, to "prove" that they were not to blame for not "knowing" about the new TL ABV IDLE alert. That is because, as you noted, it is not explicit in Rev 2, which is classified "desirable". I don´t know if it would be in the original SB (NOV 13 06) or first revision (MAY 21 07), but i don´t think it is very likely to be explicit anywhere. This is why:
The alert was announced by Airbus after the Taiwan accident and to be issued "soon" in the H2F3 standard. But according to Yannick Malinge, certification authorities did not see the alert as efficient and practical, in terms of creating situational awareness for the pilot in the split second scenario of TL ABV IDLE.
Please let me know if you advance on this.

marciovp

27th Aug 2007, 23:09

The Airbus software that TAM is going to buy and install in all A320s is called FW3.

Excuse me for saying this, since I am not a commercial pilot. Small fish
that never got there. But I did fly Cherokees and before Piper Tripacers.
Now the question: this is the third similar accident. Do we really think they are only human errors?...

Carnage Matey!

28th Aug 2007, 00:46

Nah, conspiracy theories and groundless speculation make the world go round, otherwise flyingnewbie wouldn't be here posting rubbish.

barit1

28th Aug 2007, 01:04

Do we really think they are only human errors?...

Insanity: doing the same thing over and over again and expecting different results. - attributed (perhaps imprecisely) to Albert Einstein

Flight Safety

28th Aug 2007, 09:13

There are several contributing factors to this accident. While the discussion of braking method is very interesting, I think it's almost academic given that the ground spoilers failed to deploy in this accident, as several previous accidents demonstrate how ineffective braking can be on wet runways without ground spoilers.

My own focus has been on the fact that the ENG2 TL was left in CLB detent, which prevented the GS from deploying (thus minimizing the braking action), and adding forward thrust to a decelerating aircraft. My particular focus has been on why the pilots failed to retard the ENG2 TL, which to me seems central to this accident.

Regarding PBL's comments about Raskin, the A320 is a heavily computerized aircraft, the first of its kind (FBW) in airline operations. The rest of the A320 family, the A330, A340, A380, 777, and 787 have since followed it into airline service. The very fact that all primary control inputs are feed into and processed by a computer makes Jef Raskin's Human Interface Design Rules for computers extremely relevant in my view. If a joystick for primary flight control input isn't a computer interface subject to HMI design rules, I don't know what is. On the A320, thrust levers also provide primary control input to a computer and are processed. While "modes" can be made to exist in mechanical controls, they are primarily the creation of computer programs, where the programmer determines what the control inputs mean, and how they are processed. This is the main reason why some set of Human Machine Interface Design Rules are needed when writing control interface programs, because without the disciplined guidance of design rules, a programmer could write anything (from good to terrible) as a control interface.

Regarding how the pilots interacted with the A320 throttle system in this accident, and given that the failure to retard ENG2 TL to idle caused everything to go wrong during this landing rollout, I'm going to try to put myself in the cockpit (as uncertain as this may be) during the landing.
As we know from the CVR transcript, both pilots were aware of the runway length and conditions (wet and slippery). Both were aware that ENG2 TR was inop. They briefed each other on these things, though some have correctly posted that the briefing was not extensive and did not include a concise plan of action.

My own opinion is that fear (and it relatives like anxiety, etc), cause the narrowing or tunneling of mental processing that's been discussed often in this thread. Fear seems to create a narrow focus on the circumstances causing the fear. But this narrowing focus seems to also include a kind of mental "load shedding", where the mind seems to "select out" anything in the environment that doesn't seem relevant. A fear response also seems to move more towards a "fight or flight" physical action based response, and away from higher levels of mental reasoning as a response. As others have pointed out, hearing seems to be one of the first things "selected out".

As these pilots neared touchdown, a couple of interesting things happened. First, the "retard" callout began about 5 seconds prior to touchdown. Then, 3 seconds after the retard callout started, one of the pilots pulled the ENG1 TL back to idle, but left the ENG2 TL in the CLB detent. Why was the "retard" callout ignored and why leave the ENG2 TL in the CLB detent? Or was the "retard" callout actually responded to by a pilot who simply pulling the ENG1 TL only back to idle? It's possible the pilots actually responded to the "retard" callout by pulling the ENG1 TL back to idle. However I think the reason for selecting ENG1 TL only to retard, was because the pilot who did this wanted to get the ENG1 TR deployed as soon as possible after touchdown, which in fact he did.

However these actions may already show some cognitive narrowing due to anxiety over landing in these conditions. Instead of pulling ENG1 TL only back to idle, they should have pulled both throttles back. They also should have delayed the deployment of reversers (or the one good reverser) until confirmation that the spoilers were deployed, otherwise brake performance would be abysmal. What the pilot did was a more action oriented response (get that reverser out ASAP) rather than a more reason oriented response (pull both TLs back, wait for touchdown, wait for spoilers, deploy TR).

Three seconds after touchdown, the callout was made that there were no spoilers. If the anxiety level was pucker factor 3-4 on approach to landing, the realization and callout 3 seconds later that there were no spoilers, must have created immediate pucker factor 10 for both of these very experienced pilots, who knew exactly what no spoilers meant in those conditions. At pucker factor 10 the cognitive reasoning would have been narrowed greatly, as we know they never figured out in the 16 seconds from that callout until impact, that they needed to retard the ENG2 TL to have a chance at stopping (or a much lower speed overrun). In those 16 seconds, the responses all seem to be action based, "decelerate", "it can't", "oh my god", "turn, turn", rather than reason based, "why are there no spoilers", etc. Nothing against these pilots for what happened, as I think this is human nature that all of use are subject to.

Now to conclude my argument that the multimode throttle system in the A320 may have played a role in this accident, I would argue that since auto throttles is used a lot during the gate to gate time of an A320, the mode (or state) of "thrust lever angle DOES NOT equate to engine power" is probably the predominate mode (or state) of the throttle system while pilots are operating the A320. This however in not the mode (or state) used when the aircraft is on the ground, where trust lever angle DOES equate to engine power, and where the ground spoiler system thinks it does as well. The whole idea behind a single mode primary control is that the action and responses of that control are so consistent and predictable, that using the control becomes a habit so that one no longer has to think about or mentally process how that control functions. This is what Jef Raskin meant when he said you can "habituate" the control, if it’s modeless.

However it's not possible to fully "habituate" the function of the throttle system of the A320, because it has multiple modes. This means you have to think about how it functions at times. In the circumstances these pilots were in after touchdown, they apparently were not in a condition to notice (however I still wonder what “look this” was referring to in the transcript) or think through the meaning of the ENG2 TL position. My argument is that if the throttle system had been single mode in the sense that throttle lever position ALWAYS equated to engine power, then you wouldn't have to think about how it worked when you're in a situation where it's hard to think. It's very possible the pilots could have noticed and acted instinctively (meaning to act without thinking) to pull the ENG2 TL back. At pucker factor 10, performing actions is about all you can do.

Would a single mode throttle system have saved the day in this accident? I don't really know, but I do think it would have increased their chances.

BOAC

28th Aug 2007, 10:13

They briefed each other on these things, though some have correctly posted that the briefing was not extensive and did not include a concise plan of action. - unless you have access to more of the CVR than we do, you cannot say this as fact. To avoid the howls of anguish, I DO hope they would have briefed fully, and EXPECT they did, but there is no available confirmation, so we do not know the briefed 'plan' for a wet and slippery CGH near max weight - if there was one, nor of any reminder about 'special' procedures. E.G. It is JUST possible that the 'inhibit GS' call took P2 a bit by surprise too?

bsieker

28th Aug 2007, 10:20

Flight Safety,

as has been eloquently laid out by PBL, (have you bothered to read the paper he mentioned and done the exercise?), flat state spaces will not work for avionics systems as complex as are required to fly modern airliners.

As to the workings of the thrust levers: it is really terribly simple, and a confusion very unlikely:

In a normal flighth you really only need three positions. This flight was no different:

- FLX/MCT (or possibly TOGA in certain conditions) from takeoff to thrust reduction. This gives flexible (or maximum) take-off power and arms autothrust.
- CL throughout the entire flight from thrust reduction to flare. This activates autothrust, previously armed by setting (flexible or maximum) takeoff power.
- IDLE during flare.

During rollout you additionally may use REVERSE IDLE and MAX REVERSE.

I do not see at all why this would not be habituating. I fyou fly at autothrust, you leave the thrust levers alone, if you require manual thrust, you disconnect autothrust (thumb-pushbutton at the side of the levers, aptly named "instinctive disconnect") and move the levers as required. Simple.

And to repeat the argument agains the assertion that it is great that the thrust levers always equate to engine power: that can be so habituating that one might fail to realise that it is not true in case of an engine failure (there have been examples, cited just recently in this thread). Being used to looking at the instruments to gauge engine parameters instead of the levers, helps.

That is not to say that either design philosophy is inherently better than the other, but (again) to point out that it isn't that easy.

To strain the car metaphor again: some older cruise control systems actually moved the accelerator pedal, but many modern ones don't. A side-effect of "FADEC" for cars. Will that confuse the driver?

Bernd

RatherBeFlying

28th Aug 2007, 10:49

To strain the car metaphor again: some older cruise control systems actually moved the accelerator pedal, but many modern ones don't. A side-effect of "FADEC" for cars. Will that confuse the driver?The cruise control for my car is the non-moving gas pedal type like many others. There are times I have forgotten it's still on when the car accelerates by itself and I have to choose to accept the acceleration or cancel it:\

However the engine goes down to throttle off when I put in the clutch or touch the brakes -- something that may have helped at Congonhas.

Also there's only one engine.

PBL

28th Aug 2007, 10:55

The very fact that all primary control inputs are feed into and processed by a computer makes Jef Raskin's Human Interface Design Rules for computers extremely relevant in my view.

The reason I keep harping on about this is that there seem to be quite a few people on this forum who think that they can design and analyse HCI to control systems, without showing that they have any interest in the rather large engineering literature on such things. So we see the same sophomore-level arguments. Your suggestion is not one of those, however; it actually references the literature. And is therefore worth thinking about.

Its weakness is that it has a simple refutation, which I indicated.

There are a few hundred researchers, and a few thousand HCI professionals, in the world who spend their time thinking about such things. They hold conferences. If you think that your view has merit, and that it has been somehow missed by the HCI community (most of whom are very well aware of Raskin's work), then I suggest you write it up and submit it to one of those conferences for peer review. It will go to someone to be refereed who knows about interfaces to control systems.

It will probably come back with a two-sentence refutation similar to mine (unless it comes to me, in which case it will be identical with mine).

There are also some things wrong with your further chain of reasoning.

While "modes" can be made to exist in mechanical controls, they are primarily the creation of computer programs, where the programmer determines what the control inputs mean, and how they are processed.

There is an equivocation hiding in here.

A mode is exhibited when a control action results in one function F in environment A, and a different function G in environment B. The values of the environmental parameters A and B define the mode under some suitable way of saying what parameter settings are equivalent.

When you command thrust reverse on a B767 in flight, you don't get thrust reverse. So a mode is exhibited: let us call them "GROUND" mode and "AIR" mode. This mode change is accomplished through an interlock. Interlocks have been around since whenever, and in mechanical systems this is one of the words that is often used; there are others.

But "mode" itself is a word which came into use to describe the different sets of environmental parameters which were sensed to determine what function F was executed, when digital computation started replacing mechanics and analog-electrical control. So people tend to think that "modes" come with digital computation, whereas they were around long before. It is, however, true that modes became more prevalent with the advent of digital control. This is because (to say it again) they are how one controls the complexity of the state space.

In software design for other uses, one speaks of "hierarchical decomposition". There is no other known way of controlling the complexity of the state space. Some control-system specification methods, such as Statecharts, which has been prevalent in the aviation industry since David Harel proposed it a couple decades ago for use by IAI, actually rely on modes as the main design function. Statecharts specify hierarchical state machines, and that word "hierarchical" means that you have modes, at least in the innards of the design. Since the user of such systems also has a complex state space, modes bubble through inevitably to the user interface. Other systems such as Lustre, the basic specification instrument for SCADE, also involve hierarchical state machines.

So modes are basic. You don't have to like them, but if you are advocating that people drop them, it becomes incumbent upon you to suggest how the systems can be designed without them.

If you want a flat state space, you could always just go back to B727-like controls but implement them electrically, such as in the back-up direct-law control to the B777 FCS. But no one would buy your airplane. They wouldn't just not buy it because it was old-fashioned. They wouldn't buy it because the generation of airplanes with digital control systems has by and large a statistically significantly better safety record than older generations, and most people who buy these airplanes think it has something to do with the digital control and flight management systems.

without the disciplined guidance of design rules, a programmer could write anything (from good to terrible) as a control interface.

That suggests an inappropriate view of how these systems actually become implemented. Crudely put, modern control systems are written by designing state machines on your screen and "pressing the button" to have code come out. No programmer using these systems can just "write anything". And programmers don't write control interfaces. Control interfaces are designed by HCI specialists or engineering psychologists or whatever you want to call them, and are evaluated directly as well as derivatively through many thousands of hours with test pilots in simulations. And then these designs are passed on to the design engineers who put them into the CAD system and then "press that button" to get the object code.

One is free not to like modes, but there is no better alternative for these applications. If you want to give up modes, you will also give up functionality. That is a hard technical constraint, and is the reason why no control system design engineer will listen to you if you try to persuade himher to go modeless.

PBL

Rob21

28th Aug 2007, 12:39

Al Zimer,

I understood from the CVR's tanscripts that was the PF who said (@ 18:48:33) "Look this!", and not the PNF (or pilot monitoring). And this is what puzzles me. Please, follow me on this: I believe almost everybody here agree that the PF (pilot flying) is looking out, at the runway, during the flare (18:48:21).
Especially on this flight, touchdown on the right spot is crucial. Let's imagine the pilot will continue looking out during touchdown (18:48:27). So I believe the PF is still looking at the runway when he gets the call "spoilers nothing!" (18:48:29).

Where I'm trying to go is: The pilot flying has his eyes out to the runway, and has his hands (and feet) on the controls. So it's not hard to imagine that when he says "Look This!" (18:48:33) , can only be two things: 1- Something ABNORMAL he sees outside (I don't think so) or, 2- Something ABNORMAL he feels on the controls.

Now, let's imagine he had his right hand on only one TL (left). He reduced this TL to idle, then reverse. It worked fine, so what he "felt" on the controls that was so ABNORMAL, to the point he exclaims "look this"?

Let's imagine now that he had his right hand on both TLs and he is looking out to the runway. He reduced both TLs to idle, but "feels" something ABNORMAL with the TLs, thus the exclamation "Look this!"

His exclamation (look this) really puzzles me. If this exclamation had come from the pilot monitoring, this could mean many things. But coming from the PF, in a critical phase of flight when the PF is "only" looking out to the runway and "feeling" the controls, this tells me something happened with the TLs.

Thanks for your patience.

Rob

PAXboy

28th Aug 2007, 12:59

(non pilot speaking)
Flight Safety(however I still wonder what “look this” was referring to in the transcript)
Indeed. I have said it before in this thread: The need for video cameras on the flight deck is growing. It has been proposed that one camera is mounted centrally to look at the pilots and that another is placed in the roof looking down onto the central quadrant (as I believe it is called). The information would be digital and stored along with all the other data.

Sampling rates would have to be very high to catch every flick of a switch. In this case (if the data was readable) we would see what they were pointing at and the truth about the thrust levers.

I understand that many pilots were against the introduction of CVR but these are now accepted as being helpful in saving lives. Cameras will follow this route.

PBL's excellent setting out of 'Modes' made me remember that we all operate in Modes every minute of the day. Sometimes these come into conflict and/or confusion. We might be doing our regular job but, when we walk out of the office we change Mode.

If your work is to be a teacher, you may have to exert discipline towards a student, even when your own Mode is pushing you to act like a parent. You have to decide which Mode is in force and balance them, perhaps using some experience as a parent to be a better teacher. If you are walking in the High Street as a parent but a student greets you - you have to partially change mode.

Now, I appreciate that flight Modes are exclusive to others Ground OR Air - not half and half but I thought that introducing the Human Modes (which are usually mixed!) might remind us of how we all live in Modes and constantly move between them.

PBL

28th Aug 2007, 18:31

Marciovp,

The Airbus software that TAM is going to buy and install in all A320s is called FW3.

I am not aware of that form of designation in AI products. But I don't by any means know them all. Do you (or anyone) happen to know to what kind of object it refers?

PBL

atakacs

28th Aug 2007, 19:44

If you want a flat state space, you could always just go back to B727-like controls but implement them electrically, such as in the back-up direct-law control to the B777 FCS. But no one would buy your airplane. They wouldn't just not buy it because it was old-fashioned. They wouldn't buy it because the generation of airplanes with digital control systems has by and large a statistically significantly better safety record than older generations, and most people who buy these airplanes think it has something to do with the digital control and flight management systems.

You most certainly have much more expertise in this field than me but you will have a hard time making me believe that no one would buy an A320 because it's T/L are fitted with motion feedback mechanisms...

I would even venture that regardless of the pontification about the HCI community and the supposed irrefutable quality of the AB FWB software I'm rather convinced that there are common sense improvements that could be at least considered to improve those systems which I still see as contributing factors to this tragic - and not unique - accident.

PBL

28th Aug 2007, 19:59

regardless of the pontification about the HCI community and the supposed irrefutable quality of the AB FWB software

Sorry, I've missed that. To whose comments are you referring?

PBL

atakacs

28th Aug 2007, 20:43

Originally Posted by atakacs
regardless of the pontification about the HCI community and the supposed irrefutable quality of the AB FWB software
Sorry, I've missed that. To whose comments are you referring?
I have a very strong feeling (partly induced by reading your otherwise excellent posts) that the FWB community response to the Congonhas crash is "those guys goofed up big time and there is not a single thing we could improve in our FWB software. Actually if you think otherwise then your are incompetent in this field, hence unqualified to discuss it."

Don't get me wrong, I don't want to start any kind of flame war. It's just that I am seeing too many posts in this thread that point in the above direction.

Let me reiterate that I am pretty much convinced that this tragedy raises many valid questions about HMI and that they deserve consideration and possibly action. I might be wrong but I feel like they are not addressed and might not be in the future.
Just my 2c anyway

PBL

28th Aug 2007, 20:58

atakacs,

OK, thanks for the clarification. I was concerned that you might be misinterpreting some of my interventions. My comments on software, modes and state spaces concern (obviously, so I hoped) the technology of digital control systems and are independent of manufacturer.

PBL

Brian Abraham

29th Aug 2007, 00:20

From AIN
Brazilian Aviation Agency Losing More Leaders
The leadership of Brazil’s Agência Nacional de Aviação Civil (ANAC) is collapsing under the pressure of international criticism. ANAC director Jorge Brito Velozo, formerly of the Departamento de Aviação Civil, will resign today, and president Milton Zuanazzi is expected to resign by the end of the week, according to Adalberto Febeliano, executive vice president of the Associacão Brasileira de Aviacão Geral (Brazilian Association of General Aviation). The two resignations follow last Friday’s resignation by ANAC director Denise Abreu. The agency has been under intense scrutiny, Febeliano said, following the 2005 bankruptcy of Varig Airlines, last year’s Gol 737/ExcelAire Legacy 600 midair, the air traffic controller strike early this year and the TAM crash at Congonhas Airport in July. “Everyone was under criticism after those four large events,” Febeliano told AIN. “The public, especially the large media, wanted them to be guilty. They pointed their fingers at the agency the same way they pointed their fingers to the Legacy pilots last September. It is really more a matter of public pressure than of real mismanagement.”

arcniz

29th Aug 2007, 00:28

“The public, especially the large media, wanted them to be guilty. They pointed their fingers at the agency the same way they pointed their fingers to the Legacy pilots last September. It is really more a matter of public pressure than of real mismanagement.”

When you need a scapegoat, the folks in charge of the process which has gone wrong are pretty good candidates, eh?

lomapaseo

29th Aug 2007, 00:36

I have a very strong feeling (partly induced by reading your otherwise excellent posts) that the FWB community response to the Congonhas crash is "those guys goofed up big time and there is not a single thing we could improve in our FWB software. Actually if you think otherwise then your are incompetent in this field, hence unqualified to discuss it."

Don't get me wrong, I don't want to start any kind of flame war. It's just that I am seeing too many posts in this thread that point in the above direction.

Let me reiterate that I am pretty much convinced that this tragedy raises many valid questions about HMI and that they deserve consideration and possibly action. I might be wrong but I feel like they are not addressed and might not be in the future.
Just my 2c anyway

I agree

This is not the first nor probably the last time that we will argue that a perfectly sound system has been screwed up by the unanticpated actions of man.

But can we or should we continue to argue that the screw ups are unanticipated? Was this accident really a surprise?

will the next one with all the same ingredients be a surprise?
Will the investigation stop short of looking at the man/machine interface and the smoke trail pointing at the precendents to this accident in numerous previous similar events?

Where was the regulator in their review of the previous accident/incidents with all the same similarities? Could we not see that a catastrophe was coming?

HotDog

29th Aug 2007, 02:40

the central quadrant (as I believe it is called

It's called the pedestal. Cockpit cameras would not have prevented this accident and could equally happen on a 737 if the pilot retards just the one thrust lever after touch down.

marciovp

29th Aug 2007, 03:34

PBL said: I am not aware of that form of designation in AI products. But I don't by any means know them all. Do you (or anyone) happen to know to what kind of object it refers?

The press in Brazil published widely the news that TAM was going to install the new software from Airbus named FM3 in all its planes (US$5000.00 a piece)

See here in Brazilian Portuguese:

http://www.estadao.com.br/estadaodehoje/20070815/not_imp34988,0.php

It says that TAM was going to install this software in all planes. That Airbus had produced it but instructed that it was a "desirable" software not a "mandatory" one. It will warn the pilots in sight and sound when the two TLs are pointing to opposite sides as it seems to have been the case with the disaster A320.

Sorry, this is as far as I could go. But will keep an eye on it.

Going back to my road analogy...just a little modification. We have three accidents in a road turn with a specific brand of automobile. Of course there is human error involved...but we would not look at that specific automobile to see how it could induce or make it more possible the human error?...

Just pushing the issue... (should I go back to my Cherokees?...)

marciovp

29th Aug 2007, 03:41

Just for the record, ANAC (National Agency of Civil Aviation) on being investigated showed that with a few exceptions most directors were political appointees who knew nothing about aviation. That many of these directors accepted a large number of airline tickets from the companies they were suppose to regulate and...a bizarre thing: when a federal judge decided to close Congonhas for being unsafe, one director brought to the judge a regulation that said that no airplane should land in Congonnhas with one reverser locked up. With that documento the judge liberated Congonhas...but... the regulation never was made official. It seems clear that instead of regulating the airlines they were working with them, and receiving favors from them. This is why they are in the news. I don´t see scapegoating here.

bsieker

29th Aug 2007, 08:30

No one answer me?
What is behind the logic of not deploying armed spoilers, even after manual braking is applied, if TLA is not in idle? I don't understand that. Please, I would like to understand.

I think this is a very good and valid question. I have also discussed this with PBL, and we made the following observations (PBL, feel free to correct me):

1/ Using manual braking alone as a signal to deploy ground spoilers will not work, as brakes may inadvertently be pressed in flight when making rudder inputs.

2/ Combined with any of the "on-the-ground" conditions (wheels spinning or (MLG struts compressed and RA <6ft)) it looks like a good idea. We'd still need to consider the late-go-around ("touch and go") scenario, in which rudder inputs may be needed, and brake inputs may occur, and ground spoiler deployment would be fatal.

3/ We consider it useful, as a previous poster said (I'm sorry I can't remember the name), to think of the thrust levers as "Stop"-levers. I want the aircraft to stop: I pull the thrust levers back. Although they are not really brake-levers, they work as such after touchdown: they are the only directly flight-crew-controlled inputs to the ground-spoiler extension logic, which in turn activates automatic braking.

The "LOSS OF BRAKING" memory item has as the first point after "If no braking available" (when using manual brakes):

REV ...... MAX

I have remarked before that it looks like the crew in this accident did not think they had "lost" braking, and did not fully and immediately apply the memory item.

It is also a question of whether or not they considered the less-than-satisfactory performance of the manual brakes to be "No braking available", in which case they would have gone to the next item on the list(REV: MAX), and taken a second look (touch) at the thrust levers.

I had asked experienced A320 flight crews for what situations exactly said memory item was trained:

Only failure of autobrake after it had initially been active?
And/or failure of manual brake if no autobrake was selected?
Also in a case like this where autobrake fails to engage because of failure of GS deployment?

For the third case the memory item would to be more aptly called "NO BRAKING"

As has also been suggested, it might be useful to do some data mining through collected flight data (properly anonymised) to find out how often one T/L was "forgotten" at a position above "near idle" without dire consequences.

---

Going back to my road analogy...just a little modification. We have three accidents in a road turn with a specific brand of automobile.

This one doesn't hold water.

1/ This is the first such accident at this corner (airport)

2/ there have actually been more accidents of this kind with the other brand of car, than the one involved in this accident: there have been more runway excursions on landing with B737-300/400/500 than there have been with A320, as shown by PBL in post #1316 (p.66).

So this is like saying: A Mercwagen has crashed here, so let's look at what is wrong with Mercwagen cars, when in fact more BMGs have crashed in the same way. But still people insist that there is something wrong with Mercwagen, but not so with BMG.

Bernd

TyroPicard

29th Aug 2007, 10:34

bseiker
1/ Using manual braking alone as a signal to deploy ground spoilers will not work, as brakes may inadvertently be pressed in flight when making rudder inputs.
Agreed. Also, we taxy out with ground spoilers armed - they would operate every time we used the brakes and are presumably not designed for that over their life.
2/ Combined with any of the "on-the-ground" conditions (wheels spinning or (MLG struts compressed and RA <6ft)) it looks like a good idea. We'd still need to consider the late-go-around ("touch and go") scenario, in which rudder inputs may be needed, and brake inputs may occur, and ground spoiler deployment would be fatal.
For the "rejected landing" in Airbusspeak/touch and go, the ground spoilers will retract if one thrust lever is advanced above 20° .. so that's already taken care of.
But they would still operate taxying out..... and would be extended if you held on the runway with the brakes on .. this might lead to taxying out with them "not armed" .. could they be forgotten thus adding to the risk?
Regards, TP

bsieker

29th Aug 2007, 11:37

For the "rejected landing" in Airbusspeak/touch and go, the ground spoilers will retract if one thrust lever is advanced above 20° .. so that's already taken care of.

Agreed. Here we're talking about precisely the case where one thrust lever is above "near idle", but manual braking should still deploy ground spoilers.

So we consider very late rejected landing, immediately before or after touchdown, possibly one engine out, thus one thrust lever at idle, the other at TOGA, inadvertent brake inputs while compensating for asymmetric thrust with the rudder.

Ground spoilers or no? Probably no, because of TOGA.

But if the PF did not set TOGA thrust, thus one lever at idle, one at MCT (standard setting for A/THR with one engine out). (Remember Sochi, where the pilot perfomed a go-around without setting TOGA thrust, albeit at higher altitude.)

Compare to this case:

One thrust lever at reverse, the other at CL, manual braking.

Ground spoilers or no? Perhaps yes, because of reverse ...

We must be very careful about the conditions under which to deploy the ground spoilers. Is there a possible credible scenario with one TL at reverse, the other at cl, brake pedals pressed, where one does not want to stop?

But they would still operate taxying out..... and would be extended if you held on the runway with the brakes on .. this might lead to taxying out with them "not armed" .. could they be forgotten thus adding to the risk?

We speculated before about the risk of failure to deploy ground spoilers when rejecting takeoff with two reversers inop, where SOP usually appears to be not to select reverse. So not arming ground spoilers for taxiing, forgetting to arm for take-off, and not selecting reverse in a reject: No ground spoilers during reject, which sounds like a very bad idea.

This problem, though, might be taken care off by the ground spoiler conditions during rejected take-off, namely wheels spinning >72kts, which would again allow for them to be armed during taxiing.

Bernd

TyroPicard

29th Aug 2007, 12:04

I thought you were considering a "normal" rejected landing as opposed to a TAM situation.
But if the PF did not set TOGA thrust, thus one lever at idle, one at MCT
MCT is above 20? so no ground spoilers.
Is there a possible credible scenario with one TL at reverse, the other at cl, brake pedals pressed, where one does not want to stop?
No - it's incredible.
Tyro

bsieker

29th Aug 2007, 12:28

Quote:
Is there a possible credible scenario with one TL at reverse, the other at cl, brake pedals pressed, where one does not want to stop?
No - it's incredible.

So, this might be a case for extending the ground spoiler logic to become:

A/C on ground
AND ((One T/L in reverse and other T/L in reverse or at or near idle)
OR (ground spoilers armed and both T/L at or near idle)
OR (one T/L in reverse and brake pedals pressed))

Excluding one at CL and one at idle, because that might happen with one engine shut down, even not wanting to land.

Perhaps one should also exclude one T/L at TOGA, because it would again be too ambiguous.

Whether or not this makes more sense than changing training procedures and/or memory items is not my call to make.

I may write up all my considerations about ground spoilers and thrust reversers and thrust levers in more concise form (standing on the shoulders of PBL's "classic" paper).

Bernd

P. S. To all those thinking we are defending Airbus at all costs: this should make it clear that we are not. No product created by mere mortals is above criticism, but it should be founded on more than saying "I am convinced non-moving thrust levers are bad!"

DozyWannabe

29th Aug 2007, 12:47

Again though, the more complex you make the logic tree, the higher chance you have of an error manifesting. This is aside from the fact that there are no doubt many occasions where you don't want spoilers to deploy, so if they did deploy on one occasion after your suggested update was made, would there be a similar outcry to roll back that change?

The problem with responding to these accidents emotionally is that by nature we want to do everything to stop that particular set of holes in the cheese from lining up again. Where we need to be careful is to make sure that by closing those holes, we're not opening others elsewhere.

I think there needs to be some kind of HF research into how a broad cross-section of pilots respond to that situation and the call-outs made. If a significant number of pilots only retard one TL by mistake, then we have a serious interface problem. If not, then it could be argued that it was just a combination of tragic mistake and dumb rotten luck. Something that factors in all too many aviation accidents.

bsieker

29th Aug 2007, 13:25

This is aside from the fact that there are no doubt many occasions where you don't want spoilers to deploy

I fully agree.

That is why I have a strong resistance to quick changes to these things. But the GS logic has already been changed once, and here may (or may not) be another case for a change.

I am also very aware that ground spoiler deployment in any case other than performing a full-stop landing or rejected take-off is a Bad Thing.

I'm not saying "this should be done", but it is worth considering.

Limiting ground spoilers to cases (in addition to the existing ones) where brakes are pressed (possibly only above a threshold not commonly achieved during rudder action) and at least one thrust lever is in reverse seems to be a good safeguard. Additionally, not deploying GS if at least one thrust lever is at TOGA seems worth considering, since TOGA would never be applied during a full-stop landing (except on a carrier landing, but that is a completely different domain). It is doubtful anyway, that anything, even ground spoilers, could save you if one engine was at full reverse, and the other at TOGA.

It may be that I have forgotten a case or that I am wrong on this, and this is what peer-review is for, and why I am posting this publicly.

TyroPicard (an experienced pilot on type) already said it is unthinkable that one would select reverse and press the brakes but did not want to stop. I take this as an indication that I am not too far off the mark.

Bernd

Lemurian

29th Aug 2007, 16:32

bsieker,
I had asked experienced A320 flight crews for what situations exactly said memory item was trained:
Only failure of autobrake after it had initially been active?
And/or failure of manual brake if no autobrake was selected?
Also in a case like this where autobrake fails to engage because of failure of GS deployment?
For the third case the memory item would to be more aptly called "NO BRAKING"

In the FCOM and QRH manual I'm using :
LOSS OF BRAKING
> if AUTOBRAKE selected :
PF BRAKE PEDALS............... DEPRESS
> if brakes inoperative :
PF REVERSERS....................MAX
PF BRAKE PEDALS................RELEASED
PNF A/SKID & N/W STEERING...OFF
PF BRAKE PEDALS................DEPRESS
PF BRAKE PRESSURE.............UNDER 1000 PSI
............................................................ .............................................
The first item comes on the realisation that autobrake is not operating, which emphasizes the importance of the *DECEL* or *NO DECELERATION !* call out. And by extension it takes care of the third item (CGH) where the autobrake was not functioning as selected.
Semantics can be precious sometimes : *NO BRAKING* should be used in cases where the system fails to operate as expected, whereas *LOSS OF ...* implies that a system is functioning before it then fails.
[I was there...] the scenario above (no decel then no brakes) makes a very interesting sim session on a cat IIIB autoland with 75m RVR...a very good way to determine if a crew functions optimally.
TyroPicard,
But they would still operate taxying out..... and would be extended if you held on the runway with the brakes on .. this might lead to taxying out with them "not armed" .. could they be forgotten thus adding to the risk?
I agree with your train of thoughts but normally the G/S should extend on a rejected takeoff regardless of the G/S lever position.

Al Zimer

30th Aug 2007, 04:18

Rob21
Thanks for the reply and the correction - my mis-reading of the transcript.
Yes - I see the point you are making. Particularly as there was heavy rudder usage starting about 18:48:26.
So just what was he feeling? Intriguing.
(From a non-pilot showing his ignorance.) At what stage of a landing would the PF remove his hand from the TLs?

Dani

30th Aug 2007, 04:28

At what stage of a landing would the PF remove his hand from the TLs?

Never!

____________________________________________________________ ____________
Pprune software says this reply is too short, but hey, there isn't one word more to spend!

Gullyone

30th Aug 2007, 04:52

I think that most pilots remove their hands from the thrust levers just prior to touchdown, having first closed them.

Dani

30th Aug 2007, 05:12

Nope, only Non-Airbus pilots do that. Since you fly your sidestick, you don't need your second hand anymore. You could put it on your knees, but there it doesn't help anything, hence you leave it there on the thrust levers.

This is another indication that the TAM's captain mindset was somewhat in "another aircraft". It might be justified in
some other aircraft not to touch a "broken" thrust reverser or to take your hand away from them. But as a genuine Airbus pilot you leave it there and realize that you should retard them.

btw Airbus just reissued the FCOMs for reverser fault, explaining that it's essential to retard. If the reverser fault comes on in flight, go to idle. If you execute an RTO, go to full reverse.

Dani

Lemurian

30th Aug 2007, 07:55

I think that most pilots remove their hands from the thrust levers just prior to touchdown, having first closed them.
Nope, only Non-Airbus pilots do that. Since you fly your sidestick, you don't need your second hand anymore. You could put it on your knees, but there it doesn't help anything, hence you leave it there on the thrust levers......(etc...etc...)
Dani,
Are you really a pilot, even a private pilot, or even a student pilot ?

Gullyone

30th Aug 2007, 07:56

Dani, thanks for that, I have never flown the ab, I have learnt something new.

PBL

30th Aug 2007, 08:41

Again though, the more complex you make the logic tree, the higher chance you have of an error manifesting.

I don't think this is quite right. If you were talking about dynamic decision-making, then I would agree that the more complex the decision tree, the more chance one has of barking up the wrong branch.

But we are talking about the system logic, and the complexity of the logic bsieker, TyroPicard and Lemurian are discussing is well within the scope of those examples which can be exhaustively checked for errors using common formal mathematical verification techniques.

Whether anyone does so, though, is another matter.

And of course what one *cannot* verify mathematically in this case is whether one has exhaustively covered all the environmental scenarios in which this logic will operate.

PBL

Hunter58

30th Aug 2007, 09:02

@Lemurian

I can guarantee you Dani is a pilot, actually an A320-family qualified Captain. So before you say 'rubbish'...

Dani

30th Aug 2007, 09:03

Lemurian, I'm very very, veeery disappointed by your remark. Are you telling me that you do not agree?

After a few posts of yours I was more like the opinion that you understand a little bit of aviation, unlike a lot of others in the thread.

And, - ... yeeeaaah, I have a few thousand hours spent on the left hand seat of Airbus. Do I need to draw you a picture of it or do you believe it??

Dani

Thanks, Richi ;-)

Hunter58

30th Aug 2007, 09:08

You're welcome... :-)

TyroPicard

30th Aug 2007, 09:55

Lemurian
I agree with your train of thoughts but normally the G/S should extend on a rejected takeoff regardless of the G/S lever position.

Yes but if not armed there will be a delay until reverse thrust selection - which adds to the risk. And if you forget reverse as well.............

And just to clarify some of the more ludicrous recent postings from the land of the cuckoo clock... PF keeps his hand on the T/L throughout the landing roll, because he is using that hand to select and cancel Reverse Thrust.
Tyro

Gullyone

30th Aug 2007, 09:59

Not so, most airline sops require the pnf to operate the rt at least on non ab
types. As the supposed ab pilots seem to disagree as to who does what, can someone who knows tell us the answer

HotDog

30th Aug 2007, 10:31

Not so, most airline sops require the pnf to operate the rt at least on non ab types.

Gullyone, which airline are you flying with? Am I correct in assuming you mean reverse thrust (rt) above?

I have 18,000 hours in various jet transports plus 2,000 odd in simulators, checking and training. Yes PNF handles rt, like in communications but PF flies the airplane until you are on chocks. I would love to see those SOPs that say otherwise.:suspect:

Dani

30th Aug 2007, 10:33

Oops, another non-believer.

Tyro, I understand you might be a bit aged to read the real meaing of my posts, but I said exactly what you said: On any Airbus, you KEEP! your hand on the T/L.

btw cookoos clock's are made in black forest, not in Switzerland. Another myth going down in fumes, isn't it? Hunter58 btw lives in Airbus City, that's also not in Switzerland.

Dani

Dani

30th Aug 2007, 10:36

HotDog, where are you coming from? Inspite of your 18 000 hours, you don't know a lot outside of your own airlines.

I know quite a lot of airlines where the PF flies the aircraft, but after touchdown, he orders "Revers", which means PM (PNF for older folks) regulates the reversers.

This is been done in older aircraft where it was not so easy to keep a steady revers thrust, and where you could overboost or stall a reversed engine.

Dani

HotDog

30th Aug 2007, 10:49

Dani, well it is true that in my 33 year of aviation I only worked for two companies. In both of them, PF handles reverse thrust after touchdown. This was Convair 880, B707, Lockheed L1011 and B747 SOP. Apart from that, you yourself operate the reversers in your bus. So I would still like to see the SOPs that say otherwise. Have you ever landed a 747 at Kai Tak in typhoon conditions with max crosswind? Good chance to have finished up in the harbour by handing over the thrust levers to the PNF.:ugh:

Thor Nogson

30th Aug 2007, 10:58

I think there is some confusion over the term rt.

Some of you seem to mean Reverse Thrust, and some Radio Traffic, I think?

TN

BOAC

30th Aug 2007, 11:02

Before this thread spirals downwards into yet another pit of slanging/abuse, be advised that different companies have different SOPs. Some do, indeed, call for PNF to operate REVERSERS, some PF. Please can we stop bickering? :ugh:

NB We do NOT know the TAM SOP

Hand Solo

30th Aug 2007, 11:08

Quote:
At what stage of a landing would the PF remove his hand from the TLs?

Never!

Not quite. It's BA SOP across all fleets that PNF selects reverse thrust. The PF removes his hands from the thrust levers as soon as the decision is made to select reverse. It guards against the temptation to attempt a go-around after reverse has been selected.

PBL

30th Aug 2007, 11:11

just to clarify some of the more ludicrous recent postings from the land of the cuckoo clock

btw cookoos clock's are made in black forest, not in Switzerland

Despite trying, this is hard to resist. I know it is off-topic.

The crowing rooster on the Zytglogge on the main street of the Swiss capital city of Berne predates Black Forest clocks by some 240 years.

PBL

Rob21

30th Aug 2007, 11:27

Al Zimer,

Indeed, when the PF exclaims "Look this!" (18:48:33) right pedal inputs are "huge" (24º), indicating he was looking out to the runway, he knew he had no ground spoilers (18:48:29), so what did he feel (with his right hand?) that made him exclaim "Look this"? I believe it was another "bad news", on top of the "spoiler nothing" call, and related to the TLs.

IMHO, when you don't know WHY something is happening (hell is breaking loose), you don't point to the probable cause and exclaim "Look this!!".

PBL

30th Aug 2007, 11:40

Rob21 asks
so what did he feel (with his right hand?) that made him exclaim "Look this"

The little green man sitting on the quadrant with his toe in the right thrust lever. Cousin of the guy who was playing with matches in the CWT of TWA800. :)

PBL

Flight Safety

30th Aug 2007, 11:49

bsieker and PBL both make very cogent arguments, which are well thought out. However I fully understand flat state space, "hierarchical decomposition", and the careful ordering of complex functions, modes and states into organized meaningful and useful sets. I also understand the difference between Raskin's ideal and the practical design needs of a human interface into complex systems. I'm not actually trying to argue in favor of a pure Raskin single mode approach across all systems. However I am trying to argue in favor of a single mode Raskin type design approach where primary flight controls and speed controls are concerned and I'll explain why.

Think about habits, think about how the mind narrows in an emergency, and think about how emergency controls are designed.

Regarding habits, they live somewhere else in the mind other than the conscious mind. We've all heard the expression "it's like riding a bicycle, you never forget". Once you know how to ride a bicycle or drive a car, you no longer have to think about how the controls work, you just know by habit. We've all experienced the situation where we've performed some task so long that we no longer think about how to perform it, and then when someone asks us how we perform the task, we have to watch ourselves do the task before we can explain the "how" to the person who asked. This is because the knowledge of how to do the task no longer lives in our conscious mind. I live in an urban area where it's a good idea to always lock your car, and I'm forever wondering if I've locked the car after I get out and walk away from it. The reason I wonder is because the act of locking the car does not pass through my conscious mind, I do it automatically out of habit, without thinking about it. Thus I don't remember if I did it or not.

Regarding how the mind narrows in an emergency, I explained this in my previous post that as fear rises, the mind moves more toward action oriented "fight or flight" type responses and away from thinking and reasoning type responses. In fear or an emergency, the mind tends to want to act rather than think and reason things out.

Regarding how emergency controls are designed, this is something all of us understand I believe. Why are fire extinguishers painted red? Why are they designed so that you only have to pull a pin and squeeze the handle to operate it? Why in a data center, is there a big red power button next to door, with a simple obvious sign that says "power off"? In an electrically fed fire in a data center, you want to cut the power as you're escaping, and this design makes this easy. Why are engine fire handles designed the way they are in a cockpit? Why are airliner door emergency handles designed the way they are? All are designed to accommodate the mind in an emergency, a mind that wants to act on an emergency instead of reasoning about it.
Now to primary flight controls. The primary controls change the attitude and direction of the aircraft and they speed it up or slow it down. Obviously these controls become emergency controls in an emergency. In an emergency, for the most part these are the controls the pilots will use when they act to try and resolve the emergency. Generally speaking, these controls (yoke or stick, brakes and rudder pedals, spoilers, throttles) in my opinion must be designed to accommodate the pilot's mind in an emergency, when he will tend to act on rather than reason out the emergency.

Bsieker stated the following:
As to the workings of the thrust levers: it is really terribly simple, and a confusion very unlikely:
In a normal flighth you really only need three positions. This flight was no different:
- FLX/MCT (or possibly TOGA in certain conditions) from takeoff to thrust reduction. This gives flexible (or maximum) take-off power and arms autothrust.
- CL throughout the entire flight from thrust reduction to flare. This activates autothrust, previously armed by setting (flexible or maximum) takeoff power.
- IDLE during flare.
During rollout you additionally may use REVERSE IDLE and MAX REVERSE.
I do not see at all why this would not be habituating.

He is very correct in what he says, especially when he says "I do not see at all why this would not be habituating." Whether FLX, TOGA or CLB, I would argue these are the more habituated positions of the thrust levers, since they spend most of their time there during operation of the aircraft. However this means that the mode or state of the throttle lever position DOES NOT equal engine power, is also the more habituated mode (or state), since again this is where most of the operating time is spent.

I'm running out of time this morning so I have to cut this short.

I would argue that it's very possible the pilot would NOT have left the ENG2 TL in the climb detent when ENG1 TL was pulled back, if this position were not the more habituated position for the TLs in the A320. In an all moving throttle lever system, I think it far less likely that an engine would have been left at such a high power setting at touchdown, especially since the auto thrust in such a system wouldn't have left the trottle at such a high power setting in the first place.

I think it substantially assists the pilot to have an unbroken habituated understanding below his conscious mind, that TL position ALWAYS equal engine power. I think this could have prevented leaving the ENG2 TL at a high power setting in the first place, and would have helped the pilot acting in an emergency to know (subconsciously know) to pull an advanced throttle lever back.

I noticed in the FDR data that during the rollout, the pilots disarmed and rearmed the spoilers, hoping the cycling would cause the spoilers to deploy. How wonderful a manual spoiler deploy lever would have been in those moments, but this emergency control was simply not there. AB crew know they have to become essentially system analysts when they learn to fly the AB (and to be fair Boeing pilots do as well). However who can be a fully functioning systems analyst and a diagnostic technician in a difficult landing situation and in an emergency?

Thus I'll close with this statement. A Raskin type single mode approach to HM design of primary flight controls and speed controls, that become emergency controls in an emergency, is a very good idea.

The other major airframe maker managed to create a single mode throttle system, in the sense that throttle position always equals engine power, and was not inhibited by the complexity of the system and flat state space constraints from doing so.

Someone said that cruise control on more recent cars do not move the gas pedal. True enough, but I would think the equivalent mode to the AB throttle system would be to press the gas pedal down about 3/4 full, then engage the cruise control, then the gas pedal would be left there while the cruise control remained engaged. Later when the cruise control was disengaged, the gas pedal would still be at 3/4 full. In the Boeing, the "gas pedal" would also be left where is was at when A/THR was disengaged, but at least you'd know where the engine power was before, and it wouldn't change after disengagement.

Please understand, I'm not trying to make a B vs AB argument, I'm making design choice arguments and using B and AB systems to illustrate.
I gotta go.

bsieker

30th Aug 2007, 15:26

Flight Safety,

thank you for your detailed explanations. I don't find a problem with what you say about emergency systems, like fire exinguishers, emergency circuit breakers, etc. ...

But this does not seem to have anything to do with this accident. Failure modes in airliners are so complex and manifold, that no simple emergency "handle" or "button" will do.

Since your conclusion again seems to be "moving thrust levers are better", because they better reflect what the aircraft does, I have to argue that Airbus thrust levers always directly relate to flight phase:

Start: push forward

Flight: Leave in the middle

Stop: Pull back.

Extremely simple, extraordinarily intuitive and habituating.

Some more detailed remarks:

[...] throttles) in my opinion must be designed to accommodate the pilot's mind in an emergency, when he will tend to act on rather than reason out the emergency

According to your reasoning, the throttles control the speed. What could be more instinctive then, in order to slow down, to pull back that what's making speed, i. e. the thrust levers.

I also wonder how you determine any generalised "pilot's mind in an emergency."

I think it far less likely that an engine would have been left at such a high power setting at touchdown, especially since the auto thrust in such a system wouldn't have left the trottle at such a high power setting in the first place.

As has been repeated many times in this thread, the autothrust did not leave the engine "at [...] a high power setting", but roughly at the power needed to maintain approach speed.

Exactly the same power setting at which a moving lever-system would have remained. No difference here.

This was not a normal disconnect, in which the thrust rises to meet the lever position, but a so-called "involuntary disconnect", in which the thrust is frozen.

I think [...] [moving thrust levers] could have prevented leaving the ENG2 TL at a high power setting in the first place, and would have helped the pilot acting in an emergency to know (subconsciously know) to pull an advanced throttle lever back.

The action to pull back all thrust levers during flare is also exactly the same on either type of thrust control system design.

You still haven't made a convincing point, other than gut feeling, why pilots would be more likely to pull back moving thrust levers than non-moving ones.

Bernd

DozyWannabe

30th Aug 2007, 21:37

Correct me if I'm wrong, but would it not be the case that the only reasons earlier generations of aircraft with autothrust had moving thrust levers was because there was a direct, physical connection between the levers and the engines, so the autothrust system would control the levers, and the levers would control the engines?

If that was the case then would that make the 'moving thrust levers' design a limitation of the technology of the time, a side effect rather than an actual design feature?

ChristiaanJ

30th Aug 2007, 21:57

Correct me if I'm wrong, but would it not be the case that the only reasons earlier generations of aircraft with autothrust had moving thrust levers was because there was a direct, physical connection between the levers and the engines, so the autothrust system would control the levers, and the levers would control the engines?
If that was the case then would that make the 'moving thrust levers' design a limitation of the technology of the time, a side effect rather than an actual design feature?On Concorde (and that IS going back a bit) there was no direct physical connection between throttles and engines. But the autothrottle system moved the levers, it didn't feed straight into the ECUs.

Lemurian

31st Aug 2007, 00:08

For one of the posters who have been accusing others to be paid by AI, to hide the truth, in short been accused of conspiracy, you seem to have a very thin skin.
Quite a few people have given you enough respect to discuss your theories, which, if I remember correctly, have not been discarded but considered the least likely, the least you could do is to try and consider their reasoning.
That's respect for you.
As I understand it, you have very little experience of reading accident reports and only joined Pprune in order to be allowed to discuss this very accident and an air collision over Brasil. May I suggest you took a look at -for instance - the report of the Air Inter A320 near Strasbourg in order to have a feel for the brainstorming the research of the likely causes of an accident would generate, especially when human / system interface is considered ?
What was said with humour above is that there is a point where we're leaving the realm of serious discussion to start delving into phantasies like IRQs and little green men...X files, this forum ain't !

Enough said.

On the same vein, I'd like to apologise to Dani, Hunter58, BOAC, Hand Solo...I'm sure there are others I forgot...for ignoring yet another item of SOP. I've worked for 7 airlines and flew jumpseats with another ten or so and I've never seen reversers handled by NHP...must be interesting when an airplane begins a slow waltz in Sheremetievo, for instance, in winter, or in Bombay during the Monsoon.
Well, I learn everyday.

Cheers

marciovp

31st Aug 2007, 00:52

Let me ask this question a little modified...

If this is the third accident with A320s where the pilots landing with one reverser locked up left the two TLs in opposite positions (forward and reverse), should we simply say that it was a human error?

Human error, three times, with professional pilots?...

Shouldn´t we look at how come these six pilots in three occasions committed this mistake?... And perhaps try to prevent this from happening by changing something in the machine?

Thanks to you all.

barit1

31st Aug 2007, 00:56

Boeing a monopoly? When pray tell was that? Boeing had to fight hard to compete with McDonnell Douglas and Lockheed, and before that Douglas and deHavilland and Convair and Martin too. Airbus came along in the very late 60s. Today, among the full-size airliner makers in the west, only A and B survive. But Boeing NEVER had a monopoly. Get your facts straight. :rolleyes:

preta

31st Aug 2007, 01:56

marcio vp
you are forgeting the Phoenix/USA accident.:=

marciovp

31st Aug 2007, 03:14

marcio vp
you are forgeting the Phoenix/USA accident.:=

So, we are talking about four accidents and eight well trained and experienced pilots.

Don´t you think I have a good question?

Let me ask this question a little modified...

If this is the third accident with A320s where the pilots landing with one reverser locked up left the two TLs in opposite positions (forward and reverse), should we simply say that it was a human error?

Human error, three times, with professional pilots?...

Shouldn´t we look at how come these six pilots in three occasions committed this mistake?... And perhaps try to prevent this from happening by changing something in the machine?

Thanks to you all.

Gullyone

31st Aug 2007, 03:57

On the same vein, I'd like to apologise to Dani, Hunter58, BOAC, Hand Solo...I'm sure there are others I forgot...for ignoring yet another item of SOP. I've worked for 7 airlines and flew jumpseats with another ten or so and I've never seen reversers handled by NHP...must be interesting when an airplane begins a slow waltz in Sheremetievo, for instance, in winter, or in Bombay during the Monsoon
Well, I learn everyday.
(cant seem to get Lemurins quote above to go blue)

I have worked for a few airlines in which the NHP/PM operate the thrust levers to initiate reverse, British Airways for one. After all you don't steer the A/C using reverse thrust. If it is causing problems you call to cancel and maybe re-apply. Didnt seem to cause problems even on a windy day at Kai Tak.

EMIT

31st Aug 2007, 06:44

The deepest root cause of this accident may well be, the extremely slow acceleration of the engines from idle.

Follow me.

(General info: FCOM does inform us of the increased idle when using reverse, but it does not state why. Common sense would explain that the core engine needs increased idle to survive the slight airflow disturbances caused by reverse).

1. (fact) The A-320's IAE engines accelerate very slowly from idle.

2. (fact) Idle must be increased when reverse thrust is applied.

3. (hypothesis) Because idle response of the engines is so slow, decision has been made to give the engines a headstart on the operation of the reverse sleeves. (fact) Idle is increased as thrust levers are placed in the reverse range, not when reverse sleeves are in the reverse position.

4. (fact) Because of 3, there is a slight stopping performance penalty in putting the thrust lever in reverse range, when reverser is (known to be) not operational.

5. (fact) Because of 4, operational procedures are written, which prescribe how to handle in case of deactivated reverser(s).

6. (hypothesis) Changed insights (fact) have lead to changed procedures.

7. (hypothesis) Points 4, 5, 6 together into one brain may be a setup for confusion.

8. (hypothesis) On approach to a wet and not so long runway, the conscious mind may have made a (proper) choice to *not* pull the thrust lever of the deactivated reverser into the reverse range.
Point 7 manifested itself in the millisecond that the brain fired its' action pulse to the thrust lever hand - instead of leaving the one thrust lever behind at the idle detent, this leaving behind was done half a second too early, at the CLB detent.

9. (fact) Results are known all too well and are presently being investigated.
================================

All the discussion so far has been about points 8 and 9. Very interesting by themselves, but only scratching the surface.

In the discussion about point 8, I want to state clearly, but at this moment I have no time to elaborate on it further - the autothrust system with non-moving thrust levers is well thought out and logical, but it is NOT NATURAL!

bsieker

31st Aug 2007, 09:40

EMIT,

very insightful, and some interesting facts. Thanks a lot.

The deepest root cause of this accident may well be, the extremely slow acceleration of the engines from idle.

I do not quite follow you there. In a very deep causal analysis this may turn out to be a causal factor, but I rather think that the links between the engine properties via FADEC control laws via the changed MEL procedures via confusion to neglecting to retard a thrust lever are too weak to stand the Counterfactual Test.

1. (fact) The A-320's IAE engines accelerate very slowly from idle.

Do the CFM engines accelerate significantly faster? I thought slow spin-up was inherent in all gas turbines. (Evident also in the tubo lag in turbocharged piston engines.)

Slow spin-up from idle was a causal factor in the Habsheim accident.

All the discussion so far has been about points 8 and 9. Very interesting by themselves, but only scratching the surface.

There has been quite some discussion that the changed MEL procedures (points 5 and 6) might have added to the confusion, although the reason for the changes in the procedures were unknown.

In the discussion about point 8, I want to state clearly, but at this moment I have no time to elaborate on it further - the autothrust system with non-moving thrust levers is well thought out and logical, but it is NOT NATURAL!

Perhaps not, but then again, what is natural in controlling complex machines? As I pointed out, though, the operation of the levers may be considered natural: accelerate: push, cruise: leave alone, stop: pull.

Incidentally, same as with moving levers.

Bernd

EMIT

31st Aug 2007, 10:19

Answer to BSIEKER's question.

Spool up of jet engines.

Yes, all engines spool up somewhat slowly.
On every take-off, we initially set the thrust levers to about 1.05 EPR. When the engines actually produce that thrust, we advance the thrust levers to take-off thrust. This procedure is there to prevent uneven engine acceleration (meaning, left and right not accelerating at the same time), which would cause directional control problems.
In terms of RPM, idle on the ground is roughly 25% N-1, 1.05 EPR is roughly 50% N-1.
The comparison that I can make is with the B-767 mounted P&W 4060: more than twice the thrust output, so roughly more than twice the spinning mass, yet half the spool up time from idle to 1.05 EPR.

I don't know how fast the CFM's react.
I don't know whether with the CFM's idle is also increased already on pulling the thrust lever into the reverse range (even if reverser itself is deactivated).

I do know that following the Lauda crash in 1991, we (767 fleet worldwide) have flown around one or two years with both thrust reversers deactivated. Explicit operating advice was to keep pulling the reverse thrust levers to the interlock stop on each landing, to stay in the habit. Compare this with the specific Airbus instruction to *not* pull thrust levers into reverse range when both reversers are deactivated.

Now for something completely different, is there a way to paste text into a post? Sometimes it is easier to write while you are offline, but so far I have been unable to transfer such text into a post. This limits my opportunity to post useful (longer) replies for lack of time at the appropriate moment.

jumpdrive

31st Aug 2007, 12:03

is there any transcript from the black box ?

how is the investigation so far?

Dani

31st Aug 2007, 12:26

Having flown both CFM and IAE A320 versions myself, I know what you mean with slow spooling up. This is in fact the case on capturing an altitude or a speed. I doubt that it is the case in go-around or any other critical flight phases. Airbus has certified both aircraft and they deliver more or less the same performance.

The myth also stems from the fact that the IAEs need much longer engine start time, hence pilots see the slowness every day several times.

There is nothing to add to this TAM accident. There hasn't been any spool up because there hasn't been any spool DOWN! The TL remained in approach thrust, that's why they overrun that runway. Hasn't this been noticed yet?

And hellas! We have reached 100 pages of this thread. Let's be grateful and hope for another 100. Champagne!

Dani :ouch:

EMIT

31st Aug 2007, 12:32

Dani, I don't mean to imply that spool up played a role in this acident as a physical quantity.
I was wondering whether it stands at the basis of the choice to increase idle already at entering reverse range, rather than at open state of the reverse sleeve. That choice prompted .... the sequence of points in my previous post.

TripleBravo

31st Aug 2007, 13:46

Is there a possible credible scenario with one TL at reverse, the other at cl, brake pedals pressed, where one does not want to stop?Yes, there is.

1) If you can have a TL inadvertently in CLB position at touchdown, you can also have a TL inadvertently in REV during other flight phases, where this is not desired (e. g. climb or go around).

2) Usage of rudders can imply inadvertant activation of brake sensors by deflection of the pedals with the toes.

=> This can lead to the scenario that there was something wrong with your TL (being in REV while still on your approach path), you want to abort and sort this out while airborne, because of asymmetric thrust you have to use rudder - and you're almost automatically falling from the sky, because the spoilers are deploying, because your toes applied a bit too much of a pressure.

When somebody argues this scenario to be not likely - so was leaving the TL at CLB position during landing roll!

Again though, the more complex you make the logic tree, the higher chance you have of an error manifesting.Absolutely. What's more, it makes it even harder for the crew to understand in complex situations and therefore reducing the chance of successful troubleshooting in time.

This is another indication that the TAM's captain mindset was somewhat in "another aircraft".These were my thoughts also some weeks ago. It gave me a new thinking about transitions from other aircraft families.

Once again, as we saw in this thread, the non-deployed ground spoilers did not have such a big effect on the landing roll distance that it would have turned things much. Therefore I am not sure if it helps a lot when we consider the spoiler's logic to be changed. I would rather concentrate on what might have caused the crew to leave the thrust lever where it was. Wordings in paperwork like MEL and training awareness seems to be a good starting point as well as tactible feedback to the crew like moving levers (thrust or spoilers). For sure the most effective spoilers cannot override an engine running at some 75% thrust (which was more than the approach thrust, by the way).

Lemurian

31st Aug 2007, 14:13

There has been quite some discussion that the changed MEL procedures (points 5 and 6) might have added to the confusion, although the reason for the changes in the procedures were unknown.
I know for a fact that there have been many occurences of both reversers selection in cases of a MELed T/R, and there have been inquiries from the airlines to AI about a change in the procedure.
So it is an airline originated change. Will try and confirm it.
I don't know how fast the CFM's react.
I don't know whether with the CFM's idle is also increased already on pulling the thrust lever into the reverse range (even if reverser itself is deactivated).

The CFM 56s of the latter series is faster than the -A series. If, as I suspect Dani flies the old 'Bus -A series equipped 100s - along with the newer IAE engine-equipped fleet and doesn't see a difference, the IAE engine is indeed slower to accelerate. (btw, the Habsheim 320 had the A1 engines ).
The requirement for stabilising the engines at 50% N1 /1.05 EPR is for getting all the flow control ancillaries at a stable state (the VBVs come to mind).
The slight increase of N1 /EPR reverser idle is quite general on the 'Bus fleet and as it has never bothered me, I would suspect it wasn't anything new to me from my previous types. Need to see that , too !
I know what you mean with slow spooling up. This is in fact the case on capturing an altitude or a speed. I doubt that it is the case in go-around or any other critical flight phases.
The slow spool-up in cruise /speed has to do with the AI speed stability algorythm which prioritises fuel consumption / pax comfort over instantaneous speed-keeping accuracy. B has another philosophy.

EMIT's theory has some merit, but I think it could be applied somewhere else : a confusion about inop T/R and inop engine.
If I may present it this way, I would take an analogy I've seen / experienced countless of times in the sim :
Any crew would successfully perform a single engine go-around without any major problems.
Now, if some time during the approach the SFI / TRE tells the crew that they won't land but they would have to overshoot, the go-around performance would drastically drop : forgotten items, call outs, under-par rotation...etc...
Could that phenomenon of confusion on an over-rehearsed procedure have applied to this accident ?

From EMIT :
is there a way to paste text into a post? Sometimes it is easier to write while you are offline, but so far I have been unable to transfer such text into a post. This limits my opportunity to post useful (longer) replies for lack of time at the appropriate moment.
My method is to type my text in WORD, then copy/paste. Works fine for me.

Cheers !

bsieker

31st Aug 2007, 15:58

BBB,

Thanks a lot for your input. Very good to have differing opinions here. We need to consider all things.

[scenario with one TL in reverse, brake pedal inputs, but not wanting to stop ...]

Yes, there is.

1) If you can have a TL inadvertently in CLB position at touchdown, you can also have a TL inadvertently in REV during other flight phases, where this is not desired (e. g. climb or go around).

Yes it had crossed my mind, that, although the scenario would be considered extremely unlikely, so was the scenario we seem to have in this accident. Yet it did occur.

2) Usage of rudders can imply inadvertant activation of brake sensors by deflection of the pedals with the toes.

I was aware of this one. I'm curious about it. If the FDR graphs really show degrees of brake pedal deflection, it has a stop at 80 degrees, which seems a lot. I don't think that inadvertent brake-pedal inputs would be anywhere near that range, even in flight phases where larger rudder inputs may be needed, e. g. cross-wind go-around with turbulence and asymmetric thrust, etc ...

So to make additions to GS logic that will actually be useful, we have to be very careful not to make things worse instead.

Data mining through quick access recorder data will be useful, to see what maximum magnitude "parasitic" brake inputs while using the rudder can have. Try to find out if there might be bigger inputs still for reasons yet unidentified (slippery pedals, inappropriate footwear, ...), and add a sufficient safety margin. And see if that is still well below the normal brake pedal input used for braking during landing and rejected take-off.

Am I right in assuming that the desired mode of operation is to move the rudder bar with the heels, and the brake pedals with the toes?

=> This can lead to the scenario that there was something wrong with your TL (being in REV while still on your approach path), you want to abort and sort this out while airborne, because of asymmetric thrust you have to use rudder - and you're almost automatically falling from the sky, because the spoilers are deploying, because your toes applied a bit too much of a pressure.

When somebody argues this scenario to be not likely - so was leaving the TL at CLB position during landing roll!

And this scenario is indeed very rare, and would probably have been considered "unthinkable" by most type-rated pilots prior to the well-known occurences.

Absolutely. What's more, it makes it even harder for the crew to understand in complex situations and therefore reducing the chance of successful troubleshooting in time.

Worth considering. But any addition here is to reduce the need by the pilot to analyse the logic, and rather to offer him one more way out of a pinch which he will resort to without thinking: firm manual braking.

Without needing to know that this is one of the possible GS deployment conditions. The thrust lever position, in an emergency, may not be the obvious way to look for to stop the aircraft (although maybe it should).

Brakes are.

Once again, as we saw in this thread, the non-deployed ground spoilers did not have such a big effect on the landing roll distance that it would have turned things much. Therefore I am not sure if it helps a lot when we consider the spoiler's logic to be changed. I would rather concentrate on what might have caused the crew to leave the thrust lever where it was. Wordings in paperwork like MEL and training awareness seems to be a good starting point as well as tactible feedback to the crew like moving levers (thrust or spoilers).

We witness that brakes even without ground spoilers did reach about 1.3m/s^2, And since GS have a three-fold effect ---(1) increasing normal force, thus friction force, thus deceleration, (2) avoiding hydroplaning, thus increasing friction coefficient, thus friction force, thus deceleration, and (3) increasing aerodynamic drag, thus deceleration, especially at high speeds--- its effect may have been considerable, and while not preventing the overrun, may have reduced it to a much slower one. We'll never know exactly.

But granted, training awareness is paramount.Early onset of manual braking combined with ground spoilers would have done the trick. I'm not sure the MEL wording was a problem, but it has to be chosen carefully. And MEL procedures should be subject to the same rigorous risk analysis as other procedures.

For sure the most effective spoilers cannot override an engine running at some 75% thrust (which was more than the approach thrust, by the way).

Is 1.19 EPR indeed 75% thrust? (i. e. 75% force? And what is 100%? CLIMB or TOGA?)

But you are right, and I stand corrected, it is significantly more than the thrust during final approach, which was between 1.05 and 1.1 EPR.

---

The slow spool-up in cruise /speed has to do with the AI speed stability algorythm which prioritises fuel consumption / pax comfort over instantaneous speed-keeping accuracy. B has another philosophy.

If I recall correctly, A320 also has "Soft altitude" mode, allowing deviations from the flight level by up to 50ft, in order to reduce thrust changes and save fuel.

During approach, thrust variations are quicker, in "approach autothrust".

Bernd

PAXboy

31st Aug 2007, 16:12

TripleBravo requotes this from earlier, I am sorry that I cannot recall who originally said this: This is another indication that the TAM's captain mindset was somewhat in "another aircraft".

All that I have read states that the PF was a training captain on the 320. It would seem reasonable to guess that he was not mistaken?

DozyWannabe

31st Aug 2007, 23:36

Rananim:
KISS.

But it could be just as easily argued that it doesn't get much simpler than "Levers forward for acceleration and managed speed, back to slow down, all the way back to stop."

Lemurian

31st Aug 2007, 23:42

You *forgot* to add (d) the Boeing cheerleaders who can't understand anything positive about an Airbus product to your list, in all fairness.
Of course we know very well nothing happens to Boeings. Pity that only suicidal fools fly them, hey ?

DozyWannabe

31st Aug 2007, 23:50

Lemurian, I understand where you're coming from, but *please* let's not get into that again. I think that most of us on here know each other's preferences (or indifference) in that area by now.

bsieker

1st Sep 2007, 09:21

If this is the third accident with A320s where the pilots landing with one reverser locked up left the two TLs in opposite positions (forward and reverse), should we simply say that it was a human error?

marcio vp
you are forgeting the Phoenix/USA accident.

This one was different, in that both thrust levers were retarded to idle during the flare, and reverse was selected on both engines. Only after that, the thrust lever of the engine with the inop reverser was moved forward, first to CL (at which time ground spoilers would also retract), and then to TOGA, where it stayed for 11 seconds, before being pulled back to idle again.

No fatalities.

Bernd

bsieker

1st Sep 2007, 09:53

So, we are talking about four accidents and eight well trained and experienced pilots.

Don´t you think I have a good question?

I don't think it's a very useful question. And I'll tell you why ...

I would say thats an excellent question but many here choose not to face it and instead look the other way.Seems we have 3 camps:
a)the AB pilots who naturally dont want to see the design error
b)the resident "experts" who just love discussing the man-machine interface
c)simple folk who think its a bad idea to have reverse unless and until BOTH TL's are at IDLE.

This is an extreme oversimplification, and unfair categorisation of people.
Do you really believe (1) that Airbus pilots would not like to have the safest plane possible, and are not the most qualified to judge the interface, and (2) that "simple folk" should design aircraft human/machine interfaces? Heaven forbid!

Those who talk of the MEL and THR ABV IDLE/RETARD/continuous chime see the trees but not the woods.There can be no better or clearer warning to a pilot that TL's are not at IDLE than the denial of TR.

I don't agree.

The best post came from woodvale.How pilots tunnel their vision in a bad situation.Repetitive chimes and/or EICAS annunciations can get filtered out.However,something fundamental like the physical inability to engage TR will find a way through that tunnel vision.It has to.You wont stop without TR.It either leads the pilot by active-recall to retard the forgotten TL or at the very least enables the abort scenario.

Yes, I agree he made a good point. A CRC may indeed not be the optimal way of warning. I like the "Retard TWO!" modified FWC callout better, but that, too, may not be the best way.

You are asserting that not getting reverse thrust "has to" get through tunnel vision, and give the flicght crew the correct clues, without giving any persuasive reason. "It has to" is not a reason. And "You wont (sic!) stop without TR" is flat wrong. There even are jet airliners that don't have TR at all.

Reverse thrust has an even smaller contribution to stopping performance than ground spoilers (I imagine an aircraft with inop spoilers would not be dispatched), so not getting reverse thrust despite selecting it is not going to help much in alerting the pilots to the real reason of their problems. Pilots may simply assume a failed reverser. (Thrust reversers are not the most critical systems, and thus are not required to be among the most reliable, as evident by not even being required to operate the aircraft).

Unless they also know the logic for not giving them reverse even if they asked for it. (Additional confusion. Another logic to learn by heart?)

Bernd

ELAC

1st Sep 2007, 10:05

I would say thats an excellent question but many here choose not to face it and instead look the other way.Seems we have 3 camps:
a)the AB pilots who naturally dont want to see the design error
b)the resident "experts" who just love discussing the man-machine interface
c)simple folk who think its a bad idea to have reverse unless and until BOTH TL's are at IDLE.

I dont say the tech jargon from camp (b)(if I could only understand what the hell they're saying)and the denial from camp(a) hasnt been interesting.It has.

rananim,

As is beginning to seem usual and repetitive in your posts, you appear to have placed the cart before the horse. Or, perhaps it's the placement of the cranium relative to another beast of burden? Whichever.

You, and any others who are under the illusion that operating an aircraft makes one an apologist for its design need to wake up and recognize some important facts. No serious professional here wishes to see the propogation of inferior designs. We have to work with them and consequently we have a vested interest in seeing that they are is good as they possibly can be. If any design is found to have a significant weakness that compromises safe operation we will want it fixed.

Where I, and I suspect other "Camp A" pilots as well other technically knowledgeable contributors part ways with you is in the process of analysis. Your approach as laid out in post #1715 has been:

Its not an AB/Boeing thing I can assure you although I do admit that I have deep-seated mistrust of the AB design.I quite understand though that as long as a pilot forgets everything hes been taught and learns the new concept,everything should be just fine....

You choose to start with a conclusion, that the design is flawed, and work it back to an attribution of cause. That, however, is not how analysis works, and it is fortunate that at least a few people here recognize that.

One particular difference that informs the posts from contributors who have flown the aircraft is simply that. They have flown the aircraft and have experience with its strengths and weaknesses and are capable of putting what we know of this accident into context with those experiences.

Another particular difference is the tendency to not make assumptions beyond their scope of knowledge. You, on the other hand, have chosen to conclude that the accident was induced by design without having the benefit of being able to assess the full set of environmental, design, corporate, training and individual human elements that may be involved. It seems you would prefer to jump to your sole conclusion in ignorance of these factors instead of investigating them fully and impartially in search of a complete set of causal factors.

So far as I've seen, those from your camp A (who are neither in denial nor "not wanting to see)" have tried to explain the aircraft's systems processes and operating procedures as they understand them to those who, like yourself, don't. They have not been busy advocating a specific conclusion for the simple reason that they know there is a great deal of information that is not publicly available, and most of that which is is in a raw state and has yet to be rigorously analyzed.

ELAC

PBL

1st Sep 2007, 10:07

Dozy,

I understand also, and support, your wish to keep the discussion contentful.

But there was a question of fact. Rananim said (ignoring his mode of expression for the moment which others have well addressed above), that there were three classes of people in this discussion, and listed them. Well, was he right? Do his three classes cover (with some measure of interpretation) the major classes of participants?

Lemurian pointed out that he, quite obviously, missed a class, and said which one it was.

I think that is legit. Rananim was, objectively, wrong, and Lemurian corrected him.

Here are the classes without emotive words:

a) rated Airbus pilots who do not find the interface confusing
b) technical experts who are interested in analysing the interface
c) others who may not be pilots who are contributing to the analysis from intuitive principles
d) rated Boeing pilots who are wary of the thrust-lever interface on Airbus machines

I'm in class b. So are bsieker and TripleBravo, I believe. ELAC, Lemurian, PJ2, TyroPicard are in classes a and b. Dani is in class a. I think BOAC is in class d but I can't tell if he is in b as well. I don't know where Rananim (probably class e: rabble-rousing :) )

There are also some people who don't fit these categories. But so far, I have only read of one type-rated contributor who found the interface confusing, and he has long dropped out of discussion.

PBL

BOAC

1st Sep 2007, 10:39

Just a touch of over-simplification!

I would not presume to be in b), and neither am I in d) inasmuch as I am not WARY of it - I just have no experience of it, which places me in group e) - trying to understand how it interfaces with and confuses pilots and why this accident occurred plus what needs to be addressed by manufacturers and training. You also need, sadly I think, to include the pilots from CGH in e)?

PBL

1st Sep 2007, 11:12

Just a touch of over-simplification!

By which I take it you mean spoonfuls. Yes, indeed (Disclaimer: I only proposed one of these categories. The others came from a Cat e contributor)

(probably class e: rabble-rousing )

which places me in group e) - trying to understand how it interfaces with and confuses pilots and why this accident occurred

That's not exactly what I meant by "rabble-rousing" :)

I think most contributors are trying to understand why this accident occurred, and any category in which most people fit is not a useful classifying device, so I wouldn't highlight it.

There are also some who are prepared to delve deeper than others. Some say "didn't retard the thrust lever" and don't want to go deeper. Others want to know about braking behavior and performance, even with significant thrust on #2. I don't think that part of the discussion is concluded yet, because no one has drawn lessons for improved landing decision making. Yet others want to know about the entire set of braking scenarios (RTOs as well as landings, with partial kit INOP). Indeed I believe bsieker, who in the background of this discussion is doing the equivalent of a sophisticated FMEA with the state machines reverse-engineered from the FCOM, has identified some questionable states which we could profitably discuss when he is finished.

PBL

Dani

1st Sep 2007, 12:08

Thanks for your very comprehensive post, PBL, for the first time short and precise, bravo!

Although you put me correctly in class A (I'm not confused with AI man-machine interface), it's rather obvious that other AI-pilots are.

Please excuse that I write AI because this is the more official abbreviation for Airbus Industries, compared to AB=Air Berlin.

It is a simple fact that at least 3 crews ever messed up something very badly. I have argued this way already before.
I have to repeat that it's pretty clear that this error of "forgetting" a TL is not a case of amnesia or any other pathologic reason but because they really *though* that they were acting correctly.
There must be a reason why you don't touch a broken TL/TR. I still haven't found out where and when and why. On a short runway and in an Airbus, that's fatal. But in other cases there must be a reason.

This is what we have to find out and why. This will then be the terminal cause of this accident.

Dani

HotDog

1st Sep 2007, 12:45

I don't see why you can not pull a reverser lever into reverse position if that reverser has been deactivated by maintenance? Not familiar with the bus or two engine airplanes as such, but I presume the affected thrust lever has to be at idle before you can select reverse thrust, activated or not.

Dani

1st Sep 2007, 13:32

Hotdog, you are so right! Exactly that is what nobody understands. That's why we discuss it here for more than 2000 posts long...

I still think that these TAM guy thought he was in "another aircraft". Or that he was so afraid of the electronics he couldn't figure out what is the correct thing. It is for anyone else so clear and intuitive to take back that TL. Not only in an Airbus, but in any other aircraft.

Dani

TyroPicard

1st Sep 2007, 19:50

Rananim
The pilots mindset was quite rightly to use everything at his disposal(spoilers/one rev/max braking).
Not quite true - MED Autobrake was selected, if PF had intended to use max braking I reckon he would have applied full pedal deflection very soon after touchdown.
The designers give him the one retardation device that commits him to a landing before making him cancel all fwd thrust and fulfill the condition that give him spoilers and ab.
Here's a contrary thought .... Perhaps it is safer, with one T/R Inop, not to select reverse thrust at all, but simply retard both T/L to Fwd Idle? Discuss.
Tyro

PAXboy

1st Sep 2007, 20:06

Non-pilot speaking, with the proviso that I have read every single post in this thread (No, I do not have too much spare time but I find this a fascinating thread and so am giving the time to it).
RananimThis plane didn't crash because the pilot forgot to retard the TL. It crashed because the plane's designers trapped the pilot halfway between a landing and an abort.As far as I know, the official report on this accident has not yet been published ... ??? So I proceed with due caution.

When a person is instructed how to operate a machine, they are trained in the operation of that machine in such a way as to gain the maximum from it and to minimise the risk from it. This will include instructions from the manufacturer and the owner of the machine. From a basic (but still lethal) turning lathe to a cruise ship.

On taking delivery of a new cruise ship, the captain will be told the operating parameters of that ship. This will involve numerous mechanical and human factors upon which the safe operation is based, following exhaustive trials. If the Captain fails to operate the ship within those parameters - then they will be liable to a reprimand of some form (large or small). The unique factor for an airline captain is that failure is more likely to have catastrophic effects before any reprimand can be given.

This point has been gone over many times in this fascinating thread: if the pilots are shown to have operated outside the parameters of the machine and their instructions - whose fault was it?

We all wish to see faults reduced and, overall, the airline industry has a fabulous record, so everyone WANTS to find the right answer. If the right answer is that (it is reported here) four crews have failed at a critical moment in the understanding of their machine, then the authorities may decide that is more important than the hundreds of thousands of times that the machine was operated correctly.

But if they change the operating parameters for the 'benefit' of four crews - how will that change the situation for thousands of crews that already operate the machine every day, within it's correct parameters? Will you make their life more difficult and, consequently, open up risks as yet unquantified? Whenever you change one item in a system, you affect every other item to a greater or lesser, direct or indirect degree. [For the purpose of discussion 'operating parameters' would include all human factors and electro-mechanical aspects of the design]

Please be sure that I have observed over the years the all too easy way in which unscrupulous carriers have blamed the crew for anything and everything, because they are dead. In PPRuNe, I have spoken in support of those who want to change the way in which working hours are being allowed to creep up and the ever present risk of fatigue. That specific factor has been mentioned in this thread and may well have been part of why they appear (at this stage) to have failed to operate the machine within agreed parameters.

bsieker

1st Sep 2007, 21:03

[...] this runway in Sao Paolo [...] was slippery

We don't know that. Perhaps never will.

The "no spoiler" call starts the tunnel vision because the pilot perceives things are not proceeding as planned.He even sighs(happened before?)On paper,he should have gone for an abort when he didnt get the spoilers

Really? I don't have the TAM FCOM, so I don't know. Do you?

this is a short wet rwy and time is crucial.However,his mindset was to land,to get it down and get home.Okay,so he goes for reverser,

SOPs I have seen are to select reverse thrust at MLG touchdown, before the spoilers call. TAM procedures may be different, I have seen a cockpit video of an unknown airline from a landing at Madeira, where PF clearly waits for the "spoilers" call before selecting reverse.

There is, however, an important fact to disprove your line of events: PF clearly selected reverse thrust several seconds before the "spoilers nothing" call. Look at the superimposed CVR-transcript/FDR graphs, p12:

- 18:48:26: TL1 to full reverse (one second after second MLG touchdown)
- 18:48:29: "Spoilers Nothing" callout by PM

[...],oblivious to the fact that he's forgotten TL#2.If thats denied too,then his tunnel vision will be broken

This is a strong, unsubstantiated claim. Everything deduced from it is irrelevant. You have not added a new argument.

The idea that one more thing needed to stop the aircraft being denied to the pilot will break the tunnel vision, instead of increase the panic, is doubtful at best.

This plane didnt crash because the pilot forgot to retard the TL.

Unfortunately, it did.

It crashed because the plane's designers trapped the pilot halfway between a landing and an abort.

The aircraft gives the pilot what he asks for, as it should, as does every other aircraft. Emergency scenarios are so complex and manifold, that one cannot be certain that even things that seem silly may not sometimes be needed.

You cant just disconnect the A/THR with app thrust,green light TR#1 and say "Thats what you asked for..now get on with it"You protect the pilot by installing a simple interlock and say "Look if you're not going to fly this thing correctly and retard both TL's,you're not getting any of my retardation devices and will have to go flying again".

Things aren't that simple. But for the sake of the argument, let's follow you down:

So, the pilot's mind is set to land. He doesn't think about going around after selecting reverse. Still the aircraft denies him reverse, letting him overrun even faster (a moot point here, since all died anyway). Very clever. Very safe.

I find it arrogant to be certain that this logic of denying retardation devices will not cause errors, but rather prevent them by forcing the pilot to change his blocked mind (which was set to land), in a case of emergeny.
If the pilot asks for contradictory things, the designers (and thus the aircraft) cannot decide which of the things is The Right Thing.

And neither can you, even if you may believe otherwise.

There are only very few things that an A320 will not allow you to do (if all systems are operating), among these are: stall the aircraft, fly it upside-down, selecting reverse thrust in flight, selecting ground spoilers in flight, exceed the structural (g-) limits.

It will allow you to: fly it into the ground (although it will warn you before ...), exceed the maximum speeds (although it will reduce speed if you let go of all controls), select highly unusual combinations of thrust settings, land with the landing gear up, start the take-off roll with the parking brake on, ...

These latter things are usually not useful, almost always dangerous, but not unambiguously The Wrong Thing in every case.

No claim of yours that denying one retardation device will start tunnel vision, and denying another retardation device will end it, changes that.

And although perhaps a case can be made that reverse thrust on any engine should only be possible when no other engine is above idle, this is not it.

Bernd

Rob21

1st Sep 2007, 21:21

Rananim,
Excellent post, I am still following this thread because I'm waiting to see someone explain here why not allow the pilot to deploy ground spoilers manually, when he is applying more than 20º on the manual brakes and has at least one reverse engaged.
Someone said here that adding more stuff to the logic tree could lead to more operational err. But this is what I'm trying to say. The "logic tree" does not have too many "branches" already? Why not simplify it just a bit?
TyroPicard,
What a fantastic idea, why not discuss here the possibility of (by MEL) not using reverse at all when one is inop?
It was said here that reverse is not crucial anyway, it is used to reduce stress on the brakes. Short and slippery runway? Would be nice to have reverse? Don't land there, this will make the company fix that inop reverse very fast...
I imagine that most of the posters here really want to find ways to avoid this (and other) kind of accident from happening again.
One reverse inop? By MEL, no reverse at all.
And the TLs would come to idle, no room for confusion...

GMDS

2nd Sep 2007, 05:31

PBL

a) rated Airbus pilots who do not find the interface confusing
b) technical experts who are interested in analysing the interface
c) others who may not be pilots who are contributing to the analysis from intuitive principles
d) rated Boeing pilots who are wary of the thrust-lever interface on Airbus machines

Please include:
e) pilots who have flown AI, Boeing and MD new generation aircraft and have their well founded opinion based on experience (and still get lectured by self proclaimed expert pilots who have only flown one of the above but defend it feverishely)

I stand by my earlier comment: If the THR levers would move, this particular incident would most probably have been detected rapidly enough to enable the crew (who most probably have screwed up something) to counteract early enough to prevent this accident.

Simple

GMDS

Super VC-10

2nd Sep 2007, 06:27

[off topic]

"What was it that someone said about not wanting to try tea with arsenic."

Nancy Astor to Winston Churchill - "If I were married to you, I'd put arsenic in your tea!"

Winston Churchill in reply - "Madam, if I were married to you, I'd drink it!" :D
[/off topic]

Dream Land

2nd Sep 2007, 06:27

I'm waiting to see someone explain here why not allow the pilot to deploy ground spoilers manually, when he is applying more than 20º on the manual brakes and has at least one reverse engaged It's pretty simple, on the Airbus, ground spoiler deployment happens automatically, braking without reducing thrust is useless, on this particular runway braking after "spoilers nada" is also useless.

bsieker

2nd Sep 2007, 13:22

I am still following this thread because I'm waiting to see someone explain here why not allow the pilot to deploy ground spoilers manually, when he is applying more than 20º on the manual brakes and has at least one reverse engaged.

I consider it a key point, and try as I might, I cannot find a reason.

I think this may actually be a problem of incomplete requirements. The failure mode "leaving one thrust lever up during landing" has perhaps not been analysed exhaustively, taking provisions to keep the effects from becoming "catastrophic".

A320 pilots: can you give us an estimate what the maximum inadvertent brake pedal deflection might be, given a critial high-workload situation in which large rudder inputs are necessary, also given the worst possible conditions, slippery pedals, loose footwear, ...

5 degrees? 20 degrees? 45 degrees?

on this particular runway braking after "spoilers nada" is also useless.

Not if braking deploys Ground Spoilers, even with one TL above "near idle".

Accurate calculations and simulations will tell if it would have been enough to save lives in this case, but it would have decreased significantly the overrun speed.

Since this would be an unambiguous "I want to stop" signal, it could also be used to reduce engine power to idle, possibly displaying an amber "IDLE LK" (or similar) warning on the ECAM. (Pending further research, this may turn out to be a bad idea.)

Bernd

Dream Land

2nd Sep 2007, 13:31

Accurate calculations and simulations will tell if it would have been enough to save lives in this case, but it would have decreased significantly the overrun speed.
This may or may not be true, the fact is, is that without ground spoiler deployment, they should have missed the approach, having spoilers deploying due to brake application is useless.

Dani

2nd Sep 2007, 15:50

Ranamin, I know that you don't like Airbus, but also a Boeing wouldn't have survived this laps. As it is itinerated for mor than 2000 posts, you cannot stop on a slippery short runway with one TL in approach trust. Accept this fact.

The only thing I accept to discuss is what effect has the whole AI (which you call AB) cockpit technology onto pilots minds, i.e. make them "forget" a TL in its position. If you ask me, the only fault that Airbus cockpit technology has is that it is so simple that there are a) pilots in their seats that shouldn't be and b) they forget completly about "good airmanship" and "real flying".

Dani

SR71

2nd Sep 2007, 15:53

Is it just me or does no-one ever look at your N1 gauges these days once you've cracked reverse/are on the landing roll?

I'll be the first to admit that exposure to non-standard situations reduces your cognitive capacity, but your N1 gauges surely give you a clue as to what the engines are doing?

I guess, however, that one engine in reverse and one engine at approach power might look the same....

Dani

2nd Sep 2007, 15:57

Mach 3 flyer, this very A320 has EPR gauges. They are very hard to read (because only the second digit behind the coma changes), some people look at N1, correct.

The correct visual check on a A320 is the green boxed REV indication beside EPR. Since there was no TR 2 avail there was also nothing to check...

Flight Safety

2nd Sep 2007, 16:43

Why did the pilot leave ENG2 TL in the climb detent after pulling ENG1 TL back to idle 2 seconds after the "retard" call in the flare, just prior to touchdown? EMIT may have a point regarding engine spool up time creating part of the anticipation, but what does seem clear to me from the CVR and FDR data, is that the pilot wanted to get the one working TR (on ENG1) deployed as soon as possible after touchdown.

I'm going to argue the same points (single mode vs multimode primary flight control design) as I have previously, but approach it in a different way. I know what follows may seem basic at first, but please bear with me.

What exactly is a "throttle"? A little research shows the word originated in the 1300s, from ME (middle English) “throtelen” (throttle), which probably derived from ME “throte” (throat). In the 1300s the word meant to strangle or choke. The first recorded use of the word “throttle” for mechanical devices was in the early 1800s and referred to a control operating a steam engine. A valve was used for the “choking” function that had a mechanical linkage to a lever used by an operator. Later the word “throttle” was also used for internal combustion engines and turbine engines. For steam engines, the power output of the engine is controlled by “choking’ the flow of steam into the engine. For internal combustion engines, the flow of air into the engine to burn fuel is “choked” by a valve (usually a butterfly valve). For turbine engines the flow of fuel into the engine is also “choked” by a fuel valve. In all 3 engines types, the choking valve operated by a mechanical or electronic connection to a human (via a lever or sometimes a wheel), controls the power output of the engine. Historically, the “choking” valve provides an “infinite” number of power settings providing the operator with precise control of the engine’s power output.

In aircraft, the basic function of an engine throttle is no different from the classic historical uses. When the A320 is on the ground, the throttle levers work in the classic way for controlling engine power. But from takeoff to landing, these levers no longer function as throttles in any classic sense when the auto thrust system is engaged. When auto thrust is engaged, the thrust levers become the big switch arms of multi-position selector switches, instead of throttles.

Switches and throttles work in very different ways. While throttles are described above, switches work by turning things on and off. A multi-position selector switch normally works by turning on one of the possible selections, while turning off the other selections. When auto thrust is engaged on the A320, switch arm positions CLB, FLX, and TOGA are available as possible selector switch positions.

Here we have 2 primary modes of operation for the A320 thrust levers, throttle mode and selector switch mode. In throttle mode the lever position equates directly to engine power, directly controlling the power output of the engine in the classic throttle sense. In selector switch mode however, we have the thrust levers being used as big switch arms to select power modes for the auto thrust system. In selector switch mode, lever position no longer equates to engine power thus the levers have no direct control over engine power, because they no longer function as throttles in any classic sense. It was possible to design the auto thrust system so that a selector switch on the panel performed the same power mode selection function as the thrust levers on the A320, but that design choice was not made. Instead it was decided to add a second operating mode to the thrust levers, because these levers only provide inputs to a computer, where the software determines what those inputs mean. Manufacturer B decided the levers in their cockpit would always be throttles, and would be presented to the pilots only as throttles. Thus B’s thrust levers are single mode in function because they are only throttles, not dual mode s in the AB system, where the levers are used both as throttles and selector switches, but only as one or the other at a time.

Now back to the TAM accident. I think it’s interesting that the primary function (or operating mode) of the thrust levers in the A320 is that of the auto thrust selector switch, because this mode is used the majority of the time the A320 is operating.

In the A320, the TL mode changes from the auto thrust selector switch mode, to the classic throttle mode when the aircraft touches down (or slightly before touchdown in the flare when the pilots pull the TLs back to idle in response to the “retard” callout). I find it interesting that “retard” in not a selector switch mode related callout, but it’s a throttle lever mode callout instead, because “retard” has no meaning for a switch but does have meaning for a throttle.

What’s interesting is that the pilot waited for the “retard” callout in the flare before he pulled the thrust lever back for ENG1 to idle 2 seconds after the “retard” callout started. So I believe he responded to this callout. But why leave the ENG2 TL in the CLB detent? There are several possibilities but I’ll argue for this one. When the thrust levers are in selector switch mode, CLB detent is the correct setting for the thrust levers on approach (with auto thrust engaged). Keep in mind that selector switch mode is THE predominate operating mode for the thrust levers on the A320, because auto thrust is used the majority of the time when an A320 is operating. In the mind of the pilot, he may have been thinking about “selecting reverse” in 2 steps (idle position then reverse position) on the ENG1 TL (thus selector switch mode thinking) instead of pulling engine power back to idle in preparation for reverse (throttle mode thinking)? Again we know that ENG2 TL was left in the CLB detent (the correct setting up to that moment), which suggests that he may still have been in selector switch mode thinking instead of throttle mode thinking. Then to leave ENG2 TL in the CLB detent during the rollout, further suggests to me that the pilots never transitioned from selector switch mode thinking to throttle mode thinking once on the ground. Thus we have what I believe is a classic manifestation of Jef Raskin’s Rule 1a.

Rule 1. An interface should be habituating.
If the interface can be operated habitually then, after you have used it for a while, its use becomes automatic and you can release all your attention to the task you are trying to achieve. Any interface will have elements that are habituating, but the principle here is to make the entire interface habituating.

Rule 1a. To make an interface habituating, it must be modeless.
Modes exist where the same gesture (control action) yields different results depending on system state at a time when your attention is not on system state. In the presence of modes, you will sometimes make mode errors, where you make a gesture (control action) intending to have one result but get a different and unexpected result, distracting you from your task.

If the A320 thrust levers are selector switch arms most of the time and only sometimes throttle levers, it’s possible to get the 2 modes confused right at the point of transition from one operating mode to the other (during the flare and touchdown). I also wonder that since the thrust levers spend most of their time in selector switch mode, if this habitually takes the pilots thinking away from thinking of the thrust levers as throttles (direct engine power controls)

When considering the logic of the Ground Spoilers and the Auto Brakes (which has been eloquently discussed), one has to think about which of these 2 operating modes of the thrust levers that logic applies to. It seems clear to me that the logic was built assuming that the thrust levers would be operating in the classic throttle mode, while the aircraft was on the ground rolling out after touchdown.

GMDS

2nd Sep 2007, 17:55

Nice analysis. Reminds us of the omnipresent bureaucrats priciple: "Why make it simple, if we can make it complicated".
And let's continue diffamating those who think aviation should be simple, because the more simple it is, the more safe it remains. This seems to be outdated. In the old days pilots were heroes when they brought their bird down safely, no matter how. Today's heroes are pilots who can tell that others should not be in their seats, because they do not understand all the multifunctions of unneccessary new designs.
Tempora mutantur et nos cum illis, allthough i just conform to the latter without consenting. Hypocrit? Maybe. It would definitely be if i'd shut up, which i don't, but i know it's to no avail.

BOAC

2nd Sep 2007, 18:17

I agree - an interesting analysis. Do AB pilots perhaps instinctively view the T/Ls as 'selectors' for a given mode? If so, then 'retarding' is a means of placing the T/L into the mode where reverse can be selected. Ipso facto, since there was (?presumably?) no intention of using reverse on No 2...................................

Have we, with FS's help, identified the flaw in the training? In the mindset, 'something else' in the system will look after No 2. No 1 MUST be retarded to get reverse. I think I can see how that train of thought could be inculcated.

Now, when No 2 has NOT gone to ilde, as perhaps 'expected',

"Look this"?

Comments from AB pilots? What did you come away with from training as a concept for the 'throttle quadrant' function on the 320?

It could be horrifically simple.

TyroPicard

2nd Sep 2007, 19:10

BOAC said..Do AB pilots perhaps instinctively view the T/Ls as 'selectors' for a given mode?
I don't think so.. you use them as "normal" thrust levers taxying out and in on every flight, on the runway you set a N1/EPR value to stabilise at, then select T/O thrust, move them back at thrust reduction altitude, and finally move them back in the flare. The mode you are interested in is the A/THR mode and that certainly is achieved by T/L movement.. having said that I don't conciously think "I must now disengage autothrust by placing the levers to idle so I can then use reverse thrust" .. I retard them at the appropriate point just like all pilots do then select reverse - modes, what modes????? I think about desired thrust at that point, not modes.
Flight Safety writes..I think it’s interesting that the primary function (or operating mode) of the thrust levers in the A320 is that of the auto thrust selector switch, because this mode is used the majority of the time the A320 is operating.
If you only think of time, true. But if you consider the number of times the T/Ls are moved during one flight .. at least ten "thrust selection" movements, and only one A/THR "mode change" movement (OK two if you count retard to Idle on landing). So I reckon that's at least five to one for thrust control.
I think BOAC has raised a good point, which I think of like this - I am not sure it's a case of "forgetting" No.2 T/L, rather a conscious choice to only move the No.1. This is such an illogical action that I wonder if PF had created an "emergency landing" train of thought when it was merely going to be "demanding". Is it possible to place oneself under enough pressure to perform well, that one prevents clear thought and suppresses years of habituation? I started this train of thought after reading Flight Safety..
Regarding how the mind narrows in an emergency, I explained this in my previous post that as fear rises, the mind moves more toward action oriented "fight or flight" type responses and away from thinking and reasoning type responses. In fear or an emergency, the mind tends to want to act rather than think and reason things out.

This landing was NOT an emergency ... but it became one.
I also disagree with Flight Safety here ..
The primary controls change the attitude and direction of the aircraft and they speed it up or slow it down. Obviously these controls become emergency controls in an emergency.
I don't look on sidestick and thrust levers as emergency controls - you may use them in an emergency, certainly, but not in any significantly different way from normal. Emergency controls are red, often guarded, and need confirmation before moving them!

Tyro