TAM 3054 Report released [Archive]

PJ2

1st Nov 2009, 18:24

voltage;
If I am reading the report correctly, the A/T was active until it kicked off due to the split condition (EPR 1.2 vs. reverse). So scenario 2 applies, and the "offending" TL might have been out of detent fwd by only half an inch?
No. Scenario 2 is not accurately stated.

A half-inch thrust lever displacement would produce about 40 to 50% power if I recall. The statement that a half-inch from the IDLE detent could deliver as much as "climb thrust", is incorrect. Engine thrust is limited by the TLA even when the autothrust is ON and Active. If the thrust lever is out of the CLB, (Climb) detent, engine thrust will be limited to the thrust level equivalent to that thrust lever position and will not produce climb thrust. This is a fundamental, key understanding of the autothrust system when flying the A320/A330 series aircraft.

With the levers split as they were, the autothrust did disconnect. The reference for the #2 FADEC then was limited by the thrust lever position, which was about 24deg or essentially full thrust.

The DFDR traces were provided very soon after the accident. The engine thrust being developed by #2 engine as shown in the DFDR traces was indeed 1.2EPR, which is equivalent to about 92 to 95% N1. The report doesn't have provide the N1 traces for #1 and #2 engine. The TLA of #2 thrust lever was just below 25deg so it was in the CLB detent until the end of the recording.

The #2 engine was essentially developing almost full thrust while #1 was in full reverse, (shown by fuel flows being about the same for both engines but the TLA for #1 was about -20deg).

aguadalte

1st Nov 2009, 18:55

CONF iture:
A/THR ON Engine output can be anywhere between idle and climb thrust as long as the thrust lever is not at the idle stop. As an example , one thrust lever could be only half an inch above idle stop and the engine could deliver as much as climb thrust (very unconventional)

Sorry to disagree, but that's not truth. With A/THR ON, if you retard the thrust levers to a lower (than Climb) intermediate setting of TLU you will limit the Auto-thrust to a certain amount directly related to that particular TLU angle. A/Thrust will only be able to use an amount of thrust between Idle and that particular TLU setting.

By the way, I find the work of the Brazilian Investigators much better than expected and some issues like Human Factors were well addressed.. Some of the BEA comments are only a mirror of the widely known Airbus Industrie's incapacity (or should I say, unwillingness) for a change.

CONF iture

2nd Nov 2009, 00:26

PJ2 and aguadalte,
You made me open the library … and the books support your version !
So here I stand corrected, I learn something, and I thank you for that.
... Now I have something to experiment for next flight.

Regarding the report, anyone kind enough to translate the essential of both hypotheses … ?

PS : Also, very much interested in page 115, Recommendations to Airbus ... !?

PJ2

2nd Nov 2009, 00:52

CONF iture;

That's the main purpose of the forum; glad it was of help.

Re "experimenting", in Line Indoc instructing, under appropriate circumstances I would encourage moving between fully automatic flight into fully manual flight and back again. That means disconnecting the a/p, then the autothrust, then the f/d's and then reconnecting them again.

Disconnecting the a/t's especially; I noticed that when it was the F/O's leg and I indicated that they were free to hand-fly the airplane to from takeoff to cruise and from top of descent to touchdown, most refused because I think they were uncomfortable. Good reaction in the immediate sense but I didn't think much of the lack of willingness to learn. There are a few circumstances where hand flying and manual thrust are required by the MEL and one had better know the numbers.

The other 'gotcha' which I used to emphasize and when appropriate, demonstrate so that the candidate knew what it looked like and knew what to do, is the THRUST IDLE/OPEN DESCENT mode when hand-flying and for whatever reason, not following the flight directors. Leveling off before ALT* will leave the F/Ds (and the engines) in the Open Descent mode. Since there is no capture, the power does not increase and the speed begins to bleed back for no apparent reason, (no warnings, nothing apparently wrong) and the engines remain at IDLE thrust.

This is what occurred in the accident at Madras. Airbus has since addressed this by causing the Thrust mode to revert to SPEED from THRUST IDLE at Vls + 4kts (if I recall). The sudden increase in thrust to re-capture the managed speed is very surprising, and tells the passengers that something happened up front. Deadheading Airbus guys will know. The key is to either turn off BOTH Flight Directors which causes the THRUST mode to revert to SPEED, or to disconnect the autothrust and increase the power manually.

The opposite problem occurs if one tries to control a speed problem by "disconnecting" the autothrust while leaving the thrust levers in the CLB detent. Can you imagine what would happen?!

Not activating the approach would be one more item of interest. Since this must be done manually on the FMGC, forgetting to do it means that a rapid thrust increase will occur when landing flap (Conf 3 or Conf FULL) is selected because the FMGC no longer has a speed reference for the approach, (it is still in the DESCENT mode) and so will go for the last speed it "knows"....250kts! I'm sure this was demonstrated in the sim, but if not, a swift retarding of the thrust levers to prevent an overspeed of the flaps and destabilization of the approach may rescue the situation and you can re-engage once things settle down and the approach is activated. Likely the best response is to go around but on the Quiet Bridge at SFO or the Visual onto 31 at LGA and other places, it may be a long time before you get on the ground. A go-around and a normal circuit and approach usually cost 400kg. At these places and others, it can cost more.

Sorry to drone on...this probably belongs on Tech Log forum, CONF iture.

Re recommendations to Airbus...I can say that FOQA information is invaluable in determining if there were any cases where A320 thrust levers were "split" at touchdown and if so, by how much and for how long. I would think that most airlines modified their SOPs to ensure that BOTH thrust levers were closed by touchdown and that no RETARD calls should be heard by the crew. There may even be a "SPOILERS UP" call now required, (was never called before).

As to why to high-time professionals left one thrust lever in the CLB position, that is a disturbing mystery - disturbing because by all accounts these guys were highly experienced, competent pilots with loads of time on the Airbus. In the time they had to analyze what was wrong, I'm not sure any warning would have been able to help.

ULMFlyer

2nd Nov 2009, 01:29

My translation of p.115 (Portuguese as mother tongue, but living in the US for many years). I apologize for any incorrect technical term, but I never flew anything that didn't have a Rotax 912 in the "pointy" end.

To Airbus France SAS

It is recommended:

RSV (A) 168/A/07 - CENIPA Issued on Dec 28th 2007

The establishment of a landing procedure for A-320 aircraft defining corrective actions on the part of the crew, when ground spoilers do not deploy after touchdown.

RSV (A) 170/A/07 - CENIPA Issued on Dec 28th 2007

The optimization of the A-320 RETARD advisory (warning?) system, so that it will only execute the function for which it was designed, that is, to advise the crew to retard the thrust levers to the IDLE detent.

RSV (A) 174/A/07 - CENIPA Issued on Dec 28th 2007

The improvement of the actuation logic of those systems responsible for decelerating the A-320, so that said systems will take into account the crew's clear intention to land and will guarantee [the aircraft's] deceleration efficacy, even with the wrong positioning of the thrust levers.

RSV (A) 176/A/07 - CENIPA Issued on Dec 28th 2007

The evaluation of advantages and disadvantages of employing [thrust] reversers in the A-320, before the deployment of ground spoilers are verified (confirmed?), and the establishment of the most appropriate procedure from a Safety of Flight standpoint.

RSV (B) 27/C/08 - CENIPA Issued on Apr 18th 2008

The evaluation of any need to restructure the disposition (arrangement?) of documents within the A-320 manuals (FCOM?), making it easier to consult them, particularly in flight.

Cheerio.

alemaobaiano

2nd Nov 2009, 10:13

CONF iture

Basically the investigators were unable to precisely determine the physical position of the thrust levers at the moment of the accident and so developed the two possibilities which were outlined during the press conference.

First hypothesis, equipment failure.

They looked at the possibility of the engine delivering a level of power that did not correspond to the position of the right thrust lever, giving climb thrust with the lever in idle. Airbus were asked about this and provided a mathematical probability of failure that was extremely low, essentially ending this line of thought. Not impossible, but unlikely.

Second hypothesis, pilot error.

They also examined the idea that the engine did what was expected of it and that the lever was left in the climb position by the crew. They produced a myriad of reasons as to why this could have happened, including modified procedures, lack of experience on type, authority issues, crew predisposition, and physical aspects (PIC reported a headache during descent). However, without the physical evidence of lever position the investigators were unable to state categorically that this was the principal cause.

On the subject of the recommendations passed to Airbus (which are an extremely small part of the total recommendations made) my impression from the press conference was that at least some of the TAM fleet have the updated software that provides a lever disagree indication, but that this particular airframe did not. IMHO the recommendations passed on to Airbus have little actual substance and as such the contribution of the aircraft systems to the accident seems to be minimized in this report, rightly or wrongly.

Of much greater concern are the recommendations made to TAM which cover almost all aspects of their operations and identify a number of significant failings within the company that contributed to this accident.

I haven't had time to do more than skim the report yet, so my initial views may be modified when I've read it in full.

PJ2, yes they had a lot of hours, but the pilot operating as co-pilot had very little time on the A320, and minimal recent experience in the role of co-pilot, points that were made several times during the press conference.

TTFN

atakacs

2nd Nov 2009, 13:34

RSV (A) 168/A/07 - CENIPA Issued on Dec 28th 2007
The establishment of a landing procedure for A-320 aircraft defining corrective actions on the part of the crew, when ground spoilers do not deploy after touchdown.

well in that case you don't have much choice but pray... If for some reason automation has decided you don't deserve ground spoilers (and auto braek for that matter) there is no way to overrule it. Given that you have probably eaten a good part of the runaway and unless a major redign of the AB logic your last "corrective action" will be to choose which obstacle will stop the run-over...

To the defense of AB it is indeed hardly conceivable that any crew - let alone an experienced one - would land without retarding both levelers. But it happened (maybe more that once ?) and at that time they where doomed.

RSV (A) 174/A/07 - CENIPA Issued on Dec 28th 2007
The improvement of the actuation logic of those systems responsible for decelerating the A-320, so that said systems will take into account the crew's clear intention to land and will guarantee [the aircraft's] deceleration efficacy, even with the wrong positioning of the thrust levers.

Again not an easy one but I'm still convinced that putting in that "big red stop button" might do more good than bad (although I'm sure it might also cause accidents by itself). The simple thought of not being able to decelerate a perfectly working aircraft just because the computer decided so (be it for crew mistake or sensor problems) is not acceptable.

BOAC

2nd Nov 2009, 13:51

A simple SOP of ensuring spoiler deployment BEFORE actuating reverse would retain the g/a option. There is far too much haste (in Boeing as well) in deploying reversers.

goldfish85

2nd Nov 2009, 16:05

I apologize for jumping in, but I reviewed several of these thrust reverser accidents. To date, there have been three almost identical accidents:
Mar 98, PAL 137 @ RPVB
Oct 04 TNA 536 @ RCSS
jUL 07 tam 3054 @ SBSP

Personally, I find it incredible that one pilot would not pull both thrust levers back to idle during the flare. Airbus has a unique design where the T/L's do not move during an autothrottle approach -- however the pilot is reminded by an automatic voice commend ("Retard," which leads to many jokes.) But I can't understand why anyone would only pul one back. However, one can call it "pilot error" if one does it. The second instance calls this term into question. When we have three, I don't think we can continue to call it "pilot error."

One of the problems is the explanation given. I reviewed the TAM FCOM discussion following the Sao Paulo accident. The description several lines and I found it hard to read. I had to read it two or three times to see what they were saying. It appeared to be written in French, machine translated to German and then translated into English to be read by a non-native English speaker. (see the pattern in the accidents.)

Part of the problem is that it doesn;t really matter if the pilot pulls both into reverse on only the operating reverser. The FADECs will keep an inop T/R from being engaged. Unfortunately, the procedure keeps changing. One month the drill will be only pull the operating T/R back (into reverse) and the next month it will be pull them both back.

There was a related accident in Phoenix in Aug 02. The pilot pulled both into reverse, then remembered that the procedure was to only pull the operative T/R back. He pushed it back up -- unfortunately into enough forward thrust to cause a runway departure.

There are a number of fixes proposed -- the one that was chosen was to to put an annunciation on the ECAM and continue the "Retard" call until both were pulled to idle.. I don't know if this was mandated.

Personally, I would rather see the issue made moot by making it impossible to get one in reverse and on in significant forward thrust.

Sorry for the soapbox.

Cheers

4HolerPoler

2nd Nov 2009, 16:59

I had a very similar experience as a junior skipper on the 320 a long time back but it's still clear in my memory - lucky in my case the runway was long.

One T/R deactivated, F/O flying, CAVOK but dark night/ cockpit. Reminded him at 1,000' of the deactivated T/R - maybe not a good thing - multi-cultural cockpit, low time FO, he reacted (I didn't see) by lifting his hand off that TL. At the Retard call he only closed the one TL, the other remained in the Climb detent. It was only at about the sixth Retard bleat and observing a clearly asymmetric condition that I realized things were amiss, took control, closed the other one and kept it on the paved surface.

Should we have gone around? Retrospectively no - the spool up time on the engine that was retarded would have proven potentially disastrous.

There, but for the grace of God, go I.

Rob21

2nd Nov 2009, 17:33

Why is so dificult for engineering to "teach" computers some simple logic, like if you have weigh on wheels, at least one TL on reverse and the pilot applying the brakes, the pilot wants to slow down?
Give the pilot spoilers, cancel the order coming from the TL not in reverse and "refuse" to give power to that engine.

I know it is hard for a computer understand why the pilot wants to stop if he continues whith one TL on climb.

On the other hand, it should be even harder for the computer understand why the pilot wants to go around with one engine engaged on reverse.

Maybe the computer could say: "Whow, this guy wants to fly with one engine on reverse. Since we are on the ground anyway, I will cut thrust on the other engine, deploy spoilers and apply full auto brakes. This guy can try this stunt another day, not with me supervising (or protecting) him...

goldfish85

2nd Nov 2009, 17:51

One of the tenets of Human Factors or Safety Engineering is that the best way to prevent accidents is to make the hazard inpossible to cause an accident and the least effective way is to rely on training.

I can't think of a single reason why anybody would want one engine in climb thrust (or a significant amount of forward thrust) and one in reverse. I've asked around and no-one I've spoken to can either. Therefore, make it impossible to place (or keep) one in reverse if the other is in forward thrust above idle.

Cheers,

Dick

goldfish85

2nd Nov 2009, 17:54

I'd like to discuss the circumstances with you, if you would. You're one of the surviving pilots on this type of problem.

Cheers,

Dick

Machaca

2nd Nov 2009, 17:58

Maybe the computer could say: "Whow, this guy wants to fly with one engine on reverse. Since we are on the ground anyway, I will cut thrust on the other engine, deploy spoilers and apply full auto brakes. This guy can try this stunt another day, not with me supervising (or protecting) him......as they plow into the aircraft/vehicle that inadvertently enters the active runway.

blue remaining

2nd Nov 2009, 18:48

only way, you can prevent such an accident is:

manual flight-manual thrust

when you control the throttle levers manually you know in which position they are. manual flight-automatic thrust is very dangerous and in my airline(european main carrier)forbidden.

atakacs

2nd Nov 2009, 19:57

4-holer poler: interesting contribution. I would tend to think that although rare this is not such an uncommon situation as one might think (asymmetric thrust leveller at landing). Fortunately most would catch it before it's too late.

This should warrant some more investigation by AB and some redesign of the automation logic.

ULMFlyer

2nd Nov 2009, 20:30

Personally, I find it incredible that one pilot would not pull both thrust levers back to idle during the flare. Airbus has a unique design where the T/L's do not move during an autothrottle approach -- however the pilot is reminded by an automatic voice commend ("Retard," which leads to many jokes.)According to the report, TAM had not updated the FWC to H2F3 standards. Hence the "Retard" call out stopped with only one of the levers in the idle detent. H2F3 was developed as a result of both accidents you mention. However, it came out as a SB, not an AD.

Cheers.

CONF iture

3rd Nov 2009, 04:00

ULMFlyer and alemaobaiano, Obrigado for your help.

All I can see is the obvious failure of a system : The BEA should be a leader in the continuous research of SAFETY but instead they show their total inbreeding with Airbus.

Page 118 "Furthermore, the BEA thinks that the Congonhas event was not foreseeable"
Page 119 "Since the accident, Airbus has been studying new corrective actions to take in account this scenario, which is now known"

How do they dare writing that after Bacolod and Taipei ???

Already after the first accident there was a very simple modification to be applied on the RETARD callout logic to help to prevent a recurrence !

Now, as a recommendation in that direction is done once again (170/A/07 on page 115 ) Airbus simply choose to ignore it in its comments.
It is disconcerting.

Help again : In the present report, any further specific detail on what does include the FWC (H2F3) standard except the triggering of a specific warning associated to an ECAM message ENG X THR LEVER ABV IDLE ?
To my knowledge, it does not feature a modification in the RETARD callout logic (?) which is the purpose of the recommendation 170/A/07.

ULMFlyer

3rd Nov 2009, 05:06

Help again : In the present report, any further specific detail on what does include the FWC (H2F3) standard except the triggering of a specific warning associated to an ECAM message ENG X THR LEVER ABV IDLE ?To my knowledge, it does not feature a modification in the RETARD callout logic (?) which is the purpose of the recommendation 170/A/07.
I had been under the impression that H2F3 did modify the callout logic. However, I just reread the relevant parts of the report and this is apparently not so. (The report actually reads a little ambiguously in Portuguese, but it became clearer when I was translating the relevant section on p.48 into English).

In any case, the only reference to H2F3 modifications is indeed in regard to the ECAM msg. So, I suppose you're right with respect to recommendation 170/A/07. However, another criticism in the report that also applies to this recommendation is the fact that this callout will still sound even after both levers are already in the IDLE detent, say, at 10 ft AGL during flare. In the eyes of CENIPA, the callout is not serving its purpose if it doesn't recognize that both levers have already been retarded, and this ends up leading to some complacency on the part of flight crews.

Hope this helps.

Jet_A_Knight

3rd Nov 2009, 05:28

Dick Newman said:

There was a related accident in Phoenix in Aug 02. The pilot pulled both into reverse, then remembered that the procedure was to only pull the operative T/R back. He pushed it back up -- unfortunately into enough forward thrust to cause a runway departure.

Dick, that's not quite right. Here is an excerpt from the NTSB report (NTSB Identification: LAX02FA266).

Note - the #1 Thrust Reverser was MEL'd.

The captain was the flying pilot for this leg of the flight and the airplane touched down on the centerline of the runway about 1,200 feet beyond its threshold. The captain moved both thrust levers into the reverse position and the airplane began yawing right. In an effort at maintaining directional control, the captain then moved the #1 thrust lever out of reverse and inadvertently moved it to the Take-Off/Go-Around (TOGA) position, while leaving the #2 thrust lever in the full reverse position.

The thrust asymmetry created by the left engine at TOGA power with the right engine in full reverse greatly increased the right yaw forces, and they were not adequately compensated for by the crew's application of rudder and brake inputs.

I figure that any aeroplane will spear you off the runway with that sort of thrust asymmetry.

alemaobaiano

3rd Nov 2009, 12:13

All I can see is the obvious failure of a system : The BEA should be a leader in the continuous research of SAFETY but instead they show their total inbreeding with Airbus.

Page 118 "Furthermore, the BEA thinks that the Congonhas event was not foreseeable"
Page 119 "Since the accident, Airbus has been studying new corrective actions to take in account this scenario, which is now known"

How do they dare writing that after Bacolod and Taipei ???

CONF iture, as they acknowledge Bacolod and Taipei in the very next paragraph I don't see that they are saying anything outrageous. They point out that TAM didn't have H2F3 and that the revised procedure wasn't followed, neither of which can be laid at the door of Airbus or the BEA.

I notice that you are concentrating on the technical issues with Airbus, but from my point of view the report raises many more concerns about TAM. As a frequent flier here in Brazil facts such as a failure to follow basic procedures (three different techniques in the last three landings?) do not exactly fill me with confidence when I board a flight.

TTFN

Rob21

3rd Nov 2009, 13:02

Alemaobaiano,

This is why I don't fly TAM, they are specialists in "short cuts" on training.

I heard this from pilots who quit flying TAM for this reason (not adequate training).

I like GOL's method, in the cockpit we can always see an "old" pilot and a "kid". When the kid is flying, the old captain has his eye on him.
When the old captain is flying, the kid watch and learn.

Just like with maintenance, where they never install two engines with the same flight time...

abs,
Rob

goldfish85

3rd Nov 2009, 15:16

Sorry, I implied, but didn't state it was due to asymmetric thrust.

Cheers

Dick

alemaobaiano

3rd Nov 2009, 16:17

They're not my favourite airline either Rob, I too have heard similar comments from TAM pilots, something that I don't hear as much from those at other companies. However I am sometimes obliged to fly TAM for business reasons, so I can't cut them out completely.

TTFN

Jet_A_Knight

3rd Nov 2009, 23:42

Dick - my reply was not intended to extract an apology from you.

goldfish85

4th Nov 2009, 00:39

I didn't take it that way.

Cheers

CONF iture

9th Nov 2009, 19:06

CONF iture, as they acknowledge Bacolod and Taipei in the very next paragraph I don't see that they are saying anything outrageous. They point out that TAM didn't have H2F3 and that the revised procedure wasn't followed, neither of which can be laid at the door of Airbus or the BEA.
Don’t you think it’s outrageous to pretend that Congonhas was not foreseeable when you know what happened in Bacolod and Taipei ?

They acknowledge Bacolod and Taipei but outrageously pretend that Congonhas was clearly different.
How was it different ?

All of these accidents are a direct consequence of pilots forgetting to place in the IDLE detent the thrust lever corresponding to the engine whose thrust reverser was inoperative

As early as 98 after Bacolod, the Philippines investigation team clearly identified that the RETARD callout could cease without having both thrust levers in idle detent (page 8 of the Philippino report)

Six years later, after Taipei, the Taiwanese investigation team made the clear recommendation to Airbus Company (page 102 of the Taiwanese report)
Reviewing the design of stop mode of Retard warning sounds or accommodating other warning methods to ensure that the warning will
continue before the thrust levers are pulled back to Idle notch after a touchdown has affirmed

The H2F3 response is totally inappropriate.
Who need another ECAM message when the obvious logical answer is simply to not cease the RETARD callout as long as both thrust levers are not on the IDLE stop.

Now – The similar recommendation is signified ONE MORE TIME to Airbus France SAS
RSV (A) 170/A/07
The optimization of the A-320 RETARD advisory (warning?) system, so that it will only execute the function for which it was designed, that is, to advise the crew to retard the thrust levers to the IDLE detent.

What is the BEA comment on recommendation 170/A/07 ?
NOTHING – ZERO – They just ignore it – Far more easier to flee than to have to face the fact.

All I can read is on page 119
Since the accident, the manufacturer has been studying new corrective actions to take into account this scenario, which is now known
Aside from the fact that the scenario was already known before, we would like to know what will be these corrective actions ?
What about a modification of the RETARD callout … finally ?

I am not in a position to dispute your concerns on TAM but all I can say is :
TAM was not involved in Bacolod
TAM was not involved in Taipei
I don’t think 4HolerPoler was working for TAM at the time (http://www.pprune.org/rumours-news/394232-tam-3054-report-released.html#post5291234) (?)

To resume :

Total lack of discernment on the part of Airbus.
Obvious submission of the BEA.

What to expect now from AF447 'investigation' … !?

wes_wall

9th Nov 2009, 23:08

What to expect now from AF447 'investigation' … !?

If one is to go on previous experience, then I fear, unfortunately, very little.

safetypee

10th Nov 2009, 00:27

CONF iture, you make a strong case for the sorry state of safety in our industry, but perhaps a bit one sided.
An accident investigation authority can make recommendations to a manufacturer for system change; these may or may not be accepted.
Changes can be proposed and mandated by the certification authority, although this action is unlikely without consultation with the manufacturer and more usually with other certification agencies.

The manufacturer did advise operators of the accident and the most probable cause; previously modifications had been proposed but not universally installed.

The industry and each operator have responsibility for maintaining safety, and thus with knowledge of previous problems, modification or procedural action could/should have been taken.

How was Congonhas different; for the reported conditions a normal operation may have had marginal landing distance safety factors. If the runway was flooded, then with CS25 rules, reverse could be claimed, but if not available then the landing should not be attempted.
We do not know what the crew knew or decided before landing, but on scant evidence there appears to be erroneous contributions from both the human (crew) and the wider organisational system.
We should not focus on a single entity for blame – fundamental attribution error. Nor be influenced by hindsight bias; a more open view might be that the industry still has much to learn from accident investigation and who and how remedial activities are implemented.

“You can take a horse to water, but it may not drink.”

Why System Safety Professionals Should Read Accident Reports. (www.cs.virginia.edu/~cmh7p/iet2006-reading.pdf)

What Can You Learn from Accident Reports? (www.tc.gc.ca/civilaviation/publications/tp185/3-07/Pre-flight.htm)

alemaobaiano

10th Nov 2009, 07:59

CONF iture

What was foreseeable was that an accident at Congonhas would happen, we had enough close calls prior to JJ3054 involving 737s and an ATR. The BEA position seems to be that:

1. TAM was well aware of the previous incidents
2. TAM knew about the modified software (not fitted due to cost)
3. TAM had adopted modified procedures as recommended (not used on this occasion)

So the BEA assertion is not unreasonable IMHO. Right or wrong is an entirely different question.

TTFN

leftseatview

10th Nov 2009, 14:08

The core issue as far as human factors is concerned,is a preocupation with not using rev thrust on deactivated side.Except in the case of a fuel leak,there is no prohibition on moving both thrust levers to reverse.In the TAM scenerio another factor was the transition capts prior experience on boeing 757s which ofcourse has much larger thrust levers.
The Yaw on the 320 with only one thrust reverser deployed,is easily managed.
So the problem is created when people over anticipate a minor control issue,and overcompensate.
The 320 is a very docile and easy a/c to fly,even with low experience on type.You (or the Automation)can easily deal with any kind of assymetry throughout the flight envelope.
So training Capts need to emphasise this to pilots transitioning from other types,that they need to relax and deal with control issues only if and when these arise, as too much anticipation(which might be required on conventional a/c) can actually be counterproductive,in a fly-by-wire a/c like the 320.
Even though she is a conventional a/c in direct law during the Take-Off or landing roll,the a/c has been easily controlled by normal line pilots on at least one case of actual thrust reverser deployment on Take-off(due incorect deactivation by engg,and subsequent ignoring of "NO GO ECAM")and many cases of engine failure on the old V2500 A1 engines.

CONF iture

11th Nov 2009, 02:51

Safetypee
You propose here really great reading.

May I understand I am part of the exception, not being an accident investigator and certainly not a lawyer, I still have natural interest in reading accident reports and so, on a regular base.

Focusing on a single entity for blame is not my intention but applying some farming logic to suit the ICAO Annex 13 would be more my register :
The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability.
In this context, the BEA is completely beside the point, and I believe it to be intentional.
How would they miss the repetitive recommendation addressed by the three different accident investigation authorities which had to deal with Bacolod, Taipei and Congonhas ?
Should we consider they are wrong the same way in Philippines, Taiwan and Brazil ?
Or could these places be far enough from Toulouse to still afford to apply and demonstrate common sense … ?

TAM knew about the modified software (not fitted due to cost)
Notwithstanding the fact that the modification is unadapted to this specific flight phase, I just find it over the top that the introduction of a brand new ECAM WARNING MESSAGE was and still is proposed merely as an option ???

To Airbus and to the concerned Authorities:
Just scrap that phony message and impose the awaited RETARD callout modification.
You will fulfill Annex 13.
You will save LIVES.

safetypee

11th Nov 2009, 22:59

CONF iture, I don’t think that we share the same view of the responsibility of BEA (or other investigators) in this matter.
The primary responsibility for the investigation was with the state where the accident occurred; the state of manufacture/certification will be invited to help as will the manufacturer.
It is most unlikely that the investigators will have the authority (in law) to mandate design changes. Thus, your criticisms in the first instance should be made about the Brazilian authorities for the investigation, and EASA (or FAA) for the design and certification of changes.
I agree that the industry must not seek blame, and that it serves no purpose for improving safety. What this accident and the subsequent events (non actions in your argument) have shown is the weakness of the industry’s ability (regulators to operators) to learn from previous accidents.

You may have overlooked possible difficulties in achieving an adequate solution. System changes must not result in other opportunities for error and thus several alternative modifications might have to be considered. A change to procedure or automated callout might be a quick fix, but suffers weaknesses of human involvement (which you/others suggest would remain a problem). An engineering fix might be more complicated and could take time to prove and implement.
Also, as has been debated in this forum, what is the role of the pilot, how much can or should be expected of humans, particularly in stressing circumstances which may be of their own making.

Conceptually, is manually retarding thrust levers in the Airbus any different from other aircraft; the system may be different, but the concept of human involvement should not be. The various views in this area could lead from one extreme - a completely automatic aircraft to the other, requiring pilots to action everything. We have to remember, either that humans can be viewed as the cause safety problems, or that they provide the most flexible solution; ... or both.

I think that you should reconsider your criticism of BEA and Airbus – they are not the directly accountable agencies, nor do those people who work in these safety areas deserve to be cited with ‘intentionally’ delaying safety.
Our industry trusts people; we trust our crew members, we trust the aircraft designers, so too must we trust the investigators and regulators to take appropriate action.
Accidents stir many emotions, and the apparent lack of action is frustrating, but IMHO the industry has a very good system of airworthiness (still subject to human error), and there are people who can and will ensure that those accountable for action will act; it just takes time. Meanwhile operators and pilots can learn from the mistakes of others and heed the weaknesses of system designs.

http://www.caa.co.uk/docs/33/fod200732.pdf 15 Nov 2007

leftseatview

12th Nov 2009, 14:49

Safetypee,very well surmised.
Even the best designed systems have flaws or "traps" we can fall into,given a particular set of circumstances or our "baggage" of previous experience.
It is the role of the Training set up to identify and highlight these possible pitfalls....and stress which part of ones "baggage" can be usefull in flying a new type and which parts need to be "deleted" from the memory.
And Training Capts need to note that this "expertise" cant be found in the books,as the manufacturer can hardly be expected highlight his own design flaws.The only clue is the MODs which might sometimes be made after the fact.
And IMHO they have not nailed them all yet.

augustusjeremy

13th Nov 2009, 02:18

Page 46 of the report (with picture)

http://www.cenipa.aer.mil.br/cenipa/paginas/relatorios/pdf/RF3054.pdf

Os sensores que registram a posição dos manetes de potência no gravador de dados do vôo (FDR) estão localizados no TCU e não diretamente nos manetes de potência

Translating:

The sensors that record the TLs position for the FDR are located in the Thrust Control Unit and not at the TLs themselves

Note: When the report states "not at the TLs themselves" it probably means "not at the TLs quadrant or at the Artificial Feel Unit"

CONF iture

20th Nov 2009, 04:24

safetypee

Investigators don’t have the authority (in law) to mandate design changes, but they do have the mandate, even the duty, in the pursuit of accident prevention, to make recommendations, and that’s what the Brazilian authorities for the investigation have done, so no criticism to them.
Actually they have made one specific recommendation, and it appears the Taiwanese authorities had already made that very similar recommendation :
DO NOT STOP the RETARD callout before ALL thrust leverS are fully retarded

What could justify that the BEA does not take up this recommendation in its behalf ?

They feel the need to comment on many points but meticulously avoid to address this specific issue (?) That’s where I DO BLAME the BEA.
By their recommendations, they would have the power to put pressure on certification agencies, regulator agencies and manufacturers.

I’m afraid you put things more complicated than they are :
A simple modification of the RETARD callout logic has not much to see with an hypothetic and probable overcomplicated engineering fix …

Just one more question.
In reference to Bacolod, Taipei, Congonhas … how would you answer the following statement ?

To not cancel the RETARD callout at the time one thrust reverser was selected would have :

Prevented these accidents.
Helped to prevent these accidents.
Had no effect.
Been a nuisance.

goldfish85

21st Nov 2009, 18:38

CONF iture,

To answer your little quiz, "A" is the most likely answer, but even if it were "B" or "C" it should be done.

This type of accident really bothered me at my last position with a regulatory agency. Personally, I was flabbergasted that the scenario played out once. I can't imagine not pulling both engines to idle. The rationale behind the "Retard" call was to remind pilots to pull the T/L's back in the normal situation.

However, it it happens once, we should rethink the problem. If it happens twice, we must do something. A third or fourth time should never be allowed to happen. If I'm to believe this thread, it's happened more times than we know.

I had little luch with my former employer to correct this situation. The refrain was "stupid pilot." Even our operations inspectors would say "Well, I'd never do that."

It is axiomatic in human factors and in safety engineering, that the best way to prevent accidents is to make it impossible. This means there should be no possible way to have one engine in significant reverse thrust and the other engine at significant forward thrust. -- don't let one engine into reverse unless both T/L's are near idle.

The second best way is to warn. That's what the new Airbus mod to the software does.

The present status is to rely on pilot training. It seems clear to me that this approach isn't working as well as it should.

Sorry about the ranting -- I've been to close to this one.

Dick Newman

jcjeant

21st Nov 2009, 19:58

Hi,

Prevented these accidents.

I support that.

CONF iture

28th Nov 2009, 19:42

IMO, I think answer B is quite reasonable.

We know how remarkable are the accident statistics in the commercial aviation nowadays, but what would be this figure if we only consider the FBW Airbus types which left the gate with one deactivated thrust reverser ?

I don't know that number ... it must be remarkable as well, but not for the same reason ...

goldfish85

18th Dec 2009, 21:14

Has the report been translated into english?

Dick Newman

Stubenfliege 2

5th Apr 2010, 09:24

Hi ya.

Deeply buried in the CENIPA page, you will find the english Translation:

http://www.cenipa.aer.mil.br/cenipa/paginas/relatorios/pdf/3054ing.pdf

Regards,

Stubenfliege

GlueBall

5th Apr 2010, 14:41

heavy.airbourne

5th Apr 2010, 16:36

After 30+ years of flying, I cannot avoid the impression that in the vast majority of countries, the sole purpose of accident investigation is to find a reason to blame the flight crew; in this way, authorities, insurers, manufacturers, MRO providers, and airlines, are of the hook, at little or no cost. IMHO, this also seems to be the cheapest and easiest way to deal with mishaps, as far as management is concerned. Once in a while, you have to sacrifice a pawn (or two), to win the game. :(

CONF iture

6th Apr 2010, 13:34

The human factors issue as to why 2 supposedly experienced captains had failed in the most elementary, instinctive, response of retarding both throttles upon touchdown must deal with a case of temporary insanity.

It's hard to get into people's minds, but the necessity of retarding throttle(s) upon touchdown is learned from day 1 of flight training. It requires no thought, no cues, and no aural reminders, because it's self evident that in order to stop, one has to retard thrust/power. It is also elementary for any pilot in any airplane anywhere to keep one hand on all throttles/thrust levers during landing.

You are correct GlueBall, but in the same time you have to look further and question why this type of ''temporary insanity'' happened many times already, 3 of them being well documented as the aircraft could not stop in the limit of the pavement.

Common factors :

All of them had been dispatched with one deactivated thrust reverser.
All of them were A320

I believe it is worth questioning WHAT in the Airbus thrust management conception makes that a crew is more prone to demonstrate this kind of ''temporary insanity'' ?

PJ2

6th Apr 2010, 16:49

CONF iture;
I believe it is worth questioning WHAT in the Airbus thrust management conception makes that a crew is more prone to demonstrate this kind of ''temporary insanity'' ?
I think the question you ask is a very good one.

Restated, the question being asked is: "What is different about the A320-type thrust management/thrust lever system that would/could cause a change ('more prone to') in pilot behaviour?"

I would like to explore this question. The main assumption I make is, when the airplane is flown within its certification boundaries and when in manual flight (the obvious 'default' condition should pilot confusion arise), aircraft control is entirely ordinary and traditional and should not be second-guessed or out-thought.

I think the question is one of erroneous perception that the Airbus autothrust system is 'more complex' than other aircraft and doesn't work like "traditional" aircraft and that this mistake in understanding leads crews to either subtlely second-guess or sub-conciously out-think what is, when disconnected, an ordinary thrust control system. I think this error in understanding extends to thrust-lever handling when reversers are MEL'd and locked out.

When disconnected, there are no technical reasons for thinking/believing that the autothrust system is somehow different than other systems such that pilot behaviours should be somehow modified, so the matter is one of perception and understanding, not one of additional or obscure technical complexity.

When under manual control, there is no more complexity in the A320 thrust control system than is to be found on any other manufacturer's system. The A320's thrust levers work in entirely traditional ways when under manual control but I think that many pilots mistakenly believe otherwise even when disconnected; they believe that automation is 'always there, mediating pilot input', making the assumption that because the system control is not as transparent as other aircraft that it 'may' be interfering with or modifying pilot input.

The question of difference references, by comparison, more "traditional" throttle/thrust lever arrangements. The main physical difference which has been pointed out is that the A320 thrust levers "do not move", (are not back-driven). The implied expectation and therefore problem for pilots is that moving levers indicate what the autothrust system is doing while non-moving levers do not.

The counter-example is, however, with some exceptions on an auto-coupled approach, (CATII, etc) in later generations of DC8/B707, non-moving thrust levers were standard on first and second generation transports, with no incidents caused thereby.

So why is the A320's autothrust system the focus of so much disagreement?

There is no disagreement that the A320 concept is, when under fully-automated flight, more complex than what we have seen as 'solutions' from other manufacturers. It takes longer to understand the airplane and 'wear it' such that it is second-nature. Usually that time period is at least one year if not more.

And as always is the case, if training is parsimonious or provided through processes which are poorly designed or poorly informed about the A320 automation systems, the results will reflect lack of comprehension and where that is permitted to occur, the resulting vacuum will be filled with mythologies, misperceptions and genuinely mistaken understanding of the airplane and its complexities. It necessarily goes without saying that despite such complexities the fatal accident record of the type is not an outlier and is instead about the same as equivalent types of other manufacturers.

But, except at the boundaries of certified flight, the airplane and the autothrust system are entirely ordinary and traditional when under manual pilot control. That is a fact, not a perception; the A320/A330/A340 series are as ordinary to fly as a DC8 or B727, etc.

Given this fact but given also the fact that there remain disagreements and even complaints, it makes sense to ask your question then, Why?, if the airplane flies 'ordinarily' like any other transport when manually-flown.

Why would an experienced crew leave one thrust lever (of the engine on which the reverser was locked out), in the CLB position and retard just the other thrust lever? Why, when the system behaves in a completely ordinary manner would not both thrust levers be retarded just as every other transport aircraft requires?

I think the answer may at least partially be found in the theory above - that pilots somehow assume that the system is 'different' and require different handling. I think this is the case because there is the notion that, because of the 'perceived veil of automation', they don't know what will happen if they treat it 'ordinarily', and thus assumptions and therefore behaviour, changes.

Edit;
As I re-read all this, I would like to make my intentions clear that I am focussing on natural misperceptions which may emerge due to a perceived 'mystique' about the type. I am neither focussing on 'blame' (of pilots for not understanding the airplane) nor inabilities of crews to fly the airplane.

I am trying to flesh out an answer to an important, perennial and relevant question which is partially human-factors, partially-design driven but mostly based upon the fundamental need, despite the "marketing of automation to airline managements" and the notion that the airplane "flies itself", of a clear and robust pilot-training and checking regime.

I think the accident record shows that this is already largely the case but mythologies, misapprehensions and which cause mistakes in handling have not gone away and I am trying to conceive of a different approach as to why.

This all acknowledged, we have the example of the THY B737 at AMS as a counter-example that even simple systems with moving thrust levers do not resolve the automation issues raised in this discussion.

PJ2

jcjeant

6th Apr 2010, 20:24

Hi,

This is just a thought .. gross ... but

There is no disagreement that the A320 concept is, when under fully-automated flight, more complex than what we have seen as 'solutions' from other manufacturers. It takes longer to understand the airplane and 'wear it' such that it is second-nature. Usually that time period is at least one year if not more. I find it ironic .. when it's say instead that automation is intended to simplify the tasks of pilots
By introducing more complexity ?

When under manual control, there is no more complexity in the A320 thrust control system than is to be found on any other manufacturer's system. And about manual flight (in general) .. methink this option is to be considered as exeptional (for all types of modern jet liners) because statistically it's a mode of flying very little used on such planes

PJ2

6th Apr 2010, 20:58

jcjeant;
I find it ironic .. when it's say instead that automation is intended to simplify the tasks of pilots
By introducing more complexity ?
Automation should be, (and most is, in my experience) transparent to the pilot and the operational tasks at hand, from just after takeoff, all the way to touchdown at destination should the crew decide to autoland. In other words, it should not be "in the way" of what the pilot wants to do, nor do what the pilot does not want it to do. While no automation solution is perfect and each has its warts as well as shining moments, a pilot is a pilot is a pilot and when the airplane isn't doing what the pilot wants, s/he disconnects and flies until s/he is satisfied that the airplane is once again stabilized and the automation can take over.

It is beyond argument now that automation, properly trained for, understood and appropriately used by the crew, enhances flight safety and indeed makes things much simpler. I know this from a lot of experience on the A320 doing domestic high density work and from the A330/A340 doing long-haul international work.
And about manual flight (in general) .. methink this option is to be considered as exeptional (for all types of modern jet liners) because statistically it's a mode of flying very little used on such planes
Of course it is an exception.

Please read my post carefully - I worked hard to try to make it clear that when manually flown, the A320/A330/A340 series aircraft are no different than any other aircraft yet there is a sense in some parts of the piloting community that they are different and I think this affects the way they are handled. They are designed to be flown under autoflight and do so extremely well. The outliers where loss of control can occur are areas of possible fruitful discussion in terms of how much or little intervention should be permitted the designers and engineers.

The key point is, when the airplane isn't doing what one wants, intervene and disconnect. As near as I can tell, the TAM A320 did exactly as it was designed when the thrust lever was left in the 25degree (CLB) detent and I am trying to discern why a pilot would not retard both thrust levers, (they did on the two previous landings).

I have seen similar issues (thrust levers left in the CLB position, autothrust disconnected) up close, and I can tell you it is a mess which will overspeed the airplane if one doesn't understand what is going on. In this case and to the point I wish to make, not pulling the thrust levers back and taking control of one's airplane is not an automation issue, it is a training issue and, if/when one is actually hesitant or even afraid to make a change because one doesn't comprehend what the airplane's response might be, it is therefore a perception issue. My point is, there is no justification for such a perception which may attributed to the A320/A330 design itself.

If one's airplane or autoflight system isn't under one's full control and there are no extenuating circumstances such as severe weather, collision or other massive system or airframe failure, then THAT is a training and comprehension issue, not an autoflight/autothrust issue.

The above, first post is one attempt at answering CONF iture's question.

PJ2

goldfish85

6th Apr 2010, 22:44

In a previous life, I was involved in invetigating one of these accidents. I, for one, cannot understand why any pilot would behave as the TAM pilot did. I would have been perfectly willing to chalk this up to "pilot error." However a second instance makes it harder to convince me that it's simple pilot error. The third, fourth, and fifth instance are even more troubling.

Part of the problem, I see, in the operating manual. I read the explanatory material in the TAM manual and it took me at least three readings to get what they meant.-- and I'm a native English speaker (well, American, anyway). The text appeared to have been written in French, machine translated into German, and then translated into English by a native Japanese speaker. When you consider that three of the four known instances were flown by non-native-english speakers, it makes more sense. (I don't mean to dump on Airbus's manuals; this is a major concern, though. I told Airbus that they really needed to improve the final versions of their manuals. (I told Boeing also.)

In the case of dispatch with an inoperative T/R, the problem is compounded by changes from "pull both into reverse" to "only pull the operative one into reverse." It really doesn't make any real difference which you do. In the America West accident, the pilot remembered after pulling both into reverse that the procedure had changed and tried to get the thrust lever of the inop T/R back to idle and ended up with significant forward thrust leading to a runway departure.

The computer software mod proposed by Airbus would go a long way, but it's been too long coming.

Personally, I think the system should be fixed. Don't allow either engine into reverse until both T/Ls are at or near idle. There is no reason I can think of that would justify one engine in reverse and one at a significant forward thrust. Lacking that fix, the "Retard" call should continue until both are at or near idle and the volume should increase first to "RETARD"" then to "PULL THEM BOTH BACK, DUMMY"

We've already killed a could of hundred and written off three airframes. We've had a couple of lucky breaks as well (One was reported on this very thread."

Let's fix the problem and stop blaming the crew.

Goldfish

CONF iture

10th Apr 2010, 02:52

PJ2,
Thanks for your time and effort for addressing the question.
As you mentioned it yourself, you’re not shy to constantly defend the Airbus design, and you’re pretty good at it I must say.

I agree, manual thrust is no different from any other system, no critic about it (just glad they finally didn’t opt for the push buttons instead of the thrust levers)
But auto thrust is clearly different, not better or worse or bad, actually it is even good when you like the challenge to go through and assimilate all the subtleties.
This is just a bit symptomatic that a new technology requires more practice and training to match the older one and I don’t think Airbus was planning that kind of extra … I was having a look at the FCOM, and just for the normal operation of the A/THR you have almost 20 possible displays on the PFD. I don’t really want to count the chapters and pages on the subject …

In my view, one main reason for some confusion is the frontier area between manual and auto thrust.
On a classical system, it is pretty straightforward : The thrust levers move on their own, you’re auto, they don’t, you’re manual.
Nothing like it on the bus, it takes more thinking. Even the radar altitude can have an influence on the thrust status.

Regarding the TAM accident and History before it, it would be hard to deny that the Airbus concept has not something to do with it.

the "Retard" call should continue until both are at or near idle and the volume should increase first to "RETARD"" then to "PULL THEM BOTH BACK, DUMMY"
PJ2, would you agree with that quote ?

Goldfish,
If you like to comment, how would you justify :

the BEA has not made such recommendation ?
Airbus has not taken such step even if not recommended ?

safetypee

15th Apr 2010, 01:44

There’s been time to consider the accident report in depth.
Overall the report is very fair and well balanced, it does not, nor is it necessary to state a cause of the accident; instead, it clearly presents the significant contributions.
In particular the investigators discuss many aspects of human factors which other reports might put aside because they are not factual, but in this instance even if an issue was undetermined, the discussion contributes significant understanding of a plausible contribution and thus opportunity to think and learn from the issue.

The grouping and discussion of the contributions is logical and points towards generic problems involving the human (operations), the aircraft, and the organizational system.
There may not be one specific item which would prevent the reoccurrence of this accident, but there is a multitude of points which require action to prevent repetition.

The core issues involve human error (slip or lapse); the aircraft design which satisfies human factors requirements in normal circumstances, but appears to have weaknesses in non-normal operations (Rev MEL). There are aspects of systematic and organizational management, which with the previous items, resulted in an accident.
The recommendations address issues which might provide foresight for crews, operators, airport and ATC management, and regulators / manufacturers to avoid similar accidents or incidents.

There are pointers as to how the particular slip/lapse might be avoided – training, SOPs, monitoring, corporate culture, safety oversight.

The method of thrust lever retard and audio caution had been accepted by certification. In hindsight, the technical judgement failed to sufficiently consider the non-normal circumstances which would have required mandating the existing improvement.
It would be reasonable to assume that non-normal operation (rev inop) was a similar ‘technical’ task (select idle / reverse), as for normal operations. However, this assumption perhaps did not fully address the change in context – human / training issues in the non-normal operation, and with error, the consequences of lack of spoilers / autobrake on the landing distance.
The report presents a clear case for change, whereas previous accidents perhaps did not.

I wonder how many other aircraft / systems might have a similar weakness? Do we expect too much of the human in non-normal / abnormal operations particularly with modern high reliability systems where there are fewer opportunities to gain experience from failure – and even less training time? Perhaps the industry has failed to consider that the context of non-normal and abnormal operations has changed, and thus the assumptions about human capabilities need to be revised.

A point perhaps overlooked, involved the airport meetings to determine special operational procedures for ‘wet’ landings on the unimproved runway. The requirement for reverse thrust perhaps misjudged the likely hood of reverse being able to ‘reliably’ reduce risks during a ‘wet’ landing. Whilst in practice this appears to be true, reverse is not considered in certificated landing distance, perhaps because of reliability or lack of timely selection, thus why should reverse be any more likely to reduce risk in the specific circumstances chosen?
Perhaps the meeting would have benefited from a strong operational input – risk management – thus avoiding a false assumption, or subsequently the operators should have questioned the decision.

Similarly the industry appears to have forgotten about grooved runways. If the comparative risks of operating on an un-grooved runway were identified at the time then perhaps the runway would not have been cleared for unrestricted use.

Finally the issue of ‘slippery when wet’; the NOTAM was cancelled by ‘misfortune’. However, what action should operators take when landing in these conditions – what does ‘slippery when wet’ mean. I cannot find any operational definition or guidance other than ‘take care’ and seek more information.
Perhaps the realisation of landing on a low friction runway (slippery when wet) with the additional hazard of water, which could have been of considerable depth, and a non grooved surface would have invoked the used of contaminated landing data (requires reverse thrust) – and that action could have prevented the landing on operational grounds – Rev MEL / or landing distance required.

Thus, the one simple aspect which apparently might have prevented the accident – having a NOTAM and knowing what action was required when ‘slippery when wet’ was notified, was lacking.
Was this misfortune or weakness in knowledge, or just an accident of the ‘system’?

Slippery when Wet (http://flightsafety.org/asw/feb10/asw_feb10_p46-51.pdf) - grooved runways.
UK AIP (www.nats-uk.ead-it.com/aip/current/ad/EG_AD_1_1_en.pdf) - Slippery when Wet, sect 1.1.4. para 16.

GlueBall

16th Apr 2010, 12:10

safetypee . . .What would this "slippery when wet, non grooved" 6360' (1939m) pavement have to do with this accident where neither the captain in the left seat, nor the captain in the right seat, had retarded both throttles and had left one throttle set at significant forward thrust during rollout?

This slippery-when-wet, non-grooved runway is within the operational envelope of the twin engined A320, with or without operating reversers . . . when proper landing technique is exercised...!

Thousands of landings in the rain had been made on this runway at this airport for many decades; even Trans Brasil would land with B727s in the rain many moons ago, when I was a pax. :ooh:

safetypee

16th Apr 2010, 18:59

GB, the impression gained from the report was that both the airport management and operator only considered a ‘good’ wet runway or a contaminated runway; nothing in between. This provided them with a clear division for either operation or runway closure.
Such a view might have overlooked the importance of not having grooving on the ‘improved’ runway. The absence of grooving on a ‘good’ wet runway could reduce the friction to the low values seen when operating on flooded (contaminated) runways, but also there is a range of wet friction values short of being contaminated which would present a hazard. If this hazard had been identified, then even the ‘improved’ runway might have been closed in the conditions at the time of the accident.
Example calculations:
From the report, landing distance available (LDA) 1880 m 6170 ft,
From the report, the wet landing distance required (LDR) was 1332 m 4370 ft.
4370 ft wet / 1.92 = 2450 ft unfactored
With an approximation based on CRFI tables*, 4370 ft is equivalent to;
4400 ft on a wet runway (CRFI 0.5), ICAO ‘good’ braking action, or
5370 ft in heavy rain (CRFI 0.3), or
6180 ft in standing water (CRFI 0.2).
The latter exceeds the LDA.

If the standing water case had been considered (standing water not actually required, just a poor ‘wet’ surface), a reasonable choice particularly given the runway history, the non-validated runway improvements, and lack of grooving; then first, this could define the conditions as contaminated, which require reverse thrust, and second, the LDR is greater than the LDA.

*CRFI is not measured in wet conditions, but the tables in AC 164 (www.tc.gc.ca/civilaviation/commerce/circulars/ac0164.htm) provide excellent guidance; the wet correlation is taken from
‘wet runways’, AIR sect 1.6.5. (www.tc.gc.ca/civilaviation/publications/tp14371/air/1-0.htm#1-6)

There had been many landings on the runway in wet conditions, but how wet was ‘wet’?
The report provides evidence of deteriorating runway conditions via pilot reports, which also suggest increasing reliance on thrust reverse to achieve certificated landing distances – a small, but significant and increasing deviation from the norm, which in some areas had become the ‘new norm’ – perhaps until the ATR accident the day before.
The runway improvements were not validated and the runway remained un-grooved. Thus there was no substantive justification for ‘upgrading the runway condition’, indeed IMHO (with hindsight), the original decision to allow wet operations vice a flooded runway was flawed, possibly due to a failure to consider the range of runway friction in wet conditions. Operators should note that friction is not the only factor for consideration – runway surface texture, tyre condition, rainfall rate, etc - Wet Runways (http://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/19750012279_1975012279.pdf). Also, see Hydroplaning of modern aircraft tires (www.skybrary.aero/bookshelf/books/1147.pdf).

The point about ‘Slippery when Wet’ is that there appears to be no guidance as to what operators should do to account for the additional risk in landing on such runways. In this accident, there was a sound defense – close the runway, but due to circumstance, this defense was breached.

jcjeant

17th Nov 2010, 10:44

Hi,

EASA Airworthiness Directive from 10 November 2010 (too late for 199 people)

http://henrimarnetcornus.20minutes-blogs.fr/media/00/00/1930142838.pdf

atakacs

17th Nov 2010, 15:31

Within 48 months after the effective date of this AD, replace both FWC units with FWC P/N 350E053020909, in accordance with the instructions of Airbus SB A320-31-1334 Revision 02.

That's a loooong time for what is apparently an useful improvement

jcjeant

18th Nov 2010, 07:17

Hi,

http://www.pprune.org/rumours-news/394232-tam-3054-report-released-3.html#post5625114

Originally Posted by Goldfish85
the "Retard" call should continue until both are at or near idle and the volume should increase first to "RETARD"" then to "PULL THEM BOTH BACK, DUMMY"
PJ2, would you agree with that quote ?

Fixed:
http://henrimarnetcornus.20minutes-blogs.fr/media/00/00/1930142838.pdf

CONF iture

3rd Mar 2011, 02:05

I had missed that one :
Enhanced A320 logic to warn pilots of throttle retard oversight (http://www.flightglobal.com/articles/2010/11/24/350148/enhanced-a320-logic-to-warn-pilots-of-throttle-retard-oversight.html)

The 'retard, retard' call-out will only stop if the pilot sets both throttle levers to idle, or sets one lever to idle and the other to reverse.
Shame on the BEA to have never recommended the obvious.
What next with AF447 ... ?

PJ2

3rd Mar 2011, 19:39

CONF iture;
Originally Posted by Goldfish85
the "Retard" call should continue until both are at or near idle and the volume should increase first to "RETARD"" then to "PULL THEM BOTH BACK, DUMMY"
PJ2, would you agree with that quote ?
No, not unconditionally. I think it is a response which parallels the right direction but should not be counted upon as a sole intervention.

First, I like very much what Safetypee has posted above. Second, I have offered thoughts on this throughout the thread including notions expressing the view that "not closing the throttles at landing" may be the outcome of a cognitive process of "out-thinking the airplane" when in fact no reason exists to do so. By that I mean, a pilot may hesitate in doing something he believes may be irreversible and doesn't fully understand the results of his actions. Where I think the process can cause such confusion is in the FCOM and the MEL of the time, which could have been more clear about what to do with a thrust lever for which engine had a reverser locked out. I recall reading it when I had the MEL item and wondering, do I leave the TL in IDLE or bring both into reverse? It was later clarified and both are brought into reverse but that was not always the case.

Regardless, nothing untoward would have occurred in either selection but by definition (by the incidents), that was not the understanding. Either that is the case, or some event surprised the PF such that he was momentarily unable to act. I have seen that as well, in the data and that was the comment when discussed. It happens, but not often enough to design warnings and software to cater to all untoward rabbit trails.

Now, all kinds of impressions (masquerading as 'understanding) could and have occurred on this and other A320 issues, not without understandable reasons, I will add. But early in the game of learning the airplane, it must be emphasized and accepted that "it is just an airplane". In defence of this assessment I offer two observations, which are, not surprisingly, related to the SATA (and other) hard landing events being discussed on that thread:

1) Why would a pilot expect anything different to occur other than a thrust reduction when a thrust lever was pulled back to IDLE? Was the concern, "what will happen if I bring both into reverse?

What other"devils on the wall" were painted about this and other systems that have no basis in how the aircraft actually functions? Is this merely a training issue or is there something else going on at the cognitive level that requires an "intellectualizing" of the airplane which subtlely displaces the "gestalt" we often speak of in how we normally fly airplanes? (Does automation drive out "art" or can the two co-exist? What part does training have in preserving the "art" while enhancing understanding?)

2) As partial evidence for this view, I offer the Aigle Azur A321 hard landing incident which occurred on January 08, 2008. The handling pilot, a captain, had voiced discomfort with sitting in the right seat. At landing, despite three 'retard' calls, the thrust levers were kept in the CLB detent until touchdown at 600fpm. The aircraft bounced 7ft, the PF selected the TLs to IDLE and the spoilers began to deploy. The 2nd t/d was at 850fpm, 3.3g's. The report, in French, is available here (http://www.bea.aero/docspa/2008/f-aa080108/pdf/f-aa080108.pdf).

It is not a leap to envision the potential for a thrust lever of an engine which reverser has been locked out being kept in the CLB detent even after all the RETARD calls, as that is precisely what occurred here.

We will never know why, or what caused, in the sense of a cognitive "fixation" if I may call it that, the #2 thrust lever in the TAM cockpit to be left in its position while the other was dutifully retarded to idle. But the clues are available to know and to counter such human behaviours more effectively, and I do not believe, nor do I think that the present solution of "more" is the appropriate fix in terms of retard calls or whatever is to be conceived as the next counteractive measure to the next "cause", whatever it may be.

PJ2

DozyWannabe

3rd Mar 2011, 20:44

I had missed that one :
Enhanced A320 logic to warn pilots of throttle retard oversight (http://www.flightglobal.com/articles/2010/11/24/350148/enhanced-a320-logic-to-warn-pilots-of-throttle-retard-oversight.html)

Shame on the BEA to have never recommended the obvious.
What next with AF447 ... ?

Without meaning to sound facetious CONF (as I do respect your opinion even if we have something of a history of disagreement), I've always been under the impression that your view was that a pilot should not rely on computers to that degree, and that they should know to reduce thrust without the need for an audible reminder. As I recall, there was a similar incident which had a report come out around the time of the Conghonas crash, that the recommendations included the above software alteration and that AI were working on it.

I also remember the original thread containing a lot of warnings on the "folly" of non-moving thrust levers - something that was sadly rendered somewhat moot after the Turkish 737 accident at Schiphol.

PJ2 - as always, spot on. Not being a pilot I don't think I'm qualified to make a call as to whether automation interferes with the "art", but I do think that perception of the role automation plays has definitely become muddied by vested interests over the years. As a software engineer I'm painfully aware of the lengths one has to go to in order to protect against faults and fit as many use cases as can be defined.

If the "RETARD" annunciation was intended as a reminder rather than as defining the current configuration state (I suspect it was, but as has been said, this information was not well enough understood by airlines and line pilots), then I can understand the original design intent. However - with 20/20 hindsight it does appear something of a no-brainer.

SPA83

4th Mar 2011, 04:18

- October 18, 2004. Runway Overrun during landing On Taipei Sungshan Airport

- March 2006. ASC Safety Recommendation to Airbus Company : “Reviewing the design of stop mode of Retard warning sounds or accommodating other warning methods to ensure that the warning will continue before the thrust levers are pulled back to Idle notch after a touchdown has affirmed.”（ASC-ASR-06-03 –006). Airbus response : H2F3, ECAM alarm only. Not mandatory.

- July 17, 2007. Runway Overrun during landing at Sao Paulo-Congonhas (199 victims)

- November 10, 2010. EASA PAD : “need for improvements in the identification of throttle mis-positioning and so providing further opportunity for the flight crew to identify an incorrect thrust lever configuration and to correct this : « Enhanced RETARD logic »” (mandatory). « Do not install H2F3 »

Too late for 199 people.

BOAC

4th Mar 2011, 10:11

Anyone know what that means or contributes? Tombstone 101 (http://www.tombstone.org/ts101/ts101index.htm)

DozyWannabe

4th Mar 2011, 10:17

BOAC,

"The Tombstone Imperative" was a book on aviation safety written in the late '90s. I think it was written by one of the contributors to Channel 4's "Black Box" documentary, as it seemed to cover many of the same cases.

The title was derived from the opinion of a US official who stated that it seemed "[they] regulate by counting tombstones" - by which he meant that corrective actions and airworthiness directives only seemed to become urgent once enough people had died as a result of their not having been implemented yet.

BOAC

4th Mar 2011, 10:32

Thank you DW - alles klar. A well-known judgement used in many spheres including rail, road and sea. How many people can we kill before someone notices.

DozyWannabe

4th Mar 2011, 11:05

I'm working from memory here, so if anyone knows differently, please chime in - in the book, the author refers to regulatory authorities on occasion being too cosy with manufacturers and airlines - specifically that the US FAA was founded with two contradictory aims; to regulate the industry from a safety perspective and to promote aviation.

This latter aim came from a time when the fledgling manufacturers and airlines could conceivably be put out of business by compensation arising from a single accident. The book argues that the latter aim should have been dropped years ago, as both manufacturers and airlines are now million- or billion-dollar entities that no longer require government protection.

magelan

4th Mar 2011, 15:57

PBL

4th Mar 2011, 19:22

I´ve written a study on landing excursions where the aforementioned "cognitive fixation" and TAM3054 are covered in detail.

I haven't read it yet, but many thanks, Daniel, for putting it in the easily-accessible public domain.

DozyWannabe

4th Mar 2011, 19:41

I´ve written a study on landing excursions where the aforementioned "cognitive fixation" and TAM3054 are covered in detail.
In short, there´s more happening in our brains than meets the eye.

And it would appear you're a fellow City Uni alumnus... :)

It's defintiely good stuff - If you ever extend or re-publish I reckon an interesting addition would be to compare and contrast AF358 with AA1420 at Little Rock - the common element being rapid changes in weather and time pressures causing the pilots to make poor (in hindsight) decisions and miss things (arming the spoilers in the case of the latter).

magelan

4th Mar 2011, 20:59

Yes, the Little Rock accident is an interesting (and very well researched) event, however, it is also a classic case of an unstabilized approach - very much in contrast to the Air France accident in Toronto. And that is one of my key points: the importance of stabilized approach criteria has been somewhat overstated at the expense of research into the human factor dynamics of the flare and touchdown phase ("beyond the threshold"). Good approaches have led to bad landings as much as bad approaches have led to good landings.

Fortunately from an academic standpoint, less so from a pilot´s perspective, there is no shortage of "accident material" for further research.

Thanks for the kind comments...

DozyWannabe

4th Mar 2011, 21:26

You make a good point, and I hope I didn't come across as presumptuous!

I guess the valid conclusion that can be drawn from comparing and contrasting those two incidents is that even with a stabilised approach phase things can go wrong - if the received wisdom has tended to support the notion that a stabilised approach will always help in that situation, then AF358 would tend to contradict that notion. Which supports your argument quite neatly.

CONF iture

5th Mar 2011, 14:23

PJ2
I don't see it either as the sole solution. You prone more training, so do I.
As the system is much more complex that the manufacturer wanted it to be, only regular additional training can help a crew to fully assimilate its functioning in details.

But when a specific aircraft type leaves the pavement for the third time, and so for the same reason, in terms of aviation safety, such rabbit trail is called les Champs Élysées, and serious attention is needed.

I've always been under the impression that your view was that a pilot should not rely on computers to that degree, and that they should know to reduce thrust without the need for an audible reminder.
DozyWannabe
That's correct, but as Airbus choose to put one, they need to go to the end of their logic and don't stop the reminder as long as the demand is not fulfilled, especially when the consequences can and have been tragic.

Thanks for the resume on the book, I didn't know that one.

magelan
Thanks for the link, that's interesting reading.
Concerning the TAM accident, please take note that the following is not exact :
Unfortunately, the Flight Warning Computer ceased its “retard” call-out as soon as thrust lever no.1 was at idle (a newer FWC version, offered as an option by Airbus but not bought by TAM, only ceased its “retard” call-out when both thrust levers were retarded to idle).
The RETARD callout ceased as soon as the ENG1 THR LVR was selected to REV but the other THR LVR was still in the CLB detent.
The newer FWC version was not the awaited Enhanced RETARD logic, but a useless additional ECAM warning msg.