TAM A320 crash at Congonhas, Brazil

[Dani]

Hotdog, you are so right! Exactly that is what nobody understands. That's why we discuss it here for more than 2000 posts long...

I still think that these TAM guy thought he was in "another aircraft". Or that he was so afraid of the electronics he couldn't figure out what is the correct thing. It is for anyone else so clear and intuitive to take back that TL. Not only in an Airbus, but in any other aircraft.

Dani

[TyroPicard]

Rananim

The pilots mindset was quite rightly to use everything at his disposal(spoilers/one rev/max braking).

Not quite true - MED Autobrake was selected, if PF had intended to use max braking I reckon he would have applied full pedal deflection very soon after touchdown.

The designers give him the one retardation device that commits him to a landing before making him cancel all fwd thrust and fulfill the condition that give him spoilers and ab.

Here's a contrary thought .... Perhaps it is safer, with one T/R Inop, not to select reverse thrust at all, but simply retard both T/L to Fwd Idle? Discuss.
Tyro

[PAXboy]

Non-pilot speaking, with the proviso that I have read every single post in this thread (No, I do not have too much spare time but I find this a fascinating thread and so am giving the time to it).
Rananim

This plane didn't crash because the pilot forgot to retard the TL. It crashed because the plane's designers trapped the pilot halfway between a landing and an abort.

As far as I know, the official report on this accident has not yet been published ... ??? So I proceed with due caution.

When a person is instructed how to operate a machine, they are trained in the operation of that machine in such a way as to gain the maximum from it and to minimise the risk from it. This will include instructions from the manufacturer and the owner of the machine. From a basic (but still lethal) turning lathe to a cruise ship.

On taking delivery of a new cruise ship, the captain will be told the operating parameters of that ship. This will involve numerous mechanical and human factors upon which the safe operation is based, following exhaustive trials. If the Captain fails to operate the ship within those parameters - then they will be liable to a reprimand of some form (large or small). The unique factor for an airline captain is that failure is more likely to have catastrophic effects before any reprimand can be given.

This point has been gone over many times in this fascinating thread: if the pilots are shown to have operated outside the parameters of the machine and their instructions - whose fault was it?

We all wish to see faults reduced and, overall, the airline industry has a fabulous record, so everyone WANTS to find the right answer. If the right answer is that (it is reported here) four crews have failed at a critical moment in the understanding of their machine, then the authorities may decide that is more important than the hundreds of thousands of times that the machine was operated correctly.

But if they change the operating parameters for the 'benefit' of four crews - how will that change the situation for thousands of crews that already operate the machine every day, within it's correct parameters? Will you make their life more difficult and, consequently, open up risks as yet unquantified? Whenever you change one item in a system, you affect every other item to a greater or lesser, direct or indirect degree. [For the purpose of discussion 'operating parameters' would include all human factors and electro-mechanical aspects of the design]

Please be sure that I have observed over the years the all too easy way in which unscrupulous carriers have blamed the crew for anything and everything, because they are dead. In PPRuNe, I have spoken in support of those who want to change the way in which working hours are being allowed to creep up and the ever present risk of fatigue. That specific factor has been mentioned in this thread and may well have been part of why they appear (at this stage) to have failed to operate the machine within agreed parameters.

[bsieker]

[...] this runway in Sao Paolo [...] was slippery

We don't know that. Perhaps never will.

The "no spoiler" call starts the tunnel vision because the pilot perceives things are not proceeding as planned.He even sighs(happened before?)On paper,he should have gone for an abort when he didnt get the spoilers

Really? I don't have the TAM FCOM, so I don't know. Do you?

this is a short wet rwy and time is crucial.However,his mindset was to land,to get it down and get home.Okay,so he goes for reverser,

SOPs I have seen are to select reverse thrust at MLG touchdown, before the spoilers call. TAM procedures may be different, I have seen a cockpit video of an unknown airline from a landing at Madeira, where PF clearly waits for the "spoilers" call before selecting reverse.

There is, however, an important fact to disprove your line of events: PF clearly selected reverse thrust several seconds before the "spoilers nothing" call. Look at the superimposed CVR-transcript/FDR graphs, p12:

- 18:48:26: TL1 to full reverse (one second after second MLG touchdown)
- 18:48:29: "Spoilers Nothing" callout by PM

[...],oblivious to the fact that he's forgotten TL#2.If thats denied too,then his tunnel vision will be broken

This is a strong, unsubstantiated claim. Everything deduced from it is irrelevant. You have not added a new argument.

The idea that one more thing needed to stop the aircraft being denied to the pilot will break the tunnel vision, instead of increase the panic, is doubtful at best.

This plane didnt crash because the pilot forgot to retard the TL.

Unfortunately, it did.

It crashed because the plane's designers trapped the pilot halfway between a landing and an abort.

The aircraft gives the pilot what he asks for, as it should, as does every other aircraft. Emergency scenarios are so complex and manifold, that one cannot be certain that even things that seem silly may not sometimes be needed.

You cant just disconnect the A/THR with app thrust,green light TR#1 and say "Thats what you asked for..now get on with it"You protect the pilot by installing a simple interlock and say "Look if you're not going to fly this thing correctly and retard both TL's,you're not getting any of my retardation devices and will have to go flying again".

Things aren't that simple. But for the sake of the argument, let's follow you down:

So, the pilot's mind is set to land. He doesn't think about going around after selecting reverse. Still the aircraft denies him reverse, letting him overrun even faster (a moot point here, since all died anyway). Very clever. Very safe.

I find it arrogant to be certain that this logic of denying retardation devices will not cause errors, but rather prevent them by forcing the pilot to change his blocked mind (which was set to land), in a case of emergeny.
If the pilot asks for contradictory things, the designers (and thus the aircraft) cannot decide which of the things is The Right Thing.

And neither can you, even if you may believe otherwise.

There are only very few things that an A320 will not allow you to do (if all systems are operating), among these are: stall the aircraft, fly it upside-down, selecting reverse thrust in flight, selecting ground spoilers in flight, exceed the structural (g-) limits.

It will allow you to: fly it into the ground (although it will warn you before ...), exceed the maximum speeds (although it will reduce speed if you let go of all controls), select highly unusual combinations of thrust settings, land with the landing gear up, start the take-off roll with the parking brake on, ...

These latter things are usually not useful, almost always dangerous, but not unambiguously The Wrong Thing in every case.

No claim of yours that denying one retardation device will start tunnel vision, and denying another retardation device will end it, changes that.

And although perhaps a case can be made that reverse thrust on any engine should only be possible when no other engine is above idle, this is not it.

Bernd

[Rob21]

Rananim,
Excellent post, I am still following this thread because I'm waiting to see someone explain here why not allow the pilot to deploy ground spoilers manually, when he is applying more than 20º on the manual brakes and has at least one reverse engaged.
Someone said here that adding more stuff to the logic tree could lead to more operational err. But this is what I'm trying to say. The "logic tree" does not have too many "branches" already? Why not simplify it just a bit?
TyroPicard,
What a fantastic idea, why not discuss here the possibility of (by MEL) not using reverse at all when one is inop?
It was said here that reverse is not crucial anyway, it is used to reduce stress on the brakes. Short and slippery runway? Would be nice to have reverse? Don't land there, this will make the company fix that inop reverse very fast...
I imagine that most of the posters here really want to find ways to avoid this (and other) kind of accident from happening again.
One reverse inop? By MEL, no reverse at all.
And the TLs would come to idle, no room for confusion...

[GMDS]

PBL

a) rated Airbus pilots who do not find the interface confusing
b) technical experts who are interested in analysing the interface
c) others who may not be pilots who are contributing to the analysis from intuitive principles
d) rated Boeing pilots who are wary of the thrust-lever interface on Airbus machines

Please include:
e) pilots who have flown AI, Boeing and MD new generation aircraft and have their well founded opinion based on experience (and still get lectured by self proclaimed expert pilots who have only flown one of the above but defend it feverishely)

I stand by my earlier comment: If the THR levers would move, this particular incident would most probably have been detected rapidly enough to enable the crew (who most probably have screwed up something) to counteract early enough to prevent this accident.

Simple

GMDS

[Super VC-10]

for Rananim

[off topic]

"What was it that someone said about not wanting to try tea with arsenic."

Nancy Astor to Winston Churchill - "If I were married to you, I'd put arsenic in your tea!"

Winston Churchill in reply - "Madam, if I were married to you, I'd drink it!"
[/off topic]

[Dream Land]

I'm waiting to see someone explain here why not allow the pilot to deploy ground spoilers manually, when he is applying more than 20º on the manual brakes and has at least one reverse engaged

It's pretty simple, on the Airbus, ground spoiler deployment happens automatically, braking without reducing thrust is useless, on this particular runway braking after "spoilers nada" is also useless.

[bsieker]

Originally Posted by Rob21

I am still following this thread because I'm waiting to see someone explain here why not allow the pilot to deploy ground spoilers manually, when he is applying more than 20º on the manual brakes and has at least one reverse engaged.

I consider it a key point, and try as I might, I cannot find a reason.

I think this may actually be a problem of incomplete requirements. The failure mode "leaving one thrust lever up during landing" has perhaps not been analysed exhaustively, taking provisions to keep the effects from becoming "catastrophic".

A320 pilots: can you give us an estimate what the maximum inadvertent brake pedal deflection might be, given a critial high-workload situation in which large rudder inputs are necessary, also given the worst possible conditions, slippery pedals, loose footwear, ...

5 degrees? 20 degrees? 45 degrees?

Originally Posted by Dream Land

on this particular runway braking after "spoilers nada" is also useless.

Not if braking deploys Ground Spoilers, even with one TL above "near idle".

Accurate calculations and simulations will tell if it would have been enough to save lives in this case, but it would have decreased significantly the overrun speed.

Since this would be an unambiguous "I want to stop" signal, it could also be used to reduce engine power to idle, possibly displaying an amber "IDLE LK" (or similar) warning on the ECAM. (Pending further research, this may turn out to be a bad idea.)

Bernd

[Dream Land]

Accurate calculations and simulations will tell if it would have been enough to save lives in this case, but it would have decreased significantly the overrun speed.

This may or may not be true, the fact is, is that without ground spoiler deployment, they should have missed the approach, having spoilers deploying due to brake application is useless.

[Dani]

Ranamin, I know that you don't like Airbus, but also a Boeing wouldn't have survived this laps. As it is itinerated for mor than 2000 posts, you cannot stop on a slippery short runway with one TL in approach trust. Accept this fact.

The only thing I accept to discuss is what effect has the whole AI (which you call AB) cockpit technology onto pilots minds, i.e. make them "forget" a TL in its position. If you ask me, the only fault that Airbus cockpit technology has is that it is so simple that there are a) pilots in their seats that shouldn't be and b) they forget completly about "good airmanship" and "real flying".

Dani

[SR71]

Is it just me or does no-one ever look at your N1 gauges these days once you've cracked reverse/are on the landing roll?

I'll be the first to admit that exposure to non-standard situations reduces your cognitive capacity, but your N1 gauges surely give you a clue as to what the engines are doing?

I guess, however, that one engine in reverse and one engine at approach power might look the same....

[Dani]

Mach 3 flyer, this very A320 has EPR gauges. They are very hard to read (because only the second digit behind the coma changes), some people look at N1, correct.

The correct visual check on a A320 is the green boxed REV indication beside EPR. Since there was no TR 2 avail there was also nothing to check...

[Flight Safety]

Why did the pilot leave ENG2 TL in the climb detent after pulling ENG1 TL back to idle 2 seconds after the "retard" call in the flare, just prior to touchdown? EMIT may have a point regarding engine spool up time creating part of the anticipation, but what does seem clear to me from the CVR and FDR data, is that the pilot wanted to get the one working TR (on ENG1) deployed as soon as possible after touchdown.

I'm going to argue the same points (single mode vs multimode primary flight control design) as I have previously, but approach it in a different way. I know what follows may seem basic at first, but please bear with me.

What exactly is a "throttle"? A little research shows the word originated in the 1300s, from ME (middle English) “throtelen” (throttle), which probably derived from ME “throte” (throat). In the 1300s the word meant to strangle or choke. The first recorded use of the word “throttle” for mechanical devices was in the early 1800s and referred to a control operating a steam engine. A valve was used for the “choking” function that had a mechanical linkage to a lever used by an operator. Later the word “throttle” was also used for internal combustion engines and turbine engines. For steam engines, the power output of the engine is controlled by “choking’ the flow of steam into the engine. For internal combustion engines, the flow of air into the engine to burn fuel is “choked” by a valve (usually a butterfly valve). For turbine engines the flow of fuel into the engine is also “choked” by a fuel valve. In all 3 engines types, the choking valve operated by a mechanical or electronic connection to a human (via a lever or sometimes a wheel), controls the power output of the engine. Historically, the “choking” valve provides an “infinite” number of power settings providing the operator with precise control of the engine’s power output.

In aircraft, the basic function of an engine throttle is no different from the classic historical uses. When the A320 is on the ground, the throttle levers work in the classic way for controlling engine power. But from takeoff to landing, these levers no longer function as throttles in any classic sense when the auto thrust system is engaged. When auto thrust is engaged, the thrust levers become the big switch arms of multi-position selector switches, instead of throttles.

Switches and throttles work in very different ways. While throttles are described above, switches work by turning things on and off. A multi-position selector switch normally works by turning on one of the possible selections, while turning off the other selections. When auto thrust is engaged on the A320, switch arm positions CLB, FLX, and TOGA are available as possible selector switch positions.

Here we have 2 primary modes of operation for the A320 thrust levers, throttle mode and selector switch mode. In throttle mode the lever position equates directly to engine power, directly controlling the power output of the engine in the classic throttle sense. In selector switch mode however, we have the thrust levers being used as big switch arms to select power modes for the auto thrust system. In selector switch mode, lever position no longer equates to engine power thus the levers have no direct control over engine power, because they no longer function as throttles in any classic sense. It was possible to design the auto thrust system so that a selector switch on the panel performed the same power mode selection function as the thrust levers on the A320, but that design choice was not made. Instead it was decided to add a second operating mode to the thrust levers, because these levers only provide inputs to a computer, where the software determines what those inputs mean. Manufacturer B decided the levers in their cockpit would always be throttles, and would be presented to the pilots only as throttles. Thus B’s thrust levers are single mode in function because they are only throttles, not dual mode s in the AB system, where the levers are used both as throttles and selector switches, but only as one or the other at a time.

Now back to the TAM accident. I think it’s interesting that the primary function (or operating mode) of the thrust levers in the A320 is that of the auto thrust selector switch, because this mode is used the majority of the time the A320 is operating.

In the A320, the TL mode changes from the auto thrust selector switch mode, to the classic throttle mode when the aircraft touches down (or slightly before touchdown in the flare when the pilots pull the TLs back to idle in response to the “retard” callout). I find it interesting that “retard” in not a selector switch mode related callout, but it’s a throttle lever mode callout instead, because “retard” has no meaning for a switch but does have meaning for a throttle.

What’s interesting is that the pilot waited for the “retard” callout in the flare before he pulled the thrust lever back for ENG1 to idle 2 seconds after the “retard” callout started. So I believe he responded to this callout. But why leave the ENG2 TL in the CLB detent? There are several possibilities but I’ll argue for this one. When the thrust levers are in selector switch mode, CLB detent is the correct setting for the thrust levers on approach (with auto thrust engaged). Keep in mind that selector switch mode is THE predominate operating mode for the thrust levers on the A320, because auto thrust is used the majority of the time when an A320 is operating. In the mind of the pilot, he may have been thinking about “selecting reverse” in 2 steps (idle position then reverse position) on the ENG1 TL (thus selector switch mode thinking) instead of pulling engine power back to idle in preparation for reverse (throttle mode thinking)? Again we know that ENG2 TL was left in the CLB detent (the correct setting up to that moment), which suggests that he may still have been in selector switch mode thinking instead of throttle mode thinking. Then to leave ENG2 TL in the CLB detent during the rollout, further suggests to me that the pilots never transitioned from selector switch mode thinking to throttle mode thinking once on the ground. Thus we have what I believe is a classic manifestation of Jef Raskin’s Rule 1a.

Rule 1. An interface should be habituating.
If the interface can be operated habitually then, after you have used it for a while, its use becomes automatic and you can release all your attention to the task you are trying to achieve. Any interface will have elements that are habituating, but the principle here is to make the entire interface habituating.

Rule 1a. To make an interface habituating, it must be modeless.
Modes exist where the same gesture (control action) yields different results depending on system state at a time when your attention is not on system state. In the presence of modes, you will sometimes make mode errors, where you make a gesture (control action) intending to have one result but get a different and unexpected result, distracting you from your task.

If the A320 thrust levers are selector switch arms most of the time and only sometimes throttle levers, it’s possible to get the 2 modes confused right at the point of transition from one operating mode to the other (during the flare and touchdown). I also wonder that since the thrust levers spend most of their time in selector switch mode, if this habitually takes the pilots thinking away from thinking of the thrust levers as throttles (direct engine power controls)

When considering the logic of the Ground Spoilers and the Auto Brakes (which has been eloquently discussed), one has to think about which of these 2 operating modes of the thrust levers that logic applies to. It seems clear to me that the logic was built assuming that the thrust levers would be operating in the classic throttle mode, while the aircraft was on the ground rolling out after touchdown.

[GMDS]

Nice analysis. Reminds us of the omnipresent bureaucrats priciple: "Why make it simple, if we can make it complicated".
And let's continue diffamating those who think aviation should be simple, because the more simple it is, the more safe it remains. This seems to be outdated. In the old days pilots were heroes when they brought their bird down safely, no matter how. Today's heroes are pilots who can tell that others should not be in their seats, because they do not understand all the multifunctions of unneccessary new designs.
Tempora mutantur et nos cum illis, allthough i just conform to the latter without consenting. Hypocrit? Maybe. It would definitely be if i'd shut up, which i don't, but i know it's to no avail.

[BOAC]

I agree - an interesting analysis. Do AB pilots perhaps instinctively view the T/Ls as 'selectors' for a given mode? If so, then 'retarding' is a means of placing the T/L into the mode where reverse can be selected. Ipso facto, since there was (?presumably?) no intention of using reverse on No 2...................................

Have we, with FS's help, identified the flaw in the training? In the mindset, 'something else' in the system will look after No 2. No 1 MUST be retarded to get reverse. I think I can see how that train of thought could be inculcated.

Now, when No 2 has NOT gone to ilde, as perhaps 'expected',

"Look this"?

Comments from AB pilots? What did you come away with from training as a concept for the 'throttle quadrant' function on the 320?

It could be horrifically simple.

[TyroPicard]

BOAC said..Do AB pilots perhaps instinctively view the T/Ls as 'selectors' for a given mode?

I don't think so.. you use them as "normal" thrust levers taxying out and in on every flight, on the runway you set a N1/EPR value to stabilise at, then select T/O thrust, move them back at thrust reduction altitude, and finally move them back in the flare. The mode you are interested in is the A/THR mode and that certainly is achieved by T/L movement.. having said that I don't conciously think "I must now disengage autothrust by placing the levers to idle so I can then use reverse thrust" .. I retard them at the appropriate point just like all pilots do then select reverse - modes, what modes????? I think about desired thrust at that point, not modes.

Flight Safety writes..I think it’s interesting that the primary function (or operating mode) of the thrust levers in the A320 is that of the auto thrust selector switch, because this mode is used the majority of the time the A320 is operating.

If you only think of time, true. But if you consider the number of times the T/Ls are moved during one flight .. at least ten "thrust selection" movements, and only one A/THR "mode change" movement (OK two if you count retard to Idle on landing). So I reckon that's at least five to one for thrust control.
I think BOAC has raised a good point, which I think of like this - I am not sure it's a case of "forgetting" No.2 T/L, rather a conscious choice to only move the No.1. This is such an illogical action that I wonder if PF had created an "emergency landing" train of thought when it was merely going to be "demanding". Is it possible to place oneself under enough pressure to perform well, that one prevents clear thought and suppresses years of habituation? I started this train of thought after reading Flight Safety..

Regarding how the mind narrows in an emergency, I explained this in my previous post that as fear rises, the mind moves more toward action oriented "fight or flight" type responses and away from thinking and reasoning type responses. In fear or an emergency, the mind tends to want to act rather than think and reason things out.

This landing was NOT an emergency ... but it became one.
I also disagree with Flight Safety here ..

The primary controls change the attitude and direction of the aircraft and they speed it up or slow it down. Obviously these controls become emergency controls in an emergency.

I don't look on sidestick and thrust levers as emergency controls - you may use them in an emergency, certainly, but not in any significantly different way from normal. Emergency controls are red, often guarded, and need confirmation before moving them!

Tyro

[PBL]

Originally Posted by GMDS

PBL
a) ............
b) ............
c) ............
d) ...........
Please include:.....

Am I the gatekeeper? Categories a, b, c, were introduced by Rananim, Category d (which apparently includes Rananim, who forgot to include himself) by Lemurian.

I introduced Cat. e (rabble-rousing). BOAC tried to introduce another Cat. e. Now you want to try yet another Cat. e. What is this thing with the letter "e"? Could we maybe try "f"?

PBL

[ChristiaanJ]

GMDS,

Tempora mutantur et nos cum illis

Non semper mutamus....
You sound like you've lived in that era when the quips
"A good landing is one you can walk away from.
An excellent landing is one when they can use the aircraft again"
and
"If it flew in, it can fly out"
were coined......
And when everybody still knew what an OMC handle was.
I've lived in that era, too.

[BOAC]

PBL - I chose 'e' because it came after your 'd'. You can file me in whichever drawer you need to.

Tyro - yes, I appreciate that you see it that way. We 'grew up' in the same school. The question was to the AB community at large, young and old. We now have pilots who probably know no other way of doing it (or have just forgotten basic tenets). How are they taught, and how do they visualise the system? All the 'normal' T/L handling you describe is over by the time you get to acceleration altitude, and when does it 'kick back in' - taxying in? In which box exactly does the landing fit? We have two totally different T/L functions; where is the clear transition when things go wrong?