TAM A320 crash at Congonhas, Brazil

[Avionista]

Rob21, RWA, PK-KAR

Thanks for answering my question. It seems to be an ambiguous state of affairs if pilots are instructed, rather than recommended, not to attempt a go around after reverse thrust has been deployed, but the aircraft system logic 'assumes' a full stop landing is not necessarily the pilot's intention when reverse thrust is active. By the way, is the instruction regarding reverse thrust deployment precluding a subsequent go around issued by AI and/or individual airlines?

PK-KAR posits a scenario (runway obstuction) in which a pilot, after deployment of reverse thrust, might wish to cancel a full stop landing and initiate a go around. Performing a go around in these circumstances could be very risky, possibly riskier than continuing with the landing.

Assume a normal landing situation with both TLs at IDL, autobrake and GS armed. After touchdown, the GS deploy, braking commences and the pilot selects reverse thrust on both engines. Say, five seconds later another aircraft enters the active runway at an intersection midway along a 3000 metre runway. On seeing this incursion, the pilot immediately moves both TLs to TOGA and attempts a go around. What are his chances of getting airborne in time to clear the other aircraft? Would it be better to apply maximum braking effort and try to steer clear of the obstructing aircraft?

[BOAC]

Who can tell whether there are other 'gotchas' in the AB system waiting to catch the unwary or fallible human?

All this 'automation' is damned clever, you know, but it is becoming apparent that we need a big red button we can press when we want to land which says "I have control" - just as when we declare our intention at DA - "Land" - and PNF removes his/her appendages from the throttle levers.

Discussed before, but, such a button would:

Take any AUTOMATIC position logic out of the throttle 'circuits' (allowing ONLY T/L position to dictate thrust demand)

Enable Spoiler deployment (via some other 'old-fashioned' lever?)

Activate autobraking if selected.

NB:

We still retain 'old-fashioned' control of the engines

We now have the stopping facilities we need when we want them

Now, at CGH, our departed friends would have had ground spoilers and autobrakes, and as RWA said, more time to sort things out and at worst a slower speed over-run.

On second thoughts, the techies COULD, perhaps, simply alter the logic on the autothrust disconnect button to allow those functions (WOW) when pressed?

Objections?

[TyroPicard]

Two objections before lunch...
1. In the TAM case this would give Climb thrust on No.2 engine
2. A faulty TLA which would result in Idle thrust on the ground would order a different thrust

There may well be more... reminds me of a Farside cartoon!
Tyro

[BOAC]

...."its the fuel light Frank?"

Hope you enjoyed lunch!

Both 'objections' noted, but no difference to CGH and there they had no 'rescue options' (other than perhaps closing the throttle)?

PS: In 1) would the thrust not be 'as positioned' rather than 'CLB'?

[electricjetjock]

This thread is now becoming extremely silly, in the words on Monty Python.

Why should there be changes to the AB system just because it appears that there was extremely poor training / airmanship. If you only close one thrust lever with two engines running and you are not ready to stamp on the manual brakes if the the autobrakes fail to operate on a short field landing, in marginal conditions then it is not primarily the fault of the aircraft or its design.

[DozyWannabe]

BOAC:
The thrust "ordered" in the TAM incident appears to have been CLB. I know you and a significant number of pilots distrust automation, but for the most part it really is there to help.

bubbers44:
The computer was never "confused", it did exactly as the pilots ordered it to do. From the time of A/THR disengage, the aircraft did exactly as it was designed to do with the configuration it was in.

[BOAC]

Originally Posted by DW

The thrust "ordered" in the TAM incident appears to have been CLB

- I was under the impression that our AB friends said not, and that it was less, but it in fact does not matter - it was a significant bit more than it should have been.

EJJ - I see this is your first post on this topic. Whilst I fully agree with your sentiment and I do not expect you to read all the 'history' here, if you do you will see that although it may appear 'silly' it killed a lot of people and the aim is to avoid a further repetition.

[RWA]

Originally Posted by DozyWannabe

the aircraft did exactly as it was designed to do with the configuration it was in.

In that connection, DW, can't resist contributing a quote from a beautifully-balanced press report, years ago, from the redoubtable Jim Wallace of the Seattle PI, on the differing design philosophies of the two major manufacturers. It has none other than John Lauber, Head of Safety Engineering at Airbus, saying what you said, almost word for word, way back in 2000, about the very first A320 crash at Habsheim in 1988:-

"Lauber said the pilots were supposed to fly by with the gear down at about 100 feet. Instead, they came in at less than 30 feet off the ground. When the plane gets below 50 feet, the computer assumes the pilots are trying to land, Lauber said.

"The fact is, the plane did exactly what it was supposed to do," he said. Only it landed in the trees.

Airbus learned much from that incident, Lauber said.

Until the crash, he said, there was a "genuine psychology" around Airbus that it had designed a crash-proof airplane because of the hard protections.

"The repercussions from that accident continue to reverberate," Lauber acknowledged."

http://seattlepi.nwsource.com/business/boe202.shtml

If it's all the same to you, I'll continue my policy of flying, as far as possible, in aeroplanes in which the pilots, not the computer programmers, have the final say.

[Lemurian]

BOAC

All this 'automation' is damned clever, you know, but it is becoming apparent that we need a big red button we can press when we want to land which says "I have control"

There is an even simpler way of taking over the automation : Close the Throttles !

...just as when we declare our intention at DA - "Land" - and PNF removes his/her appendages from the throttle levers

I have learnt from this very thread that is difficult to make one's SOPs universal : There are around probably more airlines where in LVP, the captain has authority -and his hands - on the controls. The - seemingly - British concept of monitored approach where the F/O opeates the aircraft until capt takes over at *Land* is far from being universal.
I have a feeling that some of your proposals will be discussed -already have, as a matter of fact -,but I'd like to take this :

...the techies COULD, perhaps, simply alter the logic on the autothrust disconnect button to allow those functions (WOW) when pressed?

,
I wonder whether you typed too quickly.
What, overriding the air/ground logic ?
- For the thrust reversers ? Do you really want to recreate another Lauda Air 767 ?
- For the Ground spoilers in flight ?

Take any AUTOMATIC position logic out of the throttle 'circuits' (allowing ONLY T/L position to dictate thrust demand)

May be you could tell me if I'm wrong but wasn't what exactly what happened : T/L position = Thrust demand ?
Should you also change the logic of the new BCA airplanes, which is quite equivalent ?
On this subject, you and some other BCA drivers have failed to demonstrate the superiority of the BCA design above AI's in terms of safety and handling.
As for the spoilers saving the day, maybe...Could I just remind you that a year earlier a perfectly sound 737 nearly went over the same drop-off, a perfectly sound F-100 did fall over same drop-off and consequently were barred from operating on CGH, if only for a time.
What I find quite baffling is that the consensus- even with the moderators - is that the 'Bus is an inherently unsafe airplane.
As the air/ground, spoilers, reversers and autobrakes have exactly the same logic whether they are from BCA or AI, I really don't see why the 737 -for instance - could escape 1/- the same sort of *mishandling* and 2/-the same *band aid patches* some would see on the 320. (WE know it doesn't)
As for superior safety of the 737, don't you forget a bit too quickly {

• Rudder hard over incidents
• Exploding fuel tanks
• Stalling after an overshoot or during a windshear encounter, and more recently :
• Cracks on new airframes.
• a total of TWELVE instances of loss of control on landing.

[DozyWannabe]

RWA:
If it's all the same to you, I'll continue my policy of flying, as far as possible, in aeroplanes in which the pilots, not the computer programmers, have the final say.

Aside from Lemurian's point that the latest Boeing aircraft have a substantially similar design (to the point where Rananim, one of the most vehement anti-automation voices on here actually retracted his posts and apologised), would these be the same pilots who drive 747s into one another? Or possibly the pilots who deploy spoilers while airborne? Maybe even the kind of pilots who let ther kids fly the plane for a bit?

Alternatively you could be dealing with the kind of pilots that prevent accidents, and the automation is there to do exactly the same. It's a major misconception that the A320 computer is there to override the pilot if the computer doesn't like what the pilot is trying to do (also the source of the 'one pilot and a dog' joke, which while amusing is pretty far from the truth). To the best of its ability the computer is there to facilitate things for the pilot, and to provide an extra safety net when things go wrong. It's a little frustrating that you brought Habsheim up yet again, but the fact is that the automation kept the aircraft wings-level down to the ground and in all likelihood saved some lives.

I guess the point I'm trying to make is that no system can be perfect, and neither is any pilot. The AI sales staff found the former, and far too many pilots, crew and passengers have found the latter out the hard way.

[RWA]

Originally Posted by DozyWannabe

would these be the same pilots who drive 747s into one another? Or possibly the pilots who deploy spoilers while airborne? Maybe even the kind of pilots who let ther kids fly the plane for a bit?

Forgive me, but you sound a bit desperate, DozyWannabe.

The Teneriffe accident was in 1997 - and had nothing at all to do with the design of either aircraft. Lauda Air was in 1991 - and reverse thrust deployed due to a system malfunction, not any mistake by the pilots. The aeroplane that the captain let his kid fly was an Airbus A310, and the accident occurred in 1994.

Is your only 'angle' on this that Boeings are as dangerous as Airbuses? For all I know, they are. But, whichever make a given aeroplane is, it's important that EVERY accident should be analysed, and lessons drawn from it.

[DozyWannabe]

Check my last paragraph for my 'angle'. I think there's a valid argument that giving a pilot absolute final say is no inherently safer than providing a safety net via automation. I wasn't comparing the individual incidents to this one, just demonstrating that humans make mistakes too.

Also worth pointing out that even Boeing has changed their stance on automation with the 777 onwards, so commercial aircraft that spend a majority of their time under manual or analogue automatic control will one day be a thing of the past.

You're also missing the substance of my post in that the computer is there to help, not hinder. The only time they'll ever override a pilot input is if the pilot tries to violate the envelope protection, which I'm sure you'll agree is undesirable. Otherwise the computer will happily do whatever the pilot tells it to.

[RWA]

Originally Posted by DozyWannabe

The only time they'll ever override a pilot input is if the pilot tries to violate the envelope protection, which I'm sure you'll agree is undesirable. Otherwise the computer will happily do whatever the pilot tells it to.

Surely that's just not so in this particular case, DW? The pilot told this computer to deploy the ground spoilers and activate the autobrakes on touchdown?

It didn't.

[sleeper]

Just to make sure:

Tenerife accident was in 1977

[3Ten]

bsieker

I don't know about procedures at different airlines, but in the FCOM a Level 3 Warning, such as the warning we're talking about (including CRC, Master WARN light and Red ECAM text), means:

In the A310 FCOM2 Emergency Procedures Chapter, the PROCEDURE INITIATION instructes:

- No action shall be taken (apart from audio warning cancel) until:

* The appropriate flight path is stabilized
* Normal procedures are applied
* At least 400 feet above the runway, in case of failure during approach, take off or go around,

- A height of 400 feet is recommended as a good compromise between the time required for flight path stabilization, and the initiation of the procedure without excessive delay.
- In some emmergency conditions, providing the flight path is stabilized, the PF may initiate the emmergency actions before reaching 400 feet AGL.

* Appropriate command by the PF.

________________________

This may give you a broader idea of the way pilots are supposed to respond to emergency warnings near the ground, and the prioritisation of tasks during flight. This relates to the "gateways" concept, and may reinforce the reasons why I think introducing that kind of warning could be less effective than desired.

Austrian Simon

So my solution to this would be: always adhere to the last command given by the pilot.

Very long post, but very good idea, there is no simpler than that, if the pilot is there to decide, systems should be designed in that line.

DozyWannabe

(...) would these be the same pilots who drive 747s into one another? Or possibly the pilots who deploy spoilers while airborne? Maybe even the kind of pilots who let ther kids fly the plane for a bit?

Alternatively you could be dealing with the kind of pilots that prevent accidents (...)

You've got it all very *black and white* uh?
I like to think that, few exception made, pilots who have accidents are just normal pilots, like we all like to think we are.

[DozyWannabe]

RWA:

If the TL was left considerably forward of the idle stop intentionally or otherwise, then the pilots failed to tell the computer that they were landing and in doing so violated the envelope protection. The 777 is exactly the same in that respect, and it will also deploy reversers without spoilers in that scenario, so you *can* get into that sticky situation on a Boeing (Rananim initially believed otherwise).

You could have BOAC's suggested 'override' button, but that would obviate the whole point of the automation protections in the first place.

At the end of the day there's going to be a fairly comprehensive overhaul of what is and what is not allowed. Personally I believed there was an accident waiting to happen at CGH for some time when I read the threads about the previous 737 and ATR incidents. Procedures are there to be followed and there'll be no sympathy from the ambulance-chasers if it turns out that they weren't. This applies as much to the old aircraft designs (popping the slat inhibitor CBs on the 727 to gain a bit of performance, for example - no-one ever tried to blame Boeing for that one) as the new ones.

3Ten:
Nope, there are good, medicre and bad pilots just as in any profession and in many accident cases it's as likely to be due to being in the wrong place at the wrong time (e.g TWA800, SR111, UAL232) as making a mistake (e.g KLM4805, AA1420, AA587). What I don't get is the insistence by some that the technology is there to thwart them rather than help them - which then becomes a self-fulfilling prophecy.

[ChristiaanJ]

Originally Posted by DozyWannabe

... manual or analogue automatic control will one day be a thing of the past.

From that remark, it seems to me that you, and a few others, are under the mistaken impression that there are fundamental differences between analogue and digital flight control systems.

In reality, the good old analogue systems did exactly the same things and used exactly the same logic, interlocks and other features as the digital systems.

"Seen" from the outside (functionally), there is no way to tell if a given system is analogue or digital.

There are very good reasons why analogue systems are fading into the mist of time, the main ones being the volume, weight and complexity of the hardware, and the fact that any modification or upgrade becomes a matter of hardware mods, rather than software.

If anybody wanted to, the control laws and logic of the A320 AFCS could be duplicated exactly using analogue and discrete-logic technology.
Not that anybody in his right mind would try, given the reasons above.

And yes, we had WOW logic into the system on Concorde....

[DozyWannabe]

Yup, am aware. An engineering marvel and one everyone involved is justifiably proud of.

Concur totally with your fourth paragraph - and that's also the reason why the old mechanical/hydraulic controls are passing on.

[ChristiaanJ]

Forgive me for being reminded of this by the pilot vs. computers controversy.

Once upon a time.....
In the earliest days of autoland....

The Americans wanted to keep the pilot in the loop. Basic autopilot, but a maximum of aids to the pilot to keep situational awareness, etc. - anybody here remembers Microvision?

Some Brits went for triplex redundancy (Trident), others for duplex-monitored systems (VC-10, Concorde): "keep your clammy hands off the controls, please, unless the "LAND" capability light goes out".

The irony is, that Sud went for the American philosophy with their trials of the Lear system on the Caravelle. Now that Sud has become Airbus, they've certainly did a 180° turn, what?

[BOAC]

Lemurian - back to your post #2527 - a long one and a lot to answer!

There is an even simpler way of taking over the automation : Close the Throttles !

- of course, but a chunk of posts here is about how to sort it out when they are not closed using 'black boxes'.

What, overriding the air/ground logic?

- I had hoped that WOW would cover that? From where do you produce the T/Rs and spoilers 'in the air'? If you are suggesting a WOW sensor failure AND a pilot pressing the button in the air AND a selection of either..........................

May be you could tell me if I'm wrong but wasn't what exactly what happened : T/L position = Thrust demand ?

- yes, but it has to remain there because we need to retain control over the engines for a g/a or whatever. Note I did not suggest forcing the engines to idle - and nothing else. You could introduce that but I would rather leave it to the crew (hopefully). The intent was to provide the other desired services such as spoilers and autobrake which were denied, but leaving the ultimate g/a option.

Please don't lead this AGAIN into a Boeing/AB rant - it was an A320 that crashed at CGH. All your Boeing events are really irrelevant to this accident, aren't they? Let's stay focussed please.