TAM A320 crash at Congonhas, Brazil

[Right Way Up]

Sorry but I cannot see the difference between Boeing & the airbus. Fly the approach with hand on both thrust levers and at the right time close the bl00dy things. What I do think could be an issue is a predominantly LHS pilot operating the aircraft from the RHS.

[ChristiaanJ]

BBB,
You may be chasing a red herring.
A faulty TLA sensor recording on the FDR would not correlate with the other data, so it would stick out like a sore thumb during analysis, especially since it would be somewhat improbable to have occurred just at touchdown.
I would certainly put the TLA 'as found' after the crash into the dossier, but I would not call it "VERY important", unless I could correlate it with a lot of other data.

[bomarc]

A thought for the philosophers and engineers:

is it better to design a plane, or indeed any machine, that adapts itself to the man, or is it better to design a machine and have the man adapt himself to the machine?

automation should help the man, not confuse him. see the film "FailSafe" for prophetic words of the pilot...(paraphrase) we don't fly the machine any more, it flys us. circa 1964

[TioPablo]

With all my respect,

A software bug can be a whole badly specified logic subsystem, which in combination with other system modules and at some undefined state may fail to achieve that for it was designed in first place: assist the pilot in bringing people safely from A to B.

IF parameters are in contradiction, THEN a simple "CONFIRM LANDING" will do the job.

[bubbers44]

If tomorrow the data tells us the automation caused the pilots to not be able to stop because they were denied speed brakes and auto brakes because they only brought the #1 engine all the way to idle and then reverse thrust and especially if the #2 engine went to high thrust they may have to change their logic. This isn't the first time this has happened.

[hetfield]

@pira

The main difference between B and A (from what I could understand from this thread, is that if you don't retard one thrust lever in the Airbus (for whatever reason: Pilot error, Mechanical Problem,...)the autothrust will keep that engine in SPD mode and will accelerate the engine up to CLB thrust to maintain the SPD while in the Boeing the engine would continue to produce the same APP thrust (around 55% N1).

No SPD mode A/THR will be off, cause TR is selectet on other engine, but thrust will be produced according lever position (CLB ?).

[BOAC]

Originally Posted by Right Way Up

LHS pilot operating the aircraft from the RHS.

- I cannot agree with you there, based on personal experience. I have operated many times in many types from the 'wrong' seat with my 'wrong' hands on various controls and the ONLY difficulties I have had have been with complex tasks such as formation/air-to-air refulleing and operating the 21 function weapons control in the Lightning. Never have I had a throttle handling problem. I am firmly convinced, like NOD and others, that this is an AB 'human factors' issue.

[PBL]

AlexL,

These pilots, as most / all pilots are, were highly skilled and highly trained. They did not intend to crash, they did not intend to kill themselves. therefore one can assume that whatever they did made absolute sense to them at the time. The fact that they made, what to them at the time, with the data they had was a sound a decision and got bitten for it, means that there is a fault with the man-machine interface. End of story.

That reasoning about faults just doesn't hold water.

Let's take as your premise:

* There are three parts to the overall system: man, machine, and interface

Let's take as additional premises:

* [Fault Distribution Premise] Any fault with the overall system occurs because of a fault with one of the parts (also: any fault behavior with the system occurs because of faulty behavior of one of the parts)
* A fault occurred with the overall system

and try to reach the conclusion
* There is a fault with the interface

You can do so if you can show
* There was no fault with man AND there was no fault with machine

You have tried to establish the premise
* There was no fault with man
but even if we buy your argument, you are only half-way there, having not argued for the other half of the conjunct.

But, even given that, I don't think anyone experienced with human factors in aviation accident investigation would buy your premise that experienced pilots who don't want to kill themselves don't make critical errors. Indeed, there is a long list of accidents in which such pilots have indeed made critical errors which are not otherwise explained.

PBL

[pira]

hetfield,
Thank you for the clarification!
But if the normal thrust lever positions are in CLB (during approach), it means that the engines will accelerate to CLB thrust every time the auto thrust is disengaged without retarding the thrust lever, even if the thrust was originally much lower (like during approach).
For me that is the most important design difference from Airbus to Boeing. In the Boeing, the engine would continue to produce the same thrust as it was producing when the auto throttle disengaged (approach thrust= around 55% N1). It would never accelerate the engine.
Just my 2 cents.

[PBL]

Bomarc,

Engineering psychologists are 30 years along this road already. My post 728 referenced Billings's notion of "human-centered automation". His book Aviation Automation, Lawrence Erlbaum Associates, 1997, is a standard reference. Major manufacturers have been using such expertise for many years now. Billings's colleague David Woods, for example, is author of a canonical series of articles on human interaction with the A320 interface. The International Journal of Aviation Psychology as well as the proceedings of the conference series International Workshop on Aviation Psychology are also standard references.

PBL

[PAXboy]

bomarc

is it better to design a plane, or indeed any machine, that adapts itself to the man, or is it better to design a machine and have the man adapt himself to the machine?

So ... make automation that has the capability to 'adapt' itself to the 1,000 or 2,000 or 3,000 pilots that will operate it during it's lifetime or ... have everyone KNOW EXACTLY what the machine will do without variation if operated according to instructions?

Make the adaptable human adapt or make the software adaptable? How much more opportunity would there then be for the human to ask: What's it doing now?

[SoaringTheSkies]

Hmmm... re the Thrust levers on the AB.

From what I read here, it really seems that they're "overloaded" (no negative connotation with that at this time) with three functions?

#1 condition levers (flight phase, the detents for TOGA, CLB, IDLE etc), used to select a defined phase of flight. A means of telling the airplane where you are.
#2 max thrust setting (donut mode), when set between CLB and IDLE detents with autothrottle active
#3 thrust setting (?) traditional direct thrust setting.

You'll be in a much better situation to explain to me which of the above functions is active under what conditions.

However, if conditions change and thus the T/L mode changes, the position of the T/L gets a whole new meaning to the A/T system or the FADECs.
As far as I know (and I've had very very limited time in a 757 sim), the levers on a Boeing move with the actual thrust setting, so in the case of an A/T disconnect, the levers are in exactly the place that commands as much thrust in manual as the A/T has last commanded.

In the AB case, the T/L might be (and as I have said times before, that's just an assumption in this case, afaik, we do not have any more information than Airbus' short message) somewhere between the IDLE and the CLB detent and when the T/L mode switches from full A/T to one of the other modes, the commanded thrust setting will change without pilot intervention, just by the fact that the internal logic has changed states.

I might still have a lot of reading to do on why it's been done that way, but to me and from a human interface point of view, this does not look like the best design to keep the pilot in the loop.

pj

[PBL]

hetfield,

I debated whether to respond to your post 777,

The point is, many accidents with AB happened 'cause the pilots did not fully know/understand the aircrafts systems. You can't wipe this away, it's a fact.

for a number of reasons. First is that you're erecting a straw man. No one is trying to "wipe" anything "away", least of all me. Second, there are lots of accidents with complex systems in which a lack of understanding of the systems on somebody's part played a role, and these accidents are not restricted to Airbus machines. They are becoming increasingly common with increasing use of digital electronic systems in aircraft. Third, even if a lack of understanding played a role in an accident, there are two non-trivial questions: what to do about it; and whether the systems bring rewards that outweigh the occasional critical lack of understanding. To this second question: many consider that the latest generation of aircraft with complex digital-electronic automated systems are overall much less prone to accident than previous generations, and consider this judgement to be borne out by (say) the annual Boeing statistical review.

I don't propose to address these issues further here, but I will indicate my reasons for not considering the A330 flight test accident similar to whatever turn out to be the causes of the TAM Congonhas accident, since you wish to question this lack of similarity.

The A330 crew
* deliberately allowed an abnormal flight condition to develop, probably in the knowledge that it would lead to loss of control if allowed to go too far
* apparently suffered autopilot mode confusion
* apparently suffered a lack of both visual and instrumentational attitude reference

There is no indication, and not even speculation here, that any of these three factors was present in the TAM Congonhas accident.

PBL

[hetfield]

@PBL

* apparently suffered autopilot mode confusion

Maybe the Congonhas findings will be something like

* apparently suffered thrust control mode confusion


If this will be the case, than there is an obvious similarity.

What i wanted to point out, like many others here, is the man machine interface. In my opinion it's far from optimum on 320.

regards

[Right Way Up]

BOAC,
You may well be right. However I think it is a bold statement to say you are convinced it is a AB HF issue when you have not flown the thing!

[Old Engineer]

Notes from an airfield design perspective

In the interest of brevity, I'll minimize mention of how I became involved to some degree in airfield design work; and likewise minimize the detailed derivation of some conclusions which may be of interest (based on personal experience). At this point I've read over 2000 posts on three sites, on this matter. Since I am familiar with runways, you'll notice that I tend to see their less desirable features; and lean toward a philosophy that they should be made forgiving if at all possible. That said, our own DCA illustrates some of the economic difficulties of always achieving this.

Runway length - Mention was made somewhere that this runway was a long as DCA. It is true that DCA operated jet ACFT at about 6300 feet for a rather long time (10-15 years), but it's now been 20-25 years since it was extended to 7000 feet (US concensus minimum for any jet operations at all at the time) with added overrun as well, to perhaps 600 feet IIRC. The adverse turn at the north is well known; less well known is the problem caused to approach from south by a 6 or 7 foot levee against Potomac River flooding.

The runway here at Sao Paulo remains short (6362 feet?), although it may be said to be marked off such that there is a 400-foot paved overrun on the accident end. However, the elevated approach end terminated in a steep embankment tends to make planes land consistently at the long end of the landing zone (see vertical photo). This could be called an awkward detail.

New paving - Asphalt paving overlay obviously has advantages in minimizing out-of-service time in an operating airport. A disadvantage is the difficulty of controlling the mix such that the desired surface friction is obtained-- on occasion problems can occur, and the investigation should look at this. Some asphalt work is very demanding.

Missing grooving - As for grooving, this should be thought of more as performing the same function as the grooving of the tires. It is hydraulically most effective if crosswise; a picture of the older surface shows it lengthwise, as well as showing the typical ruts formed by gear weight over time (the ruts will fill with water, is the problem). It is OK to think the grooves will store a little water and buy time (1 minute?) in a downpour, but I question whether they much aid the removal of water to the side (due perimeter drag of the small cross-section).

Hydroplaning - As there is a 1 percent downgrade, the water path to the side may reach 100 feet on a diagonal. At approaching a minute to go this far, that's how long it will take a heavy downpour burst to create a depth of water that's a problem (typically deeper than the tire grooves) particularly off the runway centerline, increasing to the edges. There is some thought that the depth of pavement grooves adds effectively to that of the tire grooves. So the lack of trouble to the preceeding plane is not indicative that the accident plane did not encounter sudden hydroplaning conditions.

Bright flash artifacts in the surveillence videos - I had occasion to write the section on runway/taxiway lighting and signing in the late 60's airfield design standards/details manual for one of the military services (US). Although modified for military types of course, it was based on civil aviation practices at the time, per extensive interviews including controllers and pilots. It may have been the first time a complete set of required practice for facilities in the jet age was ever set down on paper. It was still in use nearly two decades later. I can say with some confidence that so long as the gear remained on the paved runway, the engines did not strike any lighting or signing, assuming that US practice guided these details. In the video of the preceeding plane touching down, there is also a bright flash. This occurs when the plane uncovers a bright background light. It appears the imaging system removes the flare (=flash) caused by the sudden appearance of such lights, but does not do so instantly.

Perimeter "wall" - this is actually a standard roadway curb and gutter section poured as one piece of unreinforced concrete. The curb could be 6, 8, or 10 inches high in US practice. Ten inches is called a barrier curb and will generally prevent a vehicle with car-sized tires (small service vans) from going over the edge of the embankment, as well as preventing erosion of the slope. The ACFT gear broke a piece of this in half. Allowing 50 percent impact loading, indicated weight on main gear at 94 knots departure speed was roughly at least 20 percent of the parked weight.

Vertical trajectory upon runway exit - from a vertical photo, it is about 400 feet to a possible point location for the taxi, assuming this taxi over the hood of which the gear passed to be in the far lane (of four). Then the vertical drop would indicate a weight on main gear leaving the field of about 15 percent of parked weight. As other indicators of this weight indicate rather more, we can assume the taxi perhaps a lane closer or more. I don't recall the position of the taxi being given in detail. The ACFT falls in a path combining the 1% downgrade of the runway/field and that of a parabola due to the action of the proper percentage of gravity-- this latter being determined by the percentage of ACFT weight on gear. I estimate 30-foot embankment height at this corner; the reported 50 feet has to be on the other (right) corner, from the vertical photo. Obviously, better data, better results.

Other indicators of lift - assuming configuration somewhat similar to takeoff, and lift increasing as square of speed, it is hard to see how the weight on gear at 94 kts field departure (158 feet per second) could be less than 25 percent of the parked weight. Of course, with FDR data, this can be better known. I've not seen manufacturer data, although it must exist; and runway centers (away from the ends) are often designed for only half the weight of aircraft. The ruts indented into the grassed area are typical in depth of a semi-trailer (9000 lbs per each 2-wheel pair (US limit)) and so, consistent with 15-25 percent weight on gear, given soil strength known only generally without tests.

My opinion on spoilers - based on the preceeding two paragraphs, IMHO it is unlikely that the spoilers were fully deployed at the field end. As has been pointed out, the effect of this on manual (or other) braking is a serious reduction, at least down to the percentage of weight on gear.

My opinion on statistics - with rare events in reliability studies, one needs to look at the failure events, not the success events. It is significant that now almost a third of AB320 hull losses seem to involve the control sequence being discussed re landing with 1-RT U/S. Until now, there was no great loss of life from this cause (I'd have to recheck this), due apparently to more forgiving runways or good luck. But in my mind, it does point up the need for a forgiving runway. I think TAM has taken a step in the right direction by ruling out such landings (RT U/S) here.

Bottom line - We used to say in the engineering office, that death is too great a penalty for so small a mistake (if that is the case). In many cases, we really do need better airfields. Its worth noting that the 7000-foot minimum grew up in an era before fly by wire, and the preconceived notion that FBW would make such fields safer in operation might better be replaced by an evaluation of exactly what the idiosyncracies of FBW require.

OE

[bsieker]

Thrust modes ...

hetfield and SoaringTheSkies,

It's really very simple and always(1) works like this:

If the A/THR light is off, the levers command thrust directly,

if the A/THR light is on,
- A/THR controls the thrust if the thrust lever is between IDLE and the CL detent(2) with the maximum limited by the TL position(3)
- Thrust is set directly above the CL detent(4)

A confusion about whether or not A/THR was active (which, btw, is different from a mode confusion) seems extremely unlikely. And even so, if the pilot thought A/THR was off, would he not still retard the levers?

STK: During normal flight, no "conditioning" is done. The thrust levers stay in CL for the entire flight, from thrust reduction altitude to flare.


(1) Unless Alpha-Floor-Protection is active, in which case TOGA thrust is commanded and locked, even if A/THR is disarmed, and regardless of TL position. This is irrelevant here, since Alpha-Floor-Protection is inhibited below 100ft RA.
(2) A/THR is active between IDLE and the MCT/FLX detent with one engine out.
(3) Using Autothrust with the thrust levers below CL detent (MCT/FLX with 1 engine out)
is not recommended, a "LVR CL" or "LVR MCT" warning appears.
(4)Thrust is controlled directly above the MCT/FLX detent with one engine out

[PBL]

hetfield,

Maybe the Congonhas findings will be something like

* apparently suffered thrust control mode confusion


If this will be the case, than there is an obvious similarity.

Does Autothrust have modes?

Speculation here has centered on whether Autothrust might still have been on, rather than off, during touchdown and rollout. (It is usual for it to be off.) Whether a system is on or off is not covered by the term "mode confusion". A mode is a set of behaviors exhibited by the system when it is on.
"Mode confusion" means specifically that pilots (or other operators) think the system is operating in one mode, when in fact it is operating in another.

I am not sure that this interchange is going to go anywhere unless we can agree on the use of technical terms.

That said, I will agree with you in general terms that the complex electronic systems installed in modern commercial transports are not optimal, none of them. Indeed, I don't know any engineer who would disagree. The possibilities of helping continually to improve these digital systems keeps most of the ones I know working in the industry. Otherwise they would mostly be off working in computer security.

PBL

[bsieker]

Autothrust Modes

Originally Posted by PBL

Does Autothrust have modes?

Yes it does.

- Thrust ("N1") mode where it holds a specific thrust, used in combination with autopilot vertical modes that control speed by varying pitch (climb and descent modes)

- Speed/Mach ("V/M") mode, where speed is controlled by varying thrust, used in combination with autopilot vertical modes that control a vertical path, or without autopilot

- Retard mode, only for automatic landing with Autopilot "LAND" mode, to reduce thrust during flare.

[SoaringTheSkies]

PBL, together with what FlyingNewbie and bsieker said re T/L settings according to FDR and A/T and T/L settings, A/T disconnecting would have created the problem. As far as I've understood, it's common practice, maybe even SOP, to fly the airplane with A/T on until the RETARD callout?
Now, if it's true that the FDR shows the #2 T/L above idle, disconnecting the autothrust would have the engine rev up to that thrust setting (as has been said multiple times).

Again: I fully understand and agree that leaving one thrust lever above idle in the flare is counter-intuitive, but it seems that it has happened.

My whole point is that the sequence following from this is made possible by the way the AB systems work, and maybe by the fact that pilots are trained to accept the counter-intuitive fact that under normal operating conditions, the T/L setting has no direct relationship with the actual engine thrust setting.
All you AB pilots out there, hasn't that been counter intuitive to you when you got your first AB rating? It would seem so for me.
After all, what we call intuitive is often just our past experience that has gone subconcious.

pj