TAM A320 crash at Congonhas, Brazil

[TripleBravo]

Even if I left a throttle up a bit it would be obvious and corrected immediately.

Its as obvious at any airplane, be it Beechcraft, Boeing, Airbus, whatever.

I think the new technology is making the pilot the observer of the automation and a monitor otherwise how could it take them 11 seconds to use manual brakes?

No automation? Alright, forget about your FMC and get to your NAT flightlevels manually. Or what do you mean exactly?

Next accident might happen by gross forward input on the controls just before touchdown. I see the accusations against whichever manufacturer that he didn't prevent that, because the plane already "knows" that it was too close to ground (because of radio altitude) and "should have known to land".


@Max Tow:
There is such thing as an "acceptable accident rate". Airplanes are built to have an incident probability of better than ten to the 9th per FH. Boeings and Airbusses alike, since this is a certification requirement. It does not prevent to improve though.

One more questions: without spoillers and just one reverse, is it possible to stop on a short runway only applying brakes?

According to A320 FCOM it takes about 40% - 50% longer to stop without ground spoilers available.

I understand the FDR has two sensors to record TLA. Has it been verified by the FDR that both these sensors showed the TL above idle?

It was stated, that there was (until now) no evidence of malfunction.

My personal view is that the PF was focusing too much on just one lever that the second one completely disappeared from his mental view, so it did not contribute in his mind to the complete landing maneuver. They even briefed that wrongly according to what I read in the transcript, so I can imagine they might have never looked up that very procedure in the MEL, an error which can only be done when you "think you know". The very stressful situation did not help to analyse the situation calmly. The standard callout of no spoilers could have been a hint (also to break manually), which they overlooked sadly.

[lomapaseo]

Triplebravo

There is such thing as an "acceptable accident rate". Airplanes are built to have an incident probability of better than ten to the 9th. Boeings and Airbusses alike, since this is a certification requirement. It does not prevent to improve though.

methinks some confusion here and some old wifes tale.

There is no acceptable accident rate within published aviation standards

Allow me to remove the undefined word above incident probability and stick to the definition of catastrophic accident (not survivable). Catastrophes in commercial service happen at the rate of E-7 and someday we may even get this lowered by a factor of 2 but no way will we acchieve E-8 let alone E-9

Tis true however that for a very specific area of design requirements, that is multiple system failures etc. (Far/JAR 25.1309) that there is a target of achieving E-9 against the occurence of a catastrophe.

So we are then left with things like a single system failure (not specifically regulated by design) coupled with inappropriate crew response as one of the biggest contributors to our catastrophic accident rate among all aircraft

[KRUGERFLAP]

BSCU,LGCU,FADEC problems? SURE

That airbus got problems when it landing or during the 800ft and below till.Because the failures are inhibited in that phase.From 800ft to 80kts.So the possibles failures are:

FADEC eng.2 - no warning on that phase
BSCU 1 and 2 - no warning on that phase
LGCU 1 and 2 - no warning on that phase

to rearm the system they would need 10 sec! Now count the time until overran.

Airbus must change the current logic and leave to the pilot the decision to work on or not in a particular failures. We need the warning!!!!!

Cheers,

KF

[GearDown&Locked]

Luckily systems aren't desinged on the basis of feelings.

bsieker, are you sure that's the right approach for any system design?
IMHO critical systems that need to interface with humans should be Intuitive and User Friendly (I'm sure you can consider those as feelings).

A good principle (philosophy if you will) of automation is to provide comfort to a certain system user on a given manual process that is either: a)repetitive, b)monopolizes the attention of the user all the time, c)of complex operation, to name but a few.

You have automatic navigation (but you must be able to, and in fact you can, navigate using manual procedures), you have automatic engine thrust (but you can control the engines manually), you have automatic brakes (but the original process is purely manual), etc... So the philosophy is: manual process automated for comfort.

Not the case anymore. What all this airplane system philosophy states (I believe any plane maker uses it now) is the fact that: automation performs better every time; better, faster and more accurately than pilots ever will.

This hybrid analog/digital concept has made the FE redundant in the past and the current trend is that it will continue to move towards fully digital (automated) system, eliminating the need for 2 pilots - the captain figure will never cease to be present, more likely as the system manager (scapegoat?).
The main goal here is: full automation for economy, manual process as an (expensive) option.

Their favorite excuse: it's safer that way. Anyone can read here at Pprune tons of posts referring the need to fly the plane manually every time they have the opportunity; but then they all add this curious saying "when its safe to do so" (see what I mean?). So now you have airlines that have in their SOPs the obligation to operate fully automatic from TO to Landing even in long runways, CAVOK, >10 VIS, zero wind bla bla bla. We're seeing the training of new pilots emphasize the notion of "if its working fine, don't touch it", and learning stuff on a Need-To-Know basis.

The old Automate-For-Comfort philosophy is dead. Long live the new philosophy.

[PBL]

The probability of one in ten-to-the-minus-nine per operating hour is the requirement for single-component catastrophic failure, not the likelihood of catastrophic failure of the airplane. That would be one in ten-to-the-minus-seven.

According to engineers-urban-legend, this all comes from thinking that you want the airplane to have an overall probability of less than one in ten-to-the-minus-seven of single-component catastrophic failure from any source (subsystem) and as a rule of thumb an airplane has about 100 subsystems, so you get one in ...minus-nine for each subsystem. Now, this is *old* thinking, but it comes from Systematic Safety, by Lloyd and Tye, CAA Publications, 1982. (The CAA is the airworthiness authority for the United Kingdom, and Lloyd and Tye were at that point two of its most experienced certification authorities.)

The one-in---minus-seven was intended to be "not expected within the fleet life" of the airplane model. Things have changed there in the last few decades, too!

John Downer has written a thesis in the Science and Technology Studies department of Cornell University, under Trevor Pinch, about the one-in-ten-to-the-minus-nine requirements. He was turning it into a book, and I have a copy of the manuscript; I don't know whether he is distributing it. I suggested the topic to Trevor some years ago, and was glad to see someone take it up.

PBL

[PBL]

GDL,

I believe bsieker is quite correct in suggesting not to design safety-critical system interfaces on the basis of feelings [disclaimer: I know bsieker personally].

To my mind, "intuitive" and "user friendly" are concepts intended to refer to the cognitive states of a user, and not hisher feelings. I trust we all know the difference.

PBL

[armchairpilot94116]

Could it have been a case of Tunnel Vision?

http://www.airlinesafety.com/editori...ngapore006.htm

This is an article trying to explain the Human Factor regarding the accident involving a Singapore Airlines 747 at take off from TAipei Taoyuan International Airport on Oct.31, 2000.

Could the Congonhas TAM accident crew have also been affected likewise? By the known challenge that landing at Congonhas on a wet evening on a resurfaced, ungrooved runway would be? And failing basic airmanship (idle the throttles on landing) because of this overwhelming attention to the task at hand?

[GearDown&Locked]

PBL,

I'm sure it's not our (shared hopefully) wish to discuss semantics, human behavior or neuroscience here and bore everybody. But I will reply by answering with a simple example:

-you're locked in a room that has a nice big red box with a fire hose inside connected to a water valve. This room also has water sprinklers fitted. On the wall you have this big red button.

Suddenly fire spreads out, fast and deadly. What would you do?

a) you rush to the wall, hit that red button, and wait for the sprinklers to act.

b) in an orderly manner, you walk to red box, open it, pull the hose out, open the water valve and point it to the base of the fire.


Did you choose a)? Congratulations, you managed to cut all electricity to the room. Now you're in the dark and cannot find the red box with all that smoke.

You have chosen b). Great, you've got some burns because of the time needed to open the box, pull the hose and open the valve, but you've managed to survive.

My point: IF the room builder had thought out this situation in an intuitive manner, he would never had used the automatic fire detection system and, instead, he would have connected the sprinkler system to that red button on the wall. By the way, this system had an error in its conception: the automatic fire detectors were connected to the same electric system that would be affected by the original button operation. Any delayed detection would be prevented after the button pressed.

Stupid example? think about it for a second when you're in the next hotel room.

GD&L

[TyroPicard]

Ah, but in my world he would have made the sprinklers automatic, and the red button would have unlocked the door.
TP

[Clandestino]

I understand that this mean that in a runway like Congonhas (they probably are in their limit) is not possible to stop without ground spoillers, right? Or pilots have to react very soon, right?

Now there's food for thought. MEL for my A320-214 states that in the case of total spoiler faiure required landing distance (RLD) increases by 45%. Since RLD is simply calculated by adding 67% to actual landing distance (ALD), I assume this means that ALD also goes up by 45%. ALDs for my bus, on wet runway, zero winds, without reversers, crossing the threshold at VLS (that's Airbusspeak for Vref), for 62t landing weight are: 1220m using manual braking and 1240m using medium autobrake so it seems that with quick application of manual braking, loss of spoilers doesn't necessarily turn into overrun.

However at Congonhas, spoilers didn't deploy because they were faulty but because they were inhibited by the non-action of the pilots. Had they simply pulled both thrust levers to idle - and that's a must during landing, spoilers would have deployed with probability verging on the edge of certainity.

I have seen no practical difference between the A320 and B757 in terms of recognition and response to braking effectiveness

Apart from the big yellow speed trend arrow on 320's speed tape (737NG, 764 and 777 have it too) - the third thing I look for after touchdown as PNF after 10 green christmas threes meaning that we have spoilers and yellow REV showing reverser doors unlocked. Now if there were no arrow or if it were too short, that wold make me scream "BRAKES!", probably followed by a couple of expletives.

[TripleBravo]

@PBL
Of course never without units - corrected.

@lomapaseo
I should have stated that my figure is true for construction / material related failures only. This does not include human error.

@Sdruvss
Interesting perspective.

I thought once more about the transcript. At 18:43:04 the crew briefed themselves that they have only the left reverser. OK, that's just stating that #2 is inop. But right after touchdown, at 18:48:26 the PNF (HOT-2) says "reverse number one only." To me, these words sound a bit odd, as "reverse" is a verb in its imperative, not the noun (the thing at the engine). So in other words I read that as a reminder to the PF to pull back only lever #1, which could imply "don't touch #2". Even when this was not the exact intention of that sentence, it could be misunderstood like that and could have influenced PF who has left lever #2 at CLB (if the DFDR has it right). Why?

Then I took another look at the MMEL published by TAM:



The big, fat, bold sentence says to "not select thrust reverser on the affected engine". Yes, there is an "if": Only if a certain warning was triggered in flight. This caution is not true if the affected reverser was disabled prior departure. In that case the applicable procedure says REV 1 AND 2 ... MAX as we all know now, but it is written in normal letters.

To me this appears like a negative contribution to human factors: Could the bold caution been stuck in their minds, because it is the biggest eyecatcher on that page of the MMEL?

Looks like human factors are not limited to man-machine interfaces but instead start with the manual. Could it be misleading in a stressful situation?

[PBL]

I have seen the summarised FDR transcripts.

The AC had WoW on left, then right (one second later), then nose (two seconds later than that), within the usual time of touching down (a second or two). The brake pedals were only used some time after (they were first applied about 10 seconds after left gear WoW, and took two seconds to reach max (80 degrees). It is a little odd that the left pedal position fluctuated somewhat, whereas the right pedal stayed at max.

They were running over the tarmac here at 70 meters per second. They went some 700 meters before starting to apply manual braking. That is over one-third of the runway,
with essentially no reduction in speed (about 140 kts, as has been previously reported). They only started to slow when manual braking was used.

Keep in mind that the runway has an LDA of 1880 m [Edited after comment by Our Man]. One can well imagine that things would have been different had manual braking been applied earlier. They would at least have gone off the end more slowly.

TLA was as has been portrayed. The difference between this landing and the previous one at Porto Alegre (same crew, previous leg) is that at Porto Alegre the #2 lever was reduced to idle at touchdown. As one would expect from a crew following SOPs. [Added on edit: At Porto Alegre, both levers were moved in unison to Idle Reverse, then Reverse, back to Idle Reverse, back to Idle]

The puzzle is then to imagine why, at Congonhas later on, they didn't do this.

Or why this data might not represent true TLA, etc.

PBL

[Tree]

Where one might go with your idea is to propose an alternative second input to be used in the case where a TL input is discarded because the TL has not moved and Thrust Lock is active on that engine. Perhaps an input for brake pedal deflection could be used in place of the TL input.

Enter my vote for that one. If you have one engine in reverse and the other in thrust lock below CLB and the T/L not in Toga/Flex and you are applying manual brakes then the sytem logic should connect the dots and give full stopping authority by activating ground spoilers.

[TripleBravo]

This shows the approximate position of the levers, the left #1 in max reverse, the right #2 left at EPR 1.2. I think it should have been the CLB detent, which is even more forward.


(Thanks for the picture, Claus.)

EPR 1.2 translates into approx. 74% thrust.

@bomarc
Just my thoughts, transition from 737 might be more demanding than a new typerating or transitioning from something completely different.

To be a checker does not mean you're doing everything right everytime. Think of Los Rodeos (Tenerife) 1977, van Zanten was without doubt one of the best pilots they had and yet advanced the throttles without clearance. Nobody is perfect, I fear.

@PBL
Thanks for the insight. Where did you get that from?

At Porto Alegre the roles of PF and PNF were switched.

@Tree

Quote:
Where one might go with your idea is to propose an alternative second input to be used in the case where a TL input is discarded because the TL has not moved and Thrust Lock is active on that engine. Perhaps an input for brake pedal deflection could be used in place of the TL input.
Enter my vote for that one. If you have one engine in reverse and the other in thrust lock below CLB and the T/L not in Toga/Flex and you are applying manual brakes then we should program the sytem logic to connect the dots and give full stopping ability by activating ground spoilers.

No. Imagine a go-around with one TL faulty (this time the reversed one), touching the ground and maintaining runway heading by rudder input, mistakenly depressing the pedals. You would fall out of the sky.

Thrust is brought to idle in case of invalid or disconnected TLA. That should be enough for every situation, because you are able fly and stop in this configuration.

[Tree]

Looks like human factors are not limited to man-machine interfaces but instead start with the manual. Could it be misleading in a stressful situation?[

Good point TripleBravo. A ground school instructor (also an experienced psychologist) commented on the "tricky" wording of some of the exam questions and multiple choice answers. He called them "brain shunts." Those familiar with electrical circuits will understand the analogy.

Reading the remainder of the MEL; It looks like double jeopardy in the case of both reversers inoperative.

[TyroPicard]

PBL

It is a little odd that the left pedal position fluctuated somewhat, whereas the right pedal stayed at max.

This could be because of the asymmetric thrust, PF attempting to steer the a/c with brakes. Is the rudder position recorded, as this may tell you whether steering was attempted using rudder pedals?

Interesting landing, right leg last - not what we aim for!
TP

[PBL]

[PBL] It is a little odd that the left pedal position fluctuated somewhat, whereas the right pedal stayed at max.

[TP] This could be because of the asymmetric thrust, PF attempting to steer the a/c with brakes. Is the rudder position recorded, as this may tell you whether steering was attempted using rudder pedals?

Yes, rudder position is recorded. Right rudder, oscillating between 0+ and 20+ degrees, except for a quick flip left near the end. Consistent with your suggestion, but I wouldn't like to say for sure.

PBL

[TyroPicard]

PBL

Or why this data might not represent true TLA, etc.

Assuming no prior ECAM warning about TLA, for the T/L to be moved to Idle while both TLA sensors indicate CL detent until impact (IIRC), would surely need simultaneous identical faults in each sensor?
And if there had been an ECAM warning FADEC would have selected Idle thrust on the ground.
TP

[TyroPicard]

Right rudder, oscillating between 0+ and 20+ degrees

In my experience keeping Max force on both pedals (balls of the feet) while moving the rudder (heel pressure as well) can be difficult (presumably varies with design of the pedal/transducer combination) - and becomes easier when the rudder is held at constant deflection. You may find a correlation between the pressure fluctuations and the rudder oscillations?
TP

[TyroPicard]

TripleBravo

as "reverse" is a verb in its imperative, not the noun

In English.... we don't know what word he used in Portuguese.

For what it's worth this is my interpretation.

18:48:24.5
CAM [sound of thrust lever movement] ... T/L to Idle
18:48:24.9
CAM [sound of increasing engine noise] ... No.2 engine increasing thrust to maintain Vapp
18:48:25.5
GPWS retard ... Reverse not yet selected
18:48:26.3
CAM [sound similar to touchdown] .. probably the nosewheel landing
18:48:26.7
HOT-2 reverse number one only. .. a reminder call
18:48:29.5
HOT-2 spoliers nothing. ... PNF doing his job - good call.

But what happened to the PNF Reverse Green Call?
TP