TAM A320 crash at Congonhas, Brazil
Is there a possibility, not likely, almost impossible to happen, that the pilots placed the left TL in reverse and the right on on Idle (or reverse) and... for some reason the right one went back to forward and stuck there?
Hindsight
With hindsight the aircraft should not have made the approach due the combination of runway / airport conditions and aircraft configuration. Thus a conclusion could be that there was a failure in risk assessment.
Recent posts focussed on error prevention and recovery (systems failure), but these depend on error detection which suffers from a wide range of human limitations – focussed attention, reduced hearing, or not able to recall memory items. There was a dual human failure in the overall operating system – both pilots ‘failed’ to notice, to act, react, etc.
The reasons for many of the human contributions might be found in a wider view of ‘automation/technology’ and everyday operations.
Auto brake (in part) originated from a need to improve human performance during RTOs (incorrect application of brakes). In this sense, autobrake is an essential safety system. Its subsequent use for passenger comfort – landing braking levels, and the attempt to calculate runway distance remaining (Boeing computer / 737 Midway accident) can create a false perception of the system’s capability. The emphasis on braking for comfort might bias pilots from full manual brake when required.
The routine use of auto thrust with manual flight can also lead to a false sense of security in unusual situations – expecting the ‘auto’ system to look after the thrust levers; familiarity or laziness?
Were the conditions for operation of the ‘fully automatic’ spoiler system really understood; were the implications of any remote failure known – a deficiency of SOPs, training, memory, or recall?
Was the challenge of this ‘carrier sized’ airport (fun, exciting, and demanding even on a good day), transferred into a subconscious ‘press-on’ attitude, strengthened by the presence of two Captains neither whishing to fail or be outdone? Were the crew conditioned to always land at this familiar airport irrespective of the differences in this situation; did anyone with a controlling influence in this operation stop to think?
Much has been said about landing distances, but how often do crews assess their landings against the requirements? Do crews routinely assess if the aircraft was capable of stopping within the safety margins provided for a limiting runway? Do crews check what % of max landing weight they are at, or how much additional runway they have/have not for a normal landing? Most landings are made on non limiting runways thus crews have few references as to how close they were to the required limiting performance, particularly in less than ideal conditions. This too can bias pilot’s judgement to a false sense of security.
Do crews check the validity of computerised landing data or the dispatcher’s advice; or like some aspects of regulation or management do crews also pass down their accountability for these aspects of safety to a lower level – other people/computers – a form of pre-emptive blame?
The lack of accurate (meaningful) runway braking reports further complicates the issue. 3 mm of water is neither safe/unsafe; once the runway is wet the safety margin is literally on a ‘downhill slide’. The ill-defined Boeing ‘slippery’ runway has merit when considered as the range braking conditions between wet and icy - the view taken in some documents where decreasing mu is correlated with descriptions ranging ‘good’ to ‘poor’. On a wet slippery runway how wet is wet, how slippery is slippery in comparison with a normal operation? Then we tend to forget aquaplaning – “you don’t notice it on grooved runways” myth or mystery? (And the critical speed may be nearer 7xSQR P than 9xSQR P).
Normal operations set the ‘comparative’ ground rules for human assessment and behaviour. Management and pilots rarely consider that the many assumptions they make in forming their idea of ‘normal’ operations (habit / expectation) will not apply in adverse conditions, particularly with the already reduced safety margins hidden in regulation. This enables opportunities for errors of judgement, mistakes in decision making – and that’s even before the start the approach and any other erroneous opportunities. Did everyone in the decision process fail to think – were they self satisfied (complacent) with their normal operation?
Reconsidering the circumstances of this accident without hindsight, it could be concluded there were sufficient cues available to both management and crew to indicate that this specific operation should not have been conducted. The investigation (and thread speculation) should focus on why these cues were not recognised or why judgement failed; were these deficiencies in individual, organisational, regulatory or industry-wide knowledge and thinking.
Recent activities appear to be ‘closing the stable door’, but at least they recognise some of the problems. Crews might learn from these and redatum their habits and take more notice of normal operations – build experience. Operators must consider the risks at all airports and their use of MEL – clear / accurate SOPs which everyone understands and has been exposed to in training – training which encourages change or removal of previous habits.
Every runway end should have a safety area, but the call for special nets, etc, could also be met by further reducing landing weight or limiting the conditions in which operations occur e.g. LCY no tailwind (RJ100) and no contaminated ops, or touchdown by a specific point. Change requires thought, and thinking requires a change in the way we behave.
People have to take more responsibility for safety in their operation – be accountable before the fact; if they don’t then unfortunately we have these sad opportunities to learn from their errors – that’s hindsight.
Recent posts focussed on error prevention and recovery (systems failure), but these depend on error detection which suffers from a wide range of human limitations – focussed attention, reduced hearing, or not able to recall memory items. There was a dual human failure in the overall operating system – both pilots ‘failed’ to notice, to act, react, etc.
The reasons for many of the human contributions might be found in a wider view of ‘automation/technology’ and everyday operations.
Auto brake (in part) originated from a need to improve human performance during RTOs (incorrect application of brakes). In this sense, autobrake is an essential safety system. Its subsequent use for passenger comfort – landing braking levels, and the attempt to calculate runway distance remaining (Boeing computer / 737 Midway accident) can create a false perception of the system’s capability. The emphasis on braking for comfort might bias pilots from full manual brake when required.
The routine use of auto thrust with manual flight can also lead to a false sense of security in unusual situations – expecting the ‘auto’ system to look after the thrust levers; familiarity or laziness?
Were the conditions for operation of the ‘fully automatic’ spoiler system really understood; were the implications of any remote failure known – a deficiency of SOPs, training, memory, or recall?
Was the challenge of this ‘carrier sized’ airport (fun, exciting, and demanding even on a good day), transferred into a subconscious ‘press-on’ attitude, strengthened by the presence of two Captains neither whishing to fail or be outdone? Were the crew conditioned to always land at this familiar airport irrespective of the differences in this situation; did anyone with a controlling influence in this operation stop to think?
Much has been said about landing distances, but how often do crews assess their landings against the requirements? Do crews routinely assess if the aircraft was capable of stopping within the safety margins provided for a limiting runway? Do crews check what % of max landing weight they are at, or how much additional runway they have/have not for a normal landing? Most landings are made on non limiting runways thus crews have few references as to how close they were to the required limiting performance, particularly in less than ideal conditions. This too can bias pilot’s judgement to a false sense of security.
Do crews check the validity of computerised landing data or the dispatcher’s advice; or like some aspects of regulation or management do crews also pass down their accountability for these aspects of safety to a lower level – other people/computers – a form of pre-emptive blame?
The lack of accurate (meaningful) runway braking reports further complicates the issue. 3 mm of water is neither safe/unsafe; once the runway is wet the safety margin is literally on a ‘downhill slide’. The ill-defined Boeing ‘slippery’ runway has merit when considered as the range braking conditions between wet and icy - the view taken in some documents where decreasing mu is correlated with descriptions ranging ‘good’ to ‘poor’. On a wet slippery runway how wet is wet, how slippery is slippery in comparison with a normal operation? Then we tend to forget aquaplaning – “you don’t notice it on grooved runways” myth or mystery? (And the critical speed may be nearer 7xSQR P than 9xSQR P).
Normal operations set the ‘comparative’ ground rules for human assessment and behaviour. Management and pilots rarely consider that the many assumptions they make in forming their idea of ‘normal’ operations (habit / expectation) will not apply in adverse conditions, particularly with the already reduced safety margins hidden in regulation. This enables opportunities for errors of judgement, mistakes in decision making – and that’s even before the start the approach and any other erroneous opportunities. Did everyone in the decision process fail to think – were they self satisfied (complacent) with their normal operation?
Reconsidering the circumstances of this accident without hindsight, it could be concluded there were sufficient cues available to both management and crew to indicate that this specific operation should not have been conducted. The investigation (and thread speculation) should focus on why these cues were not recognised or why judgement failed; were these deficiencies in individual, organisational, regulatory or industry-wide knowledge and thinking.
Recent activities appear to be ‘closing the stable door’, but at least they recognise some of the problems. Crews might learn from these and redatum their habits and take more notice of normal operations – build experience. Operators must consider the risks at all airports and their use of MEL – clear / accurate SOPs which everyone understands and has been exposed to in training – training which encourages change or removal of previous habits.
Every runway end should have a safety area, but the call for special nets, etc, could also be met by further reducing landing weight or limiting the conditions in which operations occur e.g. LCY no tailwind (RJ100) and no contaminated ops, or touchdown by a specific point. Change requires thought, and thinking requires a change in the way we behave.
People have to take more responsibility for safety in their operation – be accountable before the fact; if they don’t then unfortunately we have these sad opportunities to learn from their errors – that’s hindsight.
I support PPRuNe
Join Date: Jul 2007
Location: Belo Horizonte, Brazil
Posts: 162
Likes: 0
Received 0 Likes
on
0 Posts
TAM Pilot
TAM pilot who landed on Congonhas the day before the disaster with a A320 with the two reversers working, said that the airplane acquaplaned three times in the runway very wet and heavy rain and that he was only able to brake on his fourth trial, about 200 or 300 meters from the end of the runway. He claims that he notified this to control tower.
Join Date: Sep 2000
Location: Bielefeld, Germany
Posts: 955
Likes: 0
Received 0 Likes
on
0 Posts
I think the most important single feature of alf5071h's message is the emphasis on risk management. I pondered if I had anything worthwhile to add. And I think I do: risk is the subject of half of my core class, and in my experience most people do not know about the technical meanings of the word until they encounter them in some such context.
Risk management is becoming part of the development and operations of most civil safety-critical systems nowadays, partly thanks to new international standards (in areas other than aviation) that countries are slowly getting around to adopting ("adopting" means not just saying "it's here, use it", but also enforcing its provisions).
However, ten years ago no one knew what risk management was except for a few experts. (Jim Reason's "Managing the Risks of Organisational Accidents" from 1997 was one of the first general-interest tomes on the topic.) Even nowadays, I suspect that few people at the pointy end (e.g., pilots, ATC) think of their critical jobs in such terms.
Framing the issues in terms of risk management changes the terms of debate. People often use success as the sole criterion: trying to decide "is this OK; is this not OK" along with the inference that if one succeeds, choosing to do it must have been OK. Risk management more often involves deciding how risks have changed; what risk factors are present/absent and in which quantity. Not whether you make it or not, but rather how your chances of success have improved or worsened in the given situation.
So, for example, one can succeed despite poor risk management: the Korean Air pilot who strayed into Russian airspace, refused the interception, was shot down, and put the airplane down successfully on a frozen lakebed without killing anybody. Success yes, but exceptionally poor risk management (and in other situations, in other professions,
grounds for firing or even, in some jurisdictions, criminal prosecution). And, on the other hand, one can also manage risks well, but fail to succeed: the Warsaw pilots who carried the then-allowed VRef + 20 onto the runway, expecting wind shear based on a wind report and a confirming pirep from the guy in front, but who ended up floating down most of the runway. If some of your biggest risks are unknown, as in this case, your judgement is likely to be inaccurate.
Risk management is, though, notoriously part of a "safety culture". If there is one thing on which almost all human- and social-factors people agree, it is that a risk-management approach to critical operations can only effectively be implemented top-down in an organisation, with a high (indeed, some say overriding) priority set by the highest management level. The reason, I suspect, is rather simple. I pointed out that success-oriented and risk-management methods can conflict, so if a company is predominantly success-oriented (as many are, because their most active managers are personally success-oriented and the company inherits the personal characteristics of its most successful managers), it is ipso facto unlikely to be risk-management oriented.
There is a sustained argument for risk management, from another sector, financial markets, in Nassim Nicholas Taleb's best-seller Fooled by Randomness (available in the U.K. from Penguin; I believe from Random House in the U.S.). He shows the pitfalls of success-orientation by recounting tale after tale of high-flying dealers who tank. It seems to be endemic in the financial sector.
One of the best arguments from risk management in commercial aviation that I have seen recently is in the Überlingen report's consideration of the risk management at Skyguide. The report leaves much to be desired in other areas, but their consideration of risk management on that fateful evening at Skyguide is exemplary.
TAM implicitly acknowledged there was a risk-management issue by changing their procedures for landing at Congonhas (changing procedures is one way to manage risks differently).
So I sympathise with alf's plea to reframe the terms of the debate, although I myself prefer to consider *all* aspects, including some that may be passe. I agree with alf that in the case of landing at Congonhas in weather, there is an argument to be made that the pertinent risks were indeed known but apparently misjudged (by many different people and organisations). It will be interesting to see if CENIPA takes this line in their report. One interesting feature of this form of framing is that it is very hard to disagree with a well-performed assessment of risk management, as one may notice while reading the Überlingen report.
PBL
Risk management is becoming part of the development and operations of most civil safety-critical systems nowadays, partly thanks to new international standards (in areas other than aviation) that countries are slowly getting around to adopting ("adopting" means not just saying "it's here, use it", but also enforcing its provisions).
However, ten years ago no one knew what risk management was except for a few experts. (Jim Reason's "Managing the Risks of Organisational Accidents" from 1997 was one of the first general-interest tomes on the topic.) Even nowadays, I suspect that few people at the pointy end (e.g., pilots, ATC) think of their critical jobs in such terms.
Framing the issues in terms of risk management changes the terms of debate. People often use success as the sole criterion: trying to decide "is this OK; is this not OK" along with the inference that if one succeeds, choosing to do it must have been OK. Risk management more often involves deciding how risks have changed; what risk factors are present/absent and in which quantity. Not whether you make it or not, but rather how your chances of success have improved or worsened in the given situation.
So, for example, one can succeed despite poor risk management: the Korean Air pilot who strayed into Russian airspace, refused the interception, was shot down, and put the airplane down successfully on a frozen lakebed without killing anybody. Success yes, but exceptionally poor risk management (and in other situations, in other professions,
grounds for firing or even, in some jurisdictions, criminal prosecution). And, on the other hand, one can also manage risks well, but fail to succeed: the Warsaw pilots who carried the then-allowed VRef + 20 onto the runway, expecting wind shear based on a wind report and a confirming pirep from the guy in front, but who ended up floating down most of the runway. If some of your biggest risks are unknown, as in this case, your judgement is likely to be inaccurate.
Risk management is, though, notoriously part of a "safety culture". If there is one thing on which almost all human- and social-factors people agree, it is that a risk-management approach to critical operations can only effectively be implemented top-down in an organisation, with a high (indeed, some say overriding) priority set by the highest management level. The reason, I suspect, is rather simple. I pointed out that success-oriented and risk-management methods can conflict, so if a company is predominantly success-oriented (as many are, because their most active managers are personally success-oriented and the company inherits the personal characteristics of its most successful managers), it is ipso facto unlikely to be risk-management oriented.
There is a sustained argument for risk management, from another sector, financial markets, in Nassim Nicholas Taleb's best-seller Fooled by Randomness (available in the U.K. from Penguin; I believe from Random House in the U.S.). He shows the pitfalls of success-orientation by recounting tale after tale of high-flying dealers who tank. It seems to be endemic in the financial sector.
One of the best arguments from risk management in commercial aviation that I have seen recently is in the Überlingen report's consideration of the risk management at Skyguide. The report leaves much to be desired in other areas, but their consideration of risk management on that fateful evening at Skyguide is exemplary.
TAM implicitly acknowledged there was a risk-management issue by changing their procedures for landing at Congonhas (changing procedures is one way to manage risks differently).
So I sympathise with alf's plea to reframe the terms of the debate, although I myself prefer to consider *all* aspects, including some that may be passe. I agree with alf that in the case of landing at Congonhas in weather, there is an argument to be made that the pertinent risks were indeed known but apparently misjudged (by many different people and organisations). It will be interesting to see if CENIPA takes this line in their report. One interesting feature of this form of framing is that it is very hard to disagree with a well-performed assessment of risk management, as one may notice while reading the Überlingen report.
PBL
Join Date: Nov 1999
Location: Anywhere that pays
Posts: 117
Likes: 0
Received 0 Likes
on
0 Posts
I have been 'sitting out' watching the infighting, tech 'to-ing and fro-ing' and the rest but thought I'd pop back in to say good post Alf - I guess we both agree with my last line way back in #316.
PBL - all very true, and I trust airline managements are reading as well as pilots and manufacturers. As you say, 'top down'.
PBL - all very true, and I trust airline managements are reading as well as pilots and manufacturers. As you say, 'top down'.
Join Date: Dec 2006
Location: washington,dc
Posts: 486
Likes: 0
Received 0 Likes
on
0 Posts
risk management...assesing the criticality of the approach
D.P. Davies, author of the fine book, "handling the big jets" wrote of assesing the criticality of the approach some 40 years ago.
With data available to the pilots prior to approach clearance, this would have to be considered an approach with certain critical features and requirements.
Whether the pilots called it risk management, or assesing the criticality of the approach...they knew it was a landing they would have to be vigilant on.
does anyone know when the FINAL report/cause(s) will be made public?
With data available to the pilots prior to approach clearance, this would have to be considered an approach with certain critical features and requirements.
Whether the pilots called it risk management, or assesing the criticality of the approach...they knew it was a landing they would have to be vigilant on.
does anyone know when the FINAL report/cause(s) will be made public?
Join Date: Jan 2001
Location: Dallas, TX USA
Posts: 739
Likes: 0
Received 0 Likes
on
0 Posts
I've come very late to the discussion of this accident, as I've had a busy schedule. I tried to read the whole thread, but simply ran out of time. Regarding the mistake the pilots made in leaving ENG2 throttle in the Climb power position upon landing, I've come to think there's a design flaw in the AB throttle system. This accident and the nearly identical 1998 Philippines and 2004 Taipei accidents seem to illustrate this.
The following discussion is about modeless primary control design, which I’m applying to the AB throttle system).
The following Human Machine Interface (HMI) design rules are from a Dutch design engineer. These design rules apply to primary machine controls, and in my view especially apply where safe machine operation is ia concern. In the following descriptions, the word “gesture” means “control action”. Rule 1a in particular, is the most relevant design rule to this accident.
Rule 1. An interface should be habituating.
If the interface can be operated habitually then, after you have used it for a while, its use becomes automatic and you can release all your attention to the task you are trying to achieve. Any interface will have elements that are habituating, but the principle here is to make the entire interface habituating.
Rule 1a. To make an interface habituating, it must be modeless.
Modes exist where the same gesture (control action) yields different results depending on system state at a time when your attention is not on system state. In the presence of modes, you will sometimes make mode errors, where you make a gesture intending to have one result but get a different and unexpected result, distracting you from your task.
Rule 1b. To make an interface habituating, it must be monotonous.
"Monotony" here is a technical term meaning that you do not have to choose among multiple gestures to achieve a particular sub-task. Crudely, there should be only one way to achieve a single-gesture subtask.
In the application of these HMI rules to primary controls on automobiles, we have the following primary control behaviors, which all of us who drive are familiar with:
Primary Auto Control – Steering Wheel (primary directional control)
This control is modeless and habituating on all autos I’m aware of, as the operating mode of the steering wheel never changes. The basic relationship of the wheel’s position to directional control does not change. To go straight, hold the wheel straight. To turn the auto left or right, turn the wheel left or right. To increase the rate of turn, turn the wheel more. All control actions are habituating, and comply with the above design rules.
Primary Auto Control – Gas Pedal (primary speed control)
This control is modeless and habituating on all autos I’m aware of, as the operation mode of the Gas Pedal never changes. Even the presence of a cruise control system (auto throttle) does not change the basic operating mode of the Gas Pedal. The basic relationship of the pedal’s position to engine power (speed) does not change. To hold speed (or power output) hold the pedal in the same position. The increase speed (power), press farther on the pedal. To reduce speed (power), lift pressure from the pedal. All control actions are habituating, and comply with the above design rules.
Primary Auto Control – Brake Pedal (other primary speed control)
This control is modeless and habituating on all autos I’m aware of, as the operation mode of the Brake Pedal never changes. The basic relationship of the pedal’s position to speed reduction does not change. To hold speed, do not press on the pedal. To decrease speed gradually, press lightly on the pedal. To decrease speed more strongly, press more firmly on the pedal. All control actions are habituating, and comply with the above design rules.
One can argue that the sudden loss of power assist of the steering wheel or brake pedal changes the forces involved on operating these primary controls, but the basic mode of operations of these controls does not change.
Now to airplanes, we have the throttle system, a primary speed control on an airplane.
Primary Airplane Control – Engine Throttle (primary power and speed control)
On nearly all models of airplanes, this control is modeless and habituating, as the operating mode of the throttle(s) does not change. Even the present of an auto throttle systems does not change the basic operating mode of the throttle. The basic relationship of the throttle position to engine power (speed) does not change. To hold engine power (speed), hold the position of the throttle. To increase engine power (speed) move the throttle forward. To decrease engine power (speed) move the throttle aft. On most airplanes, all control actions are habituating, and comply with the above design rules. On some airplanes, the throttle movement is the reverse of that described, but even for these airplanes, the control actions do not change.
On the A320, we have something different. We have a throttle system with more than one mode, which violates the basic HMI design rules listed above. The throttle system on an A320 is still a safety related Primary Control for this airplane. The main problem as far as I can see, is a mode change occurs at touchdown, when auto throttles are used on approach. There’s a mode where throttle position must be in climb detent on approach (where throttle position does NOT relate to engine power), then when auto throttles disconnect at touchdown, a sudden mode change occurs where now throttle position DOES equate to engine power”. The very failure possibility mentioned in rule 1a is at work here.
The mental mistakes introduced by this design have happened before, and will happen again on the A320, as long as this multimode throttle system exists. A Rube Goldberg machine if I ever saw one.
The following discussion is about modeless primary control design, which I’m applying to the AB throttle system).
The following Human Machine Interface (HMI) design rules are from a Dutch design engineer. These design rules apply to primary machine controls, and in my view especially apply where safe machine operation is ia concern. In the following descriptions, the word “gesture” means “control action”. Rule 1a in particular, is the most relevant design rule to this accident.
Rule 1. An interface should be habituating.
If the interface can be operated habitually then, after you have used it for a while, its use becomes automatic and you can release all your attention to the task you are trying to achieve. Any interface will have elements that are habituating, but the principle here is to make the entire interface habituating.
Rule 1a. To make an interface habituating, it must be modeless.
Modes exist where the same gesture (control action) yields different results depending on system state at a time when your attention is not on system state. In the presence of modes, you will sometimes make mode errors, where you make a gesture intending to have one result but get a different and unexpected result, distracting you from your task.
Rule 1b. To make an interface habituating, it must be monotonous.
"Monotony" here is a technical term meaning that you do not have to choose among multiple gestures to achieve a particular sub-task. Crudely, there should be only one way to achieve a single-gesture subtask.
In the application of these HMI rules to primary controls on automobiles, we have the following primary control behaviors, which all of us who drive are familiar with:
Primary Auto Control – Steering Wheel (primary directional control)
This control is modeless and habituating on all autos I’m aware of, as the operating mode of the steering wheel never changes. The basic relationship of the wheel’s position to directional control does not change. To go straight, hold the wheel straight. To turn the auto left or right, turn the wheel left or right. To increase the rate of turn, turn the wheel more. All control actions are habituating, and comply with the above design rules.
Primary Auto Control – Gas Pedal (primary speed control)
This control is modeless and habituating on all autos I’m aware of, as the operation mode of the Gas Pedal never changes. Even the presence of a cruise control system (auto throttle) does not change the basic operating mode of the Gas Pedal. The basic relationship of the pedal’s position to engine power (speed) does not change. To hold speed (or power output) hold the pedal in the same position. The increase speed (power), press farther on the pedal. To reduce speed (power), lift pressure from the pedal. All control actions are habituating, and comply with the above design rules.
Primary Auto Control – Brake Pedal (other primary speed control)
This control is modeless and habituating on all autos I’m aware of, as the operation mode of the Brake Pedal never changes. The basic relationship of the pedal’s position to speed reduction does not change. To hold speed, do not press on the pedal. To decrease speed gradually, press lightly on the pedal. To decrease speed more strongly, press more firmly on the pedal. All control actions are habituating, and comply with the above design rules.
One can argue that the sudden loss of power assist of the steering wheel or brake pedal changes the forces involved on operating these primary controls, but the basic mode of operations of these controls does not change.
Now to airplanes, we have the throttle system, a primary speed control on an airplane.
Primary Airplane Control – Engine Throttle (primary power and speed control)
On nearly all models of airplanes, this control is modeless and habituating, as the operating mode of the throttle(s) does not change. Even the present of an auto throttle systems does not change the basic operating mode of the throttle. The basic relationship of the throttle position to engine power (speed) does not change. To hold engine power (speed), hold the position of the throttle. To increase engine power (speed) move the throttle forward. To decrease engine power (speed) move the throttle aft. On most airplanes, all control actions are habituating, and comply with the above design rules. On some airplanes, the throttle movement is the reverse of that described, but even for these airplanes, the control actions do not change.
On the A320, we have something different. We have a throttle system with more than one mode, which violates the basic HMI design rules listed above. The throttle system on an A320 is still a safety related Primary Control for this airplane. The main problem as far as I can see, is a mode change occurs at touchdown, when auto throttles are used on approach. There’s a mode where throttle position must be in climb detent on approach (where throttle position does NOT relate to engine power), then when auto throttles disconnect at touchdown, a sudden mode change occurs where now throttle position DOES equate to engine power”. The very failure possibility mentioned in rule 1a is at work here.
The mental mistakes introduced by this design have happened before, and will happen again on the A320, as long as this multimode throttle system exists. A Rube Goldberg machine if I ever saw one.
Join Date: Sep 2002
Location: La Belle Province
Posts: 2,179
Likes: 0
Received 0 Likes
on
0 Posts
@FS - an interesting analogy, but I'm not sure it's quite so straightforward; if one considers a manual (standard) transmission, then the relationship between throttle position and speed is only monotonic for any single gear, and to accelerate further one must change mode - i.e. gear shift - and in order to do so one must reduce power in order to clutch, shift, clutch then apply power again.
Now this is entirely natural and instinctive for someone TRAINED on a manual, but for someone who's only ever driven an automatic, the notion of decreasing throttle to accelerate is of course unnatural. Yet there are if anything, it seems, more errors in automatics - how many accidents does one read of where people stupidly leave the car in-gear in an automatic and go barrelling through shop windows?.
Similarly, one cannot decouple the accelerator and brake pedals; there is an implicit requirement to "disable" the "accel" mode - by lifting one's foot off the accelerator - when applying brakes. And vice versa. Yet I personally have driven a hundred yards or so with the parking brake on while trying to accelerate and thinking "bit sluggish today". Now it turns out it was my brain that was sluggish, but there's nothing inherent in a car's controls that prevents mode confusion; again, in theory it's trained out, but my training failed that morning....
Regarding the AB AT, I'm noty sure its such a grevious violation of the design principles, especially compared to other types. As I understand it the mode change on the throttle which was not retarded occurred because the OTHER throttle WAS retarded. This seems analogous to pressing the brakes, hoping to slow down, while not really letting up on the gas. The aircraft receives an ambiguous signal as to the crew's intention, and tries to respond to that ambiguous instruction regarding speed control, just as a car would apply throttle and brakes in the analogous condition. In both cases I find it hard to fault the design for not understanding what the operators actual intent was.
Now this is entirely natural and instinctive for someone TRAINED on a manual, but for someone who's only ever driven an automatic, the notion of decreasing throttle to accelerate is of course unnatural. Yet there are if anything, it seems, more errors in automatics - how many accidents does one read of where people stupidly leave the car in-gear in an automatic and go barrelling through shop windows?.
Similarly, one cannot decouple the accelerator and brake pedals; there is an implicit requirement to "disable" the "accel" mode - by lifting one's foot off the accelerator - when applying brakes. And vice versa. Yet I personally have driven a hundred yards or so with the parking brake on while trying to accelerate and thinking "bit sluggish today". Now it turns out it was my brain that was sluggish, but there's nothing inherent in a car's controls that prevents mode confusion; again, in theory it's trained out, but my training failed that morning....
Regarding the AB AT, I'm noty sure its such a grevious violation of the design principles, especially compared to other types. As I understand it the mode change on the throttle which was not retarded occurred because the OTHER throttle WAS retarded. This seems analogous to pressing the brakes, hoping to slow down, while not really letting up on the gas. The aircraft receives an ambiguous signal as to the crew's intention, and tries to respond to that ambiguous instruction regarding speed control, just as a car would apply throttle and brakes in the analogous condition. In both cases I find it hard to fault the design for not understanding what the operators actual intent was.
@FlightSafty
Very aptly put IMHO.
I already asked and ask again: what was the design consideration that let AB install those non-moving, multi mode T/L ?
The mental mistakes introduced by this design have happened before, and will happen again on the A320, as long as this multimode throttle system exists. A Rube Goldberg machine if I ever saw one.
I already asked and ask again: what was the design consideration that let AB install those non-moving, multi mode T/L ?
Join Date: Sep 2002
Location: La Belle Province
Posts: 2,179
Likes: 0
Received 0 Likes
on
0 Posts
"let"?
They chose a non-back-drive design I believe because it's mechanically simpler and thus inherently more reliable than a back-driven system.
They could fit them because they are deemed certifiable per FAR/JAR 25 etc. (Otherwise they wouldn't be used, basically)
They chose a non-back-drive design I believe because it's mechanically simpler and thus inherently more reliable than a back-driven system.
They could fit them because they are deemed certifiable per FAR/JAR 25 etc. (Otherwise they wouldn't be used, basically)
Join Date: Sep 2000
Location: Bielefeld, Germany
Posts: 955
Likes: 0
Received 0 Likes
on
0 Posts
Flight Safety produces a set of "design principles" for a human-machine interface, shows the A320 throttle system does not conform, and condemns it.
As any human-machine-interface specialist will tell you, that is easy to do. Any graduate student in human-machine interfaces can come up with a set of design principles which look plausible until you confront them seriously. What is hard to do is to come up with a set of principles with which many or most experienced human-machine interface specialists agree, which most designs accepted intuitively as "good" more or less fit.
Does the "Dutch design engineer" who devised these principles have a name?
I might suggest that all design principles which require that the interface be modeless
* assume that the state space of the control system is quite small;
* will thereby condemn most control systems to be found in the cockpits of the latest generation of commercial airplanes
The technical reason there are "modes" in the control systems is that a flat state space is simply too large and one needs to structure it hierarchically for any human being to be able to operate it.
PBL
As any human-machine-interface specialist will tell you, that is easy to do. Any graduate student in human-machine interfaces can come up with a set of design principles which look plausible until you confront them seriously. What is hard to do is to come up with a set of principles with which many or most experienced human-machine interface specialists agree, which most designs accepted intuitively as "good" more or less fit.
Does the "Dutch design engineer" who devised these principles have a name?
I might suggest that all design principles which require that the interface be modeless
* assume that the state space of the control system is quite small;
* will thereby condemn most control systems to be found in the cockpits of the latest generation of commercial airplanes
The technical reason there are "modes" in the control systems is that a flat state space is simply too large and one needs to structure it hierarchically for any human being to be able to operate it.
PBL
Join Date: Jun 2001
Location: East of the Sun & West of the Moon
Posts: 286
Likes: 0
Received 0 Likes
on
0 Posts
Atakacs, somebody said it earlier, cost was the reason the TL's don't have feedback when power changes with the AT system and the TL's don't move.
For Pete's sake!
Do you really believe what you've written?
I mean really, your credulous bias towards believing anything negative you hear about an Airbus from sources likely so varied as to include your cousin's niece's nanny's boyfriend is obvious, but even you have to have a limit to your gullibility somewhere.
Somebody who? Where exactly? And with what actual knowledge of the Airbus design objectives? Cost differentials based on what set of manufacturing and operating processes?
Is posting "somebody said .." a reflection of the limit of your analytical skills? If you think it's true then investigate. Find the facts that support the position and post those. Show some depth of thought instead of being a simple reflection of what some unknown somebody might have said somewhere sometime.
I sure hope you don't carry the same unchallenging acceptance of hearsay into the cockpit with you.
ELAC
Last edited by ELAC; 26th Aug 2007 at 19:39.
Join Date: Jun 2001
Location: East of the Sun & West of the Moon
Posts: 286
Likes: 0
Received 0 Likes
on
0 Posts
I-Ford,
An interesting article, thanks.
Having said that the pedigree of the opinion is no more or less worthy than many you'll find here on PPRuNe:
I wonder if his insight regarding autothrottles reflects accumulated experience using both systems, or like some of our posters here is the result of experience with one system and assumptions about the other?
ELAC
An interesting article, thanks.
Having said that the pedigree of the opinion is no more or less worthy than many you'll find here on PPRuNe:
Given the ardent nature of the comments, we asked Alex Paterson to respond to this question: For all the thousands of hours devoted to cockpit design, do good designs result?
Paterson is a retired Australian airline pilot with some 7,000 mostly shorthaul hours of experience flying many different types of aircraft, from the relatively simple DC-9 to the 'glass cockpit' B767. His extended response, paraphrased greatly here, reflects the insight borne of accumulated experience punctuated by the occasional hard lesson.
Paterson is a retired Australian airline pilot with some 7,000 mostly shorthaul hours of experience flying many different types of aircraft, from the relatively simple DC-9 to the 'glass cockpit' B767. His extended response, paraphrased greatly here, reflects the insight borne of accumulated experience punctuated by the occasional hard lesson.
ELAC
Join Date: Jan 2001
Location: Dallas, TX USA
Posts: 739
Likes: 0
Received 0 Likes
on
0 Posts
PBL, my apologies, the design engineer is American, not Dutch (happens when you research and post in a hurry). His name is Jef Raskin (now deceased) and he was a software design engineer.
I find I agree with the design rules as they were stated by Raskin. The personal experience of 4poleholer in post #412 and the following 2 accidents, has led me to believe there's a design issue.
2004 Taipei accident
http://www.asc.gov.tw/acd_files/189-c1contupload.pdf
1998 Philippines accident
http://aviation-safety.net/database/...?id=19980322-0
All 3 of these incidents are identical in failure mode. With one TR inop per MEL, upon landing, the TL of the unaffected engine is pulled back into reverse, but the other TL is left in the climb power detent. All three experienced no spoilers and asymmetric thrust (one engine in reverse and one at climb power).
You have to ask yourself a few questions about this.
Q1. Why would any pilot leave the engine with the TR inop in the climb power detent after touchdown? To me, this is THE major question of this accident.
Q2. How could any pilot NOT pull all power back after touchdown, since he must stop before the end of the runway?
Q3. Why does Airbus have to send out notifications to remind pilots to pull ALL thrust levers back to idle upon touchdown, when EVERY pilot should instinctively know to do this?
A1. I believe the answer lies with the mode (or state) change that occurs at touchdown with the A320 throttle system. When looking at the CVR transcript and FDR data, it's clear the pilots were concerned about stopping before the end of the runway in the present conditions, just prior to touchdown. In anticipation of the need to apply maximum braking, a pilot moved the TL of ENG1 back to idle just prior to touchdown. In doing so, he left the TL of ENG2 (with TR inop) in the climb power detent, which probably seemed to be the correct setting for TL ENG2 at that moment, because the AT was engaged at that moment. However, having started this TL movement early, the pilot is now setup to miss the state change when WOW occurs (and AT disengages), because of the intense focus on deploying the TR of ENG1 as quickly as possible. When WOW occurred and the AT disengaged (though probably disengaged when TL ENG1 was retarded), the Climb Power setting of TL ENG2 now meant climb power. To me, both pilots simply missed the state change, as Raskin said would happen in Rule 1a.
A2. I think the answer to this question lies in the fact that there's a mental habituating disconnect between throttle position and engine power on the A320. If throttle position does not always equate to engine power, then it’s possible to have a confused moment under pressure, and to forget the current mode. In throttle system design, TL position and power either ALWAYS equate to each other (single mode, which is habituate and forget) or they do not (multimode, which cannot be fully habituated and must be mentally processed at times). When flying Auto throttle to touchdown, on approach the AT is reducing power for the landing (when TL position does not equate to power and the AT is performing the power reduction). But at touchdown, the pilot has to take over (when TL position suddenly does equate to power and the pilot has to perform the remaining power reduction). I personally think the TL position mode change is the more significant state change at touchdown, as all pilots who fly auto throttle know they have to take over power reduction after touchdown.
A3. The answer to this question should be obvious by now.
I find I agree with the design rules as they were stated by Raskin. The personal experience of 4poleholer in post #412 and the following 2 accidents, has led me to believe there's a design issue.
2004 Taipei accident
http://www.asc.gov.tw/acd_files/189-c1contupload.pdf
1998 Philippines accident
http://aviation-safety.net/database/...?id=19980322-0
All 3 of these incidents are identical in failure mode. With one TR inop per MEL, upon landing, the TL of the unaffected engine is pulled back into reverse, but the other TL is left in the climb power detent. All three experienced no spoilers and asymmetric thrust (one engine in reverse and one at climb power).
You have to ask yourself a few questions about this.
Q1. Why would any pilot leave the engine with the TR inop in the climb power detent after touchdown? To me, this is THE major question of this accident.
Q2. How could any pilot NOT pull all power back after touchdown, since he must stop before the end of the runway?
Q3. Why does Airbus have to send out notifications to remind pilots to pull ALL thrust levers back to idle upon touchdown, when EVERY pilot should instinctively know to do this?
A1. I believe the answer lies with the mode (or state) change that occurs at touchdown with the A320 throttle system. When looking at the CVR transcript and FDR data, it's clear the pilots were concerned about stopping before the end of the runway in the present conditions, just prior to touchdown. In anticipation of the need to apply maximum braking, a pilot moved the TL of ENG1 back to idle just prior to touchdown. In doing so, he left the TL of ENG2 (with TR inop) in the climb power detent, which probably seemed to be the correct setting for TL ENG2 at that moment, because the AT was engaged at that moment. However, having started this TL movement early, the pilot is now setup to miss the state change when WOW occurs (and AT disengages), because of the intense focus on deploying the TR of ENG1 as quickly as possible. When WOW occurred and the AT disengaged (though probably disengaged when TL ENG1 was retarded), the Climb Power setting of TL ENG2 now meant climb power. To me, both pilots simply missed the state change, as Raskin said would happen in Rule 1a.
A2. I think the answer to this question lies in the fact that there's a mental habituating disconnect between throttle position and engine power on the A320. If throttle position does not always equate to engine power, then it’s possible to have a confused moment under pressure, and to forget the current mode. In throttle system design, TL position and power either ALWAYS equate to each other (single mode, which is habituate and forget) or they do not (multimode, which cannot be fully habituated and must be mentally processed at times). When flying Auto throttle to touchdown, on approach the AT is reducing power for the landing (when TL position does not equate to power and the AT is performing the power reduction). But at touchdown, the pilot has to take over (when TL position suddenly does equate to power and the pilot has to perform the remaining power reduction). I personally think the TL position mode change is the more significant state change at touchdown, as all pilots who fly auto throttle know they have to take over power reduction after touchdown.
A3. The answer to this question should be obvious by now.
Last edited by Flight Safety; 26th Aug 2007 at 13:34.
The Analog Kid
Join Date: Aug 2004
Location: Brecon Beacons National Park
Age: 57
Posts: 239
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by I-FORD
is an interesting point of view about Airbus TL philosophy, written in year 2000.
http://www.symantec.com/security_res...062217-0726-99
Join Date: Sep 2000
Location: Bielefeld, Germany
Posts: 955
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by Flight Safety
the design engineer [whom I referred to] is Jef Raskin
Taking design principles for desktop-computer user interfaces and transferring them to critical systems with professional operators does not work.
Raskin was assuming untutored users on general-purpose computers with potentially unbounded functionality and varying degrees of creativity on the part of the users. Safety-critical control system interfaces assume professional users, a fixed number of well-defined and tested functions, and no creative use of the system. They are very different design spaces.
Since you apparently didn't understand the point I made earlier, I will repeat it. The reason modes are needed is that the flat state space is too large to expect an operator to negotiate it in real time. Please understand this: mode-less does not work.
You can show this to yourself. Go to my 1994 paper on the (pre-Warsaw) A320 braking logic. Compare the trivial factored state spaces (easy to understand) with their product (the flat state space). Look at the product for 15 minutes, and then attempt to draw it from memory on a clean sheet of paper. If you didn't get it quite right, you may rest assured that you are in the majority. And designing user interfaces for critical operations is all about ensuring that the professional operators get it right. So, no flat state spaces.
PBL
Last edited by PBL; 26th Aug 2007 at 19:58. Reason: To emphasise again the knock-down point
Sun worshipper
Join Date: Dec 2001
Location: Paris
Posts: 494
Likes: 0
Received 0 Likes
on
0 Posts
The following is just my assessment of the Airbus FBW philosophy as I have discovered that there is a lot that non-airbus pilots and other posters ignore - or chose for different reasons to ignore-.
1/- I believe, with more than ten years of experience of the airplane, that the non-moving throttle choice was the result of the envelope protection decision, and particularly the Alpha floor, in which an automatic application of go-around thrust, along with the reduction of the AoA happens.
A surprised crew would, in all probability, react first toward grabbing the T/Ls moving to full thrust, thus denying the safety philosophy of the system.
(For those still interested in the Ford Trimotor-type set-up, this can be disabled but the Habsheim accident proves that it is not generally a good idea to do so ).
2/- Quite a few comments were made about the *CLB* detent. To a certain point, I agree that *CLB* could be a misnomer...until one realises that these detents -*CLB*, *FLEX-MCT*, *TOGA* - give accurately to the pilot the maximum thrust setting one would achieve on manual throttle on different phases of flight.
I have thought of another way to call them and failed so far.
As for throttles giving an accurate idea of the actual engine output, let's just think of an engine failure after V1 : the throttles are walled, how do you determine which engine has quit ?..
Another example : the Air China 747 SP. All throttles were indicating full thrust, one engine had flamed out and they found out that the 74 could be barrel rolled.
And finally, in order to show the "seriousness" and the objectivity of some references given in this thread,this is a link to the articles written by Mr Alex Paterson on quite a few subjects, from religion to politics, science and aviation ( I recommend particularly the "Longbow versus crossbow, an analogy with FBW Airbus ", worth a laugh).
Alex Paterson's site.
Cheers
1/- I believe, with more than ten years of experience of the airplane, that the non-moving throttle choice was the result of the envelope protection decision, and particularly the Alpha floor, in which an automatic application of go-around thrust, along with the reduction of the AoA happens.
A surprised crew would, in all probability, react first toward grabbing the T/Ls moving to full thrust, thus denying the safety philosophy of the system.
(For those still interested in the Ford Trimotor-type set-up, this can be disabled but the Habsheim accident proves that it is not generally a good idea to do so ).
2/- Quite a few comments were made about the *CLB* detent. To a certain point, I agree that *CLB* could be a misnomer...until one realises that these detents -*CLB*, *FLEX-MCT*, *TOGA* - give accurately to the pilot the maximum thrust setting one would achieve on manual throttle on different phases of flight.
I have thought of another way to call them and failed so far.
As for throttles giving an accurate idea of the actual engine output, let's just think of an engine failure after V1 : the throttles are walled, how do you determine which engine has quit ?..
Another example : the Air China 747 SP. All throttles were indicating full thrust, one engine had flamed out and they found out that the 74 could be barrel rolled.
And finally, in order to show the "seriousness" and the objectivity of some references given in this thread,this is a link to the articles written by Mr Alex Paterson on quite a few subjects, from religion to politics, science and aviation ( I recommend particularly the "Longbow versus crossbow, an analogy with FBW Airbus ", worth a laugh).
Alex Paterson's site.
Cheers