TAM A320 crash at Congonhas, Brazil

[Lemurian]

StS

I never tried to hide behind pretty words . Yes, I like the Airbus technology and approach to safety, and yes I've flown more types of airplanes than most posters here have on their F.S.
On the other hand, I have defended the aircraft, whatever his brand when it was attacked unfairly - i.e the Sharm el Sheikh accident-.
Someone wants to discuss CRM, cockpit technology, ergonomics, fine by me. You apparently haven't noticed that about the only argument on this thread is "it wouldn't have happened on a Boeing because...."
And may I remind you that you are the one who cast the last drop on my bucket by accusing the Airbus Jocks of God knows what crime, when the only thing they were trying to do was explain.
Look at the way you present your conception of the S/B system compared to mine. Who shows the greatest bias ? (btw, you haven't commented on that one, have you ?)
As for what you are or what you are not, that's your concern. Here, there is a saying that *if you howl with the wolves, don't be surprised when people shoot at you *.

[Sl4yer]

Originally Posted by bomarc

While arguments in favor of the plane vs. the pilots have been quite well written, there is still a chance that moving the throttles was not possible.

So, whilst retracting the TLs to idle (BEFORE landing), the PF discovers that TL2 is stuck in the CL detent. Would his action be:

1. to continue the landing, and take no action with #2 engine?
2. to continue the landing, and shut #2 down?
3. to GO AROUND and sort it out in the air?

I would presume (since I'm not an airline pilot myself) that the best option to go for if one encountered this problem (BEFORE LANDING don't forget) on a multi-engine aircraft would be option 3, advancing the good TL to TOGA power.

Surely what happened is not consistent with a lever being physically stuck? But of course it doesn't disprove that the sensors weren't faulty, however unlikely that might be.

Another factor in the pilot's workload is the traffic taking off from their runway when they were very close (less than 2 miles?). I'm sure this happens a lot, especially at congested airports like Congonhas. How much of a distraction would this be, especially combined with the rain and slippery runway?

[SoaringTheSkies]

Lemurian,
what I have said about the "Airbus jocks" was that the attitude of "can't happen to me" scares me. This indeed has nothing at all to do with the aircraft they're flying.
Wouldn't you agree that this attitude is the first step into failing?

Also, I was not saying that all Airbus pilots were completely oblivious of their ability to fail, I bet there are just as many great pilots there as in any other cockpit. It is frustrating to see grown up people say that "the only thing they had to do is pull back the lever". I think I have outlined how the brain loses some of it's higher level analytical capacities under real stress. I would love to see the one person who can prove that this cannot possibly happen to him or her.
This paired with a very aggressive "do not even think of touching on the subject of the airplane systems" leaves me with only one conclusion:
Pilots think their airplane system is perfect (I have still to see a complex technical system that is perfect)
Pilots think they themselves are very close to perfect
So why could this accident happen then?

We all err at times, Pilots, Designers, Engineers, Programmers, everybody. In every system involving humans at any level, there needs to be some forgiveness for error. The less time there is to analyze the error, the clearer the remedy options have to be. Don't give me riddles when I'm in a hurry.

Now, can we please get off any manufacturer preference discussion? You disagree with the picture of the crew's mental state in those crucial last seconds that I've tried to envision further up. I would love to hear what you believe the reason for their continuous disregard of the simple "retard the #2TL" could have been and why a secondary exit from the "spoilers armed" state would be a bad idea (let's say a manual spoilers override lever or an override by something like 90% manual brakes applied).
Would that have fixed the 1.2 EPR issue? No, and I have to say I have no good answer for that without going into discussing a tactile feedback from the throttles again. Suggestions?

Edit (forgot to add that

the way I have outlined the spoilers/brakes equation has been done working from memory and in rather standard notation of a logical equation. Have a look at PBL's paper Airbus A320 Braking as Predicate-Action Diagrams where you'll see that a very similar notation is being used to describe the requirements of a state transition.

end edit

pj

[Krueger]

I don't think the throttle was stuck otherwise the PF would have said something when he was flaring the aircraft. However, I would like to know if there could be a mechanical disconnection from the thrust levers to the potentiometers. In this case, the PF would retard both throttles to idle, but Eng 2 would remain in Climb because the potetiometers wouldn't receive the order to go to idle.
I know that investigators found the thrust lever in climb but with the force of the impact the throttles can move around.
I fly CFM engines , so I have rpm instead of EPR, but it looks like the EPR indication is not very clear of the status of the engine.

Check Six, Krueger...

[Dani]

correct Kruger. But it is very easy to determine the TL position on impact because every metal gets scares at its position. Hardly any position of any mechanical instrument and any lever position before an impact can always be determined.

I also agree that the TL must have worked until touch down, because - if they wouldn't have - crew would realize that this is not good for landing and would have balked the landing, i.e. went around.

So the only question that rest unanswered is: Why did CM1 leave the TL in climb detend. I have just one credible answer: He thought that it was the best way to proceed because of his inop reversers. The only case where we as pilots accept uneven TL position is in OEI case (engine failure). There we are trained to leave one TL in climb detend while the other is moved around (if A/T not engaged). This captain - most probably still not at ease with Airbus procedures - must have confused ENGINE INOP with REVERS INOP and went into the state of mind not to touch the TL of the inop reverser.

Please be reminded that Airbus procedures call also in OEI case for setting TL of the failed engine to trust idle and then revers.

On ground they started decceleration. They concentrated on brake and directional controls, thus neglecting the EPR indication, which showed still ENG2 approach trust setting (but its hard to detect) and no revers green. The decceleration didn't start, they became more and more desperate, CM1 needed lots of force on his pedal, confusion... - still no result. The end of the runway is coming, engine 1 is still delivering trust. After a certain speed, normally around 100 to 80 kts, you cannot keep the aircraft on centerline anymore with assymetrical braking anymore, it goes left and leaves the runway anyway.

Dani

[slip and turn]

So the only question that rest unanswered is: Why did CM1 leave the TL in climb detend?

I disagree.

The main question is:
Given that it is possible to set the TLs this way either consciously or inadvertently, what more are Airbus and operators doing about it right now?

I am amazed with a month almost passed since this accident, and with a great deal of information apparently comfortably understood to the extent that there is no real mystery, just time-consuming analysis to do, that we haven't now seen more action. We can't (yet) change the firmware in the average pilot brain, yet the way that works or doesn't sometimes seems to be the convenient conclusion for many here.

Airbus pilots seem to be some of the first now to argue that all analysis so far seems to confirm what happened was per the design specification (assuming if it was as documented) and is as expected from the pilot actions.

Indeed one has even said that he/she has learned/reinforced what they need to do now from careful reading of this forum!!! A kind of unwritten PPRuNe derived SOP perhaps . Soon to be 100 pages long at that!

Surely not?

This isn't one of those "we'll never really know" / never found the box / wreckage not recovered / nothing to learn until the final report type accidents, is it?

Yet I have heard of no temporary groundings, no AD that urgently audits all the airframes to check that all software/firmware is standard and as documented or one that calls for immediately retraining the wetware to corresponding standards. I can only assume that the "bet your life on it money" has said it can wait. (Note "your life" not theirs - theirs is the money!)

Good read that it is, this thread is becoming like War and peace. Sadly the borderline between War and peace ops gets blurred more every day.

[madherb]

Hello all posters

Can someone please provide a synopsis of the actual chain of events? (the last 1800-odd posts have touched on so many points, I've lost track of the basics)

As I understand things so far:

• the aircraft landed normally (speed, touchdown point) with one reverser inop.
• The engine with the inop. reverser never spooled down, but continued to provide substantial thrust.
• The ground spoilers did not deploy.
• The autobrake system did not operate.
• The pilots attempted to stop the aircraft using the operative reverser and manual braking.
• The runway was wet, and while it had recently been resurfaced, it had not been grooved.

I've been sidetracked by all sorts of technical information concerning the aircraft systems, not to mention the sideshows about Airbus vs Boeing.

This is all very interesting; however the consensus seems to be that the aircraft could have been stopped within the distance available, had some sort of failure/error not occurred which prevented:

• The engine with the inop. reverser from spooling down.
• The ground spoilers from deploying.
• The autobrake from operating.

Is the argument or hypothesis now centering around possible mechanical/electrical system fault, or human performance? Or both?

Thanks to all those who have provided the wealth of technical stuff - plus the human performance input. Hope something positive can be gleaned from this.

[Lemurian]

StS

WE obviously do not read the same posts in the same way. I haven't seen on this thread a single Airbus pilot who's said that it shouldn't happen to him, or have they showed a blind trust to the system.
This said, why don't we bury the War Axe ?

So why could this accident happen then?

It's for the psychologists and the F.H specialists to give us the answer. Taking the facts of this plane history ,we could say :

• The plane was dispatched to CGH with marginal performance for a *wet* runway and -according to a few mentioned other airlines FCOM -the de-activated T/R should have been a non-dispatchable item for a *contaminated* runway.
• From the conversation the pilots had with the F/A. at the beginning of the CVR transcript, there has been a doubt, as to the possibility of landing at CGH.
• The crew was seriously concerned about :
  -The state of the runway
  -The item that made this landing different - what we call a *peculiarity* during our pre-descent briefing -, which was the availability of only one T/R.
  -The weather which made them approach with the very unusual dual autopilot configuration which one only uses for an autoland.
  -The -unsaid- worry for a possible go-around and circuit if the runway wasn't cleared in time by the then departing airplane.
• The Captain handling had a high workload piloting the final : not only because of the weather but also concentrating on the *one dot low* decision he made with the F/O's agreement ( How I'd like to have these missing 20 minutes of the CVR !). A landing , as close to the threshold as possible on an airfield that looks like an aircraft carrier in the middle of a densely built-up area was his intent and it was not an easy one.
  (On this subject,the approach speed seemes too high for the published weight of 62.7 tons, making me think about a pilot input rather than the *managed* choice.)
• At touch-down, only one T/L was idled - #1 -then passed into reverse, de-activating the auto-thrust and freezing #2 engine output to it's approach thrust.
• The *not at or near idle* condition of #2 T/L inhibited the activation of both the ground spoilers and the auto-brakes. The spoiler *not deployed* status was called-out by the F/O ; the absence of speedbrake *Decel* message was not .
• .............
• The effective attempt to use pedal braking occurred only after 11 seconds post touch-down.
• At the same time, an apparent transfer of control to the F/O was recorded on the FDR and confirmed by the Hot mike #1 -the Captain's - urging " vai, vai ....vira " which can be translated colloquially as "Go on, Go on...Turn !"-.
• ..............

There are around some clever people who will give us an explanation as to why some vital, routine, ingrained, gestual items can be omitted by human beings. I'm not one of them but I have seen, both on the airplane and on the sim some pretty extraordinary behaviour.
Designing new extra warnings is not the best solution, it will add only more confusion...Put enough pressure on two very good pilots in the sim, give them an emergency and see that in all probability, they could go on their dealing with it and completely disregard the flasing light that's blinding them and the aural warning that's deafening them and makes their communicatin very difficult (see above the contribution of someone who was in an ejection...).
Moreover, during landing, both pilots tend to concentrate on the runway and won't easily assimilate a visual message warning.
As a matter of fact, the idea that appeals to me the most is - sorry, that very good post was totally lost in the A vs B war - to modify the *RETARD* logic, first by letting it sound until all T/Ls are in IDLE, but also to insist on the identification : In this accident, the warning could have been :
" RETARD...RETARD...RETARD...RETARD TWO...RETARD TWO............". The urgency addition to a famliar aural cue would be picked a lot more easily and the cure immediate .


(About the Bielefeld University paper...)

I have the deepest respect for Pr Ladkin's and his team's work and that paper is impressive enough but it is totally non-exploitable for a pilot in it's state.
I could take the last diagram and understand the working of the system. But then - because I'm a pilot and not a scientist - I would need to break it down into some simple, digestible and usable pieces. That's what I posted yesterday and I bet my bottom Euro that ALL the pilots have a similar sum-up of the system in the back of their minds. You can check my sum-up and I bet a dinner at Vatel's that it's valid against Pr L's diagram .
Regards

[GearDown&Locked]

Rananim

Therefore,the decision to continue with a landing on a short wet rwy,based on spoiler activation,must be learnt as an automatic drill(just like the go/no go up to V1).

It seems to be the easiest (and cheapest) way of preventing this kind of situations in the future.


SoaringTheSkies

They moved the spoilers lever. Do you want to try to guess why? Because it's the only damn thing directly relating to the spoilers! Tunnel vision! No room to think about the logic equation from up there! No time to rethink your approach and discover your omission.
Yet the logic (and not the computer!) had no way out for them but to answer the 200 souls question: what precious lever have you missed, gentlemen? The clock is ticking! I want your answer!

I agree completely; Just use that lever for overriding GS logic. It's like preventing a car driver from using the hand brake if certain conditions weren't met. You never ever use it outside its normal operation but, it's there to be used ... just in case.


borghha

Sorry, but to imply that 'não da' means 'it's stuck' is jumping to conclusions! não da indicates that it was impossible to reach the desired result, ie. 'desacelerar', to reduce speed.

May I be so bold to disagree with you on that one, as a native Portuguese; "Não dá" is a fairly generic expression. We use it when we're asked to do something and for some reason it can't be accomplished. In this particular case the reason can be anything from the engines, the plane, the pilots' shoelace, etc. It's like using the words "Unable to Comply" when asked to perform some task or take a new clearance. Usually the person who gets a "Não dá"(or a "Unable to Comply") right after a request or command will need to know "WHY?" (in Portuguese "porquê?") and then, and only then, you have the right reason as to why the action couldn't be performed. We don't see the other pilot asking why soon after the "Não dá" on the CVR transcript, possibly because he already knew the answer from the PF's actions and/or seeing it for himself what was going on.

Another word that is very ambiguous is that previous "decelera" request. Did it meant to decelerate the engines or the plane itself? We can't assume either one just because both are usable at that point from the Portuguese language point of view. "decelerar" is the direct opposite from "acelerar" (accelerate) very common word for the action of moving the TLs to a forward thrust setting. The PNF could have been saying something like "hey, slowdown the plane" or "hey, don't leave that engine producing thrust - decelerate it".

GD&L

[Lemurian]

StS again

You disagree with the picture of the crew's mental state in those crucial last seconds that I've tried to envision further up.

I did not, but no matter how open you could be, your theory is only one possibility among dozens of others and I really believe that, bar a similar emergency on a personal experience, you have no right to claim tour theory as representing the truth.

why a secondary exit from the "spoilers armed" state would be a bad idea (let's say a manual spoilers override lever or an override by something like 90% manual brakes applied).

The main problem of the solution you advocate is that it calls for MORE automation and airplane actions that, in the very unlikely event we are discussing, would introduce an extra element of surprise, with more negative reactions from the crew. I know, I've been there ...

Would that have fixed the 1.2 EPR issue? No, and I have to say I have no good answer for that without going into discussing a tactile feedback from the throttles again. Suggestions?

My point is that there is no different reaction from any airplane I know : Disconnect the automatic management of the thrust with a throttle in any position and you'll have, from the engine, a reaction consistent with the throttle actual setting. What does that have to do with moving throttles or not ? Isn't an important throttle stagger a visual and tactile feed-back enough ?
As forr suggestions, read my precedent post.
Regards.

[SoaringTheSkies]

WE obviously do not read the same posts in the same way. I haven't seen on this thread a single Airbus pilot who's said that it shouldn't happen to him, or have they showed a blind trust to the system.

Of course, we all have your preoccupations.
edit: your preoccupations? It should have been our!!!! Sorry, Lemurian, that was unintended [/i]

This said, why don't we bury the War Axe ?

Thank you. Really. Running an axe is the last thing I want to do here.

...good account of most of the accident facts and events we have...

This was as far as I can tell a pretty good explanation of the steps that led up to the accident, and I really thank you for it's factuality. I know I've lost that to some polemic tone at times, but that was out of frustration about the obvious communication issues here.

Now, you have to understand that we're coming from different angles. You're obviously the type of person who has flown a lot of different airplanes and learned to adapt to the requirements and procedures of all of them and you're comfortable with that.

I'm just a humble sparetime-pilot with an interest in aviation as such.
But I've also spent a considerable amount of my professional time designing and working with logic systems, both hardware and software.

You know that you can paint yourself into a corner as a pilot, but I'm equally aware of the fact that you can paint yourself and your users into a corner when you're designing logic. I've also learned a bit or two about how humans interact and that this is not always unambiguous. Actually ambiguity is the norm in human interaction with anything. (just look at how different we perceive the very same words in this thread).

In your post, you've described yourself how vision as a sensory input channel can and will become very focussed on one thing when we're under severe stress. The auditory channel can even get completely lost, especially when there's multiple auditory stimuli competing with your attention.

This is exactly why I suggest that there is value in things that actually move in the cockpit as the underlying system changes important parameters such as thrust and spoilers. If you have your hands on the throttles and they move back, that's some very direct input.
From my experience with state machines, I look at the state machine for the spoilers and subsequently the autobrakes and I go wow, that's an awful lot of parameters required to be TRUE in the boolean sense. I'm sure you remember the Warsaw accident where one of the parameters, the right squat switch, was almost true, but not boolean TRUE.

This is the point where I wonder what a tie breaker for this state could improve and what potential dangers it could bring with it.
The first memory item on "no decel" is "BRAKE PEDALS - PRESS", right?

To me, it would make sense to feed that into the state transition as well and define it as an override for the rest of the conditions. If we have maybe 90+% max brake pressure on the pedals, isn't that a clear indication that the pilot has committed to the landing and wants to get to a stop? Of course, there needs to be a minimal lockout against doing that in flight (maybe wheel spin up or squat, but minimal, one would be sufficient).

Would that have saved the day? I don't know.
I just know that the system as it stood on that day had no way of forgiving the original error.

In the Warsaw event, Airbus did indeed change the logic afterwards. Logic is only ever as good as what the designers have envisioned. The fact that one thrust lever could be completely forgotten about was either not on their list at all or it seemed so ridiculously improbable that they did deliberately leave it out of the equation.
Today, however, we know that it has happened, and happened more than once.

To prevent error means to create interfaces and structures that are easy to understand, straightforward to communicate with and unambiguous in their feedback.

To forgive error means to try to design logic that does not carry forward errors or, if it has to, allows to transition to an error free state without having to analyze and correct the original error in a stressful situation.

To fail gracefully is probably the most difficult thing to design. The first two all deal with known or envisionable error, this one is about new and creative ways to err. This requires solid and correct situational defaulting. Let's say in this case, a logic could have looked at the given pilot inputs for brakes, thrust, spoilers etc etc and make a "last minute guess" of what might be the safest option. I know there's risk in here and I said earlier that I would not want to go down this road with the amount of knowledge I have about flying big iron.
So again, thanks for that last post, Lemurian, I don't think we're so far away from each other, we just come from completely different angles.

pj

[SoaringTheSkies]

I did not, but no matter how open you could be, your theory is only one possibility among dozens of others and I really believe that, bar a similar emergency on a personal experience, you have no right to claim tour theory as representing the truth.

As I have said before, no airliner flying here, but I know how I've got myself into a tight spot once. I have, on a small scale, experienced how the cheese layers align and found myself in difficulty that could have easily become very very nasty.

I know, I had no CRM training, I had no rigid checklists for every possible situation, only very rudimentary memory items, but the basic mechanism is the same: stress is the enemy of analysis. You get stressed, you fail, you fail, you get more stress.

So while I don't want to brag with my mafus, I think I have a pretty good idea of what the brain does when things get nasty.

pj

[Rob21]

Again about logic. And again, I am not a heavy jet pilot. Please, be patient...
1. When the pilot commands one engine's T/R, a go around is out of his mind. True or false? I would say true.
2. As soon as he has reverse thrust, the pilot expects to have GS all up. True or false? I would say true.
3. A-320's GS logic will not deploy GS if only one TL goes from CLB to reverse position.
True or false? (stupid question, I should know that by now...) I can say then, true.
4. Heavy jet pilots would like to have GS available to them, even if only one TL is commanding reverse. True or false? I would say true.
My point is, why not give the pilot ground spoilers with only one TL at reverse? It's clear he does not want to go around.
If the other TL is at CLB, it's the pilot's problem. If he forgot to move it, or the computer didn't "sense" the move, or was stuck, or got loose, whatever!
But if those pilots have had GS available to them, for sure they would have had also more time (a few more seconds) to deal with engine 2. They would still had overan the rwy? Probably yes, but not at 100 kts...
Thanks again for your patience..
Rob

[SoaringTheSkies]

Rob,

the problem with this kind of logic is: yes, it's true for the case at hand, but will it also be true for all other occurrences? Some of which might be more frequent than the omission of one TL in CLB.

This is the discussion about more or less automation here.

You've probably seen that I think it's at least questionable to have the ground spoiler inhibition logic be as rigid as it is today. It's a whole different animal to design an overall better logic, however. We have seen a few accidents that have happened somehow involving this part of the logic, but how many have we not seen where this logic has allowed the pilot to go around?

This is an impossible task without complete data.

Maybe a manual override with the ground spoilers lever is indeed the best thing one can think of.
Actually, I would love to know what the downside of that would be.

pj

[borghha]

GD&L,

you must have misunderstood my post, or better, I was too elliptic. Não da is indeed very general and means I cant do it, unable to achieve, to do what you ask me. Because it is so general, it can t be interpreted to mean that a TL was stuck. It just meant, I can t decelerate. As you rightly said, the next question, why?, was never asked...

And I agree too that the decelera could mean either... but can any pilot tell us whether it is used as a synonime for 'retard'? I still think it was used in its general meaning of slow down. The deacelera might just be used because it is so close to the english 'decel' used in the ac logic.

[bomarc]

a question to our brazilian friends?

does anyone know when the final ruling will be made on the evidence so far gathered by investigators?

[bomarc]

a challenge

to all those who believe the plane was not at fault, take the opposite view for a moment and explain the one possible fault that would lead the plane to produce thrust on the right engine, even if the throttle was at idle.

to those who don't blame the pilot, come up with the theory that would place the blame there.

to not find the absolute truth about this crash is to invite a repeat!

[NigelOnDraft]

bomarc

explain the one possible fault

This shows you know nothing about aviation, and accident investigation in particular.

Almost all accidents have a number of contributory cause. People / things are "rarely solely to blame".

I am sure in this accident there will be some aircraft design aspects commented on, as well as some pilot handling issues. There will be airport factors, and operational too...

You are just looking for a guilty party to blame, and then finish the whole epsisode. However, I can guarantee long after your smug grin has gone there will still be pilots out there who will not perform as well as the 20:20 hindsight FS guys we have here on pPrune. There will still be lots of Airbuses, and I am sure they will have interesting "logic" features, and non-moving TLs. There will still be sub-optimal airports, and however much you try, it will still rain. Finally you will not get rid of commerical pressure(s).

As an industry we have to risk management the whole lot, making compromises... and learn from the various contributory factors to this and other accidents. It will not be the last...

[SoaringTheSkies]

NOD,

I think you failed to see that bomarc was merely inviting us all to think what we think is unthinkable: the opposite of what we right now believe is true.
It's a worthwhile experiment for those having their mind set on either or.

pj

[slip and turn]

challenge solution

Q. The one fault that would produce thrust on the right engine, even if the throttle was at idle?
A. The one the manufacturer's designer didn't cater for?

ALTERNATIVELY

Q. Come up with the theory that would place the blame with the pilot?
A. The theory that the pilot didn't know what the plane was doing now?

Go easy on him Nigel, he means well I think.