TAM A320 crash at Congonhas, Brazil

[DozyWannabe]

Rob21:
So MAYBE there is a chance that the pilots "thought" that since the "reminder" ceased, the action was performed?

Then that was their mistake. As I understand it from earlier posts, if the aircraft is flown the way AI specify, then you'd never hear the 'RETARD' call at all, because you'd pull it back at the RADALT cue. Some pilots wait for the 'RETARD' call to achieve a smoother landing, but I don't think it's recommended procedure.

Yes, more comprehensive logic and a secondary warning would be a nice thing to have, but should it be mandatory, given 3 known incidents in however many thousand flights? I suspect many would say no.

[Lemurian]

bullets !

When you get the "WHOOP, WHOOP, PULL UP warning, you pull up. When the warning ceases, it means you cleared the obstacle.

It also means that you're dead, in which case the warning is also no longer needed.

In fact I have THE solution that will satisfy everybody : Cancel the *Retard* call-out altogether, just like Boeing has never done. May be the pilots will become more intelligent and not rely on a synthetic voice to cue them on a primary flying school basic, simple action.
Then the blame will be solely on their souls and we'd have saved a lot of storage place for Danny, doing away with weird theories,by some who don't have the first clue on technical aspects of the discussion (like those still unable to read a set of FDR graphs after 2619 posts and 80 days of varied informations).
The real problem that this state of affairs poses is that, very conveniently, while the discussion - ad nauseum - about "not the pilots' fault, must be the aircraft" goes on, the other aspects of the accident are not covered :

• How was the flight prepared at POA ? Were the crew provided with sufficient landing data that the planning was for GRU (?), with the proviso of an en-route reversion to the scheduled flight ?
• The thoroughness of that flight preparation could be also questioned : 31 minutes from WonW to WoffW, minus taxi times, minus deplaning and boarding times, minus walk-around, minus the dealing times with all intervenants... on blue weather could be done...but for a flight onto a dicey runway with adverse weather and an inop T/R, I seriously doubt the quality of such preflight.
• When the decision was made to land at CGH, where did the information come from ? The airline ? The ATC ? and on what data ? We must remember that the airport was closed after a Pirep for slipperiness made the airport authorities measure a 6 mm contamination, then reopened when the rain became a drizzle ; as the windshield wipers were witched on on short final, this suggests that the rain had started again. Enough to trigger the slipperiness ?
• When the decision was made to land at CGH, The crew QRH page on LDR should have raised a few alarms : At their planned landing weight (info available on the Fuel page of the MCDU), they would have needed 1840m -had they considered *wet*, or discovered that they were outside the LDA had they considered *3 to 6 mmm of standing water*. (LDR = 2130 m at sea level, so no need to go any further). To stress this point further, an LDA of 1880 m is respected at weights under 50 tons, putting them some 13 tons over the *accepted* limit. (source : QRH, Full flaps-no reverse-no autobrake).

Other aspects to follow.

[xulabias_bent]

The thrust lever angle disagree failure has nothing to do with differing angles between the two thrust levers, but with a discrepancy between the values read by the two redundant, independent sensors of one thrust lever.

Excuse me If I wasn't sufficiently clear, bsieker.

I meant just that: Two TLA (TRA) sensors for the same thrust lever not in agreement.

The A/THR disconnection here was triggered by one thrust lever being in reverse, and the subsequent EPR discrepancy.

Yes, I know !!

The A/THR disconnection here was triggered by one thrust lever being in reverse, and the subsequent EPR discrepancy.

The two things have nothing to do with each other.

Ops !! Not 100% sure here

[3Ten]

Lemurian wrote:

In fact I have THE solution that will satisfy everybody : Cancel the *Retard* call-out altogether, just like Boeing has never done. May be the pilots will become more intelligent and not rely on a synthetic voice to cue them on a primary flying school basic, simple action.

In fact, that'it, isn't it?

PBL wrote:

You will find that in any accident there are lots of factors that satisfy your criterion, not just one, so your explanation is ill-defined. If you want to call them all "primary causes", I guess that's fine. The rest of us call them causes.

Of course I'm oversimplifying. Accident investigation is complex, and I espect, when I read a report, that it includes a thourough analisys that will find the lessons to be learned to everyone.

But I see this discussion revolving around the *warning* subject, which to me has very little to do with the *lessons to be learned* in this accident. It's probbably very contrary to what should be learned. Many pilots here think of the RETARD autocallout as superfluous, because it reminds us of something that's a basic action of landing an a/c.

If in fact, it happened that they left one throttle behind, probbably one of the lessons will be that basic airmanship is beeing overlooked, and I believe there are some aspects of FBW Airbus control systems that need to be re-thinked, not actually the warning systems.

But if they had closed both throttles, would we be here discussing this?
How's that for a primary cause, PBL, you tell me?

If you look at Los Rodeos, one of the most startling chain of events ever presented, what if it dind't start the takeoff roll without clearence? Would it have happened? I don't think so. I'm not throwing blame on him, nothing like that. But why do I draw attention to the takeoff clearence? Because it's the most basic failure, and I call it the spark. Where's the relevance of this to aviation? I think the most basic aspects are were the pilot has the greatest chances of breaking the accident chain, so their importance must allways be stressed. Complex situations may not easily be counteracted by crews, so basic airmanship is still a good resource.

Lemurian wrote:

The thoroughness of that flight preparation could be also questioned : 31 minutes from WonW to WoffW, minus taxi times, minus deplaning and boarding times, minus walk-around, minus the dealing times with all intervenants... on blue weather could be done...but for a flight onto a dicey runway with adverse weather and an inop T/R, I seriously doubt the quality of such preflight.

I wonder if the Managment of TAM (and many other airlines) has any ideia what you're talking about. Captain authorithy is nowadays nothing but a distant myth, in many places.

Lemurian wrote:

When the decision was made to land at CGH, The crew QRH page on LDR should have raised a few alarms : At their planned landing weight (info available on the Fuel page of the MCDU), they would have needed 1840m -had they considered *wet*, or discovered that they were outside the LDA had they considered *3 to 6 mmm of standing water*. (LDR = 2130 m at sea level, so no need to go any further). To stress this point further, an LDA of 1880 m is respected at weights under 50 tons, putting them some 13 tons over the *accepted* limit. (source : QRH, Full flaps-no reverse-no autobrake).

Lots of automation, but not enough, uh? Not in the FMS, not in our concerns?

[armchairpilot94116]

PBL

Websters definition of "Accident" works for me:

Main Entry: ac·ci·dent
Pronunciation: 'ak-s&-d&nt, -"dent; 'aks-d&nt
Function: noun
Etymology: Middle English, from Middle French, from Latin accident-, accidens nonessential quality, chance, from present participle of accidere to happen, from ad- + cadere to fall -- more at CHANCE
1 a : an unforeseen and unplanned event or circumstance b : lack of intention or necessity : CHANCE <met by accident rather than by design>


And the Taipei overrun although technically an Incident sparked a detailed report normally associate with aircraft accidents in the real world.

It failed to satisfy the FAA criteria you mentioned by the Grace of God and by the fact that the runway was sufficiently long to reduce the overrun speed to ( still substantial) 67 knots, which was contained by the available Runway End Zone , with the help of the ditch.

Glueball:

If Congonhas had the EMAS, the crew would've headed for it. They kept the aircraft on the runway until they turned it.

3ten:

As I recall , the T/L number 2 not being brought to idle was listed as primary cause of the Taipei overrun.

[lomapaseo]

armchairpilot94116

Websters definition of "Accident" works for me:

It may worik for you but it is not the way that aviation accidents or incidents are codified for the purpose of assessing safety.

For starters you might want to take a look at the definitions in the design intent FAR/JARs relative to part 25.1309 (system safety).

All of us would welcome a thorough collection of data for every event that fits those descriptions but in the interests of practicality in the available investigators time they rightly prioritize their investigative resources against their definition of accident or serious incident.

The more minor stuff simply gets reported and is categorized accordingly. It is important that the data is codified against what actually happened and not against fanciful what-ifs. That way future designs can learn from the degree of successes at mitigating against catastrophic consequences for combinations of malfunctions and circumstances.

[Lemurian]

Iomapaseo

The more minor stuff simply gets reported and is categorized accordingly. It is important that the data is codified against what actually happened and not against fanciful what-ifs. That way future designs can learn from the degree of successes at mitigating against catastrophic consequences for combinations of malfunctions and circumstances.

Thank you, that allows me to re-introduce a concept that PJ2 has mentioned in his post #1225 a month ago :
An ICAO directive launched in Europe the implementation of FOQA - flight Operations Quality Assurance - which most EU airlines adopted. The basic idea is to use the massive recording capacity of modern FDRs to allow a complete reading of all events on every aircraft. Both engineering and Ops departments could then be aware of repetitive defects, parameter trends, flight incidents like o/speed, unstabilised approaches, out of SOPs events...etc...The possibilities that were open are quasi limitless and airline managers suddenly found that it could lead also to some rather important savings in normal operations (fuel policy, ATC constraints...etc..).
One of the best safety tools is the stats the system can derive from all these recorded events.
The beauty of it is that through IATA these data are shared between airlines and manufacturers for safety and a quarterly safety bulletin informs the crews on undesirable practices and rerference to the OPS manual. some of the results were for instance the installation of an ILS to a rather difficult small airport, the disappearance of unstabilised approaches to a particular airfield, the increased discipline in taxi speeds...another stress on a given aircraft correct landing technique etc...
Of course, FOQA or FDA are just part of the whole set-up every safety-minded airline has, but they also have to have the aircrews' agreement. All the published irregularities are anonymous and any pilot could go to the FDA office and ask for the read-out of a given flight he was on.
So you see, TAM should have all the info you'd need...but won't get.
One question, though : Are the differences in operating procedures that we've seen from the graphs or heard of here, allowed by the airline ?
Does TAM have have a serious Ops quality assurance program ?

[alf5071h]

In aviation the widely recognised definition of an accident is given in ICAO Annex 13. This document also provides guidance for investigation and reporting.

With respect to the conclusions of an investigation, the Annex recommends – “List the findings and causes established ... The list of causes should include both the immediate and the deeper systemic causes.” This neither requires nor prohibits stating a ‘Primary Cause’; however, there may be more value if all of the contributing factors were considered as a broad view and not as follow-ons to a primary cause.

The purpose of the investigation is to “prevent accidents and incidents” (Annex 13 Chapter 3), thus it is necessary to consider those contributions which address this purpose.
A problem with ‘primary cause’ is that it focuses attention to one specific aspect which might only apply to the particular accident being investigated, and thus may add little value in preventing similar but not identical accidents.

As examples; in this and similar accidents/incidents the failure to retard the thrust levers is a contributing cause, but there are many aspects of design, the MEL, human error, the situation, drills and procedures which will aid accident prevention even when the thrust levers are operated correctly.
As at Midway the lack of overrun area increased the severity of the accident, yet the underlying ‘cause’ appears to be the lack of a sufficient safety margin during landing, whether this be in calculating the required landing distance - problems with runway condition, wet, grooved, human error - or the lack of real estate at the end/side of the runway. EMAS is just one solution, but there are many others which will also be effective at CON or MID, or on any other runway where marginal operations are conducted.
Thus an investigation should consider and report equally on all of these options to add to our safety defences in a wide range of situations that we may encounter.

[xulabias_bent]

SEC logic and TRA...

I have already asked this here. I tried to find something in the FCOM but to no avail...

I have to know if there is some arbitration between pots and resolver, pots TLA and resolvers TLA in the spoiler deployment logic !!

[bsieker]

Originally Posted by xulabias_bent

I have to know if there is some arbitration between pots and resolver, pots TLA and resolvers TLA in the spoiler deployment logic !!

I don't know why exactly you have to know, but part of your answer is in this diagram:
http://img401.imageshack.us/my.php?i...latoeecza3.jpg, which was posted by IFixPlanes in Post #1540, 2007-08-13T18:11.

It shows that each of the three SEC gets the outputs of a pair of the potentiometers as inputs. The different SECs control different spoiler surfaces.

Each FADEC channel gets the output of one of the resolvers as its input.

So nowhere will an arbitration between resolvers and potentiometers be made.

I assume potentiometer discrepancies will just trigger a SEC fault, and only resolver discrepancy triggers the TLA disagree (and TLA fault) failure (the Warnings and Cautions section of FCOM 1.70.90, P13ff mentions only the resolvers, and not the potentiometers.)

To answer that definitively we need something more substantial than a drawing and the FCOM.


Bernd

[GlueBall]

armchairpilot94116

If Congonhas had the EMAS, the crew would've headed for it. They kept the aircraft on the runway until they turned it.

Not a factual statement, because when the left engine is developing reverse thrust and the right engine is developing climb thrust then there is no way the airplane can be kept in a straight line. The severe asymetric power is turning the airplane to the left; rudder authority and tiller steering control are exceeded.

Besides, why would the crew want to consciously "turn" and exit the pavement prior to reaching the threshold, and not utilize the extra overrun pavement beyond the threshold?

[ChristiaanJ]

Glueball,
You're not too factual either, sorry.

... because when the left engine is developing reverse thrust and the right engine is developing climb thrust then there is no way the airplane can be kept in a straight line. The severe asymetric power is turning the airplane to the left; rudder authority and tiller steering control are exceeded.

Do you have data, figures, or a simulation to substantiate that?

Why would the crew want to consciously "turn" and exit the pavement prior to reaching the threshold...

IIRC there is a "Turn, turn!" on the CVR towards the end. Trying to run the aircraft off the runway and into the mud, and trying to ground-loop as a last desperate measure?

... and not utilize the extra overrun pavement beyond the threshold?

Look at the maps and photos. There is virtually none, and they knew that.

[armchairpilot94116]

As I understand it, A320 seems to not have too much trouble staying on the runway itself even with one reverse and the other at a bit above idle. The Taipei crew stayed right on the runway and ran off the end of it. But we better ask the A320 pilots themselves on this one.

[DozyWannabe]

GlueBall, the right engine was not developing climb thrust. As I understand the logic the aircraft in that mode was maintaining approach speed. The A/THR was in SPEED mode, and before disconnect was increasing engine thrust on the right to counteract the drop in speed caused by manually pulling back the left engine. After the disconnect happened, the right engine remained at the thrust setting it was at when A/THR disconnected.

[gpvictor]

Originally posted by PBL Some people on this thread have expressed the opinion that the only significant causal factor was the failure of the crew to reduce thrust on landing.

To show how limited such a view is, I quote from the recently-issued U.S. NTSB Summary of their report on the December 2005 overrun at Chicago Midway:

Quote:
Originally Posted by NTSB
Also, contributing to the severity of the accident was the absence of an engineering materials arresting system (EMAS), which was needed because of the limited runway safety area beyond the departure end of runway 31C.

The same obviously holds true of 35L at CGH.

PBL

I think that in the discussion about causality, some points should be stressed:

1) The causality of all events with some complexity, like plane accidents, is systemic. Even in cases like SR111 at Halifax, where apparently it seems to be possible to restrict it exclusively to the plane, it isn’t actually so, because the first factor in TSB’s report was the certification for material flammability, done far away from the plane itself. Generally speaking, it’s true that there can be a main cause (or, better, factor), but rarely it’s sufficient to explain the whole fact. In the case of CGH, we have two main factors: a) some kind of fault (human or technical), b) an airport with a relatively short runway and w/out escape areas. Every factor is necessary to explain the event, but not by itself sufficient to cause it. If the fault was done on the main runway at GRU, for example, it is probable that the crew could stop the plane. If no fault was done at CGH, this was simply a normal landing. The only difference between these two factors is that the former is a disconformity, while the latter wasn’t considered such, at least for the brazilian standards at the moment of the accident. At present, the second factor, too, is rated as faulty, since they are creating EMAS.

2) These are facts. Another fact is that TAM’s pilots operated two different procedures for landing with de-activated thrust reverser. It seems that the choice depended from the runway’s length, since the procedure first with both TL to idle and then both to rev needs 40-50 m more space than the other to stop the plane. Was the choice let to the crew, or this was some acknowledged internal TAM’s rule? At present, all pilots have to use only the first procedure. It should be expected too that AI changes the software i.o. to solve the 40-50 m problem (it is only a little bit of space, but in some cases perhaps decisive, like in the recent Midway accident).

3) Now the hypotesis. a) If the fault was technical (very improbable), it should be at the level of the interface or of the software. It should be discarded a mechanical locking of the TL, because the FDR don’t show statements in this sense. b) In the case of the human error, it is probable that the “one TL forward and one backward” procedure, more tricky and unusual, can mislead the pilots when acting under stress conditions, because it is probably stored in the medium-long term memory and not in the short term like the usual ones. The accidents at Taipei and Bacolod seem to confirm this hypotesis. It should also be investigated more deeply why at least three pilots did the same kind of mistake. Were they acting on the basis of the same logic, and what were it?

4) From the safety point of view, some lessons have been drawn and some improvements, as seen, are now implemented. Since it is impossible to revert the flow of the time, it is of little worth to say for example that AI could make mandatory the persistence of the warning “retard”, or that TAM should be more rigorous in the training of his pilots, before the accident. The important thing, is that the chances of the repetition of similar events are at present very lower than after the Taipei accident.

Originally Posted by BOAC Whatever else, the aircraft left them with no real options to stop APART from closing the T/L (if that was the case) and that to me is WRONG, be it Boeing/Airbus/Embraer/Tupolev or whoever - WRONG. Plain and simple. Indeed, if Boeing have now gone that way, then I think they are WRONG too and I would not be surprised if folk are now looking rather carefully at what they have 'created'.
Forgive me if I have missed it in previous explanations - IF there had been those unlikely multiple failures in the sensors and with No2 T/L actually at IDLE but indicating CLB, what could the crew do to deploy the ground spoilers?

5) I ask myself if some form of “total stop device” like the ones present on locomotives, that stop immediately the engines and apply the maximal brake power to the train, could be useful on planes, specially when pilots are not aware of what is really going on, or forget something (as AA 1420 in Little Rock)

[3Ten]

b) an airport with a relatively short runway and w/out escape areas.

This kind of contributing factor is only relevant in the decision process analisys. You cannot call it a cause, there are thousands of landings in that rwy that are not accidents. For example, if the rwy was contaminated, and no information reached the crew, that would be what we might call a cause, but that's not the case, I think.

[PBL]

Originally Posted by 3Ten

But if they had closed both throttles, would we be here discussing this?
How's that for a primary cause, PBL, you tell me?

And then we have:

an airport with a relatively short runway and w/out escape areas.

Originally Posted by 3Ten

This kind of contributing factor is only relevant in the decision process analisys. You cannot call it a cause

Let me use your words:

But if they had had a longer runway, with escape areas, would we be here discussing this?
How's that for a primary, cause, 3Ten, you tell me?

PBL

[John Marsh]

Relatively short r/way; no EMAS

Perhaps this only seems 'primary' because all the other holes in the Swiss cheese lined up.

The new EMAS at Congonhas will be a good thing, but not a 'magic wand' to plug all the other holes.

I think it's vital to see the whole system and opt for multi-layered safety.

SLF out.

[3Ten]

Perhaps this only seems 'primary' because all the other holes in the Swiss cheese lined up.

Exactly, so PBL: No primary cause, or it would happen to every a/c that landed there. We are supposed to keep on every rwy when we land (easier said then done), otherwise, discard the rwy as unapropriate as per performance calculation. Contributing factor, yes, for the severity of the event.

[PBL]

Originally Posted by 3Ten

Exactly, so PBL: No primary cause, or it would happen to every a/c that landed there.

Then leaving one thrust lever at climb detent isn't a primary cause either, or it would happen to every a/c that landed there.

The thing is, 3Ten, if I may phrase it so, that you haven't thought about these things very hard yet. You're applying the Counterfactual Test selectively, but you haven't said what your selection criteria are, or justified these criteria.

Let me propose three simple resolutions to this discussion. Either
1. I promise not to tell you how to fly your large commercial aircraft if you promise not to tell me how to think about causality; or
2. I give you a rather long reading list in the logic of causality and its practical application in analysing accidents, and you read it all; or
3. You take our course in practical analysis of accidents using WBA.

PBL