TAM 3054 Report released
Join Date: Mar 2003
Location: N571
Posts: 137
Likes: 0
Received 0 Likes
on
0 Posts
The core issue as far as human factors is concerned,is a preocupation with not using rev thrust on deactivated side.Except in the case of a fuel leak,there is no prohibition on moving both thrust levers to reverse.In the TAM scenerio another factor was the transition capts prior experience on boeing 757s which ofcourse has much larger thrust levers.
The Yaw on the 320 with only one thrust reverser deployed,is easily managed.
So the problem is created when people over anticipate a minor control issue,and overcompensate.
The 320 is a very docile and easy a/c to fly,even with low experience on type.You (or the Automation)can easily deal with any kind of assymetry throughout the flight envelope.
So training Capts need to emphasise this to pilots transitioning from other types,that they need to relax and deal with control issues only if and when these arise, as too much anticipation(which might be required on conventional a/c) can actually be counterproductive,in a fly-by-wire a/c like the 320.
Even though she is a conventional a/c in direct law during the Take-Off or landing roll,the a/c has been easily controlled by normal line pilots on at least one case of actual thrust reverser deployment on Take-off(due incorect deactivation by engg,and subsequent ignoring of "NO GO ECAM")and many cases of engine failure on the old V2500 A1 engines.
The Yaw on the 320 with only one thrust reverser deployed,is easily managed.
So the problem is created when people over anticipate a minor control issue,and overcompensate.
The 320 is a very docile and easy a/c to fly,even with low experience on type.You (or the Automation)can easily deal with any kind of assymetry throughout the flight envelope.
So training Capts need to emphasise this to pilots transitioning from other types,that they need to relax and deal with control issues only if and when these arise, as too much anticipation(which might be required on conventional a/c) can actually be counterproductive,in a fly-by-wire a/c like the 320.
Even though she is a conventional a/c in direct law during the Take-Off or landing roll,the a/c has been easily controlled by normal line pilots on at least one case of actual thrust reverser deployment on Take-off(due incorect deactivation by engg,and subsequent ignoring of "NO GO ECAM")and many cases of engine failure on the old V2500 A1 engines.
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes
on
0 Posts
Safetypee
You propose here really great reading.
May I understand I am part of the exception, not being an accident investigator and certainly not a lawyer, I still have natural interest in reading accident reports and so, on a regular base.
Focusing on a single entity for blame is not my intention but applying some farming logic to suit the ICAO Annex 13 would be more my register :
The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability.
In this context, the BEA is completely beside the point, and I believe it to be intentional.
How would they miss the repetitive recommendation addressed by the three different accident investigation authorities which had to deal with Bacolod, Taipei and Congonhas ?
Should we consider they are wrong the same way in Philippines, Taiwan and Brazil ?
Or could these places be far enough from Toulouse to still afford to apply and demonstrate common sense … ?
Notwithstanding the fact that the modification is unadapted to this specific flight phase, I just find it over the top that the introduction of a brand new ECAM WARNING MESSAGE was and still is proposed merely as an option ???
To Airbus and to the concerned Authorities:
Just scrap that phony message and impose the awaited RETARD callout modification.
You will fulfill Annex 13.
You will save LIVES.
You propose here really great reading.
May I understand I am part of the exception, not being an accident investigator and certainly not a lawyer, I still have natural interest in reading accident reports and so, on a regular base.
Focusing on a single entity for blame is not my intention but applying some farming logic to suit the ICAO Annex 13 would be more my register :
The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability.
In this context, the BEA is completely beside the point, and I believe it to be intentional.
How would they miss the repetitive recommendation addressed by the three different accident investigation authorities which had to deal with Bacolod, Taipei and Congonhas ?
Should we consider they are wrong the same way in Philippines, Taiwan and Brazil ?
Or could these places be far enough from Toulouse to still afford to apply and demonstrate common sense … ?
Originally Posted by alemaobaiano
TAM knew about the modified software (not fitted due to cost)
To Airbus and to the concerned Authorities:
Just scrap that phony message and impose the awaited RETARD callout modification.
You will fulfill Annex 13.
You will save LIVES.
CONF iture, I don’t think that we share the same view of the responsibility of BEA (or other investigators) in this matter.
The primary responsibility for the investigation was with the state where the accident occurred; the state of manufacture/certification will be invited to help as will the manufacturer.
It is most unlikely that the investigators will have the authority (in law) to mandate design changes. Thus, your criticisms in the first instance should be made about the Brazilian authorities for the investigation, and EASA (or FAA) for the design and certification of changes.
I agree that the industry must not seek blame, and that it serves no purpose for improving safety. What this accident and the subsequent events (non actions in your argument) have shown is the weakness of the industry’s ability (regulators to operators) to learn from previous accidents.
You may have overlooked possible difficulties in achieving an adequate solution. System changes must not result in other opportunities for error and thus several alternative modifications might have to be considered. A change to procedure or automated callout might be a quick fix, but suffers weaknesses of human involvement (which you/others suggest would remain a problem). An engineering fix might be more complicated and could take time to prove and implement.
Also, as has been debated in this forum, what is the role of the pilot, how much can or should be expected of humans, particularly in stressing circumstances which may be of their own making.
Conceptually, is manually retarding thrust levers in the Airbus any different from other aircraft; the system may be different, but the concept of human involvement should not be. The various views in this area could lead from one extreme - a completely automatic aircraft to the other, requiring pilots to action everything. We have to remember, either that humans can be viewed as the cause safety problems, or that they provide the most flexible solution; ... or both.
I think that you should reconsider your criticism of BEA and Airbus – they are not the directly accountable agencies, nor do those people who work in these safety areas deserve to be cited with ‘intentionally’ delaying safety.
Our industry trusts people; we trust our crew members, we trust the aircraft designers, so too must we trust the investigators and regulators to take appropriate action.
Accidents stir many emotions, and the apparent lack of action is frustrating, but IMHO the industry has a very good system of airworthiness (still subject to human error), and there are people who can and will ensure that those accountable for action will act; it just takes time. Meanwhile operators and pilots can learn from the mistakes of others and heed the weaknesses of system designs.
http://www.caa.co.uk/docs/33/fod200732.pdf 15 Nov 2007
The primary responsibility for the investigation was with the state where the accident occurred; the state of manufacture/certification will be invited to help as will the manufacturer.
It is most unlikely that the investigators will have the authority (in law) to mandate design changes. Thus, your criticisms in the first instance should be made about the Brazilian authorities for the investigation, and EASA (or FAA) for the design and certification of changes.
I agree that the industry must not seek blame, and that it serves no purpose for improving safety. What this accident and the subsequent events (non actions in your argument) have shown is the weakness of the industry’s ability (regulators to operators) to learn from previous accidents.
You may have overlooked possible difficulties in achieving an adequate solution. System changes must not result in other opportunities for error and thus several alternative modifications might have to be considered. A change to procedure or automated callout might be a quick fix, but suffers weaknesses of human involvement (which you/others suggest would remain a problem). An engineering fix might be more complicated and could take time to prove and implement.
Also, as has been debated in this forum, what is the role of the pilot, how much can or should be expected of humans, particularly in stressing circumstances which may be of their own making.
Conceptually, is manually retarding thrust levers in the Airbus any different from other aircraft; the system may be different, but the concept of human involvement should not be. The various views in this area could lead from one extreme - a completely automatic aircraft to the other, requiring pilots to action everything. We have to remember, either that humans can be viewed as the cause safety problems, or that they provide the most flexible solution; ... or both.
I think that you should reconsider your criticism of BEA and Airbus – they are not the directly accountable agencies, nor do those people who work in these safety areas deserve to be cited with ‘intentionally’ delaying safety.
Our industry trusts people; we trust our crew members, we trust the aircraft designers, so too must we trust the investigators and regulators to take appropriate action.
Accidents stir many emotions, and the apparent lack of action is frustrating, but IMHO the industry has a very good system of airworthiness (still subject to human error), and there are people who can and will ensure that those accountable for action will act; it just takes time. Meanwhile operators and pilots can learn from the mistakes of others and heed the weaknesses of system designs.
http://www.caa.co.uk/docs/33/fod200732.pdf 15 Nov 2007
Join Date: Mar 2003
Location: N571
Posts: 137
Likes: 0
Received 0 Likes
on
0 Posts
Safetypee,very well surmised.
Even the best designed systems have flaws or "traps" we can fall into,given a particular set of circumstances or our "baggage" of previous experience.
It is the role of the Training set up to identify and highlight these possible pitfalls....and stress which part of ones "baggage" can be usefull in flying a new type and which parts need to be "deleted" from the memory.
And Training Capts need to note that this "expertise" cant be found in the books,as the manufacturer can hardly be expected highlight his own design flaws.The only clue is the MODs which might sometimes be made after the fact.
And IMHO they have not nailed them all yet.
Even the best designed systems have flaws or "traps" we can fall into,given a particular set of circumstances or our "baggage" of previous experience.
It is the role of the Training set up to identify and highlight these possible pitfalls....and stress which part of ones "baggage" can be usefull in flying a new type and which parts need to be "deleted" from the memory.
And Training Capts need to note that this "expertise" cant be found in the books,as the manufacturer can hardly be expected highlight his own design flaws.The only clue is the MODs which might sometimes be made after the fact.
And IMHO they have not nailed them all yet.
Join Date: Jun 2009
Location: Somewhere out there
Age: 39
Posts: 65
Likes: 0
Received 0 Likes
on
0 Posts
TCU
Page 46 of the report (with picture)
http://www.cenipa.aer.mil.br/cenipa/...pdf/RF3054.pdf
Translating:
Note: When the report states "not at the TLs themselves" it probably means "not at the TLs quadrant or at the Artificial Feel Unit"
http://www.cenipa.aer.mil.br/cenipa/...pdf/RF3054.pdf
Os sensores que registram a posição dos manetes de potência no gravador de dados do vôo (FDR) estão localizados no TCU e não diretamente nos manetes de potência
The sensors that record the TLs position for the FDR are located in the Thrust Control Unit and not at the TLs themselves
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes
on
0 Posts
safetypee
Investigators don’t have the authority (in law) to mandate design changes, but they do have the mandate, even the duty, in the pursuit of accident prevention, to make recommendations, and that’s what the Brazilian authorities for the investigation have done, so no criticism to them.
Actually they have made one specific recommendation, and it appears the Taiwanese authorities had already made that very similar recommendation :
DO NOT STOP the RETARD callout before ALL thrust leverS are fully retarded
What could justify that the BEA does not take up this recommendation in its behalf ?
They feel the need to comment on many points but meticulously avoid to address this specific issue (?) That’s where I DO BLAME the BEA.
By their recommendations, they would have the power to put pressure on certification agencies, regulator agencies and manufacturers.
I’m afraid you put things more complicated than they are :
A simple modification of the RETARD callout logic has not much to see with an hypothetic and probable overcomplicated engineering fix …
Just one more question.
In reference to Bacolod, Taipei, Congonhas … how would you answer the following statement ?
To not cancel the RETARD callout at the time one thrust reverser was selected would have :
Investigators don’t have the authority (in law) to mandate design changes, but they do have the mandate, even the duty, in the pursuit of accident prevention, to make recommendations, and that’s what the Brazilian authorities for the investigation have done, so no criticism to them.
Actually they have made one specific recommendation, and it appears the Taiwanese authorities had already made that very similar recommendation :
DO NOT STOP the RETARD callout before ALL thrust leverS are fully retarded
What could justify that the BEA does not take up this recommendation in its behalf ?
They feel the need to comment on many points but meticulously avoid to address this specific issue (?) That’s where I DO BLAME the BEA.
By their recommendations, they would have the power to put pressure on certification agencies, regulator agencies and manufacturers.
I’m afraid you put things more complicated than they are :
A simple modification of the RETARD callout logic has not much to see with an hypothetic and probable overcomplicated engineering fix …
Just one more question.
In reference to Bacolod, Taipei, Congonhas … how would you answer the following statement ?
To not cancel the RETARD callout at the time one thrust reverser was selected would have :
- Prevented these accidents.
- Helped to prevent these accidents.
- Had no effect.
- Been a nuisance.
Join Date: Nov 2009
Location: Near Puget Sound
Age: 86
Posts: 88
Likes: 0
Received 0 Likes
on
0 Posts
CONF iture,
To answer your little quiz, "A" is the most likely answer, but even if it were "B" or "C" it should be done.
This type of accident really bothered me at my last position with a regulatory agency. Personally, I was flabbergasted that the scenario played out once. I can't imagine not pulling both engines to idle. The rationale behind the "Retard" call was to remind pilots to pull the T/L's back in the normal situation.
However, it it happens once, we should rethink the problem. If it happens twice, we must do something. A third or fourth time should never be allowed to happen. If I'm to believe this thread, it's happened more times than we know.
I had little luch with my former employer to correct this situation. The refrain was "stupid pilot." Even our operations inspectors would say "Well, I'd never do that."
It is axiomatic in human factors and in safety engineering, that the best way to prevent accidents is to make it impossible. This means there should be no possible way to have one engine in significant reverse thrust and the other engine at significant forward thrust. -- don't let one engine into reverse unless both T/L's are near idle.
The second best way is to warn. That's what the new Airbus mod to the software does.
The present status is to rely on pilot training. It seems clear to me that this approach isn't working as well as it should.
Sorry about the ranting -- I've been to close to this one.
Dick Newman
To answer your little quiz, "A" is the most likely answer, but even if it were "B" or "C" it should be done.
This type of accident really bothered me at my last position with a regulatory agency. Personally, I was flabbergasted that the scenario played out once. I can't imagine not pulling both engines to idle. The rationale behind the "Retard" call was to remind pilots to pull the T/L's back in the normal situation.
However, it it happens once, we should rethink the problem. If it happens twice, we must do something. A third or fourth time should never be allowed to happen. If I'm to believe this thread, it's happened more times than we know.
I had little luch with my former employer to correct this situation. The refrain was "stupid pilot." Even our operations inspectors would say "Well, I'd never do that."
It is axiomatic in human factors and in safety engineering, that the best way to prevent accidents is to make it impossible. This means there should be no possible way to have one engine in significant reverse thrust and the other engine at significant forward thrust. -- don't let one engine into reverse unless both T/L's are near idle.
The second best way is to warn. That's what the new Airbus mod to the software does.
The present status is to rely on pilot training. It seems clear to me that this approach isn't working as well as it should.
Sorry about the ranting -- I've been to close to this one.
Dick Newman
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes
on
0 Posts
IMO, I think answer B is quite reasonable.
We know how remarkable are the accident statistics in the commercial aviation nowadays, but what would be this figure if we only consider the FBW Airbus types which left the gate with one deactivated thrust reverser ?
I don't know that number ... it must be remarkable as well, but not for the same reason ...
We know how remarkable are the accident statistics in the commercial aviation nowadays, but what would be this figure if we only consider the FBW Airbus types which left the gate with one deactivated thrust reverser ?
I don't know that number ... it must be remarkable as well, but not for the same reason ...
Join Date: Aug 2005
Location: Around the lamp
Posts: 66
Likes: 0
Received 0 Likes
on
0 Posts
Hi ya.
Deeply buried in the CENIPA page, you will find the english Translation:
http://www.cenipa.aer.mil.br/cenipa/...df/3054ing.pdf
Regards,
Stubenfliege
Deeply buried in the CENIPA page, you will find the english Translation:
http://www.cenipa.aer.mil.br/cenipa/...df/3054ing.pdf
Regards,
Stubenfliege
Join Date: Jun 2001
Location: UTC +8
Posts: 2,626
Likes: 0
Received 0 Likes
on
0 Posts
The human factors issue as to why 2 supposedly experienced captains had failed in the most elementary, instinctive, response of retarding both throttles upon touchdown must deal with a case of temporary insanity.
It's hard to get into people's minds, but the necessity of retarding throttle(s) upon touchdown is learned from day 1 of flight training. It requires no thought, no cues, and no aural reminders, because it's self evident that in order to stop, one has to retard thrust/power. It is also elementary for any pilot in any airplane anywhere to keep one hand on all throttles/thrust levers during landing.
It's hard to get into people's minds, but the necessity of retarding throttle(s) upon touchdown is learned from day 1 of flight training. It requires no thought, no cues, and no aural reminders, because it's self evident that in order to stop, one has to retard thrust/power. It is also elementary for any pilot in any airplane anywhere to keep one hand on all throttles/thrust levers during landing.
Join Date: Feb 2010
Location: a shack on a hill
Posts: 128
Likes: 0
Received 0 Likes
on
0 Posts
After 30+ years of flying, I cannot avoid the impression that in the vast majority of countries, the sole purpose of accident investigation is to find a reason to blame the flight crew; in this way, authorities, insurers, manufacturers, MRO providers, and airlines, are of the hook, at little or no cost. IMHO, this also seems to be the cheapest and easiest way to deal with mishaps, as far as management is concerned. Once in a while, you have to sacrifice a pawn (or two), to win the game. 
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes
on
0 Posts
The human factors issue as to why 2 supposedly experienced captains had failed in the most elementary, instinctive, response of retarding both throttles upon touchdown must deal with a case of temporary insanity.
It's hard to get into people's minds, but the necessity of retarding throttle(s) upon touchdown is learned from day 1 of flight training. It requires no thought, no cues, and no aural reminders, because it's self evident that in order to stop, one has to retard thrust/power. It is also elementary for any pilot in any airplane anywhere to keep one hand on all throttles/thrust levers during landing.
It's hard to get into people's minds, but the necessity of retarding throttle(s) upon touchdown is learned from day 1 of flight training. It requires no thought, no cues, and no aural reminders, because it's self evident that in order to stop, one has to retard thrust/power. It is also elementary for any pilot in any airplane anywhere to keep one hand on all throttles/thrust levers during landing.
Common factors :
- All of them had been dispatched with one deactivated thrust reverser.
- All of them were A320
CONF iture;
I think the question you ask is a very good one.
Restated, the question being asked is: "What is different about the A320-type thrust management/thrust lever system that would/could cause a change ('more prone to') in pilot behaviour?"
I would like to explore this question. The main assumption I make is, when the airplane is flown within its certification boundaries and when in manual flight (the obvious 'default' condition should pilot confusion arise), aircraft control is entirely ordinary and traditional and should not be second-guessed or out-thought.
I think the question is one of erroneous perception that the Airbus autothrust system is 'more complex' than other aircraft and doesn't work like "traditional" aircraft and that this mistake in understanding leads crews to either subtlely second-guess or sub-conciously out-think what is, when disconnected, an ordinary thrust control system. I think this error in understanding extends to thrust-lever handling when reversers are MEL'd and locked out.
When disconnected, there are no technical reasons for thinking/believing that the autothrust system is somehow different than other systems such that pilot behaviours should be somehow modified, so the matter is one of perception and understanding, not one of additional or obscure technical complexity.
When under manual control, there is no more complexity in the A320 thrust control system than is to be found on any other manufacturer's system. The A320's thrust levers work in entirely traditional ways when under manual control but I think that many pilots mistakenly believe otherwise even when disconnected; they believe that automation is 'always there, mediating pilot input', making the assumption that because the system control is not as transparent as other aircraft that it 'may' be interfering with or modifying pilot input.
The question of difference references, by comparison, more "traditional" throttle/thrust lever arrangements. The main physical difference which has been pointed out is that the A320 thrust levers "do not move", (are not back-driven). The implied expectation and therefore problem for pilots is that moving levers indicate what the autothrust system is doing while non-moving levers do not.
The counter-example is, however, with some exceptions on an auto-coupled approach, (CATII, etc) in later generations of DC8/B707, non-moving thrust levers were standard on first and second generation transports, with no incidents caused thereby.
So why is the A320's autothrust system the focus of so much disagreement?
There is no disagreement that the A320 concept is, when under fully-automated flight, more complex than what we have seen as 'solutions' from other manufacturers. It takes longer to understand the airplane and 'wear it' such that it is second-nature. Usually that time period is at least one year if not more.
And as always is the case, if training is parsimonious or provided through processes which are poorly designed or poorly informed about the A320 automation systems, the results will reflect lack of comprehension and where that is permitted to occur, the resulting vacuum will be filled with mythologies, misperceptions and genuinely mistaken understanding of the airplane and its complexities. It necessarily goes without saying that despite such complexities the fatal accident record of the type is not an outlier and is instead about the same as equivalent types of other manufacturers.
But, except at the boundaries of certified flight, the airplane and the autothrust system are entirely ordinary and traditional when under manual pilot control. That is a fact, not a perception; the A320/A330/A340 series are as ordinary to fly as a DC8 or B727, etc.
Given this fact but given also the fact that there remain disagreements and even complaints, it makes sense to ask your question then, Why?, if the airplane flies 'ordinarily' like any other transport when manually-flown.
Why would an experienced crew leave one thrust lever (of the engine on which the reverser was locked out), in the CLB position and retard just the other thrust lever? Why, when the system behaves in a completely ordinary manner would not both thrust levers be retarded just as every other transport aircraft requires?
I think the answer may at least partially be found in the theory above - that pilots somehow assume that the system is 'different' and require different handling. I think this is the case because there is the notion that, because of the 'perceived veil of automation', they don't know what will happen if they treat it 'ordinarily', and thus assumptions and therefore behaviour, changes.
Edit;
As I re-read all this, I would like to make my intentions clear that I am focussing on natural misperceptions which may emerge due to a perceived 'mystique' about the type. I am neither focussing on 'blame' (of pilots for not understanding the airplane) nor inabilities of crews to fly the airplane.
I am trying to flesh out an answer to an important, perennial and relevant question which is partially human-factors, partially-design driven but mostly based upon the fundamental need, despite the "marketing of automation to airline managements" and the notion that the airplane "flies itself", of a clear and robust pilot-training and checking regime.
I think the accident record shows that this is already largely the case but mythologies, misapprehensions and which cause mistakes in handling have not gone away and I am trying to conceive of a different approach as to why.
This all acknowledged, we have the example of the THY B737 at AMS as a counter-example that even simple systems with moving thrust levers do not resolve the automation issues raised in this discussion.
PJ2
I believe it is worth questioning WHAT in the Airbus thrust management conception makes that a crew is more prone to demonstrate this kind of ''temporary insanity'' ?
Restated, the question being asked is: "What is different about the A320-type thrust management/thrust lever system that would/could cause a change ('more prone to') in pilot behaviour?"
I would like to explore this question. The main assumption I make is, when the airplane is flown within its certification boundaries and when in manual flight (the obvious 'default' condition should pilot confusion arise), aircraft control is entirely ordinary and traditional and should not be second-guessed or out-thought.
I think the question is one of erroneous perception that the Airbus autothrust system is 'more complex' than other aircraft and doesn't work like "traditional" aircraft and that this mistake in understanding leads crews to either subtlely second-guess or sub-conciously out-think what is, when disconnected, an ordinary thrust control system. I think this error in understanding extends to thrust-lever handling when reversers are MEL'd and locked out.
When disconnected, there are no technical reasons for thinking/believing that the autothrust system is somehow different than other systems such that pilot behaviours should be somehow modified, so the matter is one of perception and understanding, not one of additional or obscure technical complexity.
When under manual control, there is no more complexity in the A320 thrust control system than is to be found on any other manufacturer's system. The A320's thrust levers work in entirely traditional ways when under manual control but I think that many pilots mistakenly believe otherwise even when disconnected; they believe that automation is 'always there, mediating pilot input', making the assumption that because the system control is not as transparent as other aircraft that it 'may' be interfering with or modifying pilot input.
The question of difference references, by comparison, more "traditional" throttle/thrust lever arrangements. The main physical difference which has been pointed out is that the A320 thrust levers "do not move", (are not back-driven). The implied expectation and therefore problem for pilots is that moving levers indicate what the autothrust system is doing while non-moving levers do not.
The counter-example is, however, with some exceptions on an auto-coupled approach, (CATII, etc) in later generations of DC8/B707, non-moving thrust levers were standard on first and second generation transports, with no incidents caused thereby.
So why is the A320's autothrust system the focus of so much disagreement?
There is no disagreement that the A320 concept is, when under fully-automated flight, more complex than what we have seen as 'solutions' from other manufacturers. It takes longer to understand the airplane and 'wear it' such that it is second-nature. Usually that time period is at least one year if not more.
And as always is the case, if training is parsimonious or provided through processes which are poorly designed or poorly informed about the A320 automation systems, the results will reflect lack of comprehension and where that is permitted to occur, the resulting vacuum will be filled with mythologies, misperceptions and genuinely mistaken understanding of the airplane and its complexities. It necessarily goes without saying that despite such complexities the fatal accident record of the type is not an outlier and is instead about the same as equivalent types of other manufacturers.
But, except at the boundaries of certified flight, the airplane and the autothrust system are entirely ordinary and traditional when under manual pilot control. That is a fact, not a perception; the A320/A330/A340 series are as ordinary to fly as a DC8 or B727, etc.
Given this fact but given also the fact that there remain disagreements and even complaints, it makes sense to ask your question then, Why?, if the airplane flies 'ordinarily' like any other transport when manually-flown.
Why would an experienced crew leave one thrust lever (of the engine on which the reverser was locked out), in the CLB position and retard just the other thrust lever? Why, when the system behaves in a completely ordinary manner would not both thrust levers be retarded just as every other transport aircraft requires?
I think the answer may at least partially be found in the theory above - that pilots somehow assume that the system is 'different' and require different handling. I think this is the case because there is the notion that, because of the 'perceived veil of automation', they don't know what will happen if they treat it 'ordinarily', and thus assumptions and therefore behaviour, changes.
Edit;
As I re-read all this, I would like to make my intentions clear that I am focussing on natural misperceptions which may emerge due to a perceived 'mystique' about the type. I am neither focussing on 'blame' (of pilots for not understanding the airplane) nor inabilities of crews to fly the airplane.
I am trying to flesh out an answer to an important, perennial and relevant question which is partially human-factors, partially-design driven but mostly based upon the fundamental need, despite the "marketing of automation to airline managements" and the notion that the airplane "flies itself", of a clear and robust pilot-training and checking regime.
I think the accident record shows that this is already largely the case but mythologies, misapprehensions and which cause mistakes in handling have not gone away and I am trying to conceive of a different approach as to why.
This all acknowledged, we have the example of the THY B737 at AMS as a counter-example that even simple systems with moving thrust levers do not resolve the automation issues raised in this discussion.
PJ2
Last edited by PJ2; 6th Apr 2010 at 18:26. Reason: Clarifications re automation; clarification re intent of post
Join Date: Aug 2009
Location: Germany
Age: 67
Posts: 1,777
Likes: 0
Received 0 Likes
on
0 Posts
Hi,
This is just a thought .. gross ... but
I find it ironic .. when it's say instead that automation is intended to simplify the tasks of pilots
By introducing more complexity ?
And about manual flight (in general) .. methink this option is to be considered as exeptional (for all types of modern jet liners) because statistically it's a mode of flying very little used on such planes
This is just a thought .. gross ... but
There is no disagreement that the A320 concept is, when under fully-automated flight, more complex than what we have seen as 'solutions' from other manufacturers. It takes longer to understand the airplane and 'wear it' such that it is second-nature. Usually that time period is at least one year if not more.
By introducing more complexity ?
When under manual control, there is no more complexity in the A320 thrust control system than is to be found on any other manufacturer's system.
jcjeant;
Automation should be, (and most is, in my experience) transparent to the pilot and the operational tasks at hand, from just after takeoff, all the way to touchdown at destination should the crew decide to autoland. In other words, it should not be "in the way" of what the pilot wants to do, nor do what the pilot does not want it to do. While no automation solution is perfect and each has its warts as well as shining moments, a pilot is a pilot is a pilot and when the airplane isn't doing what the pilot wants, s/he disconnects and flies until s/he is satisfied that the airplane is once again stabilized and the automation can take over.
It is beyond argument now that automation, properly trained for, understood and appropriately used by the crew, enhances flight safety and indeed makes things much simpler. I know this from a lot of experience on the A320 doing domestic high density work and from the A330/A340 doing long-haul international work.
Of course it is an exception.
Please read my post carefully - I worked hard to try to make it clear that when manually flown, the A320/A330/A340 series aircraft are no different than any other aircraft yet there is a sense in some parts of the piloting community that they are different and I think this affects the way they are handled. They are designed to be flown under autoflight and do so extremely well. The outliers where loss of control can occur are areas of possible fruitful discussion in terms of how much or little intervention should be permitted the designers and engineers.
The key point is, when the airplane isn't doing what one wants, intervene and disconnect. As near as I can tell, the TAM A320 did exactly as it was designed when the thrust lever was left in the 25degree (CLB) detent and I am trying to discern why a pilot would not retard both thrust levers, (they did on the two previous landings).
I have seen similar issues (thrust levers left in the CLB position, autothrust disconnected) up close, and I can tell you it is a mess which will overspeed the airplane if one doesn't understand what is going on. In this case and to the point I wish to make, not pulling the thrust levers back and taking control of one's airplane is not an automation issue, it is a training issue and, if/when one is actually hesitant or even afraid to make a change because one doesn't comprehend what the airplane's response might be, it is therefore a perception issue. My point is, there is no justification for such a perception which may attributed to the A320/A330 design itself.
If one's airplane or autoflight system isn't under one's full control and there are no extenuating circumstances such as severe weather, collision or other massive system or airframe failure, then THAT is a training and comprehension issue, not an autoflight/autothrust issue.
The above, first post is one attempt at answering CONF iture's question.
PJ2
I find it ironic .. when it's say instead that automation is intended to simplify the tasks of pilots
By introducing more complexity ?
By introducing more complexity ?
It is beyond argument now that automation, properly trained for, understood and appropriately used by the crew, enhances flight safety and indeed makes things much simpler. I know this from a lot of experience on the A320 doing domestic high density work and from the A330/A340 doing long-haul international work.
And about manual flight (in general) .. methink this option is to be considered as exeptional (for all types of modern jet liners) because statistically it's a mode of flying very little used on such planes
Please read my post carefully - I worked hard to try to make it clear that when manually flown, the A320/A330/A340 series aircraft are no different than any other aircraft yet there is a sense in some parts of the piloting community that they are different and I think this affects the way they are handled. They are designed to be flown under autoflight and do so extremely well. The outliers where loss of control can occur are areas of possible fruitful discussion in terms of how much or little intervention should be permitted the designers and engineers.
The key point is, when the airplane isn't doing what one wants, intervene and disconnect. As near as I can tell, the TAM A320 did exactly as it was designed when the thrust lever was left in the 25degree (CLB) detent and I am trying to discern why a pilot would not retard both thrust levers, (they did on the two previous landings).
I have seen similar issues (thrust levers left in the CLB position, autothrust disconnected) up close, and I can tell you it is a mess which will overspeed the airplane if one doesn't understand what is going on. In this case and to the point I wish to make, not pulling the thrust levers back and taking control of one's airplane is not an automation issue, it is a training issue and, if/when one is actually hesitant or even afraid to make a change because one doesn't comprehend what the airplane's response might be, it is therefore a perception issue. My point is, there is no justification for such a perception which may attributed to the A320/A330 design itself.
If one's airplane or autoflight system isn't under one's full control and there are no extenuating circumstances such as severe weather, collision or other massive system or airframe failure, then THAT is a training and comprehension issue, not an autoflight/autothrust issue.
The above, first post is one attempt at answering CONF iture's question.
PJ2
Join Date: Nov 2009
Location: Near Puget Sound
Age: 86
Posts: 88
Likes: 0
Received 0 Likes
on
0 Posts
In a previous life, I was involved in invetigating one of these accidents. I, for one, cannot understand why any pilot would behave as the TAM pilot did. I would have been perfectly willing to chalk this up to "pilot error." However a second instance makes it harder to convince me that it's simple pilot error. The third, fourth, and fifth instance are even more troubling.
Part of the problem, I see, in the operating manual. I read the explanatory material in the TAM manual and it took me at least three readings to get what they meant.-- and I'm a native English speaker (well, American, anyway). The text appeared to have been written in French, machine translated into German, and then translated into English by a native Japanese speaker. When you consider that three of the four known instances were flown by non-native-english speakers, it makes more sense. (I don't mean to dump on Airbus's manuals; this is a major concern, though. I told Airbus that they really needed to improve the final versions of their manuals. (I told Boeing also.)
In the case of dispatch with an inoperative T/R, the problem is compounded by changes from "pull both into reverse" to "only pull the operative one into reverse." It really doesn't make any real difference which you do. In the America West accident, the pilot remembered after pulling both into reverse that the procedure had changed and tried to get the thrust lever of the inop T/R back to idle and ended up with significant forward thrust leading to a runway departure.
The computer software mod proposed by Airbus would go a long way, but it's been too long coming.
Personally, I think the system should be fixed. Don't allow either engine into reverse until both T/Ls are at or near idle. There is no reason I can think of that would justify one engine in reverse and one at a significant forward thrust. Lacking that fix, the "Retard" call should continue until both are at or near idle and the volume should increase first to "RETARD"" then to "PULL THEM BOTH BACK, DUMMY"
We've already killed a could of hundred and written off three airframes. We've had a couple of lucky breaks as well (One was reported on this very thread."
Let's fix the problem and stop blaming the crew.
Goldfish
Part of the problem, I see, in the operating manual. I read the explanatory material in the TAM manual and it took me at least three readings to get what they meant.-- and I'm a native English speaker (well, American, anyway). The text appeared to have been written in French, machine translated into German, and then translated into English by a native Japanese speaker. When you consider that three of the four known instances were flown by non-native-english speakers, it makes more sense. (I don't mean to dump on Airbus's manuals; this is a major concern, though. I told Airbus that they really needed to improve the final versions of their manuals. (I told Boeing also.)
In the case of dispatch with an inoperative T/R, the problem is compounded by changes from "pull both into reverse" to "only pull the operative one into reverse." It really doesn't make any real difference which you do. In the America West accident, the pilot remembered after pulling both into reverse that the procedure had changed and tried to get the thrust lever of the inop T/R back to idle and ended up with significant forward thrust leading to a runway departure.
The computer software mod proposed by Airbus would go a long way, but it's been too long coming.
Personally, I think the system should be fixed. Don't allow either engine into reverse until both T/Ls are at or near idle. There is no reason I can think of that would justify one engine in reverse and one at a significant forward thrust. Lacking that fix, the "Retard" call should continue until both are at or near idle and the volume should increase first to "RETARD"" then to "PULL THEM BOTH BACK, DUMMY"
We've already killed a could of hundred and written off three airframes. We've had a couple of lucky breaks as well (One was reported on this very thread."
Let's fix the problem and stop blaming the crew.
Goldfish
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes
on
0 Posts
PJ2,
Thanks for your time and effort for addressing the question.
As you mentioned it yourself, you’re not shy to constantly defend the Airbus design, and you’re pretty good at it I must say.
I agree, manual thrust is no different from any other system, no critic about it (just glad they finally didn’t opt for the push buttons instead of the thrust levers)
But auto thrust is clearly different, not better or worse or bad, actually it is even good when you like the challenge to go through and assimilate all the subtleties.
This is just a bit symptomatic that a new technology requires more practice and training to match the older one and I don’t think Airbus was planning that kind of extra … I was having a look at the FCOM, and just for the normal operation of the A/THR you have almost 20 possible displays on the PFD. I don’t really want to count the chapters and pages on the subject …
In my view, one main reason for some confusion is the frontier area between manual and auto thrust.
On a classical system, it is pretty straightforward : The thrust levers move on their own, you’re auto, they don’t, you’re manual.
Nothing like it on the bus, it takes more thinking. Even the radar altitude can have an influence on the thrust status.
Regarding the TAM accident and History before it, it would be hard to deny that the Airbus concept has not something to do with it.
PJ2, would you agree with that quote ?
Goldfish,
If you like to comment, how would you justify :
Thanks for your time and effort for addressing the question.
As you mentioned it yourself, you’re not shy to constantly defend the Airbus design, and you’re pretty good at it I must say.
I agree, manual thrust is no different from any other system, no critic about it (just glad they finally didn’t opt for the push buttons instead of the thrust levers)
But auto thrust is clearly different, not better or worse or bad, actually it is even good when you like the challenge to go through and assimilate all the subtleties.
This is just a bit symptomatic that a new technology requires more practice and training to match the older one and I don’t think Airbus was planning that kind of extra … I was having a look at the FCOM, and just for the normal operation of the A/THR you have almost 20 possible displays on the PFD. I don’t really want to count the chapters and pages on the subject …
In my view, one main reason for some confusion is the frontier area between manual and auto thrust.
On a classical system, it is pretty straightforward : The thrust levers move on their own, you’re auto, they don’t, you’re manual.
Nothing like it on the bus, it takes more thinking. Even the radar altitude can have an influence on the thrust status.
Regarding the TAM accident and History before it, it would be hard to deny that the Airbus concept has not something to do with it.
Originally Posted by Goldfish85
the "Retard" call should continue until both are at or near idle and the volume should increase first to "RETARD"" then to "PULL THEM BOTH BACK, DUMMY"
Goldfish,
If you like to comment, how would you justify :
- the BEA has not made such recommendation ?
- Airbus has not taken such step even if not recommended ?
There’s been time to consider the accident report in depth.
Overall the report is very fair and well balanced, it does not, nor is it necessary to state a cause of the accident; instead, it clearly presents the significant contributions.
In particular the investigators discuss many aspects of human factors which other reports might put aside because they are not factual, but in this instance even if an issue was undetermined, the discussion contributes significant understanding of a plausible contribution and thus opportunity to think and learn from the issue.
The grouping and discussion of the contributions is logical and points towards generic problems involving the human (operations), the aircraft, and the organizational system.
There may not be one specific item which would prevent the reoccurrence of this accident, but there is a multitude of points which require action to prevent repetition.
The core issues involve human error (slip or lapse); the aircraft design which satisfies human factors requirements in normal circumstances, but appears to have weaknesses in non-normal operations (Rev MEL). There are aspects of systematic and organizational management, which with the previous items, resulted in an accident.
The recommendations address issues which might provide foresight for crews, operators, airport and ATC management, and regulators / manufacturers to avoid similar accidents or incidents.
There are pointers as to how the particular slip/lapse might be avoided – training, SOPs, monitoring, corporate culture, safety oversight.
The method of thrust lever retard and audio caution had been accepted by certification. In hindsight, the technical judgement failed to sufficiently consider the non-normal circumstances which would have required mandating the existing improvement.
It would be reasonable to assume that non-normal operation (rev inop) was a similar ‘technical’ task (select idle / reverse), as for normal operations. However, this assumption perhaps did not fully address the change in context – human / training issues in the non-normal operation, and with error, the consequences of lack of spoilers / autobrake on the landing distance.
The report presents a clear case for change, whereas previous accidents perhaps did not.
I wonder how many other aircraft / systems might have a similar weakness? Do we expect too much of the human in non-normal / abnormal operations particularly with modern high reliability systems where there are fewer opportunities to gain experience from failure – and even less training time? Perhaps the industry has failed to consider that the context of non-normal and abnormal operations has changed, and thus the assumptions about human capabilities need to be revised.
A point perhaps overlooked, involved the airport meetings to determine special operational procedures for ‘wet’ landings on the unimproved runway. The requirement for reverse thrust perhaps misjudged the likely hood of reverse being able to ‘reliably’ reduce risks during a ‘wet’ landing. Whilst in practice this appears to be true, reverse is not considered in certificated landing distance, perhaps because of reliability or lack of timely selection, thus why should reverse be any more likely to reduce risk in the specific circumstances chosen?
Perhaps the meeting would have benefited from a strong operational input – risk management – thus avoiding a false assumption, or subsequently the operators should have questioned the decision.
Similarly the industry appears to have forgotten about grooved runways. If the comparative risks of operating on an un-grooved runway were identified at the time then perhaps the runway would not have been cleared for unrestricted use.
Finally the issue of ‘slippery when wet’; the NOTAM was cancelled by ‘misfortune’. However, what action should operators take when landing in these conditions – what does ‘slippery when wet’ mean. I cannot find any operational definition or guidance other than ‘take care’ and seek more information.
Perhaps the realisation of landing on a low friction runway (slippery when wet) with the additional hazard of water, which could have been of considerable depth, and a non grooved surface would have invoked the used of contaminated landing data (requires reverse thrust) – and that action could have prevented the landing on operational grounds – Rev MEL / or landing distance required.
Thus, the one simple aspect which apparently might have prevented the accident – having a NOTAM and knowing what action was required when ‘slippery when wet’ was notified, was lacking.
Was this misfortune or weakness in knowledge, or just an accident of the ‘system’?
Slippery when Wet - grooved runways.
UK AIP - Slippery when Wet, sect 1.1.4. para 16.
Overall the report is very fair and well balanced, it does not, nor is it necessary to state a cause of the accident; instead, it clearly presents the significant contributions.
In particular the investigators discuss many aspects of human factors which other reports might put aside because they are not factual, but in this instance even if an issue was undetermined, the discussion contributes significant understanding of a plausible contribution and thus opportunity to think and learn from the issue.
The grouping and discussion of the contributions is logical and points towards generic problems involving the human (operations), the aircraft, and the organizational system.
There may not be one specific item which would prevent the reoccurrence of this accident, but there is a multitude of points which require action to prevent repetition.
The core issues involve human error (slip or lapse); the aircraft design which satisfies human factors requirements in normal circumstances, but appears to have weaknesses in non-normal operations (Rev MEL). There are aspects of systematic and organizational management, which with the previous items, resulted in an accident.
The recommendations address issues which might provide foresight for crews, operators, airport and ATC management, and regulators / manufacturers to avoid similar accidents or incidents.
There are pointers as to how the particular slip/lapse might be avoided – training, SOPs, monitoring, corporate culture, safety oversight.
The method of thrust lever retard and audio caution had been accepted by certification. In hindsight, the technical judgement failed to sufficiently consider the non-normal circumstances which would have required mandating the existing improvement.
It would be reasonable to assume that non-normal operation (rev inop) was a similar ‘technical’ task (select idle / reverse), as for normal operations. However, this assumption perhaps did not fully address the change in context – human / training issues in the non-normal operation, and with error, the consequences of lack of spoilers / autobrake on the landing distance.
The report presents a clear case for change, whereas previous accidents perhaps did not.
I wonder how many other aircraft / systems might have a similar weakness? Do we expect too much of the human in non-normal / abnormal operations particularly with modern high reliability systems where there are fewer opportunities to gain experience from failure – and even less training time? Perhaps the industry has failed to consider that the context of non-normal and abnormal operations has changed, and thus the assumptions about human capabilities need to be revised.
A point perhaps overlooked, involved the airport meetings to determine special operational procedures for ‘wet’ landings on the unimproved runway. The requirement for reverse thrust perhaps misjudged the likely hood of reverse being able to ‘reliably’ reduce risks during a ‘wet’ landing. Whilst in practice this appears to be true, reverse is not considered in certificated landing distance, perhaps because of reliability or lack of timely selection, thus why should reverse be any more likely to reduce risk in the specific circumstances chosen?
Perhaps the meeting would have benefited from a strong operational input – risk management – thus avoiding a false assumption, or subsequently the operators should have questioned the decision.
Similarly the industry appears to have forgotten about grooved runways. If the comparative risks of operating on an un-grooved runway were identified at the time then perhaps the runway would not have been cleared for unrestricted use.
Finally the issue of ‘slippery when wet’; the NOTAM was cancelled by ‘misfortune’. However, what action should operators take when landing in these conditions – what does ‘slippery when wet’ mean. I cannot find any operational definition or guidance other than ‘take care’ and seek more information.
Perhaps the realisation of landing on a low friction runway (slippery when wet) with the additional hazard of water, which could have been of considerable depth, and a non grooved surface would have invoked the used of contaminated landing data (requires reverse thrust) – and that action could have prevented the landing on operational grounds – Rev MEL / or landing distance required.
Thus, the one simple aspect which apparently might have prevented the accident – having a NOTAM and knowing what action was required when ‘slippery when wet’ was notified, was lacking.
Was this misfortune or weakness in knowledge, or just an accident of the ‘system’?
Slippery when Wet - grooved runways.
UK AIP - Slippery when Wet, sect 1.1.4. para 16.