The core issue as far as human factors is concerned,is a preocupation with not using rev thrust on deactivated side.Except in the case of a fuel leak,there is no prohibition on moving both thrust levers to reverse.In the TAM scenerio another factor was the transition capts prior experience on boeing 757s which ofcourse has much larger thrust levers.
The Yaw on the 320 with only one thrust reverser deployed,is easily managed.
So the problem is created when people over anticipate a minor control issue,and overcompensate.
The 320 is a very docile and easy a/c to fly,even with low experience on type.You (or the Automation)can easily deal with any kind of assymetry throughout the flight envelope.
So training Capts need to emphasise this to pilots transitioning from other types,that they need to relax and deal with control issues only if and when these arise, as too much anticipation(which might be required on conventional a/c) can actually be counterproductive,in a fly-by-wire a/c like the 320.
Even though she is a conventional a/c in direct law during the Take-Off or landing roll,the a/c has been easily controlled by normal line pilots on at least one case of actual thrust reverser deployment on Take-off(due incorect deactivation by engg,and subsequent ignoring of "NO GO ECAM")and many cases of engine failure on the old V2500 A1 engines.

Safetypee
You propose here really great reading.

May I understand I am part of the exception, not being an accident investigator and certainly not a lawyer, I still have natural interest in reading accident reports and so, on a regular base.

Focusing on a single entity for blame is not my intention but applying some farming logic to suit the ICAO Annex 13 would be more my register :
The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability.
In this context, the BEA is completely beside the point, and I believe it to be intentional.
How would they miss the repetitive recommendation addressed by the three different accident investigation authorities which had to deal with Bacolod, Taipei and Congonhas ?
Should we consider they are wrong the same way in Philippines, Taiwan and Brazil ?
Or could these places be far enough from Toulouse to still afford to apply and demonstrate common sense … ?

Notwithstanding the fact that the modification is unadapted to this specific flight phase, I just find it over the top that the introduction of a brand new ECAM WARNING MESSAGE was and still is proposed merely as an option ???

To Airbus and to the concerned Authorities:
Just scrap that phony message and impose the awaited RETARD callout modification.
You will fulfill Annex 13.
You will save LIVES.

CONF iture, I don’t think that we share the same view of the responsibility of BEA (or other investigators) in this matter.
The primary responsibility for the investigation was with the state where the accident occurred; the state of manufacture/certification will be invited to help as will the manufacturer.
It is most unlikely that the investigators will have the authority (in law) to mandate design changes. Thus, your criticisms in the first instance should be made about the Brazilian authorities for the investigation, and EASA (or FAA) for the design and certification of changes.
I agree that the industry must not seek blame, and that it serves no purpose for improving safety. What this accident and the subsequent events (non actions in your argument) have shown is the weakness of the industry’s ability (regulators to operators) to learn from previous accidents.

You may have overlooked possible difficulties in achieving an adequate solution. System changes must not result in other opportunities for error and thus several alternative modifications might have to be considered. A change to procedure or automated callout might be a quick fix, but suffers weaknesses of human involvement (which you/others suggest would remain a problem). An engineering fix might be more complicated and could take time to prove and implement.
Also, as has been debated in this forum, what is the role of the pilot, how much can or should be expected of humans, particularly in stressing circumstances which may be of their own making.

Conceptually, is manually retarding thrust levers in the Airbus any different from other aircraft; the system may be different, but the concept of human involvement should not be. The various views in this area could lead from one extreme - a completely automatic aircraft to the other, requiring pilots to action everything. We have to remember, either that humans can be viewed as the cause safety problems, or that they provide the most flexible solution; ... or both.

I think that you should reconsider your criticism of BEA and Airbus – they are not the directly accountable agencies, nor do those people who work in these safety areas deserve to be cited with ‘intentionally’ delaying safety.
Our industry trusts people; we trust our crew members, we trust the aircraft designers, so too must we trust the investigators and regulators to take appropriate action.
Accidents stir many emotions, and the apparent lack of action is frustrating, but IMHO the industry has a very good system of airworthiness (still subject to human error), and there are people who can and will ensure that those accountable for action will act; it just takes time. Meanwhile operators and pilots can learn from the mistakes of others and heed the weaknesses of system designs.

http://www.caa.co.uk/docs/33/fod200732.pdf 15 Nov 2007

Safetypee,very well surmised.
Even the best designed systems have flaws or "traps" we can fall into,given a particular set of circumstances or our "baggage" of previous experience.
It is the role of the Training set up to identify and highlight these possible pitfalls....and stress which part of ones "baggage" can be usefull in flying a new type and which parts need to be "deleted" from the memory.
And Training Capts need to note that this "expertise" cant be found in the books,as the manufacturer can hardly be expected highlight his own design flaws.The only clue is the MODs which might sometimes be made after the fact.
And IMHO they have not nailed them all yet.

TCU
 

Page 46 of the report (with picture)

http://www.cenipa.aer.mil.br/cenipa/...pdf/RF3054.pdf

Translating:

Note: When the report states "not at the TLs themselves" it probably means "not at the TLs quadrant or at the Artificial Feel Unit"

safetypee

Investigators don’t have the authority (in law) to mandate design changes, but they do have the mandate, even the duty, in the pursuit of accident prevention, to make recommendations, and that’s what the Brazilian authorities for the investigation have done, so no criticism to them.
Actually they have made one specific recommendation, and it appears the Taiwanese authorities had already made that very similar recommendation :
DO NOT STOP the RETARD callout before ALL thrust leverS are fully retarded

What could justify that the BEA does not take up this recommendation in its behalf ?

They feel the need to comment on many points but meticulously avoid to address this specific issue (?) That’s where I DO BLAME the BEA.
By their recommendations, they would have the power to put pressure on certification agencies, regulator agencies and manufacturers.


I’m afraid you put things more complicated than they are :
A simple modification of the RETARD callout logic has not much to see with an hypothetic and probable overcomplicated engineering fix …


Just one more question.
In reference to Bacolod, Taipei, Congonhas … how would you answer the following statement ?

To not cancel the RETARD callout at the time one thrust reverser was selected would have :

1. Prevented these accidents.
2. Helped to prevent these accidents.
3. Had no effect.
4. Been a nuisance.

CONF iture,

To answer your little quiz, "A" is the most likely answer, but even if it were "B" or "C" it should be done.

This type of accident really bothered me at my last position with a regulatory agency. Personally, I was flabbergasted that the scenario played out once. I can't imagine not pulling both engines to idle. The rationale behind the "Retard" call was to remind pilots to pull the T/L's back in the normal situation.

However, it it happens once, we should rethink the problem. If it happens twice, we must do something. A third or fourth time should never be allowed to happen. If I'm to believe this thread, it's happened more times than we know.

I had little luch with my former employer to correct this situation. The refrain was "stupid pilot." Even our operations inspectors would say "Well, I'd never do that."

It is axiomatic in human factors and in safety engineering, that the best way to prevent accidents is to make it impossible. This means there should be no possible way to have one engine in significant reverse thrust and the other engine at significant forward thrust. -- don't let one engine into reverse unless both T/L's are near idle.

The second best way is to warn. That's what the new Airbus mod to the software does.

The present status is to rely on pilot training. It seems clear to me that this approach isn't working as well as it should.

Sorry about the ranting -- I've been to close to this one.


Dick Newman

Hi,

I support that.

IMO, I think answer B is quite reasonable.

We know how remarkable are the accident statistics in the commercial aviation nowadays, but what would be this figure if we only consider the FBW Airbus types which left the gate with one deactivated thrust reverser ?

I don't know that number ... it must be remarkable as well, but not for the same reason ...

Has the report been translated into english?


Dick Newman

Hi ya.

Deeply buried in the CENIPA page, you will find the english Translation:

http://www.cenipa.aer.mil.br/cenipa/...df/3054ing.pdf

Regards,

Stubenfliege

The human factors issue as to why 2 supposedly experienced captains had failed in the most elementary, instinctive, response of retarding both throttles upon touchdown must deal with a case of temporary insanity.

It's hard to get into people's minds, but the necessity of retarding throttle(s) upon touchdown is learned from day 1 of flight training. It requires no thought, no cues, and no aural reminders, because it's self evident that in order to stop, one has to retard thrust/power. It is also elementary for any pilot in any airplane anywhere to keep one hand on all throttles/thrust levers during landing.

After 30+ years of flying, I cannot avoid the impression that in the vast majority of countries, the sole purpose of accident investigation is to find a reason to blame the flight crew; in this way, authorities, insurers, manufacturers, MRO providers, and airlines, are of the hook, at little or no cost. IMHO, this also seems to be the cheapest and easiest way to deal with mishaps, as far as management is concerned. Once in a while, you have to sacrifice a pawn (or two), to win the game. :(

You are correct GlueBall, but in the same time you have to look further and question why this type of ''temporary insanity'' happened many times already, 3 of them being well documented as the aircraft could not stop in the limit of the pavement.

Common factors :

• All of them had been dispatched with one deactivated thrust reverser.
• All of them were A320

I believe it is worth questioning WHAT in the Airbus thrust management conception makes that a crew is more prone to demonstrate this kind of ''temporary insanity'' ?

CONF iture;
I think the question you ask is a very good one.

Restated, the question being asked is: "What is different about the A320-type thrust management/thrust lever system that would/could cause a change ('more prone to') in pilot behaviour?"

I would like to explore this question. The main assumption I make is, when the airplane is flown within its certification boundaries and when in manual flight (the obvious 'default' condition should pilot confusion arise), aircraft control is entirely ordinary and traditional and should not be second-guessed or out-thought.

I think the question is one of erroneous perception that the Airbus autothrust system is 'more complex' than other aircraft and doesn't work like "traditional" aircraft and that this mistake in understanding leads crews to either subtlely second-guess or sub-conciously out-think what is, when disconnected, an ordinary thrust control system. I think this error in understanding extends to thrust-lever handling when reversers are MEL'd and locked out.

When disconnected, there are no technical reasons for thinking/believing that the autothrust system is somehow different than other systems such that pilot behaviours should be somehow modified, so the matter is one of perception and understanding, not one of additional or obscure technical complexity.

When under manual control, there is no more complexity in the A320 thrust control system than is to be found on any other manufacturer's system. The A320's thrust levers work in entirely traditional ways when under manual control but I think that many pilots mistakenly believe otherwise even when disconnected; they believe that automation is 'always there, mediating pilot input', making the assumption that because the system control is not as transparent as other aircraft that it 'may' be interfering with or modifying pilot input.

The question of difference references, by comparison, more "traditional" throttle/thrust lever arrangements. The main physical difference which has been pointed out is that the A320 thrust levers "do not move", (are not back-driven). The implied expectation and therefore problem for pilots is that moving levers indicate what the autothrust system is doing while non-moving levers do not.

The counter-example is, however, with some exceptions on an auto-coupled approach, (CATII, etc) in later generations of DC8/B707, non-moving thrust levers were standard on first and second generation transports, with no incidents caused thereby.

So why is the A320's autothrust system the focus of so much disagreement?

There is no disagreement that the A320 concept is, when under fully-automated flight, more complex than what we have seen as 'solutions' from other manufacturers. It takes longer to understand the airplane and 'wear it' such that it is second-nature. Usually that time period is at least one year if not more.

And as always is the case, if training is parsimonious or provided through processes which are poorly designed or poorly informed about the A320 automation systems, the results will reflect lack of comprehension and where that is permitted to occur, the resulting vacuum will be filled with mythologies, misperceptions and genuinely mistaken understanding of the airplane and its complexities. It necessarily goes without saying that despite such complexities the fatal accident record of the type is not an outlier and is instead about the same as equivalent types of other manufacturers.

But, except at the boundaries of certified flight, the airplane and the autothrust system are entirely ordinary and traditional when under manual pilot control. That is a fact, not a perception; the A320/A330/A340 series are as ordinary to fly as a DC8 or B727, etc.

Given this fact but given also the fact that there remain disagreements and even complaints, it makes sense to ask your question then, Why?, if the airplane flies 'ordinarily' like any other transport when manually-flown.

Why would an experienced crew leave one thrust lever (of the engine on which the reverser was locked out), in the CLB position and retard just the other thrust lever? Why, when the system behaves in a completely ordinary manner would not both thrust levers be retarded just as every other transport aircraft requires?

I think the answer may at least partially be found in the theory above - that pilots somehow assume that the system is 'different' and require different handling. I think this is the case because there is the notion that, because of the 'perceived veil of automation', they don't know what will happen if they treat it 'ordinarily', and thus assumptions and therefore behaviour, changes.


Edit;
As I re-read all this, I would like to make my intentions clear that I am focussing on natural misperceptions which may emerge due to a perceived 'mystique' about the type. I am neither focussing on 'blame' (of pilots for not understanding the airplane) nor inabilities of crews to fly the airplane.

I am trying to flesh out an answer to an important, perennial and relevant question which is partially human-factors, partially-design driven but mostly based upon the fundamental need, despite the "marketing of automation to airline managements" and the notion that the airplane "flies itself", of a clear and robust pilot-training and checking regime.

I think the accident record shows that this is already largely the case but mythologies, misapprehensions and which cause mistakes in handling have not gone away and I am trying to conceive of a different approach as to why.

This all acknowledged, we have the example of the THY B737 at AMS as a counter-example that even simple systems with moving thrust levers do not resolve the automation issues raised in this discussion.

PJ2

Hi,

This is just a thought .. gross ... but

I find it ironic .. when it's say instead that automation is intended to simplify the tasks of pilots
By introducing more complexity ?

And about manual flight (in general) .. methink this option is to be considered as exeptional (for all types of modern jet liners) because statistically it's a mode of flying very little used on such planes

jcjeant;
Automation should be, (and most is, in my experience) transparent to the pilot and the operational tasks at hand, from just after takeoff, all the way to touchdown at destination should the crew decide to autoland. In other words, it should not be "in the way" of what the pilot wants to do, nor do what the pilot does not want it to do. While no automation solution is perfect and each has its warts as well as shining moments, a pilot is a pilot is a pilot and when the airplane isn't doing what the pilot wants, s/he disconnects and flies until s/he is satisfied that the airplane is once again stabilized and the automation can take over.

It is beyond argument now that automation, properly trained for, understood and appropriately used by the crew, enhances flight safety and indeed makes things much simpler. I know this from a lot of experience on the A320 doing domestic high density work and from the A330/A340 doing long-haul international work.
Of course it is an exception.

Please read my post carefully - I worked hard to try to make it clear that when manually flown, the A320/A330/A340 series aircraft are no different than any other aircraft yet there is a sense in some parts of the piloting community that they are different and I think this affects the way they are handled. They are designed to be flown under autoflight and do so extremely well. The outliers where loss of control can occur are areas of possible fruitful discussion in terms of how much or little intervention should be permitted the designers and engineers.

The key point is, when the airplane isn't doing what one wants, intervene and disconnect. As near as I can tell, the TAM A320 did exactly as it was designed when the thrust lever was left in the 25degree (CLB) detent and I am trying to discern why a pilot would not retard both thrust levers, (they did on the two previous landings).

I have seen similar issues (thrust levers left in the CLB position, autothrust disconnected) up close, and I can tell you it is a mess which will overspeed the airplane if one doesn't understand what is going on. In this case and to the point I wish to make, not pulling the thrust levers back and taking control of one's airplane is not an automation issue, it is a training issue and, if/when one is actually hesitant or even afraid to make a change because one doesn't comprehend what the airplane's response might be, it is therefore a perception issue. My point is, there is no justification for such a perception which may attributed to the A320/A330 design itself.

If one's airplane or autoflight system isn't under one's full control and there are no extenuating circumstances such as severe weather, collision or other massive system or airframe failure, then THAT is a training and comprehension issue, not an autoflight/autothrust issue.

The above, first post is one attempt at answering CONF iture's question.

PJ2

In a previous life, I was involved in invetigating one of these accidents. I, for one, cannot understand why any pilot would behave as the TAM pilot did. I would have been perfectly willing to chalk this up to "pilot error." However a second instance makes it harder to convince me that it's simple pilot error. The third, fourth, and fifth instance are even more troubling.

Part of the problem, I see, in the operating manual. I read the explanatory material in the TAM manual and it took me at least three readings to get what they meant.-- and I'm a native English speaker (well, American, anyway). The text appeared to have been written in French, machine translated into German, and then translated into English by a native Japanese speaker. When you consider that three of the four known instances were flown by non-native-english speakers, it makes more sense. (I don't mean to dump on Airbus's manuals; this is a major concern, though. I told Airbus that they really needed to improve the final versions of their manuals. (I told Boeing also.)

In the case of dispatch with an inoperative T/R, the problem is compounded by changes from "pull both into reverse" to "only pull the operative one into reverse." It really doesn't make any real difference which you do. In the America West accident, the pilot remembered after pulling both into reverse that the procedure had changed and tried to get the thrust lever of the inop T/R back to idle and ended up with significant forward thrust leading to a runway departure.

The computer software mod proposed by Airbus would go a long way, but it's been too long coming.

Personally, I think the system should be fixed. Don't allow either engine into reverse until both T/Ls are at or near idle. There is no reason I can think of that would justify one engine in reverse and one at a significant forward thrust. Lacking that fix, the "Retard" call should continue until both are at or near idle and the volume should increase first to "RETARD"" then to "PULL THEM BOTH BACK, DUMMY"

We've already killed a could of hundred and written off three airframes. We've had a couple of lucky breaks as well (One was reported on this very thread."

Let's fix the problem and stop blaming the crew.


Goldfish

PJ2,
Thanks for your time and effort for addressing the question.
As you mentioned it yourself, you’re not shy to constantly defend the Airbus design, and you’re pretty good at it I must say.

I agree, manual thrust is no different from any other system, no critic about it (just glad they finally didn’t opt for the push buttons instead of the thrust levers)
But auto thrust is clearly different, not better or worse or bad, actually it is even good when you like the challenge to go through and assimilate all the subtleties.
This is just a bit symptomatic that a new technology requires more practice and training to match the older one and I don’t think Airbus was planning that kind of extra … I was having a look at the FCOM, and just for the normal operation of the A/THR you have almost 20 possible displays on the PFD. I don’t really want to count the chapters and pages on the subject …

In my view, one main reason for some confusion is the frontier area between manual and auto thrust.
On a classical system, it is pretty straightforward : The thrust levers move on their own, you’re auto, they don’t, you’re manual.
Nothing like it on the bus, it takes more thinking. Even the radar altitude can have an influence on the thrust status.

Regarding the TAM accident and History before it, it would be hard to deny that the Airbus concept has not something to do with it.

PJ2, would you agree with that quote ?


Goldfish,
If you like to comment, how would you justify :

• the BEA has not made such recommendation ?
• Airbus has not taken such step even if not recommended ?

There’s been time to consider the accident report in depth.
Overall the report is very fair and well balanced, it does not, nor is it necessary to state a cause of the accident; instead, it clearly presents the significant contributions.
In particular the investigators discuss many aspects of human factors which other reports might put aside because they are not factual, but in this instance even if an issue was undetermined, the discussion contributes significant understanding of a plausible contribution and thus opportunity to think and learn from the issue.

The grouping and discussion of the contributions is logical and points towards generic problems involving the human (operations), the aircraft, and the organizational system.
There may not be one specific item which would prevent the reoccurrence of this accident, but there is a multitude of points which require action to prevent repetition.

The core issues involve human error (slip or lapse); the aircraft design which satisfies human factors requirements in normal circumstances, but appears to have weaknesses in non-normal operations (Rev MEL). There are aspects of systematic and organizational management, which with the previous items, resulted in an accident.
The recommendations address issues which might provide foresight for crews, operators, airport and ATC management, and regulators / manufacturers to avoid similar accidents or incidents.

There are pointers as to how the particular slip/lapse might be avoided – training, SOPs, monitoring, corporate culture, safety oversight.

The method of thrust lever retard and audio caution had been accepted by certification. In hindsight, the technical judgement failed to sufficiently consider the non-normal circumstances which would have required mandating the existing improvement.
It would be reasonable to assume that non-normal operation (rev inop) was a similar ‘technical’ task (select idle / reverse), as for normal operations. However, this assumption perhaps did not fully address the change in context – human / training issues in the non-normal operation, and with error, the consequences of lack of spoilers / autobrake on the landing distance.
The report presents a clear case for change, whereas previous accidents perhaps did not.

I wonder how many other aircraft / systems might have a similar weakness? Do we expect too much of the human in non-normal / abnormal operations particularly with modern high reliability systems where there are fewer opportunities to gain experience from failure – and even less training time? Perhaps the industry has failed to consider that the context of non-normal and abnormal operations has changed, and thus the assumptions about human capabilities need to be revised.

A point perhaps overlooked, involved the airport meetings to determine special operational procedures for ‘wet’ landings on the unimproved runway. The requirement for reverse thrust perhaps misjudged the likely hood of reverse being able to ‘reliably’ reduce risks during a ‘wet’ landing. Whilst in practice this appears to be true, reverse is not considered in certificated landing distance, perhaps because of reliability or lack of timely selection, thus why should reverse be any more likely to reduce risk in the specific circumstances chosen?
Perhaps the meeting would have benefited from a strong operational input – risk management – thus avoiding a false assumption, or subsequently the operators should have questioned the decision.

Similarly the industry appears to have forgotten about grooved runways. If the comparative risks of operating on an un-grooved runway were identified at the time then perhaps the runway would not have been cleared for unrestricted use.

Finally the issue of ‘slippery when wet’; the NOTAM was cancelled by ‘misfortune’. However, what action should operators take when landing in these conditions – what does ‘slippery when wet’ mean. I cannot find any operational definition or guidance other than ‘take care’ and seek more information.
Perhaps the realisation of landing on a low friction runway (slippery when wet) with the additional hazard of water, which could have been of considerable depth, and a non grooved surface would have invoked the used of contaminated landing data (requires reverse thrust) – and that action could have prevented the landing on operational grounds – Rev MEL / or landing distance required.

Thus, the one simple aspect which apparently might have prevented the accident – having a NOTAM and knowing what action was required when ‘slippery when wet’ was notified, was lacking.
Was this misfortune or weakness in knowledge, or just an accident of the ‘system’?

Slippery when Wet - grooved runways.
UK AIP - Slippery when Wet, sect 1.1.4. para 16.

safetypee . . .What would this "slippery when wet, non grooved" 6360' (1939m) pavement have to do with this accident where neither the captain in the left seat, nor the captain in the right seat, had retarded both throttles and had left one throttle set at significant forward thrust during rollout?

This slippery-when-wet, non-grooved runway is within the operational envelope of the twin engined A320, with or without operating reversers . . . when proper landing technique is exercised...!

Thousands of landings in the rain had been made on this runway at this airport for many decades; even Trans Brasil would land with B727s in the rain many moons ago, when I was a pax. :ooh:

Slippery when Wet
 

GB, the impression gained from the report was that both the airport management and operator only considered a ‘good’ wet runway or a contaminated runway; nothing in between. This provided them with a clear division for either operation or runway closure.
Such a view might have overlooked the importance of not having grooving on the ‘improved’ runway. The absence of grooving on a ‘good’ wet runway could reduce the friction to the low values seen when operating on flooded (contaminated) runways, but also there is a range of wet friction values short of being contaminated which would present a hazard. If this hazard had been identified, then even the ‘improved’ runway might have been closed in the conditions at the time of the accident.
Example calculations:
From the report, landing distance available (LDA) 1880 m 6170 ft,
From the report, the wet landing distance required (LDR) was 1332 m 4370 ft.
4370 ft wet / 1.92 = 2450 ft unfactored
With an approximation based on CRFI tables*, 4370 ft is equivalent to;
4400 ft on a wet runway (CRFI 0.5), ICAO ‘good’ braking action, or
5370 ft in heavy rain (CRFI 0.3), or
6180 ft in standing water (CRFI 0.2).
The latter exceeds the LDA.

If the standing water case had been considered (standing water not actually required, just a poor ‘wet’ surface), a reasonable choice particularly given the runway history, the non-validated runway improvements, and lack of grooving; then first, this could define the conditions as contaminated, which require reverse thrust, and second, the LDR is greater than the LDA.

*CRFI is not measured in wet conditions, but the tables in AC 164 provide excellent guidance; the wet correlation is taken from
‘wet runways’, AIR sect 1.6.5.

There had been many landings on the runway in wet conditions, but how wet was ‘wet’?
The report provides evidence of deteriorating runway conditions via pilot reports, which also suggest increasing reliance on thrust reverse to achieve certificated landing distances – a small, but significant and increasing deviation from the norm, which in some areas had become the ‘new norm’ – perhaps until the ATR accident the day before.
The runway improvements were not validated and the runway remained un-grooved. Thus there was no substantive justification for ‘upgrading the runway condition’, indeed IMHO (with hindsight), the original decision to allow wet operations vice a flooded runway was flawed, possibly due to a failure to consider the range of runway friction in wet conditions. Operators should note that friction is not the only factor for consideration – runway surface texture, tyre condition, rainfall rate, etc - Wet Runways. Also, see Hydroplaning of modern aircraft tires.

The point about ‘Slippery when Wet’ is that there appears to be no guidance as to what operators should do to account for the additional risk in landing on such runways. In this accident, there was a sound defense – close the runway, but due to circumstance, this defense was breached.

Hi,

EASA Airworthiness Directive from 10 November 2010 (too late for 199 people)

http://henrimarnetcornus.20minutes-b...1930142838.pdf

That's a loooong time for what is apparently an useful improvement

Hi,

http://www.pprune.org/rumours-news/3...ml#post5625114

Fixed:
http://henrimarnetcornus.20minutes-b...1930142838.pdf

I had missed that one :
Enhanced A320 logic to warn pilots of throttle retard oversight

Shame on the BEA to have never recommended the obvious.
What next with AF447 ... ?

CONF iture;
No, not unconditionally. I think it is a response which parallels the right direction but should not be counted upon as a sole intervention.

First, I like very much what Safetypee has posted above. Second, I have offered thoughts on this throughout the thread including notions expressing the view that "not closing the throttles at landing" may be the outcome of a cognitive process of "out-thinking the airplane" when in fact no reason exists to do so. By that I mean, a pilot may hesitate in doing something he believes may be irreversible and doesn't fully understand the results of his actions. Where I think the process can cause such confusion is in the FCOM and the MEL of the time, which could have been more clear about what to do with a thrust lever for which engine had a reverser locked out. I recall reading it when I had the MEL item and wondering, do I leave the TL in IDLE or bring both into reverse? It was later clarified and both are brought into reverse but that was not always the case.

Regardless, nothing untoward would have occurred in either selection but by definition (by the incidents), that was not the understanding. Either that is the case, or some event surprised the PF such that he was momentarily unable to act. I have seen that as well, in the data and that was the comment when discussed. It happens, but not often enough to design warnings and software to cater to all untoward rabbit trails.

Now, all kinds of impressions (masquerading as 'understanding) could and have occurred on this and other A320 issues, not without understandable reasons, I will add. But early in the game of learning the airplane, it must be emphasized and accepted that "it is just an airplane". In defence of this assessment I offer two observations, which are, not surprisingly, related to the SATA (and other) hard landing events being discussed on that thread:

1) Why would a pilot expect anything different to occur other than a thrust reduction when a thrust lever was pulled back to IDLE? Was the concern, "what will happen if I bring both into reverse?

What other"devils on the wall" were painted about this and other systems that have no basis in how the aircraft actually functions? Is this merely a training issue or is there something else going on at the cognitive level that requires an "intellectualizing" of the airplane which subtlely displaces the "gestalt" we often speak of in how we normally fly airplanes? (Does automation drive out "art" or can the two co-exist? What part does training have in preserving the "art" while enhancing understanding?)

2) As partial evidence for this view, I offer the Aigle Azur A321 hard landing incident which occurred on January 08, 2008. The handling pilot, a captain, had voiced discomfort with sitting in the right seat. At landing, despite three 'retard' calls, the thrust levers were kept in the CLB detent until touchdown at 600fpm. The aircraft bounced 7ft, the PF selected the TLs to IDLE and the spoilers began to deploy. The 2nd t/d was at 850fpm, 3.3g's. The report, in French, is available here.

It is not a leap to envision the potential for a thrust lever of an engine which reverser has been locked out being kept in the CLB detent even after all the RETARD calls, as that is precisely what occurred here.

We will never know why, or what caused, in the sense of a cognitive "fixation" if I may call it that, the #2 thrust lever in the TAM cockpit to be left in its position while the other was dutifully retarded to idle. But the clues are available to know and to counter such human behaviours more effectively, and I do not believe, nor do I think that the present solution of "more" is the appropriate fix in terms of retard calls or whatever is to be conceived as the next counteractive measure to the next "cause", whatever it may be.

PJ2

Without meaning to sound facetious CONF (as I do respect your opinion even if we have something of a history of disagreement), I've always been under the impression that your view was that a pilot should not rely on computers to that degree, and that they should know to reduce thrust without the need for an audible reminder. As I recall, there was a similar incident which had a report come out around the time of the Conghonas crash, that the recommendations included the above software alteration and that AI were working on it.

I also remember the original thread containing a lot of warnings on the "folly" of non-moving thrust levers - something that was sadly rendered somewhat moot after the Turkish 737 accident at Schiphol.

PJ2 - as always, spot on. Not being a pilot I don't think I'm qualified to make a call as to whether automation interferes with the "art", but I do think that perception of the role automation plays has definitely become muddied by vested interests over the years. As a software engineer I'm painfully aware of the lengths one has to go to in order to protect against faults and fit as many use cases as can be defined.

If the "RETARD" annunciation was intended as a reminder rather than as defining the current configuration state (I suspect it was, but as has been said, this information was not well enough understood by airlines and line pilots), then I can understand the original design intent. However - with 20/20 hindsight it does appear something of a no-brainer.

- October 18, 2004. Runway Overrun during landing On Taipei Sungshan Airport

- March 2006. ASC Safety Recommendation to Airbus Company : “Reviewing the design of stop mode of Retard warning sounds or accommodating other warning methods to ensure that the warning will continue before the thrust levers are pulled back to Idle notch after a touchdown has affirmed.”（ASC-ASR-06-03 –006). Airbus response : H2F3, ECAM alarm only. Not mandatory.

- July 17, 2007. Runway Overrun during landing at Sao Paulo-Congonhas (199 victims)

- November 10, 2010. EASA PAD : “need for improvements in the identification of throttle mis-positioning and so providing further opportunity for the flight crew to identify an incorrect thrust lever configuration and to correct this : « Enhanced RETARD logic »” (mandatory). « Do not install H2F3 »

Too late for 199 people.

Anyone know what that means or contributes? Tombstone 101

BOAC,

"The Tombstone Imperative" was a book on aviation safety written in the late '90s. I think it was written by one of the contributors to Channel 4's "Black Box" documentary, as it seemed to cover many of the same cases.

The title was derived from the opinion of a US official who stated that it seemed "[they] regulate by counting tombstones" - by which he meant that corrective actions and airworthiness directives only seemed to become urgent once enough people had died as a result of their not having been implemented yet.

Thank you DW - alles klar. A well-known judgement used in many spheres including rail, road and sea. How many people can we kill before someone notices.

I'm working from memory here, so if anyone knows differently, please chime in - in the book, the author refers to regulatory authorities on occasion being too cosy with manufacturers and airlines - specifically that the US FAA was founded with two contradictory aims; to regulate the industry from a safety perspective and to promote aviation.

This latter aim came from a time when the fledgling manufacturers and airlines could conceivably be put out of business by compensation arising from a single accident. The book argues that the latter aim should have been dropped years ago, as both manufacturers and airlines are now million- or billion-dollar entities that no longer require government protection.

I´ve written a study on landing excursions where the aforementioned "cognitive fixation" and TAM3054 are covered in detail.
In short, there´s more happening in our brains than meets the eye.

Please feel free to download it from http://dl.dropbox.com/u/6109264/study.pdf.

I haven't read it yet, but many thanks, Daniel, for putting it in the easily-accessible public domain.

And it would appear you're a fellow City Uni alumnus... :)

It's defintiely good stuff - If you ever extend or re-publish I reckon an interesting addition would be to compare and contrast AF358 with AA1420 at Little Rock - the common element being rapid changes in weather and time pressures causing the pilots to make poor (in hindsight) decisions and miss things (arming the spoilers in the case of the latter).

Yes, the Little Rock accident is an interesting (and very well researched) event, however, it is also a classic case of an unstabilized approach - very much in contrast to the Air France accident in Toronto. And that is one of my key points: the importance of stabilized approach criteria has been somewhat overstated at the expense of research into the human factor dynamics of the flare and touchdown phase ("beyond the threshold"). Good approaches have led to bad landings as much as bad approaches have led to good landings.

Fortunately from an academic standpoint, less so from a pilot´s perspective, there is no shortage of "accident material" for further research.

Thanks for the kind comments...

You make a good point, and I hope I didn't come across as presumptuous!

I guess the valid conclusion that can be drawn from comparing and contrasting those two incidents is that even with a stabilised approach phase things can go wrong - if the received wisdom has tended to support the notion that a stabilised approach will always help in that situation, then AF358 would tend to contradict that notion. Which supports your argument quite neatly.

PJ2
I don't see it either as the sole solution. You prone more training, so do I.
As the system is much more complex that the manufacturer wanted it to be, only regular additional training can help a crew to fully assimilate its functioning in details.

But when a specific aircraft type leaves the pavement for the third time, and so for the same reason, in terms of aviation safety, such rabbit trail is called les Champs Élysées, and serious attention is needed.

DozyWannabe
That's correct, but as Airbus choose to put one, they need to go to the end of their logic and don't stop the reminder as long as the demand is not fulfilled, especially when the consequences can and have been tragic.

Thanks for the resume on the book, I didn't know that one.

magelan
Thanks for the link, that's interesting reading.
Concerning the TAM accident, please take note that the following is not exact :
The RETARD callout ceased as soon as the ENG1 THR LVR was selected to REV but the other THR LVR was still in the CLB detent.
The newer FWC version was not the awaited Enhanced RETARD logic, but a useless additional ECAM warning msg.