[Peetwo]

EK521 accident uncovers a TOGA flaw -

Excellent article by BB in the Oz today possibly slices up the first piece of Swiss cheese in the EK521 Dubai accident :

Emirates B777 crash was accident waiting to happen

• Byron Bailey
  
• The Australian
  
• 12:00AM August 9, 2016
  

The crash of an Emirates B777 during an attempted go-around in Dubai last Wednesday was always an accident waiting to happen.

It was not the fault of the pilots, the airline or Boeing, because this accident could have happened to any pilot in any airline flying any modern glass cockpit airliner — Airbus, Boeing or Bombardier — or a large corporate jet with autothrottle.

It is the result of the imperfect interaction of the pilots with supposedly failsafe automatics, which pilots are rigorously trained to trust, which in this case failed them.
First, let us be clear about the effect of hot weather on the day. All twin-engine jet aircraft are certified at maximum takeoff weight to climb away on one engine after engine failure on takeoff at the maximum flight envelope operating temperature — 50 degrees C in the case of a B777 — to reach a regulatory climb gradient minimum of 2.4 per cent.

The Emirates B777-300 was operating on two engines and at a lower landing weight, so climb performance should not have been a problem. I have operated for years out of Dubai in summer, where the temperature is often in the high 40s, in both widebody Airbus and Boeing B777 aircraft.

Secondly, a pilot colleague observed exactly what happened as he was there, waiting in his aircraft to cross runway 12L. The B777 bounced and began a go-around. The aircraft reached about 150 feet (45 metres) with its landing gear retracting, then began to sink to the runway.

This suggests that the pilots had initiated a go-around as they had been trained to do and had practised hundreds of times in simulators, but the engines failed to respond in time to the pilot-commanded thrust. Why?

Bounces are not uncommon. They happen to all pilots occasionally. What was different with the Emirates B777 bounce was that the pilot elected to go around. This should not have been a problem as pilots are trained to apply power, pitch up (raise the nose) and climb away. However pilots are not really trained for go-arounds after a bounce; we practise go-arounds from a low approach attitude.

Modern jets have autothrottles as part of the autoflight system. They have small TOGA (take off/go-around) switches on the throttle levers they click to command autothrottles to control the engines, to deliver the required thrust. Pilots do not physically push up the levers by themselves but trust the autothrottles to do that, although it is common to rest your hand on the top of the levers. So, on a go-around, all the pilot does is click the TOGA switches, pull back on the control column to raise the nose and — when the other pilot, after observing positive climb, announces it — calls “gear up” and away we go!
But in the Dubai case, because the wheels had touched the runway, the landing gear sensors told the autoflight system computers that the aircraft was landed. So when the pilot clicked TOGA, the computers — without him initially realising it — inhibited TOGA as part of their design protocols and refused to spool up the engines as the pilot commanded.

Imagine the situation. One pilot, exactly as he has been trained, clicks TOGA and concentrates momentarily on his pilot’s flying display (PFD) to raise the nose of the aircraft to the required go-around attitude — not realising his command for TOGA thrust has been ignored. The other pilot is concentrating on his PFD altimeter to confirm that the aircraft is climbing due to the aircraft momentum. Both suddenly realise the engines are still at idle, as they had been since the autothrottles retarded them at approximately 30 feet during the landing flare. There is a shock of realisation and frantic manual pushing of levers to override the autothrottle pressure.

But too late. The big engines take seconds to deliver the required thrust before and before that is achieved the aircraft sinks to the runway.

It could have happened to any pilot caught out by an unusual, time-critical event, for which rigorous simulator training had not prepared him.

Automation problems leading to pilot confusion are not uncommon; but the designers of the autoflight system protocols should have anticipated this one. Perhaps an audible warning like “manual override required” to alert the pilots immediately of the “automation disconnect”.

My feeling is the pilots were deceived initially by the autothrottle refusal to spool up the engines, due to the landing inhibits, and a very high standard of simulator training by which pilots are almost brainwashed to totally rely on the automatics as the correct thing.

MTF...P2