The airport at Jackson Hole, Wyo., is both beautiful and challenging. JAC sits on a small plain at an elevation of 6,451 ft., some 7 mi. north of Jackson. The airport, which is surrounded by the Rocky Mountains and is in a noise-sensitive area, has one asphalt runway (1/19) that is 6,300 ft. long, 150 ft. wide and features a 0.6% gradient with the Runway 19 threshold on the high end. A four-light PAPI generates a 3-deg. glidepath for visual guidance into Runway 19.
The published approach plate remarks includes this cautionary note: “Aircraft that fail to touch down within the first third of Runway 01/19 sometimes fail to stop on the runway and are at risk for a runway excursion.” In fact, there were 20 runway excursions at JAC from 2007-2010 — half by air carriers, half by general aviation aircraft. Advisory Circulars and SAFOs have been issued for operators to help them avoid such unhappy arrivals.
This month we'll look at a Dec. 29, 2010, incident involving an-200 that ran off the departure end of Runway 19, coming to a stop in deep snow some 730 ft. beyond the runway's end. None of the 179 passengers or six crewmembers were injured and the airplane sustained only minor damage.
This accident is worth reviewing not so much because someone erred, but rather because it points out that multiple system failures can occur when least expected — a timely reminder as we begin to depend on the protections usually offered by automated systems in modern transports. What follows is primarily from thereport on the incident.
The pilots operating American Flight 2253 were well experienced both in type and in JAC operations. The captain had logged 19,645 hr. flight time, 10,779 of them in the 757. He had also logged 300 to 400 trips into JAC. The first officer had accumulated about 11,800 hr. of total flight time, including 3,582 hr. in the 757. He had flown into JAC frequently including four times with the captain during the month of the accident. Investigators found no evidence of fatigue or medical/behavioral conditions that might have adversely affected the pilots' performance.
The en route phases of the flight had been routine and the crew had checked conditions for JAC several times at they approached the destination. IMC prevailed. The first officer was the pilot flying (PF) and the captain was the pilot monitoring (PM). Both pilots later told investigators that they were familiar with the challenging landing conditions that could exist at JAC in the winter (for example, slippery runway conditions and relatively high landing weights, which were common during the ski season). As a result, they said they were especially vigilant and began preparing for the approach and landing at JAC early during what they described as an uneventful flight from Chicago O'Hare International. These guys were on their game.
American's757/767 Performance Manual requires pilots to confirm landing performance limits just before landing, using the actual runway conditions at the time. If the runway braking action is determined to be less than good, pilots “must use the most adverse reliable and appropriate braking action report or the most adverse expected conditions for the runway, or portion of the runway, that will be used for landing when assessing the required landing distance.” The crew of Flight 2253 gathered the most current information about the JAC weather and runway conditions, including wind, MU runway friction values and pilot braking action reports.
The pilot of a corporate jet that landed on Runway 19 about 1 hr. before the incident airplane reported “poor” braking action on the last one-third of the runway, but “good” braking action on the first two-thirds of the runway. The American crew obtained the most current MU friction values for the runway when the flight was 18 min. out. The values were 0.43, 0.43 and 0.39 for the first, second and third sections of the runway, respectively. The pilots also reviewed information about potential delays and/or alternate airports for various circumstances. In addition, they specifically discussed the airplane's performance at high-density altitude airports.
After reviewing this information, the pilots determined that they were legal and safe to land on Runway 19 based on the airplane's landing weight, the existing wind, the weather and the “good” braking action that was reported on the first two-thirds of the runway.
The pilots decided they would touch down within the first 1,000 ft. of the runway and then make efforts to slow the airplane using automatic wheel brakes and thrust reversers as promptly as possible to maximize braking effectiveness while on the “good” braking action portion of the runway. To this end, during their preparations for landing, the pilots armed the speed brakes for automatic deployment after touchdown and selected the automatic wheel brakes to MAX AUTO setting.
Investigators determined that the approach to the runway was normal and that the airplane's touchdown was “firm” and about 600 ft. beyond the approach threshold, after which the struts unloaded momentarily. The captain (PM) called “[speed brakes] deployed.” Seconds later he announced, “Two in reverse.” But the first officer responded, “No reverse.”
The first officer tried to deploy the thrust reversers promptly after touchdown, but they did not deploy. After he made several attempts to get the reversers out, the captain took over the thrust reverser controls and eventually succeeded in deploying them with about 2,100 ft. of runway remaining. The pilots worked in a coordinated fashion to stop the airplane and the CVR indicates that they had no idea what had gone wrong. The airplane continued off the departure end of the runway.
At 11:38:13.9 the first officer radioed “and American, ah, twenty two fifty three is gon' off the end of the runway.” The tower responded “American twenty two fifty three, Roger.” (Both pilots told investigators later that they were unaware until after the airplane came to a stop that the speed brakes, which they had armed for automatic deployment, had failed to deploy after touchdown.)
When the airplane was stopped in the snow, the captain told the flight attendants not to evacuate immediately. He determined that it was safer for the passengers to remain in the airplane until help arrived. In the meantime, the first officer advised the JAC tower and American Airlines operations personnel that they had run off the end of the runway and would need assistance. All occupants remained on board the airplane until JAC ground personnel reached the airplane to help the occupants exit the Boeing. There were no injuries and only minor damage to the aircraft.
Obviously, the crew expected two things to happen immediately after touchdown: the speed brakes to deploy automatically, and the reversers to deploy after being commanded to do so. However, the speed brakes never deployed automatically, although they could have been operated manually, and the reversers were extended late probably because of the rapidity with which the PF attempted to get the levers over the hump. So, the Safety Board took a close look at these systems and the flight crew interactions with them. The airplane's automatic speed-brake system consists of six panels on the upper surface of each wing that can be activated automatically or manually at touchdown to disrupt the airflow over the wings, maximizing the weight on the landing gear and increasing wheel brake effectiveness.
Although automatic speed brakes are not generally required for landings (because pilots can manually deploy them at any time), use of the automatic speed brakes can (or at least, should) ensure their prompt deployment after touchdown, thus optimizing the airplane's deceleration during the landing roll.
To deploy the speed brakes automatically, the pilots move the speedbrake lever to its “armed” detent before touchdown. By design, when the lever is so positioned, the actuator automatically drives it to its full aft position after touchdown (indicated by the air/ground sensing system signal's transition from “air” mode to “ground” mode). This normally results in the extension of the speed-brake panels to their fully deployed position.
However, if the air/ground sensing system reverts back to “air” mode after the automatic speed-brake actuator has begun to extend (during a bounce, for example), the actuator will retract automatically and retract the speed-brake lever. If the air/ground sensing system signal subsequently transitions back to “ground” mode, the speed-brake system is designed to again drive the speed-brake lever to extend the speed brakes.
Investigators reviewed the flight data recorder (FDR) and cockpit voice recorder (CVR) data and confirmed that the pilots positioned the speed-brake lever to its “armed” detent about 7 min. before landing at JAC. FDR data further indicated that, after the airplane touched down, the speed-brake lever moved briefly from its armed position but then returned to it and remained for the duration of the landing. This movement of the speed-brake lever coincided with the air/ground sensing system cycling from “ground” mode to “air” mode and then back to “ground” mode. The speed-brake lever's movement from its “armed” position indicated that the automatic speed-brake actuator had partially extended upon initial touchdown. Normally, when the air/ground signal indicated “ground” a second time, the automatic speed-brake system would have driven the speed-brake lever beyond its “armed” position to fully deploy the speed brakes.
In this case, however, the speed brakes failed to automatically deploy even though the pilots had armed the system. Initial examination and testing of the incident airplane's automatic speed-brake system and its components revealed no evidence of a malfunction that would have prevented normal operation.
However, the aircraft was returned to service and on March 31, 2011, the automatic speed-brake system failed again. At that point, the automatic speed-brake mechanism was removed and examined. What the examination uncovered was a latent assembly defect in the no-back clutch mechanism that intermittently prevented the speed-brake actuator from automatically driving the speed-brake lever beyond its armed detent to extend the speed brakes.
(Because the effects of this defect were intermittent and the defect's visual detection would require disassembly of the no-back clutch mechanism [a function usually performed by the manufacturer or another external facility, not the operator], an operator would not likely have detected the defect during normal maintenance testing. When this assembly defect in the no-back clutch was identified, the manufacturer of the no-back clutch told NTSB investigators that the company would clarify its documentation to ensure proper assembly of the units. Boeing told the Safety Board that it is “currently writing a Fleet Team Digest article that will contain the information concerning the no-back clutch and its possible intermittent anomaly.”)
So — bottom line — unlikely failure number one was a manufacturing defect in the airplane's speed-brake no-back clutch mechanism that prevented the speed brakes from automatically deploying during the incident landing.
What about the reversers?
Although use of thrust reversers is not required during landing, reversers help reduce the airplane's stopping distance when they are deployed early in the landing roll. To initiate thrust-reverser extension, the airplane must detect that it is on the ground, and the pilot flying must lift the reverse thrust levers up and rearward to their interlock position. At that point, the thrust reversers would begin to deploy, and, after they reach their mid-travel positions, the pilot flying must move the levers farther aft to apply reverse thrust, increasing engine power as required to help stop the airplane.
Each engine has its own thrust-reverser control system that hydraulically deploys the thrust reversers based on electrical and mechanical commands it receives from several sources including: pilot inputs; the air/ground sensing system; the thrust-reverser auto restow system; and multiple thrust-reverser system sensors, relays and feedback signals. The thrust-reverser systems function independently except for the common signal they receive from the air/ground system. Because a thrust-reverser extension command is a function of several system inputs, an intermittent loss of any one of these inputs could briefly interrupt continuous deployment.
During the incident landing, a momentary interruption in the “ground” signal from the air/ground sensing system occurred almost immediately after the thrust reversers began to extend. Such interruptions in the “ground” signal are not unusual (commonly occurring during bounced landings, for example). Under normal circumstances, such interruptions are benign and go undetected by pilots because the thrust reversers continue to deploy automatically when the air/ground “ground” signal resumes with no further pilot action required. However, during the incident landing, the thrust reversers locked in transit and did not continue to deploy. The pilots made multiple attempts to deploy the reversers after the air/ground sensing system returned to “ground” mode; however, the thrust reversers did not deploy until about 18 sec. after touchdown.
Post-incident testing of the thrust-reverser control system verified that each engine's thrust-reverser system was fully operational and that each engine's thrust-reverser translating sleeve extended and retracted per the specified maintenance requirements.
However, a detailed review of the thrust-reverser control system design identified one potential scenario in which the momentary change from “ground” mode to “air” mode could cause each engine's thrust-reverser sync-lock mechanism to lock in transit. Such a lockout could only occur if a momentary change from the “ground” mode to the “air” mode occurs in the instant immediately after the thrust reversers begin to extend after touchdown, and in the split second before the thrust reverser's auto restow system is activated. This lockout would prevent movement of the thrust reversers until about 5 sec. after a pilot moves the reverse thrust levers back to their stowed position, allowing the thrust-reverser system to deactivate and begin deployment again when commanded.
FDR data showed that one of the pilots (likely the captain, based on post-incident statements and CVR data) briefly moved the reverse thrust levers to the stowed position and then back to the interlock position about 10 sec. after touchdown. The data further showed that the reverse thrust levers were moved forward of their interlock position allowing the full deployment of the thrust reversers about 18 sec. after touchdown.
During post-incident interviews, both incident pilots indicated that they were unaware of a circumstance in which the thrust reversers could be locked in transit and were unaware of the actions needed to correct the situation. (Further, American Airlines personnel in general, including the company's 757/767 fleet manager, were unaware of this rare event or its resolution.) It is likely that, during their post-landing manipulations of the reverse thrust levers, the pilots moved the levers forward enough to deactivate the system because when the levers returned to their interlock position, the system was properly configured, and the thrust reversers deployed normally.
So, unlikely failure number two was a glitch in the reverser operation logic that was unknown to the crew.
The Safety Board concluded “although the momentary interruption of the air/ground system's 'ground' signal after touchdown would not normally adversely affect the deployment of thrust reversers, in this case it coincided almost precisely with the initial deployment of the thrust reversers and resulted in the thrust reversers locking in transit instead of continuing to deploy. [Talk about Murphy's Law!]”
Immediately after touchdown, the pilot monitoring made calls indicating that the speed brakes and thrust reversers had deployed when, in fact, they had not. The Safety Board evaluated possible explanations for the captain's “erroneous and premature speed-brake and thrust-reverser callouts and his failure to monitor and notice that the speed brakes had not automatically deployed as expected.”
According to the Board, the only positive indication available to the captain to verify extension of the speed brakes would have been the aft position of the handle, which was visible from and within reach of both pilots' seating positions. FDR data showed that the speed-brake handle was in the armed position for landing and began to move within 1 sec. of landing but did not continue to move to the aft (extended) position as expected. The Safety Board concluded that the captain's speed brakes “deployed” callout was likely made in anticipation (not in confirmation) of speed-brake deployment after he observed the speed-brake handle's initial movement. Both pilots likely presumed that the reliable automatic speed-brakes were functioning normally and focused on the thrust-reverser problem after the “deployed” callout was made.
About the same time that the speed-brake handle started to move, the amber annunciation lights on the EICAS display would have provided the captain with a cue that the thrust reversers were in transition. Although the captain called out “two in reverse,” this callout was not based on the illumination of the green annunciation since the air/ground sensing system cycling to “air” mode prevented the reversers from deploying at that time. (Immediately following the captain's “two in reverse” callout, the CVR recorded the first officer stating, “No reverse” in a voice that sounded strained.) Given the typical reliability of the thrust-reverser system, it is likely that the captain made the callout because he expected normal thrust-reverser activation.
The Safety Board determined that the probable cause of this incident “was a manufacturing defect in a clutch mechanism that prevented the speed brakes from automatically deploying after touchdown and the captain's failure to monitor and extend the speed brakes manually. Also causal was the failure of the thrust reversers to deploy when initially commanded. Contributing to the incident,” said the Board, “was the captain's failure to confirm speed-brake extension before announcing their deployment and his distraction caused by the thrust reversers' failure to initially deploy after landing.”
Based on those findings, the Safety Board recommended the:
Require all operators of existing speed-brake-equipped, transport category airplanes to develop and incorporate training to specifically address recognition of a situation in which the speed brakes do not deploy as expected after landing.
Require all newly certified transport category airplanes to have a clearly distinguishable and intelligible alert that warns pilots when the speed brakes have not deployed during the landing roll.
Require Boeing to establish guidance for operators and pilots of all relevant airplanes to follow when an unintended thrust-reverser lockout occurs.
The NTSB also reiterated recommendations to the FAA arising from earlier investigations and attached them to this report. They include:
Establish best practices for conducting both single and multiple emergency and abnormal situations training.
Once the best practices for both single and multiple emergency and abnormal situations training have been established, require that these best practices be incorporated into all operators' approved training programs.
Require that all pilot training programs be modified to contain modules that teach and emphasize monitoring skills and workload management and include opportunities to practice and demonstrate proficiency in these areas.
More Than Meets the Eye
Two Safety Board members — Vice Chairman Christopher Hart and member Robert Sumwalt — concurred in these findings but believe the matter is more complicated, and we agree. Hart focused on the challenges attendant to the man-machine interface in highly automated aircraft, while Sumwalt keyed in on training. Take a look at their comments in the accompanying sidebars. They provide important food for thought.