Tenerif... AUSTIN!

[Gabriel]

The tower communicated a lie to the 767 (that the runway was and would remain clear)

It was not a lie because here in the US "cleared to land" doesn't mean that the runway is and will remain clear. It barely means that you are authorized to land and that I (ATC) assessed that the runway WILL be clear by when you do so, and if things don't go as I expect I will let you know.

The tower also communicated a sin to the 737 (to proceed onto a runway that had already been cleared for the 767). The 737 accepted that sinful act and the entire safety culture just imploded right there.

Again, this is not a sin, this is Tuesday. Or Wednesday. Or any other day, here in the USA.
And let me be clear, it is not a sin from the controller or pilot point of view. It is a sin from the design point of view.
And let me be clear again, I am talking in general about letting another plane to land or take-off on a runway where there is another plane cleared to land. And not about the particular way in which said practice was implemented in this particular incident which my have been sinful also in its execution.

- Cleared to land means cleared runway. No grey anything.

It doesn't mean that. It means authorized to land. The rules by which this authorization can be given differ in different parts, so in most of the world it implies that the runway already is and will remain clear. Not in the US.

[Evan]

It doesn't mean that. It means authorized to land.

Ok, fine, deconstruct that. Authorized in what respect? Customs? The company check for the airport services has cleared? No. Authorized in that it is safe to land. Authorized in that the runway is designated for you and it is free of threats.

...or it will be? The runway is expected to be clear when you arrive at it? So what is the value of this provisional "authorization"? That level of authorization is implicit enough if you've already been allowed onto the runway approach. If it's not clear but expected to be clear later, issue expect late clearance. Otherwise, in low visibility, everything rests upon the controller. One paltry slice of cheese known for having lots of holes and a good deal of balls in the air.

Pilots need a clear confirmation that the runway beyond their visual range is actually clear before proceeding past a safe go-around point. This incident makes that very clear.

It was not a lie because here in the US "cleared to land" doesn't mean that the runway is and will remain clear. It barely means that you are authorized to land and that I (ATC) assessed that the runway WILL be clear by when you do so, and if things don't go as I expect I will let you know.

In Cat III! Insane! It's just a matter of time for the Tenerife sequel. Are you saying that outside of the US, things are more sane in this respect?

[Gabriel]

Ok, fine, deconstruct that. Authorized in what respect?

In the sense you (pilot) want to land here, that you can do that only after I (tower) clear you to do so, that certain parameters clearly spelled out in my procedures and in regulations must be met before I grant you such clearance, and that I asses that these parameters have been met.

And stop putting words in my mouth. I am talking about the in-advance clearance to land in general and not about the specific way it was executed in this incident.

In Cat III! Insane! It's just a matter of time for the Tenerife sequel. Are you saying that outside of the US, things are more sane in this respect?

Once again, stop putting words in my mouth. That was a direct replay to what I quoted you saying, that ATC lied because they told the 767 that the runway would remain clear. That is not what ATC did because in the US cleared to land doesn't meant what you say it means. Period.

Now, put these words in my mouth: I was the OP of this thread, I titled it "Tenerife" (or sort of) for a reason. And I have been criticizing the US way to "cleared to land" and contrasting it with the "most-of-the-rest-of-the-world" way since the first post in this thread and since years ago, at least since the report of Delta 1086 came out.

So I do thing what you said (the quote above) but that was NOT what I was expressing in what you quoted me.

Recognize that the in-advance clearance to land is done possibly thousands of times per day, millions of times per year, and the vast majority of them don't end in close calls like here or in Delta 1080. In my opinion the system is safe but it has a hidden risk (well, not so hidden, just that it caused non-fatal incidents so far) that will one day result in a tragedy, a risk that is unnecessary and can be easily avoided.

That we have that systemic flaw is one thing.
The way that the controller performed in this incident is a different thing.
Not having the gap mentioned above would mean that there would have been an additional layer of Swiss cheese to save the day, and that saving the day would not have required a pilot to do something he was not required to do (see-and-avoid in a cat III approach). But not having the controller screw up would have also saved the day with no action required by the pilots. And even in the non-US way there are ways that controllers and pilots can screw up. For example a distracted controller may clear a plane to cross the runway i front of a landing plane, or a distracted pilot may land forgetting that he had not been cleared to land yet.

The non-US way adds a slice of Swiss cheese but is not a bullet proof slice. But it is still a slice, it adds up safety, and it is free.

[Evan]

In the sense you (pilot) want to land here, that you can do that only after I (tower) clear you to do so,

Meaning?

that certain parameters clearly spelled out in my procedures and in regulations must be met before I grant you such clearance,

Hello!

and that I asses that these parameters have been met.

Exactamundo. Not that these parameters 'will be met'. With the only safe parameter being that the runway is clear.

And stop putting words in my mouth. I am talking about the in-advance clearance to land in general and not about the specific way it was executed in this incident.

I'm not trying to put words in your mouth. I'm trying to understand your position here, which I thought was the same as mine: that this is a recipe for disaster.

In my opinion the system is safe but it has a hidden risk.

So which is it? No system that has an unnecessary and removable hidden risk is safe.

And you have already told us that 'in-advance' clearance is not necessary.

And 'expect late clearance' is only safe if it has a safe minimum and a default go-around point.

The non-US way adds a slice of Swiss cheese but is not a bullet proof slice. But it is still a slice, it adds up safety, and it is free.

See, I entirely agree with you. Except to point out that, in the US, we are currently at one—just one—very insecure slice of cheese. That seems to conflict with all the other redundancies required for CAT II/III ops. Having a fail-operational autoland system operating in a protected ILS is largely a waste of effort if the controller is going to plow you into another airplane on the runway.

[Gabriel]

Exactamundo. Not that these parameters 'will be met'. With the only safe parameter being that the runway is clear.

I am sorry, but the runway being and remaining clear all the time from the time I clear you to land to the time you actually land is NOT among the "parameters clearly spelled out in my procedures and in regulations that must be met before I grant you such clearance".

So, when you say I lied to you because I cleared you to land because "that means that the runway was and would remain clear", the liar is you because that is NOT what cleared to land means, not in the US anyway.

I may have still lied to you because "cleared to land" may include other parameters that were not met when I cleared you to land. But the one you mentioned is not one.

Capice?

Can you distinguish the contrast between the US and the most-of-the-non-US procedures, from the possible contrast between the US procedures and what this controller did here?
These are 2 different contrasts. This controller may be guilty of not following the US procedures, but is definitively NOT guilty of clearing a plane to land when the "runway is and would remain clear" was not met, because not meeting parameter that exists only in your imagination (context: US) that is not only not against regulations, but it is every day SOP in the US executed thousands of times per day which, to my knowledge, has never caused an accident.

I'm not trying to put words in your mouth. I'm trying to understand your position here, which I thought was the same as mine: that this is a recipe for disaster.

I have 2 positions:

a) The procedure in the US is safe in the sense that it was applied in hundreds of millions of times without causing an accident. Note that that exceeds by at least one order of magnitude the leve of safety required for single catastrophic point of failure in aircraft design and certification (1 in 10 million flights). But the system has an inherent risk which has already caused a few close calls, and this risk is unnecessary and can be solved at virtually no cost to implement and virtually no drawbacks for the continued operation. So why not plug this hole regardless of how little it is? I am sure that it would be fixed if/when it causes a fatal accident. So why wait?

b) What the controller did in this particular incident was probably a violation of the US procedures. And I hope that it is clear for you by now that the reason why it was a violation, if it was, was NOT because it didn't meet the "runway is and will remain clear" inexistent requirement. And if it was NOT a violation, the the system has greater weaknesses than the in-advance clearance to land.

So which is it? No system that has an unnecessary and removable hidden risk is safe.

I am sorry but that is a stupid comment and I will not even lose time explaining why. If you cannot see it by yourself, any attempt to explain it is hopeless.

[Evan]

I am sorry but that is a stupid comment and I will not even lose time explaining why. If you cannot see it by yourself, any attempt to explain it is hopeless.

I'm sorry but it is not a stupid comment. A clear and defined risk can exist in a safe environment. A hidden one that has presented itself but remains hidden is not part of a safe environment. Stealth factors are a common causative factor in aviation disasters.

Capice?

Yes, capice. Except...

The procedure in the US is safe in the sense that it was applied in hundreds of millions of times without causing an accident.

Hundreds of millions of times in CAT III with critically low ceilings and visibility with another aircraft sitting on the threshold? Because, that's bound to happen. Oh, wait, it did happen...

Take this incident and lower the visibility. Delay the 737 another 30 seconds. Try that once.

I think, what we are both saying, is this:

So why not plug this hole regardless of how little it is? I am sure that it would be fixed if/when it causes a fatal accident. So why wait?

The answer is that we often have a 'won't happen again' attitude toward safety that waits for the inevitable before imposing regulation or procedural change. It is based the the following mentality:

The procedure in the US is safe in the sense that it was applied in hundreds of millions of times without causing an accident.

In critically low CAT II/III ops, 'cleared to land' must mean the ILS is now protected and the runway and obstacle free zone are clear. Anything else is a disaster waiting to happen. Give it late or don't give it at all. That's your missing slice of cheese.

[Gabriel]

Over and out. Again.

[Evan]

Over and out. Again.

Not so fast. Here is what you opened this thread with:

At a ground speed of say 120 miles per hour (to make the math easy) an airplane is making 2 miles per minute. That is 1.5 minutes to touchdown. Taking into account the time it takes to position the plane from the hold-short line to the centerline and spool up the engines, accelerate and lift off, it is basically impossible that the departing plane will be airborne in the 1.5 minutes it would take the arriving plane to touch down. So why clear the departing plane to take off with a another plane 3 miles out? Especially in IMC. And let's not even talk about a possible aborted take off, let alone an accident during take off that may leave the pilots of the departing plane unable to contact the tower, and the tower unable to see the departing the plane in these low vis conditions.

2 things here that I don't understand and that I dislike and that are unlike what is done in most of the world.

1- Clearing a plane to take off with another one 1.5 minutes from touchdown, in solid IMC where the pilots of the departing and arriving planes cannot see each other and the tower can see neither.

2- The "in-advance" clearances to land, where a plane is cleared to land with another plane cleared to land or take off on the same runway ahead of them. In most of the world that is illegal, nobody is cleared to occupy a runway unless the runway is already clear and expected to remain clear until the cleared plane occupies it. What you have instead is the delayed clearances, like "expect landing clearance on short final". If the arriving plane did not receive the clearance (which would only be received when it is confirmed that the runway is currently clear and expected to remain clear), then they have to go around.

And I agree with every word of that. Especially:

In most of the world that is illegal, nobody is cleared to occupy a runway unless the runway is already clear and expected to remain clear until the cleared plane occupies it.

Or, if that is not 'practical':

What you have instead is the delayed clearances, like "expect landing clearance on short final". If the arriving plane did not receive the clearance (which would only be received when it is confirmed that the runway is currently clear and expected to remain clear), then they have to go around.

It the NON_US world, clear means clear, am I clear on that?

So, your opening tirade is directed at the danger of 'cleared to land' not meaning 'runway is clear' in the US. Do I capisce that correctly?

If so, why are you now telling us "The procedure in the US is safe in the sense that it was applied in hundreds of millions of times without causing an accident."

I'm not saying that issuing landing clearance when the runway is not 'clear and expected to remain clear' is a violation of US procedure. I'm saying it is a violation of universal safety in critical IMC. It is unsafe and needs to be revised in step with the NON_US procedures.

Are you not saying that as well?

All I am adding to that is that the 'expect landing clearance on short final' should have a hard minimum distance out, as in 1nm at the least, to assure a go-around will not conflict with anything on the runway. And, if I'm not mistaken, London Heathrow has exactly that limit.

(1nm at 120mph ground speed (this 767 was at 130kts) leaves about 30 seconds to react, correct for the runway or initiate a go-around, get effective thrust, arrest sink rate and achieve positive climb before crossing the threshold where the tail and main landing gear must clear a 50+' vertical stabilizer.)

[Gabriel]

Not so fast.

Ok, let me try one last time:

You quoted me above, point 1 and 2, right? They are different and almost independent points.

Point 1 is the rant of what the controller did here. Point 2r is the rant on "in advance" clearance to land.
The overlap is that point 2 would have been an additional slice of Swiss Cheese

In the US and other parts of the world (I think Canada is another example), giving you a clearance to land when other planes are already or will be cleared to land, take-off or cross your runway before your arrival, in VMC or IMC, in daylight or night time, in whatever CAT approach, is not lying to the crew. It is everyday SOP in these places and it is the norm rather than the exception. Cleared to land, in those places, doesn't mean what you and I would like it to mean and what it means in most of the rest of the world (but not "universally" as you said). And pilots know it. ESPECIALLY pilots of US airlines. So ATC did not lie to the FedEx crew. The FedEx and Southwest crew knew EXACTLY what ATC meant when he cleared FedEx to land and repeated that FedEx was still cleared to land after clearing Southwest to take off. If there was a violation of the rules, if there was a violation of the safety culture by ATC, (and I think there was both), it was NOT because he cleared FedEx to land knowing that other planes would occupy the runway. Had he done all he did except with the FedEx say 6 miles out instead of 3, it would have been ok provided that he kept monitoring the progress of the Southwest to confirm that they were airborne prior to the FedEx crossing some threshold, and ready to issue a go-around instruction to the FedEx if not.

The other incident I mentioned (Delta 1086) was IMC but was not CAT II or III. Which shows that CAT level is not a good criteria in deciding the acceptability of these in-advance clearances.
Although unrelated with in-advance clearances, the incident where an Air Canada plane arriving to SFO becase within 30 ft of landing on top of 5 big airliners that were lined up in the taxiway holding short for take off show that VFR or IFR is not a good criteria either.

In non-towered airports (which airliners sometime use too), pilots maintain their own visual separation for using the runway. So clearance to land / take-off is not even a thing. And airplanes are not even required to have a radio to operate in some of these airports.

"Inspired" on this, the only way I would accept "in-advance" clearance to land (or even to take off) is if the pilot confirms having the other airplane in sight and the tower instructs said pilot to maintain visual separation. I used to fly in a now closed airport in the Buenos Aires areas. It was a small airport with no airline operations, but at the time it was the busiest airport in Argentina, in in the weekends it became extremely busy, with plane owners doing weekend trips, or just flying around for fun, and flight schools having their peak of activity. It was not uncommon to call downwind and receive a response like "You are #6 behind a Cessna, #1 has just touched down, #2 is on short final", and then you looked and found #3 turning to final, #4 turning to base, and certainly, # 5 was the Cessna on downwind in front of you, and then you replied "I have the Cessna in sight" and they would say "report turning base". And they would squeeze take-offs between these landings whenever they could (I have spent 20 minutes on the line waiting for my take-off turn). They would never say "cleared to land" and then clear someone else to do something else on that runway ahead of you, but they would give "conditional" clearances. Like I am MRG approaching, OJN is landing, and MZB is holding short for take-off (by the way these are 2 Tomahawks and a C-152 I actually flew in that airport).

MRG: MRG turning final:
TWR: MRG, continue.
MZB (who just witnessed OJN cross the threshold in front of them): MZB is ready for an immediate take-off (which in the US is now called "no-delay" take-off)
TWR: MZB line up, OJN has just landed, with the runway clear, cleared for take off.
MZB: In sight, lene up and with runway clear cleared for take off.
TWR: MRG, MZB is lining up for take-off. With the runway clear, cleared to land.
MRG: In sight, with the runway clear, cleared to land. (and believe me that in multiple occasions the MZB of that day did not perform a so immediate take-off and was still on the roll when I crossed the threshold, so I had to execute a go-around.

This felt safe to me, and very agile too.

Now, does this mean that "in advance" clearances as done in the US are unsafe? You don't like them, I don't like them, you and I agree that this practice should be changed and that doing that would make it safer with virtually no drawbacks (or with drawbacks that are better than the current drawbacks it replaces, like the risk of doing unnecessary go-arounds vs not doing necessary ones), but REALITY show that they are not unsafe, rather the opposite. Now "safe", like "cold", "nice", "strong" etc are relative terms. That something is safe doesn't mean that it cannot be safER.

Using in-advance clearances to land, even when posing an avoidable and unnecessary risk, is much safer than wingsuit flying even after you eliminated all the risks that are avoidable and unnecessary.
And that is why your comment that in-advance clearances are not safe, and that the reason for that is that they have an unnecessary risk, is really stupid. It is still much safer than things that you do everyday like driving.

Now let's go back to point 1. Say that we are in Europe where the "most-of-the -non-US-world" procedure is in place. So point 2 is not a thing.
Let's say that FedEx is authorized to continue the CAT-III approach and is not cleared to land yet.
Then when the FedEx is 3 NM out, TWR clears Southwest to take-off.
That is still ridiculously poor judgement by the controller, unsafe, and probably illegal. Having the FedEx NOT cleared to land adds a layer of safety, but it is not bulletproof and it is not something ATC should relay on to save the day. Like planes never landed or took off without being cleared, right? Like Tenerife happened because KLM was cleared for take off with Pan-Am still on the runway? No.

[Evan]

It is everyday SOP in these places and it is the norm rather than the exception. Cleared to land, in those places, doesn't mean what you and I would like it to mean and what it means in most of the rest of the world (but not "universally" as you said).

This is the point of confusion between us: I am (now) aware that this is SOP in the US. What I am saying is that this SOP is universally unsafe, not universally illegal. And therein lies the problem. It should be universally illegal.

Now wait... first of all I am saying this ONLY in the context of severe IMC. Wherever pilots can have eyeballs on the runway at least 1nm short of the threshold, this adds that second layer of cheese. So your Tomahawk anecdotes seem very safe. In order for a collision to occur in good visual conditions, both the controller and the pilot must commit a deadly error. Two layers. So, while I appreciate all you have added there about ops in good visual conditions, they are not germane to the point I am making. Tenerife would obviously not have happened in such conditions. This is specifically about approaching the runway in the blind with no redundancy beyond the controller (who failed to warn off the 767 in this incident).

And secondly, we know, painfully well by now, that just because a hidden danger has not yet resulted in a catastrophe over many flights, it does not mean it is a safe situation. AFAIK, Tenerife was the first time an airline pilot ever mistook an instruction to line up for takeoff with a clearance for takeoff AND subsequently collided with another airliner on the runway (and thus, after the disaster, the standard language was changed to line up for 'departure'). The danger was always there but nobody seemed to recognize it until some things got bent.

So it comes down to language. "Cleared for departure" does not mean "cleared for takeoff". Nobody can take off until the magic words "cleared for takeoff" are given. (Hopefully that one stuck... )

And we both agree on everything else. As long as the landing clearance is never given until the runway is verified to be clear, and a go-around must occur if not given before a safe minimum, viola, there is your second slice of cheese when visibility is rotten and the windows can't save you.

And now we can do nothing more than wait for it to happen, I suppose.

[Gabriel]

2 things:

1- 2 critical differences between the Argie operation and the US-style in-advance clearance in VMC are:
a) The pilot of the second plane was made aware of the presence of the other plane, was required to confirm visual contact, and was required to maintain visual separation and not take-off or land until the runway was clear of such traffic.
b) Nobody was cleared to land or take off unless the runway was already cleared and expected to remain clear. The first plane was cleared first, and the second plane was cleared to "land / take-off when the pilot visually confirmed that the preceding trafic has cleared the runway". For example, this would NOT have happened: MRG, cleared to land. MJN, are you ready for an immediate take-off? Do you have the traffic on long final in sight? Ok, maintain visual separation, cleared for take off, no delay." See the difference?

2- We clearly have different understandings of what safe means. It think that an operation that causes less than 1 fatal accident every 1 Billion operations is safe. I think that having such a safe operation that can be made even safer by eliminating a known risk at virtually zero cost and virtually zero drawbacks for the operation, is unacceptable. But still safe. Just not as safe as it could be for virtually free. if tomorrow we have a fully loaded 747 colide with a fully loaded A380 killing 900 in an accident that could have been avoided by using the most-of-the-non-US approach to landing clearances would not change my opinion that the current practice is safe, because safe doesn't mean accident-free, and it would still be less than 1-part-per-billion. But it would be neglect, or a sin. Because we know the risk, we know how to avoid it, we can avoid it virtually for free, and still we don't.

[Evan]

See the difference?

Yes. Do you? I'm not talking about VMC here. I want a redundant means of confirmation that the runway IS clear. In VMC, that is seeing. That is safe enough for me. But, when there is no seeing, clear to land needs to mean the runway that you cannot see is actually clear and will remain so.

I also think, since there is an entire agency dedicated to making aviation safer, that it is reasonable to expect them to make incremental improvements to safety—particularly when an apparently safe procedure has been revealed to harbor a hidden* danger (See: this incident), especially when it comes with virtually zero cost and virtually zero drawbacks for the operation—rather than wait until people have to die to prove the danger. So, one hopes they look to Europe and see the light...

We agree Gabriel.

*I'm being generous, the danger is pretty obvious.

[Gabriel]

I want a redundant means of confirmation that the runway IS clear. In VMC, that is seeing. That is safe enough for me.

Not sure what "safe enough" means. The system now is "safe enough" for me in the sense that I happily get on airplanes without this risk being a particular concern. It is not "safe enough" in the sense that for me it is unacceptable to have a deadly risk, no matter how unlikely, that can be fixed "for free", and not fix it. In that second sense, relying on the pilot seeing the other plane is not enough for me because it has proven to be unreliable, and again it is a risk that can be fixed for free. If we are going to require French-style clearances, is there any reason not to go Frnch-style even in VMC? Or at the very least get confirmation that the trailing plane has the leading plane in sight?

[Evan]

If we are going to require French-style clearances, is there any reason not to go Frnch-style even in VMC? Or at the very least get confirmation that the trailing plane has the leading plane in sight?

I'm all for it.

[TeeVee]

dont tell evan...

another runway near miss, this time at BOS, with a lear jet taking off after being instructed to wait for landing cross-traffic. maybe they need to install moving barriers that lift up out the tarmac to prevent this type of thing. whaddaya think evan?