TransAsia GE235

There are two unspoken words in the pilot world: fear and panic. In theory, we have these emotional reactions to stress trained out of us in the simulator. One of the problems with this approach is that in the simulator we know our lives are not on the line and perhaps the fear is reduced accordingly. But there are also cases where simulator performance could have predicted real world performance. This is just such a case.

Because this accident was caught by the dash camera of a taxi it captivated the world for a few days. It became obvious rather quickly that the captain shut down the wrong engine. Not so obvious was that the pilot in the other seat could have been more assertive. Finally, another lesson learned here is that if we fail to automatically default to standard operating procedures in times of stress, our ad hoc reactions can be fatally wrong.

Everything here is from the references shown below, with a few comments in an alternate color.

Photo: TransAsia GE235 Loss of control and initial impact sequence, (Accident Occurrence Report, Figure 1.1-2)

• Date: February 4, 2015
• Time: 1054 Taipei Local Time
• Type: ATR-GIE Avions de Transport Regional ATR72-212A
• Operator: TransAsia Airways
• Registration: B-22816
• Fatalities: 4 of 5 crew, 39 of 53 passengers
• Aircraft fate: Destroyed
• Phase: Initial Climb
• Airport (departure): Taipei Songshan Airport (TSA/RCSS), Taiwan
• Airport (arrival): Kinmen Shang Yi Airport (KNH, RCBS), Taiwan

[Accident Occurrence Report, §1.1]

• On the day of the occurrence, the flight crew was assigned to operate two return flights from Songshan to Kinmen. The four sectors were allocated two operating captains and a first officer acting as an observer.
• The third sector (GE235), which was the occurrence flight, was scheduled to depart Songshan at 1045. Captain A, who was the pilot-in-command (PIC), occupied the left seat and was the pilot flying (PF) for the take off, while Captain B occupied the right seat and was the pilot monitoring (PM). The first officer occupied the cockpit jump seat as an observer pilot (OBS).
• According to the Flight Data Recorder (FDR) and Cockpit Voice Recorder (CVR) data, GE235 took off from Songshan runway 10 at 1051 in accordance with the MUCHA 2 Quebec standard instrument departure (SID) procedure bound for Kinmen. The take off roll commenced at 1051:39. Four seconds later (1051:43), the PM mentioned that the automatic take off power control system (ATPCS) was not armed. The PF responded with “really” and then said “ok continue to take off”. The PM replied “we will continue”. Seven seconds later, the PM stated “oh there it is ATPCS armed”, and then the aircraft became airborne at 1052:01. The landing gear was retracted after achieving a positive rate of climb. The aircraft accelerated and continued to climb. The crew selected an altitude of 5,000 feet (ALT SEL 5,000) and airspeed of 115 knots on the autopilot. The left coupling autopilot was engaged with lateral navigation (LNAV) and indicated airspeed (IAS) modes. At 1052:34 the Songshan tower controller instructed the GE235 flight crew to contact Taipei Approach while the aircraft was commencing a right turn and climbing through an altitude of 1,000 feet.
• At 1052:38, when the aircraft was continuing the right turn and climbing through 1,200 feet, the FDR indicated that engine number 1 (ENG 1) was operating in an uptrim condition with its bleed valve closed. That corresponded with the beginning of an ATPCS sequence, which included the auto feathering of the engine number 2 (ENG 2) propellers. The master warning (MW) annunciated in the cockpit and the ENG 2 propeller pitch angles started to advance to the feather position accompanied by the indication of the “ENG 2 FLAME OUT AT TAKE OFF” procedure on the engine warning display (EWD).

The captain had everything he needed to ascertain what was going on at this point. The right engine had auto feathered and the warning display told him it was the right engine that had flamed out. He might not have had any adverse yaw indications, since the autopilot was designed to handle just such an occurence. But he soon gave up that advantage . . .

• At 1052:41, the autopilot was disconnected as the aircraft climbed through an altitude of 1,300 feet. Three seconds later at 1052:44, the ATPCS sequence ended and the ENG 2 propeller was fully feathered. At 1052:43 the PF stated “I will pull back engine one throttle”. The PM responded “wait a second cross check”, but the ENG 1 power lever angle (PLA) had already been retarded from 75 degrees to 66 degrees. The PF and PM then both announced heading mode, and continued the flight. At 1052:51, the aircraft was climbing through 1,485 feet at 106 knots, with a heading of 131 degrees. The automatic flight control system (AFCS) indicated that HDG SEL and IAS modes were selected. At 1052:57, the selected heading was altered to 092 degrees and the aircraft then started turning to the left at an airspeed of 106 knots.

There were no indications of fire and no real reason to pull back anything given that the auto feather had taken care of that for them. The PM appeared to realize the captain was set on the wrong engine but didn't follow through by checking the PF's actions or noticing the PF's annunciation of "number one" engine.

• At 1053:00, the PM stated “okay engine flame out check”. The PF responded “check” and the PM stated “check up trim yes, auto feather yes”. At 1053:05 the PF responded “okay”. At almost the same time, the PM stated “watch the speed” because the indicated airspeed had reduced to 101 knots. The PF then announced ”pull back number one”, and the ENG 1 PLA was retarded to 49 degrees. While the ENG 1 power lever was retarded, the PM said “okay now number two engine flameout confirmed”, and the PF responded “okay” but the ENG 1 PLA still remained at 49 degrees.

The PF stated "number one" and pulled back the left engine, the PM stated "number two" and didn't seem to notice the PF's wrong engine pull.

Photo: TransAsia GE235 flight path and key events rendered on a fused satellite image and digital surface model between 1053:07.7 and 1053:59.7, (Accident Occurrence Report, Figure 1.11-6)

• At 1053:09, the aircraft had climbed to 1,630 feet, which was the highest altitude recorded for the occurrence flight. The indicated airspeed was 102 knots. The AFCS IAS mode then reverted into PITCH HOLD mode and one second later the stall warning annunciated in the cockpit for one second. The PF then stated “terrain ahead” and the PM replied “okay lower . . .” and the OBS said “you are low”. At 1053:13 the stall warning sounded for four seconds and the stick shakers activated. The PM stated “okay push, push back”, to which the PF stated “shut”. The PM responded “wait a second . . . throttle throttle”.
• Between 1053:13 and 1053:15, the ENG 2 PLA was advanced to 86 degrees and the ENG 1 PLA was retarded to around 34.5 degrees (idle position). At 1053:18, the aircraft was heading 087 degrees but in a continuous left turn with a 10 to 20 degree angle of bank, descending through 1,526 feet at an airspeed of 101 knots. At 1053:19 the PF said “number one” followed by “feather shut off”. The PM called “number feather”, and then the stick shakers and stick pushers activated several times until 1053:27. At 1053:24, the FDR indicated that the ENG 1 condition lever was in the fuel shut off position, and six seconds later the ENG 1 propeller had attained the feathered position. The aircraft’s indicated airspeed was 110 knots at an altitude of 1,165 feet and descending.

At this point they had no thrust on either engines and presumably no engine-induced yaw. The airplane was still above minimum control speed.

Photo: TransAsia GE235 flight path and key events rendered on a fused satellite image and digital surface model for the final 23 seconds of flight, (Accident Occurrence Report, Figure 1.11-7)

• At 1053:35, the PM declared an emergency (Mayday) to air traffic control (ATC). The aircraft was heading 050 degrees and had commenced to bank to the right. From 1053:46 to 1054:04, the flight crew tried to engage the autopilot twice, but they did not succeed. At 1053:53, the OBS said “how come it becomes like this”. At 1054:05, the PM stated “both sides . . . lost” and two seconds later the PM realized and stated “no engine flameout we lost both sides”. At 1054:09, the PF stated “restart the engine”, when the altitude was 545 feet with an airspeed of 105 knots. He subsequently repeated “restart the engine” seven times.
• At 1054:20, the ENG 1 condition lever was moved out of the shut off position and at 1054:25, the ENG 1 high pressure speed (NH1) increased to 30%. The aircraft’s altitude and indicated airspeed at that time were 400 feet and 106 knots respectively. The aircraft also started to bank to the left. At 1054:27, the PF said “wow pulled back the wrong side throttle”. From that time on, the aircraft entered an aerodynamic stall from which it did not recover.
• At 1054:34, the enhanced ground proximity warning system (EGPWS) “pull-up” warning was annunciated in the cockpit. At 1054:35 the aircraft’s left bank angle increased from 10 to 80 degrees. The aircraft’s left wing then collided with a taxi driving on the overpass. The wing then impacted the fence and a light pole at the edge of the overpass located southwest of the Keelung river occurrence site. The aircraft continued to bank to the left after those collisions and then entered the river inverted.

There were two captains in the pilots' seats, Captain A was in the left seat and was the Pilot Flying (PF). Captain B was in the right seat and was the Pilot Monitoring (PM). For the sake of analysis we'll look at Captain A's training history because it has a bearing on what happened during the accident flight. We will not look at Captain B's training history because it was perfectly normal, "no items of concern" as put by the accident report.

[Accident Occurrence Report, §1.5.2.1]

Captain A's initial training at a previous airline:

• Captain A received A330 initial transition training from September 2009 to March 2010. During the training process, an additional 14 hours of ground school, 8 hours on the MFTD [maintenance/flight training device], 2 oral tests, 1 interview, and 3 TRBs [technique review boards] were conducted to address the pilot’s skill and knowledge deficiencies identified during training. In addition, given the pilot’s training performance, four instructors requested that the pilot undertake remedial training during the simulation phases.
• Captain A could not meet the airline’s pilot performance standards and requirements despite the additional remedial training. The flight training department subsequently decided to discontinue his training on 30 March 2010. The concluding training report noted the following areas of concern:
• Multi-Tasks handling/management ability was not able to catch flight progress, left behind aircraft was observed from time to time;
• Insufficient situational awareness and confidence. Unable to prioritize and make correct decisions in both normal and abnormal situation; and
• Lack of resistance to stress. Unsteady performance under high workload situations. Unable to handle multi-task at the same time.

Captain A's initial training at TransAsia:

• Captain A received ATR72-500 initial training from 16 August 2010 to 18 February 2011. He successfully completed the initial training and passed the first officer line check on 4 March 2011.
• Captain A commenced ATR72-500 command upgrade training on 14 April 2014. He passed the ground school and simulator training but failed the simulator check on 31 May 2014 with the following unsatisfactory items: “ABNORMAL ENG START”; “BOTH HYD SYS LOSS”; and “S/E APP GO AROUND”. The check airman’s comments included:
• Incomplete procedure check and execution;
• Insufficient knowledge of QRH (ENG FLAME OUT AT T/O, BOTH HYD SYS LOSS);
• Did not fully advance power levers to ramp position during the SINGLE ENGINE APP GO AROUND;
• Did not follow SOP for ENG FIRE operation while on short final and altitude below 400 feet; and
• Cockpit management and flight planning needs improvement.
• A technical review board (TRB) to discuss the pilot’s performance was convened on 19 June 2014. The TRB decided to provide Captain A an additional simulator session followed by a simulator re-check between 29 and 30 June 2014. The additional simulator training session was conducted by the Flight Operations Department’s (FOD) Assistant Vice-President who was a senior instructor pilot (IP). As a qualified senior check pilot (CP), the company’s ATR Chief Pilot conducted Captain A’s re-check. Captain A successfully completed the additional simulator training session and subsequently passed the simulator check. He was promoted to captain on 1 July 2014.
• Captain A then completed line training from 2 July to 10 August 2014. Evaluations of the pilot’s performance by the IPs delivering the line training included:
• Prone to be nervous and may make oral errors during the engine start procedure;
• Insufficient knowledge leading to hesitations in “Both EEC Failure” and “Engine Failure after V1” situation during the oral test;
• Lack of confidence and being nervous while answering the Smoke procedure during the oral test;
• Incomplete check and execution of certain procedures;
• Hesitant when facing situations that require making decisions; and
• Flight planning should be improved.

Captain A's differences training at TransAsia:

• The assessment of the pilot’s performance during the virtual hardware platform (VHP) trainer sessions in the first 4 days were “Progress is Normal” with instructors’ comments of “Good Job”. However, the assessment of the pilot’s performance during the full flight simulator (FFS) session on the final day of training noted that the pilot “MAY NEED extra training” with an instructor commenting “check EFATO [engine flame out at take off] call out and Task sharing and GA [go-around] Single Engine”.
• Captain A passed the ATR72-600 simulator check and was authorized to captain the ATR72-600 aircraft on 2 November 2014. The areas for improvement that were previously identified were assessed again during the simulator check and the pilot’s performance was found to be "Satisfactory" - "all STD" [standard]. He subsequently passed the ATR72-600 line check on 11 November 2014 and began operating as an ATR72-600 captain.

Photo: Simulated EWD [Engine Warning Display] indications for ENG 2 autofeather at take off, (Accident Occurrence Report, Figure 1.6-4)

The display is a bit busy and perhaps getting the right information isn't as straight forward as it could be, but the cues should have been apparent: the right engine dials indicated the engine wasn't producing any torque and the two red messages spelled it out: "ENG 2 OUT" and "ENG 2 FLAME OUT AT TAKE OFF".

[Accident Occurrence Report, §1.18.1]

• Safe flight with one-engine inoperative required an understanding of the basic aerodynamics involved and proficiency in one-engine inoperative procedures. Loss of power from one engine affected both climb performance and controllability of multi-engine aircraft. An important consideration for multi-engine aircraft performance is to minimize aerodynamic drag in the event of an engine failure in flight. Drag can be caused by a windmilling propeller, extended landing gear and wing flaps, control surface deflection or aircraft attitude. In wings level one-engine inoperative flight, an aircraft will sideslip while maintaining heading, thus increasing drag. Banking up to 5 degrees toward the operating engine reduces drag, by reducing the sideslip, as well as the amount of rudder required to counteract yaw. Drag from a windmilling propeller will cause an aircraft to yaw towards the failed or failing engine.
• Many multi-engine turboprop aircraft, including the ATR72, are equipped with auto feathering propellers. Auto feathering feathers the propellers without pilot input in response to a powerplant malfunction where the engine torque value reduces below the pre-defined threshold. Feathering results in the propeller blades being streamlined to the direction of aircraft travel and the propeller blade ceasing to rotate, which minimizes drag and therefore the yawing tendency in the event of an engine failure or shutdown in flight.
• The occurrence aircraft had surplus performance available after the uncommanded autofeather and was able to continue climbing without difficulty on one engine under the full control of the flight crew.

[Accident Occurrence Report, §1.18.3]

TransAsia flight crewmembers were interviewed following the accident.

• Most of the interviewees were unable to share what they had learned from CRM training. There were some introductory cases used in CRM recurrent training but the instructor did not design scenarios to facilitate discussion of a specific situation by crews.
• Some senior captains did not consider that the use of standard call-outs were important and preferred to use gestures instead of call-outs. Some first officers would attempt to challenge a captain’s SOP non-compliance behavior but would not insist in correcting it. In addition, several interviewees did not want to report SOP non-compliance behavior via the company’s safety reporting system because they do not trust the system.

[Accident Occurrence Report, §2.2.]

• The ATPCS [Automatic Take Off Power Control System], AFU [Auto Feather Unit], and related components were examined and tested. Torque signal continuity relevant items including wiring harnesses and torque sensors were also checked. The continuity of wiring harnesses were checked normal. Among the four torque sensors88 that were examined, the left torque sensor of ENG 2 which connected to AFU No.2 was found a coil winding open circuit. The X-ray analysis of the sensor indicated that the coil wires had broken at the outside of the bend due to the impact.
• The AFU examination results indicated that the compromised soldering joints inside ENG 2 AFU which formed part of the connection between ENG 2 torque sensor and the AFU No.2 had increased an unstable signal path resistance, therefore, may have produced an intermittent discontinuity of the torque signal. Continuity of the signal was required to ensure that the ATPCS system functioned as expected. The disrupted signal probably resulted in the uncommanded autofeather.
• After the brakes were released and both power levers were ‘SET IN THE NOTCH’ and ‘FMA’ [Flight Mode Annunciator] was announced and checked, the TNA ATR72-600 take off standard operating procedures required CM2 [Crew member 2] to check then announce ‘ATPCS ARM’. As the throttle was advanced for take off in the occurrence flight, Captain B (PM) noticed that the ATPCS was not armed and he responded correctly by announcing that. The PM then announced ‘take off inhibit” which was confirmed by Captain A (PF) who then decided to continue the take off with the assent of the PM.
• The company’s ATR72-600 policy required crews to reject the take off if the ATPCS did not ‘ARM’ and crews were trained to perform this procedure. In addition, the ATR72-600 pilots (including IPs, CPs, captains and first officers) who were interviewed also stated that they would abort the take off in such circumstances.
• TNA’s ATR72-600 Abnormal and Emergency SOPs provided a failure identification process to assist crews. In response to a “MASTER WARNING/CAUTION” Captain B, as the PM, was to announce the flashing master warning and call out the item flashing on the EWD. That meant that the required initial actions by the PM in the occurrence should have comprised calling ‘MASTER WARNING” and ‘ENGINE 2 OUT ON FWS92” followed by cancellation of the master warning and then announcing the fault or type of event on the systems display page. Captain A, as the PF, was then required to call “Check” after he had acknowledged the failure and when able to call out “SYSTEM CHECK”. Six failure analysis checks must be performed for failure confirmation after the PF calls ‘SYSTEM CHECK’. However, the CVR transcript and FDR readout indicated that following the master warning, the PM said “take a look”. Just as the PM began the failure identification process, approximately 4 seconds after the master warning occurred, the PF retarded the ENG 1 power lever (PL1) to a power lever angle (PLA) of 66.4 degrees and then said "I will pull back engine one throttle". This was consistent with the PF assessing the situation and responding without any input from the PM as per the documented failure identification and confirmation process. Those hasty actions resulted in the cancellation of the uptrimmed power on ENG 1 which reduced the engine’s torque from its highest value of 104% to 82%.
• The flight crew failed to perform the appropriate failure identification procedure before the PF reduced power on the operative engine. This premature action led to confusion in the cockpit. The PM called for a cross check and an engine flame out check but the PF did not address those items. The PM subsequently called an auto feather and confirmed that ENG 2 flameout but the PF had already retarded PL1 to 22% torque. The aircraft stall warning system then activated and then confusion was prevalent as the PF called the shutdown of ENG 1. By the time the PM announced engine flameout on both sides and an engine restart was attempted, the aircraft was at an altitude from which recovery was not possible and a stall and loss of control followed.
• The FDR indicated that the autopilot was engaged at 1052:16 and it was still engaged when the master warning occurred. The CVR indicated that one second after the master warning sounded, Captain A (PF) called out "I have control". Two seconds later the autopilot was disconnected. There was no call out or conversation between the flight crew about autopilot disengagements. Based on the FDR data and the ATR72 autopilot disengagement logics analysis (see Appendix 14), the Safety Council concluded that the PF disconnected the autopilot when he had taken manual control of the aircraft.
• Part 1.04.20 of the ATR72-600 FCOM indicated that when the autopilot was engaged, the pitch, roll and yaw actuators were connected to the flight controls, the pitch auto trim and yaw auto trim function were also activated. This meant that the ATR72-600 auto trim system automatically compensated for the yaw moment induced by an engine failure and back drove the rudder pedals in the cockpit.
• As recorded in the FDR, after the autopilot was disengaged, the PF frequently applied trim control. In addition, the speed decreased due to the fact there were no more engine power and that the aircraft was maintained in a climb attitude. When the flight crew tried to follow the engine-out standard instrument departure (EOSID) after the master warning, the aircraft’s heading was set to 092 degrees by Captain B (PM), but the PF continually turned to the left after passing through a heading of 095 degrees. If the autopilot had not been disengaged at this point in the flight, the autopilot would have maintained heading 092 degrees and subsequently reduced the crew’s workload.
• The PF’s decision to disconnect the autopilot shortly after the first master warning increased the PF’s subsequent workload and reduced his capacity to assess and cope with the emergency situation.
• [TransAsia's] ATR72-600 SOP memory items for an engine number 2 flame out at take off ("ENG 2 FLAME OUT AT TAKE OFF") required the PF to announce the failure, maintain aircraft control at all times and call for “engine flame out at take off memo items.” The PM shall confirm and callout that the ‘ATPCS UPTRIM’ and ‘AUTOFEATHER’ functions are activated and displayed on the EWD. Landing gear ‘UP’ and ‘BLEED 1 + 2’ were to be confirmed if no fault was present. The PF was then to adjust the aircraft’s attitude to accelerate to the aircraft’s target speed (VFTO).
• However, the CVR transcript and FDR readout showed that the PF did not command “engine flame out at take off memo items”. The PM initiated the memory items and called out “engine flameout check” at 1053:00, which was approximately 22 seconds after the first master warning had annunciated. The PM then verified the activation of the ATPCS sequence and called “check up trim yes, auto feather yes” at 1053:02.
• Instead of adjusting the aircraft’s attitude to accelerate to VFTO as per SOPs, the PF retarded power lever No. 1 (PL1) as indicated by a power lever angle (PLA) reduction from 66.5 to 49.2 degrees between 1053:05 and 1053:07.

[Accident Occurrence Report, §3.1]

• An intermittent signal discontinuity between the auto feather unit (AFU) number 2 and the torque sensor may have caused the automatic take off power control system (ATPCS):
• Not being armed steadily during takeoff roll;
• Being activated during initial climb which resulted in a complete ATPCS sequence including the engine number 2 autofeathering.
• The available evidence indicated the intermittent discontinuity between torque sensor and auto feather unit (AFU) number 2 was probably caused by the compromised soldering joints inside the AFU number 2.
• The flight crew did not reject the take off when the automatic take off power control system ARM pushbutton did not light during the initial stages of the take off roll.
• Following the uncommanded autofeather of engine number 2, the flight crew failed to perform the documented failure identification procedure before executing any actions. That resulted in pilot flying’s confusion regarding the identification and nature of the actual propulsion system malfunction and he reduced power on the operative engine number 1.
• The flight crew’s non-compliance with TransAsia Airways ATR72-600 standard operating procedures - Abnormal and Emergency Procedures for an engine flame out at take off resulted in the pilot flying reducing power on and then shutting down the wrong engine.
• The loss of engine power during the initial climb and inappropriate flight control inputs by the pilot flying generated a series of stall warnings, including activation of the stick pusher. The crew did not respond to the stall warnings in a timely and effective manner.
• The loss of power from both engines was not detected and corrected by the crew in time to restart an engine. The aircraft stalled during the attempted restart at an altitude from which the aircraft could not recover from loss of control.
• Flight crew coordination, communication, and threat and error management (TEM) were less than effective, and compromised the safety of the flight. Both operating crew members failed to obtain relevant data from each other regarding the status of both engines at different points in the occurrence sequence. The pilot flying did not appropriately respond to or integrate input from the pilot monitoring.

Panic

Reliability Engineering: Murphy's Law

. . . and other Case Studies

Aviation Occurrence Report, 4 February, 2015, TransAsia Airways Flight GE235, Loss of Control and Crashed into Keelung River, June 2016