Losing Two Functional Engines: TransAsia Airways flight GE235
On the 4th of February 2015, these horrifying photographs of TransAsia Airways flight GE235 were published around the world.
These appear to be some photos of the TransAsia ATR72 crashing over the roadway. via @missxoxo168 h/t @marker7193 pic.twitter.com/7WlvhVFI6j
— Airline Reporter (@AirlineReporter) February 4, 2015
Just three minutes after take off and three nautical miles east of the airport, the aircraft crashed into the Keelung River after the flight crew lost control.
The final report was released in English a few days ago and includes some very interesting analysis of the problem.
Let’s start with a refresher of what happened that day.
The aircraft was new, a ten-month-old ATR 72-600: a twin-engine turboprop short-haul aircraft popular with regional airliners. There were three pilots, two cabin crew and fifty-three passengers on board for the scheduled TransAsia Airways flight from Taipei Songshan Airport to Kinmen Airport.
The flight crew consisted of two captains and a first officer, who acted as an observer. Their schedule that day was for two return flights from Songshan to Kinmen (four sectors). The first flight of the day departed Songshan at 07:44 that morning, arriving at Kinmen at 08:50. They departed Kinmen at 09:17 and arrived back at Songhsan at 10:12 to prepare for the second return trip.
Flight GE235 departed at 10:45. The Pilot in Command was the Pilot Flying and sat in the left seat. The second captain was the Pilot Monitoring and sat in the right seat.
The first officer had flown with another airline as an MD-82 captain and was transitioning to the ATR-72. He completed his training on the ATR 72-500 and it was noted that he would “need some time to get used to the 600, flying with an experienced captain is strongly recommended.” The first officer sat in the cockpit jump seat as an observer pilot as a part of his ATR 72-600 differences line training.
There’s no evidence that the crew briefed or reviewed the engine failure procedure during the take-off briefing.
The flight was due to depart Songshan at 10:45. The aircraft began the take-off roll on runway 10 at 10:51:39. Four seconds later, the Pilot Monitoring pointed out that the Automatic Takeoff Power Control System (ATPCS) was not armed.
The ATPCS is part of the propulsion system. I’m not good on this kind of detail so here’s the exact description from the accident report.
The automatic take off power control system (ATPCS) is one of the sub-systems of the propulsion unit. The ATPCS is designed to automatically feather the propeller during takeoff and approach if the engine torque decreased below 18.5 percent rated torque. The auto-feather logic and control circuits with interlock features provided arming control and prevented auto-feather of the operating propeller, once the auto-feather sequence for one of the propellers was initiated. The system also provided for relaying a ‘power uptrim’ (engine power increase) signal to the operating engine.
The engine torque is a way of indicating engine power. If the engine torque is below a certain percentage, then the engine is no longer producing thrust. In this case, the propellers can be feathered in order to reduce drag, which means that the propeller blades are rotated to be parallel to the airflow.
The point is that if one of the engines is no longer producing thrust, then on the ATR-600, the ATPCS will feather the engine automatically. The ATPCS will also (if I understand this bit correctly) provide maximum power to the alive engine (the ‘power uptrim’) of up to 10% torque.
In this case, the ATPCS was not armed. According to a TransAsia crew training supervisor, if the ATPCS is not armed during the take-off roll, the flight crew should abort the take-off.
However, in this case when the Pilot Flying heard that the ATPCS was not armed, he responded with, “Really?” And then, “OK, continue to take off.”
The Pilot Monitoring repeated “We will continue.” A few seconds later, he said “Oh, there it is. ATPCS armed.” The aircraft then became airborne at 10:52:01.
They achieved a positive rate of climb and retracted the landing gear. The autopilot was set to a selected altitude of 5,000 feet and an airspeed of 115 knots.
At 10:52:34, the Songshan tower controller asked the flight crew to contact Taipei Approach. The aircraft had just started its right turn for the standard departure as it was climbing through an altitude of 1,000 feet.
According to the flight data recorder, at 10:52:38 as the aircraft continued the right turn and was climbing through 1,200 feet, No. 1 engine began operating in an uptrim condition with its bleed valve closed.
This was the beginning of an ATPCS sequence which would also auto-feather the dead engine: rotate the angle of the blades so that the propeller no longer encounters any resistance (which it needs when producing thrust). The master warning lit up as the No. 2 engine propeller angles began to advance. The engine warning display also lit up with a reference to the appropriate procedure: ENG 2 FLAME OUT AT TAKE OFF
At 10:52:41, forty seconds after take-off, the autopilot was disconnected as the Pilot Flying called out, “I have control.”
The aircraft climbed through 1,300 feet. The ATPCS sequence ended with the No. 2 engine propeller fully feathered.
The Pilot Flying said, “I will pull back engine one throttle.” The Pilot Monitoring, correctly, replied with “Wait a second, cross check.” However, the No 1 engine power lever had already been retarded; it’s angle reducing from 75° to 66°.
Both the Pilot Flying and the Pilot Monitoring announced heading mode (that is, the autopilot would keep the nose of the aircraft pointed in the direction set by the heading bug, not speed, level or lateral navigation) and continued. The aircraft was climbing through 1,481 feet and 106 knots. A heading of 092° was selected and the aircraft began turning left.
At 10:53:00 the Pilot Monitoring was ready for the cross check.
|10:53:00||Pilot Monitoring:||OK, engine flame out check.|
|Pilot Monitoring:||Check uptrim: yes. Auto feather: yes|
|Pilot Monitoring:||Watch the speed!|
The indicated airspeed had reduced to 101 knots. The Pilot Flying called “pull back number one” and the No. 1 engine power lever angle was retarded to 49°.
The Pilot Monitoring said, “OK, now No 2 engine flameout confirmed.”
This is the cross-check complete, with the No 2 engine correctly identified.
“OK,” said the Pilot Flying. However, he didn’t increase the thrust on the No. 1 engine. The power lever angle remained at 49°.
At 10:53:09, the flight reached its peak altitude of 1,630 feet. With one engine out and the other at reduced thrust, the aircraft couldn’t climb any further.
The Automatic Flight Control System reverted into PITCH HOLD mode. The Automatic Flight Control System has a built-in protection (flight path angle protection) which is triggered if the aircraft does not have sufficient energy to continuing climbing on a minimum slope at the selected airspeed. If this condition is met for 20 seconds, then the Automatic Flight Control System reverts to PITCH HOLD mode.
One second later, the stall warner sounded briefly.
|Pilot Flying:||Terrain ahead.|
|Pilot Monitoring:||OK, lower…|
|Observing Pilot||You are low.|
At 10:53:13, the stall warning sounded for four seconds and the stick shakers activated. The stick shakers do exactly what it sounds like, they vibrate the pilots’ controls in order to warn them of an impending stall.
|Pilot Monitoring:||Ok, push, push back.|
|Pilot Monitoring:||Wait a second…throttle, throttle!|
It’s this next action which seems unbelievable. It’s impossible to be absolutely sure which pilot had his hands on the controls but over the next two seconds, both power levers were manipulated. The No. 2 power lever angle was advanced to 86° and the No. 1 power level angle was retarded to around 35.5°, which is the idle position.
At 10:53:18, the aircraft was descending through 1,526 feet in a continuous left turn with a 10-20° angle of bank.
|10:53:19||Pilot Flying:||Number one.|
|Pilot Flying:||Feather shut off.|
|Pilot Monitoring:||Number feather|
The stick shakers activated again. As the aircraft was now entering an aerodynamic stall, the automatic stick pusher kicked in, which pushes the stick forward to decrease the aircraft’s angle of attack.
At 10:53:35, the Pilot Monitoring made a MAYDAY call to Air Traffic Control. The aircraft was now banking to the right. The flight crew tried twice to engage the autopilot.
|10:53:53||Observing Pilot||How come it becomes like this?|
|10:54:05||Pilot Monitoring:||Both sides…lost|
|Pilot Monitoring:||No engine flameout, we lost both sides.|
|10:54:09||Pilot Flying:||Restart the engine!|
The aircraft’s altitude was 545 feet with an airspeed of 105 knots. The Pilot Flying repeated, “Restart the engine” seven times.
At 10:54:20, the No. 1 engine condition lever was moved out of the shut off position and the engine one high pressure speed increased to 30%. The time required to restart the engine is 25-30 seconds.
The aircraft was at 400 feet with an indicated airspeed of 106 knots as it started to bank to the left.
The aircraft stalled and did not recover.
The Enhanced Ground Proximity Warning System sounded with PULL UP, PULL UP. The left bank angle increased from 10° to 80°. The left wing collided with a taxi driving on the overpass and then impacted the fence at the edge of the overpass. It continued to bank to the left and crashed into the Keelung river upside down.
Four crew members and 39 passengers were killed in the impact. Thirteen passengers and one cabin crew sustained serious injuries and one passenger sustained minor injuries. All of the surviving passengers and crew were seated after row 10. They reported that as the aircraft crashed into the river, the middle-aft section separated. Some of the passengers were unconscious and woke to find themselves upside down in the cabin, restrained by their seatbelts, as the water filled the cabin.
The taxi driver sustained serious injuries and the taxi passenger sustained minor injuries.
The investigation discovered that the Pilot Flying had shown issues in training, failing his initial simulator check on abnormal engine starts. The instructor noted multiple issues, including that the pilot did not advance the power levels during a single engine approach go around. The technical review board discussed the pilot’s performance and allowed for an additional simulator session and recheck, which the pilot passed, which allowed for his promotion to captain. However, in the line training, his performance evaluations note some issues.
- Prone to be nervous and may make oral errors during the engine start 10 procedure;
- Insufficient knowledge leading to hesitations in “Both EEC Failure” and “Engine Failure after V1” situation during the oral test;
- Lack of confidence and being nervous while answering the Smoke procedure during the oral test;
- Incomplete check and execution of certain procedures;
- Hesitant when facing situations that require making decisions; and
- Flight planning should be improved.
The Pilot Monitoring had no significant comments regarding his checks and training.
The wreckage examination showed that there was no issues with either engine previous to the crash. They discovered that the issue with the No. 2 engine was solely the autofeathering of the No. 2 engine propeller by the the automatic take off power control system (ATPCS).
The FDR showed that the ATPCS hadn’t armed correctly initially but that it had armed later in the take-off roll. The post-wreckage examinations showed that the left torque sensor (for the No. 2 engine) had compromised soldering joints which may have caused an intermittent discontinuity of the torque signal.
The engine manufacturer (P&WC) had been aware of AFU-related technical issues causing uncommanded autofeather events since 2005 and proposed SBs starting from 2007. Investigation of the AFUs from those events revealed that some of the units exhibited cracks in the soldering of the J1 and J2 connectors. Those cracks were believed to have caused momentary electrical disruptions leading to an uncommanded autofeather. In response, the manufacturer issued various service bulletins and service information letters to operators recommending unit modification and/or information to address the AFU-related autofeather events.
SB No.21742 advised that “Aging of the Autofeather Unit (AFU) electrical connectors and interconnect ribbon solder joints can lead to loss of torque signal”. The manufacturer recommended implementing the service bulletin actions before the AFU had accumulated 12,000 flight hours, or before 31 July 2010, whichever occurred last.
The aircraft had less than 2,000 flight hours, much less than the 12,000 flight hours recommended by the engine manufacturer, thus the intermittent continuity failure does not appear to be simply caused by aging.
Although the No. 2 engine may have been correctly producing power and the sensor would have picked up the correct torque reading, if the signal was interrupted, the ATPCS would become unreliable.
Symptoms of an unstable torque signal include unreliable arming and inadvertent or uncommanded autofeathering.
This is exactly why the take-off should have been rejected. However, the investigation discovered that there were no documented company policies, instructions, procedures or notices to flight crew that they should reject the take-off if the ATPCS did not arm.
UPDATE: Dozens awaiting rescue after TransAsia Airways plane crash lands in #Taipei riverhttp://t.co/8OPytImDnQ pic.twitter.com/DyIQebdP4T
— ST Foreign Desk (@STForeignDesk) February 4, 2015
Once in the air, the MASTER WARNING/CAUTION should have led the Pilot Monitoring to announce the warning and call out the item flashing: ENGINE 2 OUT ON FWS. The Pilot Flying’s response would have been to call out CHECK to acknowledge the failure.
Instead, the Pilot Monitoring said, “Take a look” and never read out the item. As he began the failure identification process, the Pilot Flying retarded the No. 1 engine power lever as he said, “I will pull back engine one throttle.” Thus, the Pilot Flying was attempting to assess and respond to the situation without the input of the Pilot Monitoring, which led him to cancel out the additional power which the ATPCS had uptrimmed. Although the Pilot Monitoring asked him to wait, the Pilot Flying never announced that he had in fact pulled back the throttle.
The flight crew failed to perform the appropriate failure identification procedure before the PF reduced power on the operative engine. This premature action led to confusion in the cockpit. The PM called for a cross check and an engine flame out check but the PF did not address those items. The PM subsequently called an auto feather and confirmed that ENG 2 flameout but the PF had already retarded PL1 to 22% torque. The aircraft stall warning system then activated and then confusion was prevalent as the PF called the shutdown of ENG 1. By the time the PM announced engine flameout on both sides and an engine restart was attempted, the aircraft was at an altitude from which recovery was not possible and a stall and loss of control followed.
Reading through the transcript, it seems that the Pilot Monitoring understood that it was the No. 2 engine which was out but the Pilot Flying never appeared to be clear of the situation and repeatedly manipulated the No. 1 engine. By the time he said that he’d pulled back the wrong side throttle, it was much too late.
A summary of non-compliance with SOPs and/or company expectations or non-conformance with safe practices identified during the occurrence flight included:
- Non-compliance with sterile cockpit rule during taxi;
- Did not brief engine out procedure during takeoff briefing;
- Did not comply with the undocumented company expectation to reject the take off if the ATPCS did not arm during the takeoff roll (ATR72-600 only);
- PF unnecessarily disconnected the autopilot after the master warning sounded;
- PF did not positively identify propulsion system malfunction before taking action;
- Crew did not perform the ENG 2 flameout at take off procedure correctly.
The non-compliance with procedures deprived the flight crew of an opportunity to manage the emergency correctly and efficiently. Their actions further complicated the situation, substantially increasing their workload, and a manageable situation eventuated in a stall and loss of aircraft control. The repetitive and recurring non-compliance with SOPs identified again in this occurrence and by previous ASC investigations of TransAsia Airways ATR accidents (GE222) and serious incidents, indicated that non-compliant behaviors were an enduring, systemic problem and were consistent with a poor safety culture within the airline’s ATR fleet
The report is very good and very readable but also very, very long. If you are interested in more of the detail, I recommend the English translation. I’m out of space now but the probable causes cover the various issues that the investigation looked into. Note that the pilot referred to as Captain A in the investigation was the Pilot Flying.
- An intermittent signal discontinuity between the auto feather unit (AFU) number 2 and the torque sensor may have caused the automatic take off power control system (ATPCS):
- Not being armed steadily during takeoff roll;
- Being activated during initial climb which resulted in a complete ATPCS sequence including the engine number 2 autofeathering.
- The available evidence indicated the intermittent discontinuity between torque sensor and auto feather unit (AFU) number 2 was probably caused by the compromised soldering joints inside the AFU number 2.
- The flight crew did not reject the take off when the automatic take off power control system ARM pushbutton did not light during the initial stages of the take off roll.
- TransAsia did not have a clear documented company policy with associated instructions, procedures, and notices to crew for ATR72-600 operations communicating the requirement to reject the take off if the automatic take off power control system did not arm.
- Following the uncommanded autofeather of engine number 2, the flight crew failed to perform the documented failure identification procedure before executing any actions. That resulted in pilot flying’s confusion regarding the identification and nature of the actual propulsion system malfunction and he reduced power on the operative engine number 1.
- The flight crew’s non-compliance with TransAsia Airways ATR72-600 standard operating procedures – Abnormal and Emergency Procedures for an engine flame out at take off resulted in the pilot flying reducing power on and then shutting down the wrong engine.
- The loss of engine power during the initial climb and inappropriate flight control inputs by the pilot flying generated a series of stall warnings, including activation of the stick pusher. The crew did not respond to the stall warnings in a timely and effective manner.
- The loss of power from both engines was not detected and corrected by the crew in time to restart an engine. The aircraft stalled during the attempted restart at an altitude from which the aircraft could not recover from loss of control.
- Flight crew coordination, communication, and threat and error management (TEM) were less than effective, and compromised the safety of the flight. Both operating crew members failed to obtain relevant data from each other regarding the status of both engines at different points in the occurrence sequence. The pilot flying did not appropriately respond to or integrate input from the pilot monitoring.
The Findings Related to Risk are what I would call Contributing Factors: unsafe acts and conditions that made the accident more likely but would not have caused it on their own.
- The engine manufacturer attempted to control intermittent continuity failures of the auto feather unit (AFU) by introducing a recommended inspection service bulletin at 12,000 flight hours to address aging issues. The two AFU failures at 148 1,624 flight hours and 1,206 flight hours show that causes of intermittent continuity failures of the AFU were not only related to aging but also to other previously undiscovered issues and that the inspection service bulletin implemented by the engine manufacturer to address this issue before the occurrence was not sufficiently effective. The engine manufacturer has issued a modification addressing the specific finding of this investigation. This new modification is currently implemented in all new production engines, and another service bulletin is available for retrofit.
- Pilot flying’s decision to disconnect the autopilot shortly after the first master warning increased the pilot flying’s subsequent workload and reduced his capacity to assess and cope with the emergency situation.
- The omission of the required pre-take off briefing meant that the crew were not as mentally prepared as they could have been for the propulsion system malfunction they encountered after takeoff.
- TransAsia Airways (TNA) did not follow its own procedures when selecting and training pilot flying for upgrade. The TNA’s quality assurance processes had not detected that the command selection upgrade process had been compromised.
- TransAsia Airways (TNA) did not use widely available crew resource management (CRM) guidelines to develop, implement, reinforce, and assess the effectiveness of their flight crew CRM training program.
- While the TransAsia Airways (TNA) ATR72-600 differences training program was consistent with the European Aviation Safety Agency ATR72 operational evaluation board report and compliant from a Civil Aeronautics Administration regulatory perspective, it may not have been sufficient to ensure that TNA flight crews were competent to operate the ATR72-600 under all normal procedures and a set of abnormal conditions.
- The ATR72-600 differences training records for the GE 235 flight crew showed that Captain A probably needed more training on the single engine flame out at take off procedure. That meant if the differences training records were stored, adequately maintained and evaluated by appropriate TransAsia Airways (TNA) flight operations and/or quality assurance personnel, the TNA would have had yet another opportunity to review Captain A’s ability to handle engine out emergencies.
- Captain A’s performance during the occurrence was consistent with his performance weaknesses noted during his training, including his continued difficulties in handling emergency and/or abnormal situations, including engine flame out at take off and single engine operations. However, TransAsia Airways did not effectively address the evident and imminent flight safety risk that Captain A presented.
- The Civil Aeronautics Administration’s (CAA) oversight of flight crew training, including crew resource management (CRM) training, is in need of improvement.
- The systemic TransAsia Airways (TNA) flight crew non-compliances with standard operating procedures identified in previous investigations, including GE 222, remained unaddressed at the time of the GE235 occurrence. Although the Civil Aeronautics Administration (CAA) had conducted a special audit after the GE 222 accident which identified the standard operating procedures compliance issue, the CAA did not ensured that TNA responded to previously identified systemic safety issues in a timely manner to minimize the potential risk.
So both engines were perfectly fine. What brought the plane down? A known fault, an ignored procedure, bad training, followed by a complete failure of Cockpit Management Resources. I’m not sure how it could possibly have gone more wrong.
The original report is available in English on the Aviation Safety Council site here: https://www.asc.gov.tw/upload/acd_att/ASC-AOR-16-06-001 EN.pdf.
Another mystery. But it seems that the airline passed a pilot for command even though there were enough clues to warrant serious misgivings about his suitability.
Most turboprop airliners have an autofeather system, some coupled with a rudder boost that also will automatically apply rudder input to assist pilots to overcome the initial period when they may otherwise be a bit slow to react. After all, a sudden engine failure does catch most pilots by surprise.
It would seem that the situation was returning to a measure of control. The aircraft was climbing. What went through the pilot’s head when he decided to retard the power lever on the live engine?
Deciding to depart with an essential system not functioning or at least not reliably so is a very dangerous one.
And what was the role of the new crew member? He had been a MD 82 captain? This is a more advanced jet airliner and even if a turboprop is in fact a more complex aircraft, he would have been a very experienced pilot in his own right.
Because of the aerodynamics and engine performance of jet aircraft, that operate most efficiently at high altitudes – at least 30.000 feet (10 km) or higher, jets have oodles of excess power at low altitudes, like on take-off. A jet does not have propellers to be feathered and is able to continue climb comfortably to a safe altitude if one fails during take-off.
Turboprops do not have the same amount of extra power which makes it mandatory to feather a prop instantly.
All this is well known and would have been drilled into the pilots during training. A well trained crew will be able to cope with an engine failure on take-off and it should not have led to a serious crash.
Even the good aul’ Fokker F27 was manageable in such a situation, even if we did it in the simulator and once in the air – engine set to “simulated zero thrust” just to check performance calculations we had made ourselves. It worked even if we saw tree tops close below us.
It is scary just how many accidents are caused my the miss identification (of the malfunctioning engine) and or miss action on the wrong engine. This goes for all Multi Engine aircraft rather they be Jets, Turboprops or Helicopters. It is interesting that in this case it almost sounds like if the crew had done nothing they might have got away with it. I don’t have the technical knowledge to know however if the aircraft would have had enough power / flight envelope protection for them just to fly on for a few more minutes to collect themselves. Thankfully ‘most’ modern aircraft have enough power / redundancies or systems design to allow the crew to ‘do nothing’ for a few moments.
I get the feeling that the pilot flying would have been better off doing nothing at all. The plane’s automation seemed perfectly capable of sorting it out and all he needed to do was turn around and go back?
The ‘A’ pilot may have had problems with being under ‘expectation’ stress, that is to family expected to much from him and he took it to seriously, or he might have been overly confident or even suicidal. Who can tell. It may have even been fuel contamination or clear air turbulence.(CAT). Obviously these things woud be inconsquencial, as the problem wa quite simply, failure of ‘A” pilot to maintain Vmc, weather because of loss of power, failure to identfy correct engine, crew fategue, or improper elevator input. Maybe a jato bottle assist or c.g. problem? Close down runway to that class of airplane? Build another airport away from congested areas? Switch to surface transportation? Sign non responsibility contract before enplaning? No fault insurance? Increased airfare?