TransAsia airplane crashes in Taipei (ATR 72)

[Gabriel]

What if no engine failed except as commanded by the pilot?

Read carefully:

Incident: Transasia AT72 at Taipei on Feb 21st 2015, engine loses power

A Transasia Avions de Transport Regional ATR-72-212A, [...] from Taipei Songshan to Makung (Taiwan) [...] was climbing out of Taipei's Songshan Airport when the crew received abnormal torque indications for the left hand engine (PW127) suggesting loss of engine power, stopped the climb and returned to Songshan Airport for a safe landing 19 minutes after departure.

[...] Taiwan's Civil Aviation Authority reported that the engine was working properly, the sensor system however delivered false indications.

http://avherald.com/h?article=482218c6&opt=0

[Evan]

There was another way. It was hard to do. Lot of temptations to pull up + lots of workload + knowing that you are likely about to die are human factors.

(fiixed)

So, in reality, once they botched the engine out procedure and CRM/SA went out the window, it may have been inevitable. Concentration on relight and basic airmanship, not on navigation, and then buildings... stall warning or impact with structures, not a great range of choices... cleared the structures and then coming down with no power on... must clear the roadway so back pressure... roll... game over.

You can argue that there were better solutions but this is a crew that failed on procedure and shut down the wrong engine so expecting them to make better decisions beyond that point seems a bit unrealistic.

I will go wth practically inevitable.

[Evan]

What if no engine failed except as commanded by the pilot?

Read carefully:


http://avherald.com/h?article=482218c6&opt=0

But the FDR Gabriel...

The first engine appears to shut itself down (engine bleed shuts down on the live engine and objective torque ramps up at the exact moment of the master caution). Would this happen with a bad sensor indication? I don't know. But this is still not a crash scenario. Failing procedure and shutting down the other engine IS the issue here.

[elaw]

What if no engine failed except as commanded by the pilot?

Read carefully:
http://avherald.com/h?article=482218c6&opt=0

Looking at the comments on that article (which in addition to $1.00 will get you a cup of coffee), it sounds like an erroneous loss-of-torque indication could trip the autofeather system. Were that to happen, even though the engine had not failed the effect would be the same - its thrust would be lost.

Or as the automation haters might say: "the engine doesn't have to actually fail... the computer will fail it for you".

[Gabriel]

But the FDR Gabriel...

The first engine appears to shut itself down (engine bleed shuts down on the live engine and objective torque ramps up at the exact moment of the master caution). Would this happen with a bad sensor indication? I don't know. But this is still not a crash scenario. Failing procedure and shutting down the other engine IS the issue here.

Look at the FDR.

Engine 2 "seems" to fail. You have the warning for Eng 2 and it goes to Beta (feather) while Eng 1 closes the bleed air and increases the objective torque.

However:
NP2 (RPM propeller)
NL2 (RPM low pressure turbine and compressor)
NH2 (RMP high pressure turbine and compressor)
FF2 (fuel flow)
ITT2 (internal turbine temperature)
don't go to zero or as low as they do for Eng 1 once it's shut down.

Eng2 was still working, and this can certainly add confusion about what's the engine that we have to shut down.

It seems logical that the system may use "torque" to trigger the "engine fail" reaction plan. So a bad torque sensor could be a part in the chain of events.

[elaw]

It's a little hard to tell because of the small time differences involved, but in the FDR graphic it almost looks to me like the flameout warning came *before* any of the engine parameters changed, including torque.

That makes me wonder if the flameout warning was false, and the parameter changes seen are due to the prop being feathered rather than the other way around.

[3WE]

Again, just don't say that they had no choice but to stall to avoid the buildings. Or in Evan's words....

Indeed...

The occasional fuzzy, gray wiggle word is often helpful to accurately describe things.

Like: "Going to full power and nailing a high-performance climb attitude is generally a good procedure to deal with an incipient stall where altitude is critical."

[Also, see the edit about the wording of arguing with vs. arguing against you]

[3WE]

...IS the issue...

Two absolute terms and another failure to use a wiggle word.

If a faulty sensor initiated the chain of events on this crash, I invite Evan to defend the sensor-maker and the sensor-maintainer in the coming lawsuits by saying it's all the fault of the pilots.

The loss of one engine and multiple different aspects of a lost engine are known, dangerous situations where errors get magnified...

...falsely triggering such a situation??? I think Tee Vee might make a pretty good case (and it's not even his area of specialty).

[Evan]

I invite Evan to defend the sensor-maker and the sensor-maintainer in the coming lawsuits by saying it's all the fault of the pilots.

It's showtime...

The contained loss of a single engine is a fault-tolerant event of which licensed operators are required to foresee and provide in depth pilot-training and procedures to mitigate, thereby assuring the safety of the passengers they are entrusted to convey. The ATR-72-600 is certified to operate with one engine inoperative; it is certified as a passenger carrying aircraft with the stipulation that a contained single engine failure will not in and of itself result in a fatal accident. To be qualified to pilot this aircraft, a pilot must show proficiency in contigency procedures executed in the event of a single engine failure, the actual cause of the event nonwithstanding. The operator must provide assurance of this proficiency through scheduled training records and flight simulations. In the best interests of safety, these training programs should meet with the standards of the ICAO. This being done, there is every reason to expect a safe outcome from a contained single engine failure, regardless of the cause of the failure.

Sensors fail and are expected to fail. Many sensors are included on the aircraft's Master Minimum Equipment List (MMEL) indicating that safe flight is possible and expected with the sensor inoperable. The safety philosophy behind sensor failures is for 'fault-passive' outcomes, that is, a pilot can always take steps to maintain safe flight in spite of the failure. Procedures are designed to take into account the possibility of sensor failures by incorporating cross-check procedures and crew communication (CRM).

In the event of an engine torque sensor failure and subsequent engine shutdown, a qualified crew is trained to use procedure and CRM to ensure that the remaining live engine is not shut down erroneously. These procedures use an 'indicate and verify' method of cross-check between the pilots. In addition to these procedures, pilots are instructed during basic airmanship training to determine by response to flight control and power management inputs if an incorrect engine has been powered down and this must be determined prior to an actual engine shutdown. Thus, if the response is not the expected one, the pilot can always restore power to the engine without delay.

Because aircraft engines and their related sensors are prone to failure, all of the aforementioned contigencies have been incorporated into pilot training and aircraft design to accomodate a contained single engine failure regardless of the cause of the failure and to assure a safe return to the aerodrome.

The crash of TransAsia GE-507 was not the direct result of a sensor failure or an engine shutdown. These events alone are expected to be fault-tolerable. A properly-trained crew performing tasks proficiently should be capable of returning the aircraft safely to the aerodrome and for this reason almost all single-engine failures result in a safe return.

The crash of TransAsia GE-507 was the result of a lack of proper procedure for single-engine failure. The live engine was inadventently shut-down as a result. The loss of the remaining live engine was the factor that elevated the situation from an urgent event to an ultimately fatal emergency. In the case of TranAsia GE-507 adequate time existed to perform these procedures and cross-checks. Once the live engine was shut down it was not possible to relight that engine in time to maintain sufficient altitude needed to clear obstacles in the flight path without incurring aerodynamic stall. As a result AirAsia GE-507 suffered a loss of flight control at low altitude and impacted water inverted, resulting in the loss of 43 lives.

A failure of procedural proficiency and basic airmanship technique is commonly the result of insufficient pilot training and proficiency checks on the part of the operator, particularly regarding abnormal operations such as that resulting from a single engine failure. Pending the findings of the final report but taking into consideration the facts as known to us including the flight data recorder parameters, the fault in the crash of AirAsia GE-507 was almost certainly the result of pilot error and fault almost certainly resides with the operator for failing to provide this training and proficiency.

The failure of an individual sensor, while possibly a contributing factor, cannot be found at fault for the crash as the sensor is by definition fault-tolerant.

[ATLcrew]

It's showtime...

The contained loss of a single engine is a fault-tolerant event of which licensed operators are required to foresee and provide in depth pilot-training and procedures to mitigate, thereby assuring the safety of the passengers they are entrusted to convey. The ATR-72-600 is certified to operate with one engine inoperative; it is certified as a passenger carrying aircraft with the stipulation that a contained single engine failure will not in and of itself result in a fatal accident. To be qualified to pilot this aircraft, a pilot must show proficiency in contigency procedures executed in the event of a single engine failure, the actual cause of the event nonwithstanding. The operator must provide assurance of this proficiency through scheduled training records and flight simulations. In the best interests of safety, these training programs should meet with the standards of the ICAO. This being done, there is every reason to expect a safe outcome from a contained single engine failure, regardless of the cause of the failure.

Sensors fail and are expected to fail. Many sensors are included on the aircraft's Master Minimum Equipment List (MMEL) indicating that safe flight is possible and expected with the sensor inoperable. The safety philosophy behind sensor failures is for 'fault-passive' outcomes, that is, a pilot can always take steps to maintain safe flight in spite of the failure. Procedures are designed to take into account the possibility of sensor failures by incorporating cross-check procedures and crew communication (CRM).

In the event of an engine torque sensor failure and subsequent engine shutdown, a qualified crew is trained to use procedure and CRM to ensure that the remaining live engine is not shut down erroneously. These procedures use an 'indicate and verify' method of cross-check between the pilots. In addition to these procedures, pilots are instructed during basic airmanship training to determine by response to flight control and power management inputs if an incorrect engine has been powered down and this must be determined prior to an actual engine shutdown. Thus, if the response is not the expected one, the pilot can always restore power to the engine without delay.

Because aircraft engines and their related sensors are prone to failure, all of the aforementioned contigencies have been incorporated into pilot training and aircraft design to accomodate a contained single engine failure regardless of the cause of the failure and to assure a safe return to the aerodrome.

The crash of TransAsia GE-507 was not the direct result of a sensor failure or an engine shutdown. These events alone are expected to be fault-tolerable. A properly-trained crew performing tasks proficiently should be capable of returning the aircraft safely to the aerodrome and for this reason almost all single-engine failures result in a safe return.

The crash of TransAsia GE-507 was the result of a lack of proper procedure for single-engine failure. The live engine was inadventently shut-down as a result. The loss of the remaining live engine was the factor that elevated the situation from an urgent event to an ultimately fatal emergency. In the case of TranAsia GE-507 adequate time existed to perform these procedures and cross-checks. Once the live engine was shut down it was not possible to relight that engine in time to maintain sufficient altitude needed to clear obstacles in the flight path without incurring aerodynamic stall. As a result AirAsia GE-507 suffered a loss of flight control at low altitude and impacted water inverted, resulting in the loss of 43 lives.

A failure of procedural proficiency and basic airmanship technique is commonly the result of insufficient pilot training and proficiency checks on the part of the operator, particularly regarding abnormal operations such as that resulting from a single engine failure. Pending the findings of the final report but taking into consideration the facts as known to us including the flight data recorder parameters, the fault in the crash of AirAsia GE-507 was almost certainly the result of pilot error and fault almost certainly resides with the operator for failing to provide this training and proficiency.

The failure of an individual sensor, while possibly a contributing factor, cannot be found at fault for the crash as the sensor is by definition fault-tolerant.

Good writing.

[elaw]

...the fault in the crash of AirAsia GE-507 was almost certainly the result of pilot error and fault almost certainly resides with the operator for failing to provide this training and proficiency.

Plaintiffs, lawyers, regulatory agencies, airline PR people, and all the other parties who have a vested interest in the validity of the concept that human error is 100.000% preventable will agree.

The failure of an individual sensor, while possibly a contributing factor, cannot be found at fault for the crash as the sensor is by definition fault-tolerant.

True, but I bet if a faulty sensor is found to be a factor, it's enough of a contributing factor for the sensor and/or engine manufacturer to become the defendant in a lot of lawsuits.

[3WE]

It's showtime...

...Gabriellian dissertation...

The failure of an individual sensor, while possibly a contributing factor, cannot be found at fault for the crash as the sensor is by definition fault-tolerant.

Ever hear the phrase that you can sue anyone for anything?

...yeah, it's not completely true...you know, more of a rule of thumb...

[James Bond]

BREAKING NEWS

Investigation report: Taiwan’s #TransAsia Flight 235 crew shut off working engine after the other lost power, before February’s crash

[James Bond]

1051:39

GE 235 began takeoff roll.

1051:43

Pilot Monitoring (PM) called “no ATPCS armed”, and Pilot Flying (PF) replied “ok continue takeoff.”
(ATPCS: Automatic Take-off Power Control System)

1051:51

PM called “oh there it is ATPCS armed.”

1052:01

The aircraft lifted off and climbed out. Autopilot was engaged after after-takeoff check completed. The aircraft turned right after 1,000 ft.

1052:38

After climbing through 1,200 ft. master warning sounded. Engine and Warning Display (EWD) showed “ENG2 FLAME OUT AT TAKE OFF” procedures.

1052:41

PF disengaged autopilot while the flight climbing through 1,300 ft.

1052:43

PF announced “ I will pull back engine one throttle” and PM replied “wait a second cross check”. At this moment ENG1 PLA (Power Lever Angle) record indicated a reduction from 75 deg. to 66 deg.

1053:00

PM replied “okay engine flameout check” and continued announcing “check up trim yes auto feather yes.”

1053:06

PF said “pull back number one” and ENG1 PLA record showed a reduction to 49 deg. Meanwhile PM said “okay now number two engine flameout confirmed.”

1053:09

PF relied “okay” ; however ENG1 PLA remained at 49 deg. The aircraft reached its highest altitude of 1,630 ft. and started to descend at 102 knots.

1053:13

Stall warning sounded with stick shakers activated. PM called “okay push push back.”

1053:15

PF said “shut” and PM replied “wait a second throttle throttle.” Between 1053:13 and 1053:15, ENG2 PLA was advanced to 86 deg. and ENG1 PLA was retarded to 34.5 deg. (idle position.)

1053:19

PF said “number one”, followed by “feather shut off”. Meanwhile PM said “number feather”. Stall warning revived and stick pusher was in effect until 1053:27.

1053:22

PM said “okay” and PF said “uh number one.”

1053:24

ENG1 Condition Lever (CL) was in fuel shut off position. Six seconds later ENG1 propellers were in feather position.

1053:35

PM declared emergency on engine flameout to Songshan tower. Between 1053:46 and 1054:04 PF attempted to reengaged autopilot twice but failed. The aircraft stalled again during the time.

1054:05

PM said “both sides lost”. 2 seconds later PM said “no engine flameout we lost both sides.”

1054:09

PF announced “restart the engine” while the aircraft was at 545 ft. with speed 105 knots.

1054:20

ENG1 CL was advanced from fuel shut off position.

1054:25

PM said “cannot restart it” while the aircraft was at 401 ft. with speed 106 knots. ENG1 NH1 speed recorded an increase to 30%.

1054:27

PF said “wow pulled back the wrong side throttle” while aircraft was at 309 ft. with speed 105 knots.

1054:34

“Pull-up” warning issued by Enhanced Ground Proximity Warning System (EGPWS) sounded. The aircraft was at 83 ft. with speed 108 knots.

1054:35

At altitude of 55 ft. with speed 106 knots, aircraft increased its left bank from 10 deg. to 80 deg. and its left wing collided with a taxi driving on an elevated expressway at the left bank of Keelung River. The left wing continued to hit the fence of the expressway as well as a light pole, before it crashed into Keelung River.

https://www.asc.gov.tw/main_en/docDetail.aspx?uid=318&pid=318&docid=701

[Leftseat86]

https://www.asc.gov.tw/main_en/docDe...=318&docid=701

Ouch!!