Shutting Down the Wrong Engine.

[Fareastdriver]

A thought has occurred to me reading aboutr the ATR 72 in Taiwan. The opinion at the moment is that the crew shut down No1 engine where in fact it was No2 that had failed. The aircraft's immediate history was that there was a problem with No 1 engine. This knowledge could POSSIBLY have led them to carry out the shutdown on No1.

Taking the 332 as an example, for base checks where the candidate has to demonstrate a successful recovery after an engine failure the No 2 engine is restricted so as not to encroach into its overhaul life. This equipment is always fitted to No 2 engine. Therefore the candidate will know that he is going to have a No 1 engine failure.

A flashback to the 1960s. The Lightning simulator at Wattisham had its own callsign. One day a Lightning had an engine fire with appropiate Mayday calls that led to total confusion in ATC because he had reverted to the simulator callsign. From then on the simulator was issued with a random callsign.

Should a 332 have an engine failure in a high stress situation would it be possible, despite that checklist requirement to confirm which engine is the problem, that the No 1 engine would be subconciously shut down irrespective of which engine is at fault because this is the engine which is always retarded.

The problem should not arise where all the checks are carried out in the simulator but again the Taiwanese crew involved had also been through simulator training.

How many times did they have a No1 engine failure?

[AAKEE]

For the 332, I only did just the OEI-landing procedure as F.P with training card/ mode. Never any emergency procedures as NFP - these where always trained in the sim.

But I see your Point. Some 412 FFS hade the feature of very very slow start up on one of the Engines( dont remember which). If the sim instructor cut the wrong engine, there was a tremendous wait to get it up and running, so just about every time the other engine was cut. Might lead to dangerous cuoplings in the brain...

But I guess everyone both confirms correct engine involved, correct handle and also 'tastes' on the handle before complete shut off...

[terminus mos]

It's a diminishing risk though as many 332s are being retired and cannibalised as they are difficult to support with parts.

[airpolice]

I am told that the same callsign cognitive error happened in the Hatton Cross arrival of Speedbird38.


https://www.youtube.com/watch?v=cCK62U6Fob0

[Devil 49]

The power of the mistake is overwhelming. Even as you do it, your subconscious is screaming something's wrong with your solution! while your logic takes the wrong turn...
You can't eliminate accidents. The best you can do is extend the time between them as long as possible by minimizing the stuff that results in bad things happening.

[JohnDixson]

FED, I had the same thoughts while reading that thread, supported by the knowledge that a few well trained early H-3 crews succombed to the type failure described by Nick Lappos in this forum 11 years ago. Here's Nick:

NickLappos
7th Jul 2004, 04:06
Sassless has it right on, as usual.

For a "high side runaway" the bad engine fuel control/governor goes to max fuel flow, usually because the Nf/N2 reference is lost to the governor, which makes the control think the rotor is going down in rpm. The classic case is the Nf flex shaft failure in the previous generation of engines, where a flexible shaft runs from the power turbine section forward to the fuel control to provide the output speed reference. If that shaft breaks, the governor thinks the engine is winding down, so it tosses in more gas, and the engine runs away upward. FADEC engines have multiple references for N2/Nf so they are harder to fool.

The key in multi engine helos is to be SURE you have ID'd the bad engine, and that can be confusing.

For the pilot, these highside runaways are doubly bad in some cases because the pilot's triple tach uses the same reference as the control, so the pilot sees a big torque split and an N2/Nf needle going to zero. The natural tendency is to think the low N2 engine failed, and grab the lever of the healthy engine and do some foolish things. It is all too common for a healthy engine to be mistakenly shut down leaving the screwy one as the only power source. That usually means a trip home in a rubber boat, unless you are Sky King.

The absolute key is to do nothing when the torque split occurs. Nothing except stare at the rotor rpm. If the rotor is in the green, do not grab any levers, nor any fuels. Torque split, rotor in the green, hold altitude and airspeed and study the rotor rpm. If the rpm is dropping, of course, lower collective to get it to stop!

If the rpm is going up, power is too high, so blame the high torque engine. If rotor rpm is screaming upward, do not grab any levers, the odds are about 50% that you will grab the wrong one. The lever to grab is the collective pitch. Pull it up to absorb the extra power, you won't have to pull far. Once the rpm comes up about 3% the good engine will be at flight idle, loafing along, trying to be your friend, while the bad engine is at max torque, carrying the whole helicopter.

Some pilots will worry about that massive torque that they see, perhaps even a bit above the red line. Yes, you can worry, but don't grab any levers yet, at least until you and your stick buddy have discussed this thing. Rotor up means too much power, blame the up engine, confirm it, tell your cp to put his hand on it, confirm his hand is on the correct lever. Do this as carefully as the first time you bought a house, you will live with this decision about as long as a mortgage! Then pull gently back to get the torque to start creeping back. Don't wiggle the collective, it will confuse things if you are making the torque wiggle while he is trying to sort out if you two astronaughts have chosen the right lever! If you can control the torque by pulling back, just manually set the bad torque maybe 10% below the good engine, and the two of you coordinate the lever during the flight home.

In a single, the answer is easier. If the rpm is up, the engine is up in power, pull the collective to stop it from overspeeding, then coordinate a lever pull back with collective reduction to keep things in the green. Fly home gently, and make a shallow approach.

Some test pilots think the engine levers should be in the tail cone, inaccessible in flight, because of all the bad things that good people do with them. In an engine emergency, the engine lever should be the last thing you move, after the situation has been stabilized by collective pitch and brainpower. Airplane training where you have to jump on the controls and identify/feather fast is exactly backwards to a helicopter.

[ShyTorque]

Earlier in life, as a military sim instructor on a twin engined type! I taught that all engine problems were to be announced as "engine malfunctions" and not engine failures.

The initial actions were to be:
"Captain to crew - engine malfunction".
"Checking the Nr".


Case 1. Nr is low
Lower collective, contain Nr within limits.

Case 2. Nr is high
Raise collective, contain Nr within limits.

Then diagnose the malfunction and carry out secondary actions / shutdown drills as appropriate.

From experience, this set brains thinking along the correct path. We taught initial students and experienced pilots. I watched both make the initial mistake of assuming an engine failure and rapidly lowering the lever and flaring, which confuses the issue. I watched one relatively senior and experienced squadron pilot mis-diagnose engine malfunctions a number of times to begin with because he couldn't unlearn his incorrect habit of dumping the lever. He eventually got the message and for him the simulator training was probably a life saver. I watched another ab initio pilot who considered himself a smart cookie and tended to rush everything. He dumped the lever after being given a Fire warning on the downwind leg at 800 feet. I had intended it to be a spurious warning but to my surprise, he lowered the collective a long way and allowed the aircraft to descend till it hit the ground while he misdiagnosed the fault and carried out fire drills and a single engine shutdown. The aircraft was fully serviceable apart from a false fire warning. That was one occasion where I was glad I had set record because he point blank refused to believe me when I debriefed him until I replayed the sim.

[Snarlie]

A common sense approach which has been favoured for some years now, ever since the Kegworth accident with the Boeing 737, is that, having gone through exhaustive check and double check crew procedures involving the indications, a decision is arrived at. The SSL for the selected engine is then confirmed again by both crew and then, SLOWLY retarded whilst a check is made of the response of the remaining engine. If any doubt exists the SSL can be restored with minimal loss of Nr.
During training I have seen several candidates opt for the wrong engine but the above procedure prevents further trauma.

[MightyGem]

The possibility of shutting down the wrong engine is always there. The US Army carried out a study back in 1998 amongst it's helicopter pilots, and found that:
Over 70 percent believe there is a potential for shutting down the wrong engine and 40 percent confirmed that they had, during actual or simulated emergency situations, confused the PCLs. In addition, 50 percent of those who recounted confusion confirmed they had shut down the "good engine" or moved the good engine’s PCL.

https://www.tc.gc.ca/eng/civilaviation/publications/tp202-4-98-459-3388.htm

[bondu]

Slightly off thread, but I believe very relevant....

Some years ago (around 25!) two friends of mine were flying a PR type flight, onshore in a 332L. The LS was in a field near the very large hotel were the passengers (including women and children) had just had Christmas lunch. The only way out of the field was with a helipad takeoff. The co-pilot was in the right hand seat and was PF; the captain in the left was a 332L TRE/TRI. As the PF lifted off, the PNF called the standard 20', 40', 60', 80' and the aircraft approached 100', he called out "Practice engine failure, Go!" The co-pilot's shout of "STOP!!!" was heard by the passengers at the rear of the 332L! Needless to say, the captain dropped his arm and the takeoff continued safely.

Moral of the story; the only time we practiced the helipad takeoff technique was during a base check and 90% of the time we would get an engine failure either just before TDP or just after. So a classic case of 'environmental capture'! It just goes to show that taking a moment to think before moving an FCL is worthwhile and also that anyone of us can (and does) make mistakes.

bondu

[Ascend Charlie]

Yeah. almost did it myself.

I had just finished my endorsement on the BK117, first one in Oz, and was using it on a police mission - we were in a high hover over bushy ground, looking for some escaped prisoners.

Then the warning of a torque split went off (usual indication of an engine failure)- No.2 was dropping, and No.1 was going up to take the load, but I knew I couldn't stay in the hover, so down went the nose to pick up speed and I flew away. All I knew was the drills the Japanese instructor had taught me the previous week - identify the bad engine, verify it by reducing throttle, shut it down.

So, I reduced the throttle on 2, stayed flying, and then had a think - 2 was still running at idle, 1 was hooting along, RRPM were good. I had started to return to base, just 5 mins away, and along the way I tried to bring the 2 throttle back up, but then NR started to overspeed, so 2 went back to idle. It was a runaway N2 governor on No.1 engine, but I hadn't ever heard of one before, so didn't know the symptoms.

Anyway, with the base only minutes away, I continued for a running landing on the grass, came to a stop, then pulled No.1 back to idle and was able to roll 2 back up - but I couldn't get both engines up without Nr overspeed, so I just shut them off, towed the bird back to the hangar, and subsequently learned a good lesson from the engineers.

If I had not been single pilot (with the other crew in the back) I would have tried to simultaneously roll 1 back and roll 2 up, but I needed both hands on the controls - our department had bought the El Cheapo model with no CSAS or autopilot or anything remotely that would reduce pilot workload.:{

[megan]

From many years ago, but still valid lessons.

http://www.atsb.gov.au/media/24790/199100020.pdf

We had an outstanding C & T who caught everyone out on engine shutdown identification. We had spent our multi lives up to that point flying the 212 single pilot, with the big fire handles slap bang in the middle of the instrument panel. The 76A was introduced, which had a grouping of four lights in a square on the upper right of the instrument panel. From memory the upper left was baggage fire, upper right engine fire, and the lower two the respective engine out. During engine cool down after a training sortie he would illuminate the engine fire warning, whereupon stupid would note the right upper light of the four light segment and immediately pull the #2 fire handle without looking at said handle. I mean, stupid wants to put on a smartish show. Of course, had stupid looked up to the overhead he would have found it was the #1 fire handle with the blazing red light. We learnt well, and in the numerous real life engine shutdowns we suffered as the bugs were sorted out in the early versions of the engine, no one got it wrong.

[Nigel Osborn]

An S76 in China had that exact problem, the good engine was shut down & the burning one failed. Result 14 dead.

In Borneo a Wessex 5 had the good engine shut down & the bad one overspeed tripped. Result no engine & 4 dead.

More haste, less .speed

[chopjock]

A stupid question perhaps, but why shut it down? (Heli & fixed wing)
Why not retard the suspect engine and leave it idling incase you might need it again? (unless it's on fire obviously).
Like the Kegworth incident, had they kept the suspect engine idling, and perhaps started up the APU too…

[Bravo73]

A stupid question perhaps, but why shut it down? (Heli & fixed wing)

If the Emergency Cx list tells you to shut down the engine, you'd better have a very good reason for not shutting it down.

[Sir Niall Dementia]

Chopjock;


Engines rarely fail. FADECS, governors and lots of ancillaries tend to fail. The shutdown is normally to preserve the engine from the damage the ancillaries are trying to do. Trust me when you hear a real engine failure it ain't a happy set of noises and shutting it down protects you from all sorts of other damage.


I had a BIG engine failure in the 90's, the CVR area sounded like an artillery barrage until the engine finally stopped. The sound lived with me for some time afterwards.


SND

[NickLappos]

chopjock,
Good question: Why do anything? Shutting down a dead engine is closing the barn door after the horse has gone, and shutting down the remaining engine is the beginning a a Very Bad Day, so why grab the levers at all?

On a twin helo, grabbing the engine levers during the early phase of an emergency should be a capital offense. CPs who do so are looking for a way to help, and must fight the urge.

First rule of medicine and piloting: Do No Harm
The aircraft is already trying to get your goat, don't compound it.
The CP's job is to be another set of eyes and another brain. Diagnose, discuss and then decide.
Even if you had a rare (almost vanishingly small probability) high side failure, that "problem is that you have too much power. As if too much power is a bad thing!

[ShyTorque]

Even if you had a rare (almost vanishingly small probability) high side failure, that "problem is that you have too much power. As if too much power is a bad thing! Experienced one in a C+, Nick. At night, in an unlit, off helipad area, just before TDP. Following the EF drill (landing back, as we were in the process of doing, having been told to terminate the take off by ATC) causes the Nr to very rapidly go to over speed once the collective is lowered. Not at all pleasant.

Diagnosis is the problem. The failed DECU ran the engine all the way up.

[NickLappos]

Shytorque,
Not to deminish your event too much, but I bet it was a failure of that collective pot, so that it basically beeped the engine up to high N2, but not semi-permanently to maximum power. Perhaps I am wrong and it was a true worst case runup to full power. The max beep event is alarming, but just (in the end) a runaway of the N2 set. A true high side failure makes the engine go to max power, which would, while at flat pitch on the ground, probably trigger the overspeed protection as the way to protect the aircraft.

[Lonewolf_50]

Nick:
I recall an SH-60F mishap, SoCal, early 90's (http://aviation-safety.net/wikibase/wiki.php?id=56323), where the crew had the infamous T700-401 torque spikes and surges. Mission abort, return to Imperial Beach, ended with a very hard landing.
Will try to find a better ref. That sticks in my memory as one of those (and there were quite a few) bizarre T-700 to Seahawk interface problems that plagued our wing for a couple of years.

John D or G-12 might be able to recall something about that. My foggy memory recalls getting the old caution from the Wing about checking (and confirming) which ECL or T-handle you had/have in your hand before pulling, and the old "idle, reconfirm, then off" as the best practice, per your previous post.
Memory may not be serving, however. That one may not have been a "shut down the wrong one" but a "pull one back, split torques" but the wrong one was leading. (Ref your earlier post on what to do with twins not getting along well with others).
However, I may have confused that mishap with another one.

[John Eacott]

As mentioned by SND, if the engine fails then it is already shut down.

A PT6 failure I had (turbine let go) resulted in such a plethora of captions on the CWP that it was a case of fly the aircraft, read off the failure warnings and finally notice one row of engine gauges at zero. Oops!

Winding off the wrong throttle didn't even enter the equation as a single pilot operation. But I have had a very experienced pilot in the LHS retard a PCL before I had verified the call, fortunately without creating an issue at the time. Salutary lesson :hmm:

[ShyTorque]

A true high side failure makes the engine go to max power, which would, while at flat pitch on the ground, probably trigger the overspeed protection as the way to protect the aircraft.

Let's just say that the aircraft went out on a low loader. It was full power, btw and it was the second similar event on that airframe. The RTO's C+ also suffered the same problem with engines running away up.

[JimEli]

IMHO, any pilot flying a twin who thinks he is immune to making this error is foolish. Having said that, shutting the wrong engine down is most likely NOT the pilot’s fault. The human factors and engineering in this area is abysmal. But in the end, it’s always the pilot’s fault.

Consider the number of aircraft that have caution lights stating something similar to “#1 ENGINE FAIL”. Yet the related emergency procedure typically contains considerable warning about the light's false activation. How about a warning panel directly in front of a pilot with the far left segment stating “FIRE”? I’ve heard many a pilot utter the left engine was on fire when responding to its illumination.

Actual emergencies involve failure modes and faults that combined, become confusing at best, and may not be covered in the flight manual (ask me about the loose DECU connector I experienced on a maintenance flight).

Many times the crew needs to evaluate multiple sources of data which are incomplete, inconsistent, conflicting or wrong. Often, multiple warnings with different color coding, location or associated horns and bells distract and tend to focus attention to the exclusion of other data.

I once flew a twin the military that had over 80 underlined emergency procedures. That’s purely ridiculous. I take the time to consult the checklist before accomplishing any critical procedure, especially when single pilot. You can easily "miss-remember" a step, the proper order or a crucial note. Obviously, if on fire, out-of-control or given no choice, youskip the checklist.

The golden rule of power lever/control manipulation is always to pause at idle, and confirm before proceeding. My current twin has a one-step memory item for single-engine emergency shutdown:

“ENG MAIN switch (affected engine) – IDLE, check then OFF.”

I break that down into at least 5 seperate steps!

[Fareastdriver]

Judging by the number of responses to my thread that ATR 72 crew were not alone, and that's just from the rotary world.

However, should somebody reading it checks their actions if they have a similar problem in the future then it is worth it.

[AnFI]

The problems of shutting down the wrong engine are not factored into the risk calculations for twin engined theoretical engine related risk.

and 'pilot error' is not always a fair label when too much is expected from the pilot.

It is stressful if one engine runs up to diagnose the idling engine as the good one.

Some good advice here along the lines of 'do nothing'

[AnFI]

Shy: "Let's just say that the aircraft went out on a low loader. It was full power, btw and it was the second similar event on that airframe. The RTO's C+ also suffered the same problem with engines running away up."

so unreliable ?!

[ShyTorque]

The C+ had a difficult time with the later DECU controlled French engines. Not the best version of the Sikorsky S76 by any means, in my own experience of operating the A+, A++, B, C and C+ models. I haven't flown the C++ but by all accounts the problems of its earlier brother were sorted but by a fairly involved redesign of the "engine room" including its controls.

[Mast Bumper]

If memory serves me right, the problem with the C+ when talking about erratic engines was the collective position sensor. They proved to be unreliable and on occasion would send erroneous signals to the DECU so that one engine would run up into blow-away power while the other engine would obviously go the other way. Significant torque splits ensue. If you don't take a wait and see approach, I can see how it would be easy to grab the wrong engine. Every time this happened while I was flying, it was only momentary and a change in collective pitch would restore normal engine operation. However, the Ng changes are rapid enough to really get your attention.

[Fareastdriver]

Seeing we are discussing the S76--going back to the very beginning with the Allisons.


To brighten up a boring trip the Allisons had an overspeed protection device. You tested this when taxiing out by pulling one engine back until the needles split and then holding down its test switch. This would cause the engine to hunt about 10% up and down proving the system worked. This used to go off in the air so you had one engine galloping up and down with the other galloping down and up trying to compensate. They would never get in sequence so the aircraft would fishtail furiously with the swings in torque. One had to lower the lever and pull the throttles to see which one had gone wrong before it threw the passengers out of the windows. Pulling it back to idle cleared it and so on you went.

[megan]

Fareastdriver, you take us back. Most of us used to fly with the breakers pulled following a few rundowns in less than ideal circumstances. We took no notice of the edict which came, from the FAA I think, that on single engine aircraft the overspeed was to be disabled, whereas on a twin the overspeed was to be used - both single/twin edicts were mandatory. Figuring that the overspeed trip was more or less equivalent to having an engine failure we were unable to discern the reasoning behind the single/twin logic, and still flew with the breakers pulled.