TransAsia Airways Flight 235 crashed into the Keelung River in Taipei after the crew shut down the functioning left engine while attempting to manage a malfunction of the right engine, leaving the aircraft with zero thrust at low altitude over a densely populated area. The aircraft struck a highway overpass, a taxi, and fell into the river. Forty-three of 58 on board died.
The crew’s identification of the wrong engine as the failed engine is the proximate cause. The systemic cause is an autofeather annunciation pattern that was ambiguous between ‘right engine has a problem’ and ‘left engine has a problem’ in the specific failure mode encountered — an ambiguity that the type rating training had not adequately prepared crews to resolve.
TransAsia 235 is the ‘wrong engine’ accident — one of aviation’s most feared scenarios. The crew correctly identified an engine problem. They correctly applied the emergency procedure. They identified the wrong engine. The annunciation system was ambiguous. The training had not resolved the ambiguity.
Date | 4 February 2015 |
Flight | GE 235 |
Aircraft | ATR 72-600 |
Operator | TransAsia Airways |
Fatalities | 43 of 58 on board |
Category | Engine Failure / Wrong Engine Shutdown / Ambiguous Annunciation / CRM |
Location | Keelung River, Taipei, Taiwan |
The Event
- GE 235 departs Taipei Songshan Airport on a scheduled domestic service
- Climbing through 1,200 feet, the right engine experiences an abnormal power event
- The right engine’s autofeather system activates — propeller is automatically feathered
- The cockpit annunciation in this specific failure mode is ambiguous
- The crew apply emergency procedure — identifying the left engine as the problem
- The left engine is shut down — it was the functioning engine
- The aircraft is now at 1,200 feet with zero thrust and a feathered propeller on the right
- The aircraft clips a highway overpass and falls into the Keelung River
- 43 die; 15 survive
The accident was captured on video by multiple cameras on the highway overpass and surrounding infrastructure. The footage shows the aircraft in a steep left bank as it descends, rolls, and strikes the bridge. The video was widely circulated and has been used extensively in aviation safety training contexts.
Systems Engineering Perspective
From a systems engineering perspective, TransAsia 235 is an annunciation ambiguity failure — the cockpit annunciation for the specific failure mode encountered was not sufficiently unambiguous to allow correct engine identification under the high-workload conditions of a low-altitude engine failure.
An emergency procedure that requires correct engine identification to be effective must be supported by an annunciation system that makes correct identification unambiguous. Ambiguity in emergency annunciation is not a minor design issue — it is a fatal one.
ATR 72 Autofeather System and Annunciation
The ATR 72-600’s autofeather system activates the propeller feathering automatically when engine torque drops below a threshold — protecting against an engine failure producing a windmilling propeller and asymmetric drag. When the right engine experienced an abnormal power reduction, the autofeather activated on that engine.
The cockpit annunciation for autofeather activation — in the specific failure mode involved — did not unambiguously indicate which engine had activated. The crew’s interpretation of the annunciation led them to identify the left engine as the problem. The left engine was producing normal power.
In a dual-engine aircraft at 1,200 feet, the ability to correctly identify which engine has failed is not a training skill — it is a design requirement. The annunciation must make it impossible to misidentify.
The Identify-Verify-Action Sequence
The standard engine failure procedure follows Identify, Verify, Action: identify the failed engine from the annunciation and instruments, verify by cross-checking thrust and performance indicators, then take action. The procedure depends on the identify step being correct.
The annunciation ambiguity compromised the identify step. The verification step — if fully and correctly executed — might have caught the identification error. Under the time pressure of a 1,200-foot engine failure, the verification step may not have been fully completed before the action step was taken.
Human Factors Perspective
The human factors analysis centres on the time-pressure error under which the wrong identification was made — and on the training gap that left crews without a specific, trained response to the ambiguous annunciation pattern.
High Workload, Low Altitude, Time Pressure
At 1,200 feet, with an active engine malfunction, the time available for the identify-verify-action sequence is measured in seconds. Under this time pressure, the verification step — which might have caught the identification error — is subject to truncation. The cognitive load of the emergency, the physical demands of flying the aircraft, and the urgency of the situation all work against the careful, deliberate verification that correct engine identification requires.
Emergency procedures that are safe at altitude may be too cognitively demanding to execute completely at 1,200 feet with seconds available. Low-altitude engine failure procedures must be designed for the time and cognitive load that altitude provides.
Training Gap for Specific Failure Mode
The type rating training for the ATR 72-600 did not specifically address the annunciation pattern of the specific failure mode encountered on GE 235. The crew encountered an ambiguous annunciation without the specific trained knowledge to resolve it.
Post-accident training revision specifically added this failure mode — and its annunciation pattern — to the type rating syllabus.
System Interaction Breakdown
1. Ambiguous Annunciation for Specific Failure Mode
The autofeather activation annunciation in this failure mode did not unambiguously identify the affected engine.
2. Wrong Engine Identification
The crew identified the left (functioning) engine as the problem and shut it down.
3. Zero Thrust at 1,200 Feet
With the right engine feathered and the left shut down, the aircraft had zero thrust at 1,200 feet over an urban area.
Significance in Aviation Risk
1. ATR 72 Annunciation Design Review
The ambiguous annunciation pattern for the specific autofeather failure mode was reviewed and addressed in subsequent aircraft production and retrofit.
2. Type Rating Training for Specific Failure Mode
The specific failure mode — autofeather activation with ambiguous annunciation — was added to the ATR 72-600 type rating training syllabus.
3. Identify-Verify-Action Emphasis
The emphasis on the full identify-verify-action sequence — particularly the verification step — was elevated in emergency procedure training for all turboprop types.
Related Aviation Risk Lab Content
Pillar Pages
Human Factors: Human Factors
Crew Resource Management: Crew Resource Management
Systems Engineering: Systems Engineering
Related Case Studies
Case Study 33: US Airways 1549 — The River Landing: Usair 1549
Case Study 27: Colgan Air 3407 — Fatigue, Startle and the Stall: Colgan 3407
Case Study 31: Adam Air 574 — Distracted by the IRS: Adam Air 574
Closing Perspective
TransAsia 235 killed 43 people because an annunciation system was ambiguous in a specific failure mode, a training programme had not addressed that ambiguity, and a crew at 1,200 feet had seconds rather than minutes to identify the correct engine.
The annunciation revision, the type rating training addition, and the identification procedure emphasis are the systemic responses. Together, they close the specific gap that killed 43 people over Taipei.
The lesson is old and recurrent: when the correct identification of a failed component determines whether the emergency procedure saves the aircraft or kills it, the identification must be unambiguous. Ambiguity in that one step is fatal.
TransAsia 235 is the proof that ambiguous emergency annunciations are not a minor design issue. They are a fatal one when the wrong identification kills the wrong engine at 1,200 feet.
Related Posts
