Saturday, February 14, 2015

Only a Fraction of TransAsia's Pilots Pass Post Crash Exam

In the wake of the crash of TransAsia GE-235, the airline tested all 68 of the pilots currently flying the ATR 72 aircraft at the recommendation of Taiwan's Civil Aeronautics Administration. Of those pilots given an oral examination, 39 passed, 10 failed and 19 others were grounded until they take the exam. All of the pilots will be given additional simulator training as well.

Foremost in any accident investigation is an effort to identify the primary cause of the accident and to suggest changes which will forestall any recurrence. In the case of TransAsia GE-235, the pilots' erroneous decision to shut off their remaining good engine appears to be the primary cause. The subsequent testing and failure of a number of pilots seems to provide a smoking gun that poor procedural knowledge is the culprit.

Of those who failed the exam, they will most likely be retrained and retested before being allowed to fly again. Sounds like the problem has been quickly and easily identified and solved. We can all go safely back to our phones. Or can we?

In any investigation, care should be taken to also identify underlying trends which may contribute to the obvious causes of any accident. A facile determination of the cause and a quick and easy palliative certainly serves corporate and political interests, but not necessarily those of the flying public.

This can be especially true if the underlying problems prove to be stubborn, or expensive to fix, or if the political will to fix them is lacking. I believe that all three of these things are happening here.

If Possible, Blame the Pilots

Airline crashes, besides being human tragedies of the highest order, are also both economic and political tragedies.

The economics involve not only the expected payment of upwards of a million dollars per fatality, and the loss of a revenue producing asset worth perhaps $20 million in this case, but also the lost revenue from the inevitable drop in bookings which follows any air disaster. Findings of fault with training, maintenance or procedures can increase any liability or punitive damage awards.

The political tragedy is more subtle but no less real in that questions involving regulatory oversight and preventative actions will be asked of government oversight entities. In the US, the FAA is occasionally referred to as being a macabre sounding "tombstone agency". This term refers to a perception that nothing of substance gets changed until some bodies pile up, and that the agency is essentially reactive.

In the meantime, after any crash, regulatory agencies will engage in a bureaucratic circling of the wagons to deflect any political blowback concerning regulatory oversight or lack thereof, which may have somehow contributed. The words "FAA Approved" which must appear on each and every page of the many volumes of manuals, checklists, and documents used by all US airlines, provide ample incentive for investigators to fault pilots' failures to follow guidance, and not the guidance itself.

In many countries with less stable governments, an air disaster can be a useful cudgel to be used by an opposition political group with which to criticize a currently ruling party or government.

There has been some speculation for instance, that a possible motive for the captain of MH370, the Malaysian airliner which disappeared last year, was to embarrass the Malaysian government which had recently brought charges against an opposition leader towards whom the captain had strong sympathies.

So in consideration of both corporate and political needs, incentives are well aligned to find some measure of incompetence or malfeasance with the people who always arrive first at the scene of any crash, the pilots. Dead pilots, conveniently unavailable to defend themselves, are useful for this effort.

How Stupid Could They Have Been?

As has been widely surmised through the release of the flight recorder data, it appears as if the pilots of GE-235 misidentified which engine had failed, and then shut off their remaining good engine. For this they are being pilloried in the comments sections of various blogs and social media as incompetents, idiots and worse.

Yes, it was a boneheaded thing to do, and it cost them their lives, but does anyone believe they did it on purpose? Or couldn't tell their left from their right? The gauges on an aircraft panel are fairly straightforward. Each gauge corresponds to the engine on same side of the aircraft as the gauge. The left RPM gauge or fire warning is lit? That means it's the left engine. Seems simple.

Adrenaline Can Make You Stupid

Anyone in law enforcement will tell you that in a real gun fight, fear and the adrenaline that will be dumped into your bloodstream as a result, can nearly incapacitate. The same can be true for stage fright or any other high stress situation. Fine muscle control and reasoning can evaporate. Concert pianists, police, figure skaters, and pilots all have the same need to practice what they do until it becomes second nature. It counteracts the effects of fear and surprise.

An old adage in aviation says that the first step of any emergency procedure is to first wind your watch. What this really means is that you should first take a moment and contemplate what is actually happening for there is very little in flying that requires instant reaction. An engine failure at 1000 ft certainly isn't one of those times.

So how did they screw it up?

The only way that that question will be definitively answered will be through a thorough analysis of the cockpit voice recorder to see who said what to whom. Someone identified the wrong engine as failed, and someone shut down the good engine. It may have been the same person. There was a high time instructor sitting in the cockpit jumpseat who may have had some influence.

While I have no way of knowing for sure, my guess is that the pilots of TransAsia GE-235 allowed the surprise of an engine failure on takeoff to cloud their judgement so much that they rushed and made a simple, yet fatal error. But in a high stress environment and under the influence of an adrenaline dump, human judgement can go out the window.

I know this because I've seen it happen. Lots of times. With students.

Training is Good but Experience is Better

Being an Air Force flight instructor is probably one of the least glamorous, yet one of the most rewarding jobs a young company grade officer can have. The T-37 was loud, hot and slow but an incredible amount of fun to fly. It was the students, though, that made the job a kick. They were beyond enthusiastic about being where they were.

But while they worked hard and leaned forward, they knew that a few bad rides in the jet could bust them out of the program, and for many, their life's dream. That kind of pressure amps up the desire to do everything correctly to a fever pitch.

This meant that when I'd pull an engine back in the jet or simulator, there were plenty of times when the student would jump on the wrong rudder. They'd overthink it and literally knee jerk the wrong foot. I also saw this plenty of times during spins. When the airplane is falling 10,000 ft a minute, the stress is palpable.

I even had a student attempt to pitch his aircraft into mine on a formation flight when his intention was to break the other way. I was ready for him, and pushed my jet over to avoid a collision. He had telegraphed his intent by looking the wrong way while clearing.

What these students were lacking was a deep and ingrained foundation of experience. They had no cushion to fall back on. This is what hours of training and repetition are designed to establish. My contention is that while the TransAsia pilots had satisfactory hours totals on paper, they were lacking real experience in actual hands on flying. This is a byproduct of automation.

But Weren't They Experienced Pilots?

A pilot's flight hours used to be the badge of experience. Old heads could regale young bucks with the stories of how they obtained their thousands of hours hand flying a 707 around the world. This is no longer the case. Once a real measure of experience, automation can easily hide the measure of true experience that was once contained in a pilot's total hours count.

For example, in a 14 hour trans-oceanic flight, pilots today may only actually hand fly the aircraft for a total of a few minutes or less. And it's not because they're lazy; this is usually corporate policy. The use of automation is becoming if not completely mandatory, then highly recommended.

Automation saves fuel, and it standardizes the operation of the aircraft which managements like. And let's be honest, it's also safer. But it also allows the placement of low time pilots with little actual aviation experience in cockpits thereby staving off some of the effects of the pilot shortage. Pilots with many thousands of hours in their logbooks may have as little hand flying time as my former students.

And the dirty secret about all of this is that airlines are just fine with barely qualified pilots staffing their cockpits. The alternative is to park airplanes. And should one crash, blame the pilot, make a public showing of retraining and get back to normal operations.

Ab Initio, Automation, and the Pilot Shortage

There is currently a worldwide pilot shortage which is expected to grow progressively worse in the next few years. This shortage is most acute in the Asia-Pacific region which is experiencing extremely fast growth in the aviation sector, and yet lacks a robust private aviation sector from which to draw pilots. The demand for pilots is so acute in India, they are experiencing a rash of fake pilots passing themselves off as the real thing. From Aviation Week:

The potential problems could be particularly acute in the Asia-Pacific region which Boeing projects will need 41% of the more than one million new pilots and maintenance technicians it forecasts will be needed by the world’s airlines over the next 20 years. The combined worldwide requirement is expected to include 533,000 pilots and 584,000 maintenance personnel.

Airlines outside of the US are resorting to a number of strategies to provide the numbers of pilots needed to fill their schedules. These include ab initio training and automation.

Ab initio training refers to a type of training program used mostly overseas which takes prospective pilots off the street and trains them from a pedestrian all the way to their placement in an airline cockpit. It typically involves a rudimentary flying training program in a simple trainer to the point where the student amasses several hundred hours and a $100,000 bill before being placed in an airliner. The emphasis is on airline operations as opposed to actual stick and rudder proficiency.

Run in conjunction with participating airlines, the tab is then paid back over some number of years with the hiring airline. Graduating with only several hundred hours of total time, a prospective student then starts in the right seat of one of today's highly automated airliners. While proficient in running an automated cockpit, an ab initio pilot never has a chance to gain a solid foundation of "stick and rudder" or hand flying.

A pilot with this type of background may fly for an entire career with nary a hiccup. Highly automated cockpits are designed to be flown from just after takeoff to just prior to landing in the control of the autopilot and autothrottles controlled by a flight management computer preprogrammed with the entire route. They work just fine for most of the time but on occasion things go wrong. And when things go wrong and the automation quits, a qualified pilot should probably be on hand to actually fly the airplane.

Coming to a Cockpit Near You

Well, you might say, I'll simply avoid flying on small, obscure Asian airlines and should be just fine. Maybe. But consider that the pilot shortage is a worldwide phenomenon and airlines even here in the states are starting to curtail their schedules due to a lack of pilots. The FAA, in recognition of the hazards of low time pilots, recently raised the hours requirements last year from 250 to 1500 hours. This has only served to exacerbate the problem in that personally financing the required hours before being qualified to get a job is nearly impossible for most aspiring pilots.

Add in the coming deployment of commercial drones which will take the few non-airline jobs available to aspiring pilots such as pipeline inspection or banner tows, and you can see the dilemma that even domestic airlines face.

Will drones eventually replace airline pilots and make the whole problem moot? Absolutely. But in the interim, which may be a while yet, pilots should still probably be able to fly their aircraft when the automation, or an engine, quits.

A Way Forward

There is a way to cut this Gordian knot of a need for both greater numbers of pilots and pilots with actual flying skills. It will cost money of course and require some bureaucratic and corporate risk taking, but the alternative will be more preventable accidents like Air France 447 and Asiana 214 where nominally experienced pilots flew good airplanes into the ground for no reason.

The US Air Force and US Navy have been running the equivalent of their own ab initio flight training programs for decades. In both services, pilot candidates with no previous flight time at all are trained in an intensive year and a half program and graduate to fly everything from transport aircraft to jet fighters. The difference between these military programs and their civilian equivalents is an immersion in nothing but stick and rudder flying to include aerobatic training even for transport pilots.

If I recall, I graduated from USAF undergraduate pilot training with about 175 hours of total time and after a checkout in my follow on aircraft, was placed in the right seat of a KC-135 tanker which is a military 707. But every hour of that 175 was hand flown and involved aerobatics, spins, stalls, and formation flying. Expensive? Sure. 

Could such a program be modified for civilian use? I have little doubt that such a solution must, because the alternative will be either parked airplanes, or more likely, additional dramatic dash cam videos of crashing airplanes.

Sunday, February 08, 2015

Cessna T-37 Single Spin Recovery Bold Face

For those who might have forgotten, I think it goes like this:

Throttles – Idle

Rudder and Ailerons – Neutral

Stick – Abruptly full aft and hold

Rudder – Abruptly apply full rudder opposite spin direction (opposite turn needle) and hold

Stick – Abruptly full forward one turn after applying rudder

Controls – Neutral after spinning stops and recover from dive

(43 words as I remember)

And if that doesn't work there was always this:

Handles - Raise

Triggers - Squeeze

The above bold face items were two of the  memory items required in the Air Force's undergraduate pilot training program while in the T-37 phase of instruction. The first is the spin recovery, and the second is the ejection sequence.

The course ran for about a year and successful completion would result in the award of silver wings and the aeronautical rating of pilot.

Bold face memory items were required to be committed to memory and recalled verbatim. Every morning, a briefing was conducted to go over items pertaining to the day's flying. One of the segments of the briefing was known as the "stand up".

A designated instructor would present an emergency scenario and then call upon a student to stand and verbally walk though all the steps required to resolve the emergency. Should the event require the use of a memory item, the student was expected to recite the bold faced item perfectly as a first step. Incorrect recitation would be followed by a command of "sit down".

This meant that the student was grounded for the day. This morning dog and pony show probably induced more stress in the students than would an actual emergency in the aircraft, and came to be widely hated by all.

Wrong Engine Shut Down?

The data readout from TransAsia's flight data recorder has been made available. The first warning in the cockpit was associated with the right hand engine (No. 2). The crew next discussed a failure associated with the left engine (No. 1). The left engine was then throttled back and shut down.

Shortly thereafter the right hand engine auto-feathered. This is an automatic feature on the ATR 72 which feathers the propeller (aligns it with the windstream to reduce drag) when the power from the engine falls below 18%. This is essentially an engine failure of the right hand engine and though it continued to run, it was not producing thrust.

The crew then discussed and attempted a relight of the left hand engine. Engine data suggest that the relight on the left hand engine was successful though perhaps too late to recover the aircraft.

The ATR 72 also features an automatic yaw compensator which would automatically apply rudder to counteract any adverse yaw resulting from an engine failure.

All these automatic features are designed to reduce the workload on the pilots in the event of an engine failure on takeoff. What they cannot do is counter basic airmanship mistakes such as misidentifying and shutting down the wrong engine.

There has been some discussion that perhaps there were miswired engine indicators. This is not an unknown occurrence, but pilots should use all available resources to make a determination of a failed engine. This would include other gauges such as fuel flow and exhaust temperature and also the performance of the aircraft itself. The aircraft will always yaw towards the failed engine.

In any event, miswired engine indicators should be noticed on engine start. If starting the left engine and the right hand RPM indicator spins up, that would be a big clue. At this point there is no evidence of miswired gauges.

An engine loss of thrust at 1000 ft agl (above ground level) should be no cause to take rash action. The aircraft is flying and will continue to fly well with only one engine. In this event, a proper course of action would have been to continue to fly the aircraft to altitude and then to methodically proceed through engine failure checklists.

Saturday, February 07, 2015

AirAsia 8501 May Have Entered a Spin Over the Java Sea

As of today, 93 bodies have been recovered from the fuselage of QZ8501 with 68 of them being identified. There have also been reports of a body being recovered wearing a pilot uniform from the cockpit area.

The mystery that still remains is the exact nature of the events which caused the aircraft to stall and to apparently depart controlled flight. As detailed in an earlier post, the aircraft climbed at a very high vertical speed to nearly 38,000ft followed by sounds of stall warnings being heard on the cockpit voice recorder.

Additional data released indicate that the aircraft changed heading twice during this climbing event and then started a rapid descent after which two more heading changes occurred. Data then indicate that the aircraft entered a "spiral" according to an article in the Wall Street Journal. (Paywall)

Modern airliners are not supposed to stall. All transport category aircraft certificated for commercial service are equipped with elaborate stall warning systems which are designed to give clear audio and tactile (stick shaker) warnings for even an approach to a stall.

Some aircraft manufacturers have gone even further in designing flight controls and other automated safety systems which will not even allow an aircraft to be flown into a stall. Airbus, the manufacturer of the A320 flown as QZ8501, is one of those aircraft builders. Airbus, a consortium of European aircraft manufacturers, revolutionized the industry by introducing the first "fly by wire" commercial airliner, the A320, in 1987. 

"Fly by wire" means that there is no mechanical connection between the controls in the cockpit and the wings as has historically been the case. With this aircraft, the cockpit control stick merely provides electronic signals to a computer (actually a series of computers) which interpret the pilot's intent. The computers then generate commands for the hydraulic servos which actually control the ailerons, elevators, and rudder. 

A Brief History of Flight Controls

The world's first successful heavier-than-air powered airplane was the Wright Flyer. The Wright brothers developed a system to steer the aircraft which actually warped the wood and cloth wings using cables fastened to the body. They later developed and patented a system of hinged flight controls which still provides the basis for aircraft control today.

As aircraft size, speed and complexity grew, new systems of mechanical linkages were employed to connect cockpit controls to flight control surfaces. Hydraulically powered flight controls were introduced in the post WWII era when aerodynamic forces became too great for human strength to overcome. These controls were, however, still controlled through direct mechanical linkages to the cockpit.

An ongoing objective of aircraft designers over the years has been to find ways to reduce the weight of their designs. A lighter aircraft can carry more payload, more fuel, has increased range and is more economical to operate. 

In the 1980s, Airbus felt that computer technology was mature enough for them to design a commercial aircraft with a fully digital flight control system. This system would replace all the pulleys, cables and other mechanical linkages between the cockpit and the wings with electronically controlled servos to command the hydraulic flight controls. There would be no direct mechanical linkage between pilot and wing. It would also save thousands of pounds of weight.

An "Un-stall-able" Airplane

Airbus went even further in their revolutionary design realizing that with computer control, they could design an aircraft that could not be mishandled by an errant or distracted pilot. In effect, the pilot was no longer in direct control of the aircraft but merely got a "vote" in how the aircraft was to be flown. And his vote could be overridden by the computer if a preprogrammed rule was violated.

So should a pilot inadvertently attempt to fly the aircraft into a stall, the computers would intervene to lessen the angle of attack to prevent the wing from stalling. You can theoretically pull fully back on the stick all day in an Airbus and the airplane won't stall. At least that's how it should work.

Faulty Computers

And in a normally functioning airplane that is how it does work. But something was amiss in the cockpit of QZ8501. News reports from the investigation now indicate that there might have been a problem with the aircraft's flight augmentation computer (FAC). There have been unconfirmed reports that the FAC had had recent mechanical difficulties, and that Captain Iriyanto, the pilot in command that night, may have been aware of the problems.

Data from the cockpit voice recorder now indicate that at some point just prior to loss of control of the aircraft, Captain Iriyanto transferred control of the airplane to First Officer Remy Plesel and got out of his seat for the purpose of pulling the circuit breaker controlling power to the FAC. This is considered a highly unusual course of action as a more normal procedure would be to reset the computer from a switch on the overhead panel if it was warranted. For some reason the captain felt that a reset was not appropriate and that the computer should be depowered.

Now as I've mentioned above, the Airbus's flight controls are completely computer controlled. But pulling the breaker on the FAC didn't mean that the airplane was now uncontrollable. There are multiple computers and redundancies in the system, but it does mean that the functions provided by the FAC were no longer available.

Now Vulnerable to a Stall

And one of those functions is what is known as "flight envelope protection" or more simply stall protection. Without flight envelope protection, the aircraft's computers would no longer automatically guard against a low speed condition or stall. Keep in mind that this vulnerability currently exists in all non-digital flight control airplanes flying today including the Boeing aircraft I fly. Their old school philosophy is that the pilot is the best stall protection.

What exactly happened next is still unclear but reports suggest that First Officer Plesel may have been startled by the loss of the FAC. Or he may have been trying to avoid a storm. But whatever the reason for it, he then placed the aircraft in a very steep climb which ran the airspeed down below flying airspeed at an extreme altitude.

At this point Captain Iriyanto was able to retake his seat and assume command of the aircraft, but the aircraft may already have been well into the now unprotected stall regime.

F/O  Remy Plesel

A Spin

Some data that has been made available from the DFDR indicates that there were multiple heading changes both before and after the stall warning sounded. It is possible that the aircraft entered a spin after stalling at high altitude from which the pilots could not recover.

A spin is a species of stall whereupon one wing is stalled and the other is either not stalled or is stalled less severely. When this happens, the more highly stalled wing has more drag than the partially or un-stalled wing and the aircraft starts to auto-rotate and drop.

Many aircraft can enter and exit spins should the correct procedures be applied. Airliners are not counted among those type of aerobatic aircraft. It is doubtful that Airbus even wind-tunnel tested the original design of the A320 for it's spin characteristics. The ability of an aircraft to exit a spin is also highly dependent on it's center of gravity (CG) and beyond certain limits no control input will be successful.

Captain Iriyanto had been a military F-16 pilot and was certainly familiar with unusual aircraft attitudes, and may even have had experience in spinning trainer aircraft. But a spinning airliner would certainly test the mettle of the best pilot ever to fly one even if recovery had been possible.

I've intentionally spun jet trainer aircraft many dozens of times during my instructor days, and it is a violent maneuver. Doing it at night in the weather in an airliner is the stuff of nightmares.


The events I've spelled out here contain a measure of conjecture based on the admittedly sparse data available from various news reports. The reality of what actually happened to QZ8501 may be remarkably different once the full report is made known. It is not yet known what the actual maintenance status of the aircraft was nor its proximity to the nearby thunderstorms. These details should be known when the final accident report is released.

TransAsia Synopsis

This is a video from the Wall Street Journal which succinctly summarizes the events leading to the crash of TransAsia 235. It may be behind their paywall.

View video.

Friday, February 06, 2015

TransAsia Aircraft Lost Power

By now everyone has seen these dramatic images of the TransAsia ATR 72 that crashed into a river shortly after takeoff from Taipei. 15 of 58 passengers aboard survived the crash but neither pilot survived. The data recorders have been recovered and are being analyzed. 

So far it is known that the aircraft reported engine problems at an altitude of 1200ft, 37 seconds into the flight. One of the pilots radioed the word "flameout" shortly before the crash and apparently an automated maintenance reporting system also sent a signal indicating that one of the engines had suffered a flameout according to an aviation investigator.

The term "flameout" is used by pilots to indicate that an engine has stopped producing thrust. While the ATR 72 is a propeller driven aircraft, its engines are technically known as turboprops. This type of engine is actually a turbine, or jet engine attached to a propeller. This means that if fuel is interrupted or some other malfunction occurs, the "flame" in the hot combustion section can go "out", and the engine stops producing thrust.

This particular ATR 72 was relatively new having been delivered in April but had suffered engine problems previously. The malfunctioning engine had been replaced according to reports. News reports did not mention which engine that was.

The latest reports now indicate that the right engine had not flamed out but had inadvertently entered "auto-feather" mode meaning that the propeller blades themselves are rotated on their axis so as to stop producing thrust but that the engine itself continued to run. This was apparently an uncommanded anomaly which would present itself to the pilots in the same fashion as a flameout.

Furthermore, the data recorders also indicate that the left engine was manually shut down. This suggests that there was confusion in the cockpit as to which engine had suffered a loss of thrust and the wrong engine may have been chosen to attempt a restart.

Expect the Unexpected

There was a time in aviation when things would routinely go wrong. Engines were unreliable, instruments were rudimentary and inaccurate, and pilots were pretty much on their own. Those days are decades gone and modern commercial transports almost never suffer the catastrophic failures of the past but that doesn't mean bad things don't happen. 

They still occasionally do, but the odds of say an engine failure on takeoff, one of the most challenging things that can happen, are becoming vanishingly small. At the current reliability rates of aircraft engines, the expected statistical occurrence of any engine failure let alone one at takeoff over a career of flying, is in the low single digits.

This is a really good thing, but it does present the problem of how to keep pilots from becoming complacent. Luckily, modern day simulators have capabilities that are so true in fidelity to actual aircraft that the FAA allows new pilots to complete a full training program and check ride entirely in a simulator. The first time a pilot may fly a newly assigned aircraft is now routinely on a revenue flight with paying passengers. The sims are that good.

You Are Only as Good as Your Training

Not only do all pilots train for normal operations in the sim, but we are routinely checked on emergency procedures such as engine and other system failures. One of the most common (and nerve wracking) events is known as the "V1 cut". In this scenario, during takeoff the instructor will fail an engine almost immediately after reaching our go/no-go decision speed known as V1.

This is the most critical point to lose an engine as you are committed to take off but have barely any flying speed. You won't know which engine will fail or how but you have an idea that something bad is going to happen. You're in the sim after all, and it's a required item, so it's coming. Not so true during everyday flying.

When the engine fails, the first thing you notice is that the aircraft will yaw, meaning the nose will swing towards the failed engine. (The thrust from your good engine on the other side is now pushing the nose towards the failed one.)  What must be immediately done then is to apply rudder to realign the aircraft with the runway so you don't go off the side into the grass. This is also your best clue as to which engine has failed without even looking at the gauges. It's an instinctual response. The nose goes left, you step on the right rudder.

If you're already airborne when the engine fails, the best indicator of which engine failed will more likely be the instruments, especially at night. I always instructed my students to "step on the good engine" and it seemed to work for them.

Don't Shut Down the Wrong One

I should probably also mention now that while an engine failure on takeoff is a serious event, it is also an eminently survivable one. All commercial transport aircraft are designed to fly perfectly well with the loss of an engine. Back in my military days, we'd fail two engines on one side of a four engine plane and get it to the runway with no fuss. In fact with no other system malfunctions, a single engine airliner won't fly as high or fast with a failed engine but landing is not a particular challenge.

The procedures to be followed after getting airborne and cleaned up with a failed engine are to determine what went wrong, attempt a restart of the failed engine if warranted, and to plan a return to the departure airport. Under certain conditions such as no apparent fire, and no internal damage or seizure, a restart may be attempted. If a restart is not warranted due perhaps to a seized rotor, the engine should be secured.

Here is where mischief can occur.

Checklists for both an emergency restart and also for securing a failed engine both usually involve taking the fuel control to off. For a restart attempt, this resets the fuel control unit and for a shutdown, you don't want fuel flowing into the dead engine. 

You have two engines with two fuel control levers right next to one another. This is the time to be very careful to choose the correct one. Choose unwisely and you're a glider. At my airline, as I suspect at most, this is a two person job with one person designated to guard the good engine lever while the other person shuts down the failed engine.

Again the key to all of this is to not rush. A single engine airplane will fly just fine all day, so rushing will only increase the likelihood of  mistakes.

There is actually precedent for the shutting down of a wrong engine causing a crash. In 1989 a British Midland Boeing 737-400 crashed when the pilots shut down a good engine having misidentified which engine had suffered an internal failure. There were 47 fatalities.

As I mentioned above, things almost never go wrong in commercial aviation, but when they do, you will be presented with multiple alarms sounding and a profound sense of confusion as you attempt to figure out what just happened. Simulator training is invaluable to be prepared but nothing tops a mental preparation to always expect the worst.