This is the crash that could put an end to Boeing's trajectory as the world's preeminent airplane builder and that would be a shame. It should also put a focus on the way the U.S. FAA certifies airplanes and that is a good thing. But for us pilots the blame game may have another consequence: obscuring the need for better pilot training.

— James Albright

image

Updated:

2019-11-02

image

Angle of Attack (AOA) sensor,
KNKT.18.10.35.04, figure 7

Much has been made about this particular airplane's design and many are quick to blame that design for the death of the 189 people aboard Lion Air 610 as well as the 157 on board Ethiopian Airlines 302 on March 10, 2019. The installation of larger engines meant the airplane would be unstable in some, rare flight regimes. To counter this without having to apply for a new aircraft type certification or require additional pilot training, Boeing relied on an electronic gizmo called "MCAS" and assumed pilots would treat malfunctions as they would any other pitch trim abnormal. But on these two crashes, that was a bad assumption.

So the blame game can be stated thusly: the aircraft manufacturer took a short cut in the design when installing what they considered an automatic and transparent system. Two airline crews were caught and now people are dead. But is that really what happened?

Boeing. I think there is a point where the engines are too big for the existing airframe and it is time to start over. I also think giving pitch authority to the MCAS based on a single Angle of Attack sensor is foolhardy.

Lion Air. The airline has a reputation for doing everything as cheaply as possible and that includes pilot hiring and pilot training. Filling the front two seats with pilots with so little experience is very dangerous and doing so should make the company culpable in the deaths of those behind those two seats.

The pilots. The pilots of Lion Air 610 made a lot of mistakes and could have survived had they simply pulled the throttles back, kept the airplane configured, and returned to land. They could have also survived had they simply placed the pitch trim switches to "cut out" and finished the flight manually trimming their stabilizer. But it is hard to blame pilots who are plucked off the street with very little experience, given minimal training, and are allowed to continue flying even after years of failing checkrides and demonstrating to any objective observer that the Boeing 737 MAX was more airplane than they could handle. It was, simply put, too much airplane.

Airline crashes are rare, and rarer still are crashes that force the grounding of an entire fleet. Lion Air 610 was not immediately among them. But about four months later, on March 10, 2019, an equally new 737 Max flown by Ethiopian Airlines went down on departure from Addis Ababa with the loss of everyone aboard, and within a week all further flights of the 737 Max were stopped worldwide. After both accidents, the flight-data recordings indicated that the immediate culprit was a sensor failure tied to a new and obscure control function that was unique to the 737 Max: the Maneuvering Characteristics Augmentation System (MCAS). The system automatically applies double-speed impulses of nose-down trim, but only under circumstances so narrow that no regular airline pilot will ever experience its activation — unless a sensor fails. Boeing believed the system to be so innocuous, even if it malfunctioned, that the company did not inform pilots of its existence or include a description of it in the airplane’s flight manuals.

Source: Langewiesche

Even highly experienced pilots may be taken by surprise by a system that "applies double-speed impulses of nose-down trim." In a nutshell, the issue is this: Most pilots assume that when an airplane stalls the nose drops abruptly, which is where the nose needs to go in the event of a stall. But that isn't true of all airplanes, including the 737 MAX. So the double-speed impulse does that and makes the airplane appear to stall like early 737s. Of course an electronic fix to imitate an aerodynamic behavior is subject to malfunction. As we shall see in the case of Lion Air 610.

1 — Accident report

2 — Narrative

3 — Analysis

4 — Cause

image

1

Accident report

  • Date: 29 Oct 2018
  • Time: 0631
  • Type: Boeing 737 MAX 8
  • Operator: Lion Air
  • Registration: PK-LQP
  • Fatalities: 8 of 8 crew, 181 of 181 passengers
  • Aircraft Fate: Destroyed
  • Phase: En route
  • Airport: (Departure) Jakarta-Soekarno-Hatta International Airport (WIII), Indonesia
  • Airport: (Destination) Pangkal Pinang Airport (WIKK), Indonesia

2

Narrative

imageInstrument SPD and ALT flags appear on PFD, KNKT.18.10.35.04, figure 3

The Accident Flight

This appears to be a simple case of runaway nose down pitch trim that was easily treated with opposite nose up pitch trim, but there are two things that immediately catch your eye. First, there did not appear to be any attempt to disable the electric pitch trim. Second, there are two actors here: one labeled "the automatic AND trim" and the other labeled "MCAS". Both are related to a stability augmentation system, described below.

  • Prior to the departure, the Cockpit Voice Recorder (CVR) recorded the flight crew preflight briefing which mentioned Deferred Maintenance Item (DMI) of Automatic Directional Finder (ADF) that was unserviceable, the taxi route, runway in use, the intended cruising altitude of 27,000 feet and the weather being good. The CVR did not record the flight crew discussion related to the previous aircraft problem recorded in the Aircraft Flight and Maintenance Log (AFML).
  • The Captain acted as Pilot Flying (PF) and the First Officer (FO) acted as Pilot Monitoring (PM). The Digital Flight Data Recorder (DFDR) recorded pitch trim was 6.6 units.
  • At 23:20:01 UTC, the DFDR recorded Takeoff/Go-around (TO/GA) button was pressed and the engines spooled up to takeoff thrust. At 23:20:16 UTC, the FO called 80 knots and the DFDR recorded the airspeed indicator on Captain’s Primary Flight Display (PFD) indicated 79 knots while on the First Officer’s (FO) PFD indicated 81 knots. The DFDR also recorded difference angle between left and right Angle of Attack (AOA) sensor, which was about 21° which continued until the end of recording. The DFDR indicated that the Flight/Director (F/D) on the Captain Primary Flight Display (PFD) showed 1° down, while on the first officer PFD showed 13° up.
  • At 23:20:32 UTC, the aircraft Enhance Ground Proximity Warning System (EGPWS) sounded “V1”. The DFDR recorded the airspeed indicator on the Captain’s PFD indicated 140 knots while on the FO’s PFD indicated 143 knots. The low speed barber pole appeared on Captain’s PFD airspeed indicator with the overspeed barber pole bar on the Vr (rotation speed) mark.
  • At 23:20:33 UTC, the FO called “rotate” and 2 seconds later as the nose gear lifted off the runway, the DFDR recorded left control column stick shaker activation which continued for most of the flight.
  • At 23:20:37 UTC, the takeoff configuration warning sound was recorded momentarily on the CVR then the FO stating “Takeoff Config”. Four seconds later, the Captain queried about the aircraft problem, at this time the DFDR recorded pitch was 7° up, the rate of climb was 1,000 feet/minute (fpm).
  • At 23:20:40 UTC, the aircraft became airborne. The clearance for departure was to follow the Standard Instrument Departure (SID) of ABASA 1C.
  • At 23:20:44 UTC, the FO called “Auto Brake Disarm” and advised the Captain of “Indicated Airspeed Disagree”. The DFDR recorded the left indicated airspeed (IAS) was 164 knots and the right IAS was 173 knots. The IAS DISAGREE message appeared until the end of the recording. The FO then questioned what was the aircraft problem and asked whether the Captain intended to return to the airport. The Captain did not respond to the FO question and did not provide acknowledgment. The FO repeated the call "auto brake disarmed" which was acknowledged by the Captain.
  • At 23:20:51 UTC, the landing gear lever was moved to UP.
  • At 23:21:03 UTC, the Jakarta Tower controller instructed the LNI610 flight crew to contact Terminal East (TE) controller.
  • At 23:21:22 UTC, the FO made initial contact with the TE controller who responded that the aircraft was identified on the controller Aircraft Situational Display/ASD (radar display). Thereafter, the TE controller instructed the LNI610 to climb to flight level 270.
  • At 23:21:28 UTC, the FO asked the TE controller to confirm the aircraft altitude as shown on the TE controller radar display. The TE controller responded that the aircraft altitude was 900 feet and was acknowledged by the FO. The DFDR recorded the altimeter on Captain’s PFD indicated 790 feet and the FO’s PFD indicated 1,040 feet.
  • At 23:21:37 UTC, the Captain instructed the FO to perform memory items for airspeed unreliable. The FO did not respond to this request.

Source: KNKT.18.10.35.04, ¶1.1

As shown below, these memory items are all assigned to the PF, so directing the PM to perform them indicates the captain didn't know the memory items or was flustered.

  • At 23:21:44 UTC, the FO asked the Captain what the intended altitude he should request to the TE controller and suggested to the Captain to fly to downwind, which was rejected by the Captain. The Captain then commanded to the FO to request clearance to any holding point.
  • At 23:21:45 UTC, the DFDR recorded the aircraft started to turn to the left. The altimeter on Captain’s PFD indicated 1,310 feet and on the FO’s PFD indicated 1,540 feet. The heading bug was turned to the left.
  • At 23:21:52 UTC, the FO requested clearance from the TE controller “to some holding point for our condition now”. The TE controller asked the LNI610, what was the problem of the aircraft and the FO responded “flight control problem”. The TE controller did not acknowledge the flight crew request to go to a holding point and only remembered the problem reported by the flight crew.
  • At 23:22:04 UTC, the FO suggested whether the Captain wanted to reconfigure the flaps setting to flaps 1, which the Captain agreed. The DFDR recorded that the flaps traveled from 5 to 1. About 10 seconds later, the Captain directed the FO to take over the control; the FO responded stating “standby”.
  • At 23:22:15 UTC, the TE controller noticed that the LNI610 aircraft altitude on the radar display was decreasing from 1,700 to 1,600 feet and then the TE controller asked the intended altitude to the LNI610 flight crew. The DFDR recorded the altimeter on Captain’s PFD indicated 1,600 feet and on the FO’s PFD indicated 1,950 feet.

Source: KNKT.18.10.35.04, ¶1.1

At this point the airplane had unreliable airspeed indications and the captain's stick shaker. But the airplane was flyable.

  • At 23:22:24 UTC, the FO suggested to the Captain to continue the flap reconfiguration and the Captain agreed. The flaps started to travel to UP position. The DFDR recorded the indicated airspeed on the Captain’s PFD was 238 knots and the FO’s PFD indicated 251 knots. Four seconds later, the FO asked the Captain if 6,000 feet would be the altitude they wanted, in response to the TE controller query. The Captain response was 5,000 feet.
  • At 23:22:30 UTC, the FO advised the TE controller that the intended altitude was 5,000 feet and the TE controller then instructed LNI610 to climb to an altitude of 5,000 feet and to turn left heading 050°. The instructions were acknowledged by the FO.
  • At 23:22:32 UTC, the aircraft EGPWS sounded: “BANK ANGLE, BANK ANGLE”. The DFDR recorded the aircraft roll momentarily reached 35°.

Source: KNKT.18.10.35.04, ¶1.1

It appears the pitch down movements started just as the flaps were retracted but these were noted as "automatic AND trim" and not MCAS.

  • At 23:22:33 UTC, the flaps reached the fully retracted position and the automatic AND trim was active for about 10 seconds, during which the horizontal stabilizer pitch trim decreased from 6.1 to 3.8 units.
  • At 23:22:41 UTC, the Captain instructed the FO to select flaps 1 and the DFDR recorded the flaps started to move. Three seconds later, the DFDR recorded the main electric trim moved the stabilizer in the aircraft nose up (ANU) direction for 5 seconds and the pitch trim gradually increased to 4.7 units.

Source: KNKT.18.10.35.04, ¶1.1

It appears the pitch down movements stopped just as the flaps were extended.

  • At 23:22:44 UTC, the FO called 5,000. The Mode Control Panel (MCP) selected altitude began moving from 11,000 and reached 5,000 about 6 seconds later. At 23:22:45 UTC, the aircraft descended at a rate up to 3,570 fpm and lost about 600 feet of altitude. The DFDR recorded the pitch trim was at 4.4 units.
  • At 23:22:48 UTC, the flaps reached position 1 and the left control column stick shaker stopped briefly. The left AOA recorded 18° (nose up) and the right AOA recorded -3° (nose down). The rate of descent increased up to 3,200 fpm. On the Captain’s PFD, the low speed barber pole appeared with the top of the pole was about 285 knots.
  • At 23:22:54 UTC, the automatic AND trim activated for 8 seconds at a low speed.
  • At 23:22:57 UTC, the FO asked the TE controller of the speed as indicated on the radar display.
  • At 23:23:00 UTC, the aircraft EGPWS sounded “AIR SPEED LOW – AIR SPEED LOW”. The TE controller responded that the ground speed of the aircraft, shown on the radar display, was 322 knots. The DFDR recorded the indicated airspeed on the Captain’s PFD indicated as 306 knots and on the FO’s PFD indicated 318 knots.

Source: KNKT.18.10.35.04, ¶1.1

The airspeed indicators differed by 12 knots but were generally "in the ball park." It should have been apparent that the stick shaker and speed barber poles were wrong, both pointing to a possible AOA problem.

  • At 23:23:00 UTC, the flight crew selected flaps 5 and the flaps began to travel from position 1 to 5. The Captain commanded ANU trim for 5 seconds and the pitch trim was recorded at 4.8 units. During this time, the AND automatic trim ended.
  • At 23:23:04 UTC, the left control column stick shaker activated and continued until the end of the recording, the rate of climb was about 1,500 feet/minute, and the pitch attitude was 3° nose up.
  • At 23:23:07 UTC, the DFDR recorded the flaps position was at 5.
  • At 23:23:08, the DFDR recorded on the Captain’s PFD low speed barber pole and overspeed barber pole merged. On the FO’s PFD, the overspeed barber pole appeared with the bottom of the pole about 340 knots and the low speed barber pole did not appear.
  • At 23:23:09 UTC, the Captain commanded “memory item, memory item”.
  • At 23:23:15 UTC, the automatic AND trim activated for 1 second and activated again at 23:23:18 UTC for another 1 second.
  • At 23:23:17 UTC, the FO advised the Captain “Feel differential already done, auto brake, engine start switches off, what’s the memory item here”. The Captain then responded “check”.
  • At 23:23:18 UTC, the automatic AND trim activated for 2 seconds and activated again at 23:23:23 UTC for another 2 seconds.
  • At 23:23:23 UTC, the automatic AND trim activated for 1 second and activated again at 23:23:26 UTC for 1 second, at this time the aircraft was on heading 100°.
  • At 23:23:26 UTC, the automatic AND trim activated for 1 second and activated again at 23:23:32 UTC for 2 seconds, at this time the aircraft stopped roll turn on heading 100°.
  • At 23:23:34 UTC, the FO asked “Flight control?” and the Captain responded “yeah”.
  • At 23:23:39 UTC, the CVR recorded sound similar to paper pages being turned and the Captain commanded ANU trim for 1 second.
  • At 23:23:48 UTC, the FO called “flight control low pressure” and 4 seconds later the CVR recorded the sound of an altitude alert tone. At this time, the altimeter on the Captain’s PFD indicated 4,110 feet and the FO’s PFD indicated 4,360 feet. The automatic AND trim activated for 1 second and the aircraft began to turn to the left.
  • At 23:24:03 UTC, the DFDR recorded the Captain commanded ANU trim for 1 second.
  • At 23:24:05 UTC, the FO called “Feel Differential Pressure”. Afterwards, the Captain commanded to perform the checklist for air speed unreliable, which was acknowledged by the FO.
  • At 23:24:27 UTC, the DFDR recorded the altimeter on the Captain’s PFD indicated 4,900 feet and the FO’s PFD indicated 5,200 feet. The aircraft climbed with a rate of about 1,600 feet/minute.
  • At 23:24:31 UTC, the FO advised the Captain that he was unable to locate the Airspeed Unreliable checklist.
  • At 23:24:43 UTC, the CVR recorded altitude alert tone and the DFDR recorded the altimeter on the Captain’s PFD indicated 5,310 feet and the FO’s PFD indicated 5,570 feet with a rate of climb of about 460 feet/minute.
  • At 23:24:46 UTC, the CVR recorded a sound similar to paper pages being turned.
  • At 23:24:51 UTC, the TE controller added “FLIGHT CONT TROB” text for LNI610’s target label on the controller radar system as a reminder that the flight was experiencing a flight control problem.
  • At 23:24:52 UTC, the DFDR recorded the flaps started retracting from 5 to 1. The CVR did not record any discussion related to flap position.
  • At 23:24:57 UTC, the TE controller instructed LNI610 flight crew to turn left heading 350° and maintain an altitude of 5,000 feet. The instruction was read back by the FO.
  • At 23:24:59 UTC, the DFDR recorded the flaps were at position 1. Four seconds later, the Captain commanded ANU trim for 4 seconds followed 1 second later by another ANU command for 1 second.
  • At 23:25:11 UTC, the FO repeated the TE controller instruction to the Captain to fly heading 350°, then informed him that there was no airspeed unreliable checklist.
  • At 23:25:13 UTC, the DFDR recorded that the flaps started traveling from position 1 to 0 (UP) and reached position 0 at 23:25:27 UTC. The CVR did not record any discussion related to flap position.
  • At 23:25:17 UTC, the FO stated “10.1” and began reading the Airspeed Unreliable checklist. Note: The Airspeed Unreliable checklist is on page 10.1 of the QRH.

Source: KNKT.18.10.35.04, ¶1.1

It appears the MCAS induced trim started here, with the flaps up for the remainder of the fight.

  • At 23:25:27 UTC, the automatic AND trim activated by the Maneuver Characteristic Augmentation System (MCAS) for 2 seconds and was interrupted by the Captain who commanded ANU trim for 6 seconds. The pitch trim recorded 6.19 units.
  • At 23:25:40 UTC, MCAS activated for 6 seconds. The pitch trim recorded 4.67 units. This MCAS activation was interrupted when the Captain commanded ANU trim at 23:25:46 UTC for 7 seconds and again at 23:25:54 UTC for 1 second. The pitch trim recorded 6.27 units.
  • At 23:26:00 UTC, MCAS activated for 7 seconds and was interrupted at 23:26:06 UTC when the Captain commanded ANU trim for 6 seconds. The pitch trim recorded 5.59 units.
  • At 23:26:17 UTC, MCAS activated for 4 seconds until it was interrupted at 23:26:20 UTC when the Captain commanded ANU trim for 4 seconds. The pitch trim recorded 5.6 units
  • At 23:26:29 UTC, MCAS activated for 3 seconds until it was interrupted at 23:26:32 UTC when the Captain commanded ANU trim for 3 seconds. The pitch trim recorded 5.0 units.
  • At 23:26:32 UTC, the DFDR recorded the aircraft heading was 015° while the last instruction by the TE controller was fly heading 350°. While the FO was reading the Airspeed Unreliable checklist, the TE controller instructed to turn right heading 050° and maintain 5,000 feet. The instructions were read back by the FO.
  • At 23:26:45 UTC, MCAS activated for 3 seconds until it was interrupted at 23:26:48 UTC when the Captain commanded ANU trim for 6 seconds. The pitch trim was recorded as 5.83 units.
  • At 23:26:59 UTC, MCAS activated for 5 seconds until it was interrupted at 23:27:03, when the Captain commanded ANU trim for 6 seconds. Also, at 23:26:59, that the TE controller instructed LNI610 flight crew to turn right heading 070° to avoid traffic. The DFDR recorded the aircraft heading was 023° while the last instruction by the TE controller was fly heading 050°. The FO was still reading the Airspeed Unreliable checklist step noting that the flight path vector and pitch limit indicator may be unreliable and did not respond to the TE controller’s instruction, thereafter, the controller called LNI610 twice and the FO responded at 23:27:13 UTC.
  • At 23:27:03 UTC, the flight crew commanded ANU trim for 7 seconds.
  • At 23:27:15 UTC, MCAS activated for about 5 seconds until it was interrupted at 23:27:19, when the flight crew commanded ANU trim for 5 seconds. The FO was reading the Airspeed Unreliable checklist while the TE controller instructed LNI610 to turn right heading 090°, which was acknowledged by the FO. The DFDR recorded the aircraft heading was 038° while the last instruction by the TE controller was fly heading 070°. A few seconds later, the TE controller revised the instruction to stop the turn and fly heading 070°, which was acknowledged by the FO.
  • At 23:27:19 UTC, the flight crew commanded ANU trim for 5 seconds.
  • At 23:27:29 UTC, MCAS activated for about 5 seconds until it was interrupted at 23:27:33 when the Captain commanded ANU trim for 6 seconds. The pitch trim was recorded as 5.5 units.
  • At 23:27:44 UTC, MCAS activated for 4 seconds and at 23:27:48 UTC, the Captain commanded ANU trim for 4 seconds. The Captain commanded ANU trim again at 23:27:53 for 3 seconds. The pitch trim recorded 5.7 units.
  • At 23:27:58 UTC, the FO continued reading the Airspeed Unreliable checklist and informed the Captain that he would check the Performance Inflight, which was acknowledged by the Captain.
  • At 23:28:01 UTC, MCAS activated for about 7 seconds until it was interrupted at 23:28:07 when the Captain commanded ANU trim for 7 seconds. The pitch trim recorded 5.30 units.
  • At 23:28:09 UTC, the FO instructed the Flight Attendant (FA) via interphone to enter the cockpit.
  • At 23:28:15 UTC, the TE controller provided traffic information to the LNI610 flight crew, which was acknowledged by the FO and 1 second later the flight crew commanded ANU trim for 1 second.
  • At 23:28:18 UTC, the FA entered the cockpit and the Captain commanded to call the engineer to the cockpit. The FO also repeated the Captain’s instruction for the FA to call the engineer.
  • At 23:28:22 UTC MCAS activated for 1 second and the flight crew commanded ANU trim for 3 seconds. The pitch trim recorded 5.4 units.
  • At 23:28:30 UTC MCAS activated for about 4 seconds until it was interrupted at 23:28:33 when the flight crew commanded ANU trim for 6 seconds. The pitch trim recorded 5.6 units.
  • At 23:28:41 UTC, the CVR recorded a sound similar to the cockpit door opening and 14 seconds later, the Captain asked someone “look what happened”.
  • At 23:28:43 UTC, the TE controller instructed LNI610 flight crew to turn left heading 050° and maintain 5,000 feet. The instruction was acknowledged by the FO. The DFDR recorded the aircraft heading was 045° while the previous instruction by the TE controller was to fly heading 070°.
  • At 23:28:44 UTC, MCAS activated for about 4 seconds until it was interrupted at 23:28:48 when the Captain commanded ANU trim for 6 seconds. The pitch trim was recorded as 5.7 units.
  • At 23:28:58 UTC, there was communication between FAs on the interphone which discussed that there was a technical issue in the cockpit.
  • At 23:28:59 UTC, MCAS activated for about 6 seconds until it was interrupted at 23:29:04 when the flight crew commanded ANU trim for 5 seconds. The pitch trim was recorded as 5 units.
  • At 23:29:14 UTC, MCAS activated for about 7 seconds, until it was interrupted at 23:29:20 when the Captain commanded ANU trim for 3 seconds. Also, at 23:29:14, the FO confirmed the aircraft condition of landing gear up and altitude of 5,000 feet. Four seconds later, the CVR recorded sound similar to the altitude alert tone, at this time the DFDR recorded the altimeter on the Captain’s PFD indicated 4,770 feet and the FO’s PFD indicated 5,220 feet.
  • At 23:29:25 UTC, the flight crew commanded ANU trim for 6 seconds. The pitch trim was recorded as 5.4 units.
  • At 23:29:37 UTC, the TE controller questioned the LNI610 flight crew whether the aircraft was descending as the TE controller noticed that the aircraft was descending on the radar screen. The FO advised the TE controller that they had a flight control problem and were flying the aircraft manually.
  • At 23:29:38 UTC, MCAS activated for about 4 seconds until it was interrupted at 23:29:41 when the Captain commanded ANU trim for 7 seconds. The pitch trim was recorded as 5.6 units.
  • At 23:29:45 UTC, the TE controller instructed the LNI610 flight crew to maintain heading 050° and contact the Arrival (ARR) controller. The instruction was acknowledged by the FO. The DFDR recorded the aircraft heading was 059° while the last instruction by the TE controller was heading 050°.
  • At 23:29:53 UTC, MCAS activated for about 6 seconds until it was interrupted at 23:29:58 when the Captain commanded ANU trim for 3 seconds. The pitch trim was recorded as 4.5 units.
  • At 23:30:02 UTC, the FO contacted the ARR controller and advised that they were experiencing a flight control problem. The ARR controller advised the LNI610 flight crew to prepare for landing on runway 25L and instructed them to fly heading 070°. The instruction was read back by the FO. The DFDR recorded the aircraft heading was 054° while the last instruction by the TE controller was heading 050°. At 23:30:06 UTC, MCAS activated for about 2 seconds until it was interrupted at 23:30:07 when the Captain commanded ANU trim for 6 seconds. The pitch trim was recorded as 5.1 units.
  • At 23:30:18 UTC, MCAS activated about for 6 seconds until it was interrupted at 23:30:23 when the Captain commanded ANU trim for 9 seconds. The pitch trim was recorded as 5.5 units.
  • At 23:30:38 UTC, MCAS activated for about 5 seconds until it was interrupted at 23:30:42 when the Captain commanded ANU trim for 3 seconds. The pitch trim was recorded as 4.8 units.
  • At 23:30:48 UTC, the Captain asked the FO to take over control of the aircraft.
  • At 23:30:49 UTC, the FO commanded ANU trim for 3 seconds. At 23:30:54, the FO replied “I have control”.
  • At 23:30:57 UTC, the Captain requested to ARR controller to proceed to ESALA8 due to weather which was approved by the ARR controller.
  • At 23:31:00 UTC, the automatic AND trim activated for 8 seconds, the pitch trim changed from 5.4 to 3.4 units.
  • At 23:31:07 UTC, the FO stated “wah, it’s very”.
  • At 23:31:08 UTC, the FO commanded ANU trim for 1 second and the pitch trim changed to 3.5 units. Meanwhile the Captain advised the ARR controller that the altitude of the aircraft could not be determined due to all aircraft instruments indicating different altitudes. The Captain used the call sign of LNI650 during the communication. The ARR controller acknowledged then stated “LNI610 no restriction”.
  • At 23:31:15 UTC, MCAS activated for about 3 seconds until it was interrupted at 23:31:17 when the FO commanded ANU trim for 1 second, the pitch trim changed to 2.9 units and the FO’s column sensor force recorded 65 lbs. of back pressure.
  • At 23:31:19 UTC, the FO commanded ANU trim for an additional 4 seconds and the pitch trim changed to 3.4 units.
  • At 23:31:22 UTC, the Captain requested the ARR controller to block altitude 3,000 feet above and below for traffic avoidance. The ARR controller asked the intended altitude.
  • At 23:31:27 UTC, MCAS activated for 8 seconds, the pitch trim changed to 1.3 units and the FO’s control column sensor force recorded 82 lbs.
  • At 23:31:33 UTC, the FO informed to the Captain that the aircraft was flying down. At this time the DFDR recorded that the aircraft pitch angle was -2° and the rate of descent was about 1,920 fpm. At 23:31:35 UTC, the Captain responded to the ARR controller with “five thou”. The ARR controller approved the flight crew request. At 23:31:36 UTC, the FO exclaimed the aircraft was flying down which then the Captain responded: “it’s ok”.
  • At 23:31:36 UTC, the FO commanded ANU trim for 2 seconds and the pitch trim changed to 1.3 units.
  • At 23:31:43 UTC, MCAS activated for 4 seconds, the pitch trim changed to 0.3 units and the FO’s control column sensor recorded 93 lbs.
  • At 23:31:46 UTC, the FO commanded ANU trim for 2 seconds, the altitude indicated on the Captain’s PFD was 3,200 feet, the FO’s PFD indicated 3,600 feet, and the rate of descent was more than 10,000 feet/minute.
  • At 23:31:51 UTC, the EGPWS audible alert “TERRAIN - TERRAIN” followed by “SINK RATE” were heard on the CVR as well as an overspeed clacker.
  • At 23:31:53 UTC, MCAS activated until the DFDR stopped recording at 23:31:54 UTC and the CVR stopped recording 1 second later.
  • The ARR controller attempted to contact the LNI610 flight crew twice with no response. At 23:32:20 UTC, LNI610 aircraft target disappeared on the ASD and changed to flight plan track. The ARR controller and TE controller attempted to contact the LNI610 four more times with no response.
  • The ARR controller then checked the last known coordinates of LNI610 and instructed the controller assistant to report the occurrence to the operation manager.
  • The ARR controller requested several other aircraft to hold over the last known position of LNI610 and to conduct a visual search of the area. About 0005 UTC (0705 LT), a tugboat crew found floating debris at coordinate 5°48'56.04"S; 107°7'23.04"E which is about 33 Nm from Jakarta on bearing 056°. The debris was later identified as part of LNI610 aircraft.

Source: KNKT.18.10.35.04, ¶1.1

The Pilots

The pilots appear to be relatively inexperienced in comparison to U.S. major airline pilots. The captain was 31 years old with 6,028 hours total of which 5,176 was in type. The first officer was 41 years old with about a thousand hours less in total time as well as time in type.

  • Captain training record summary [ . . . ] 12 May 2015, in the assessment item of “stall on final approach”, the remark was lack of appropriate technique that resulted in a second stick shaker activation.

Source: KNKT.18.10.35.04, ¶1.5

The body of the report highlighted three items in the captain's training record, of which a "stall of final approach" and two items of crew resource management were mentioned.

  • First officer training record summary [ . . . ] 23 April 2017, the remark was “application exercise for stall recovery is difficult due to wrong concept of the basic principal for stall recovery in high or low level.”

Source: KNKT.18.10.35.04, ¶1.5

The body of the report highlighted thirteen items in the first officer's training record, showing a pattern of problems, including: failing to tune the correct NAVAID on approach, basic stall recovery procedures, rudder usage on single engine approaches, and an inability to focus

The appendices included more details on both pilots' training records which revealed the captain wasn't particularly strong and confirmed the negative impression of the first officer.

Recorded Aircraft Problems

In three weeks prior to the accident flight, there were a number of maintenance write ups on the air data system that do not seem to have been addressed correctly. On 9 October 2018, for example, an AOA sensor out of range was followed by several circuit breakers popping while the aircraft was parking. The engineer "rectified the problem by closing all the CBs and conducted engine run at idle power to verify the problem. The AFML entry stated the problem was resolved." On 26 October 2018 SPD and ALT flags on the captain's PFD were treated by finding a Stall Management Yaw Damper (SYMD) fault message. The engineer ran the maintenance self test on the SYMD which passed, and the aircraft was released for flight. The next day (27 October 2018) the SPD and ALT flags appeared again on the first and fourth flights. That night the SYMD self test failed. After further tests and CB resetting, the SYMD test passed.

28 October 2018

On the day before the accident the SPD and ALT flag problems continued and were added to by SPEED TRIM and MACH TRIM lights as well as the auto throttle arm disconnect on takeoff roll. Corrective action was as before with one exception:

  • The AFML entry stated the engineer in Denpasar intended to replace the AOA sensor for trouble shooting due to repetitive problem.
  • Because a spare AOA sensor was not available in Denpasar, the engineer coordinated with Maintenance Control Centre (MCC) to order an AOA sensor from Batam Aero Technique (BAT) located in Batam. While waiting for the AOA sensor to arrive in Denpasar, the aircraft was grounded.
  • The AOA sensor (part number 0861FL1 serial number 14488) arrived in Denpasar about 1000 UTC (1800 LT). The engineer in Denpasar removed the AOA sensor (part number 0861FL1 serial number 21401) referring to AMM 34-21-05-000-801 and installed the AOA received from BAT, referring to AMM 34-21-05-400- 801. After installation of the AOA, the AMM requires performing an installation test by referring to task AMM 34-21-05-400-801. The AMM described two methods for performing the installation test; the recommended method by using test equipment AOA test fixture SPL-1917 and the alternative method using the SMYD BITE module. The test equipment (AOA test fixture SPL-1917) was not available in Denpasar therefore, the engineer in Denpasar used the alternative method. The alternative method is performed by deflecting the AOA vane to the fully up, center, and fully down positions while verifying the indication on the SMYD computer for each position. The engineer did not record the indication on the SMYD computer during the installation test.
  • The engineer in Denpasar conducted the heater test by dropping water onto the AOA vane with result that it passed. The engineer performed the BITE test on the FMC CDU which showed “No Current Faults”.
  • The engineer in Denpasar provided the investigation several photos including of the Captain’s PFD that was claimed to be taken after the AOA sensor replacement and of the SMYD during the installation test. However, the time shown on the Captain’s PFD was the time before arrival of AOA sensor spare part and the investigation confirmed that the SMYD photos were not of the accident aircraft.

Source: KNKT.18.10.35.04, ¶1.6.3

It appears the engineer did not verify the AOA sensor indications after installation and attempted to falsely document the readings by taking photos of another airplane's PFD.

  • The aircraft was released to service at 1230 UTC (2030 LT).
  • Thereafter, the aircraft departed from Denpasar to Jakarta with flight number LNI043 and arrived in Jakarta at 1556 UTC (2256 LT). The flight crew reported on AFML page number B3042855 that the aircraft had problems of “IAS and ALT Disagree shown after take-off” and “FEEL DIFF PRESS light illuminated”.
  • The AFML recorded that engineer in Jakarta conducted flushing on left pitot and static ADM refer to the IFIM task 34-20-00-810-801 (ALT DISAGREE Shows on entry stated the of the PFD (Captain’s)- Fault Isolation) and conducted the operational test which resulted in satisfactory performance. The AFML page number B3042855 also recorded that the Jakarta engineer cleaned the electrical connector of the elevator feel computer and referred to the IFIM task 27-31-00-810-803 (FEEL DIFF PRESS Light is on-Fault Isolation) and conducted the test with result that it passed.

Source: KNKT.18.10.35.04, ¶1.6.3

Angle of Attack (AOA) Sensors

  • The Boeing 737-8 (MAX) has two independent angle-of-attack (AOA) sensors, one on each side of the forward fuselage. The AOA sensors consist of an external vane which rotates to align with the local airflow connected to two internal resolvers which independently measure the rotation angle.

Source: KNKT.18.10.35.04, ¶1.6.5.2

image

Angle of Attack (AOA) indicator on PFD, KNKT.18.10.35.04, figure 8.

  • The AOA sensor used on the Boeing 737-8 (MAX)-8 is made by Collins Aerospace (previously Rosemount Aerospace). For each AOA sensor (left and right), one resolver is connected to the respective Stall Management Yaw Damper (SMYD) computer and the second resolver is connected the respective ADIRU. Both the SMYD and ADIRU monitor the resolver circuits within the AOA sensor. If a fault is detected, the AOA resolver information is not used and the fault is annunciated. There is no scheduled maintenance for AOA sensors. Any required maintenance is a consequence of annunciated faults or observed malfunctions. This practice is known as “on-condition” maintenance.
  • Boeing provides the option for the operator to install the AOA indicator on the PFD for Boeing 737-8 (MAX).

Source: KNKT.18.10.35.04, ¶1.6.5.2

image

AOA disagree message on PFD, KNKT.18.10.35.04, figure 9.

  • The AOA DISAGREE message was first implemented on the Boeing 737 NG fleet in 2006 in response to customer requests. [ . . . ] The AOA DISAGREE non-normal procedure alerts pilots to the possibility of airspeed and altitude errors, and of the IAS DISAGREE and ALT DISAGREE alerts occurring; but the non-normal procedure does not include any flight crew action in response to the AOA DISAGREE alert.
  • Lion Air did not select the optional AOA indicator feature on the PFD of their 737-8 (MAX) aircraft. As a result, the AOA DISAGREE did not appear on PK-LQP aircraft, even though the necessary conditions were met.

Source: KNKT.18.10.35.04, ¶1.6.5.2

The AOA sensor that appeared to cause the problems prior to the accident flight was removed and replaced the day before:

  • Examination of the AOA sensor revealed an intermittent open circuit in the resolver #2 coil wiring. At temperatures above approximately 60°C, the resolver functioned normally, but did not function below that temperature.

Source: KNKT.18.10.35.04, ¶1.6.4

The AOA sensor that took its place had previously been removed for issues and had been repaired by a shop in Florida:

  • At the time of the accident, AOA sensor, P/N 0861FL1, S/N 14488 was installed on the left side of the fuselage of PK-LQP; this sensor had been installed on 28 October 2018 in Denpasar. No fragments of the AOA sensor were identified in the recovered wreckage.
  • This AOA sensor was previously installed on the right side of the fuselage of a Boeing 737-900ER aircraft, Malaysian registration 9M-LNF, which was operated by Malindo Air. The AOA sensor had been removed on 19 August 2017 due to maintenance write-ups indicating that SPD and ALT flags were shown on the FO PFD during a pre-flight check.
  • On 20 October 2017, Batam Teknik sent S/N 14488 from Kuala Lumpur to Xtra Aerospace in Miramar, Florida, USA for repair. Preliminary inspection of the AOA sensor at Xtra Aerospace verified the part number and serial number. The unit was observed to be in fair but dirty condition and did not pass the operational test. The preliminary result stated that the eroded vane caused erroneous readings. Based on repair records, the unit was disassembled to replace the eroded vane. After vane replacement and reassembly the unit was calibrated and tested to the requirements of the CMM Revision 8 (current at the time of the repair). The work order stated that the results for the required tests were satisfactory. Xtra Aerospace approved S/N 14488 for return to service on 3 November 2017.

Source: KNKT.18.10.35.04, ¶1.6.4

Horizontal Stabilizer

  • Pitch control for the Boeing 737-8 (MAX), is provided by two elevators and a movable horizontal stabilizer. The Horizontal Stabilizer pivots through about 17 degrees and the position is shown on the flight deck stabilizer trim indicator. Lower values indicate more nose-down trim and high values indicate more nose-up trim. Before takeoff, the flight crew set the position of the horizontal stabilizer based on the location of the aircraft’s center of gravity.

Source: KNKT.18.10.35.04, ¶1.6.5.3

This is a fairly conventional setup used by many airplanes and just about every Boeing. The pilot's yoke moves the elevator, various trim systems move the stabilizer.

  • The horizontal stabilizer is positioned by a single electric trim motor controlled through either the main electric trim switches on the control wheels or automatic trim. The stabilizer may also be positioned by manually rotating the stabilizer trim wheels which are located on either side of the aisle stand.

Source: KNKT.18.10.35.04, ¶1.6.5.3

The electric trim on the yoke is also fairly standard. The manual control wheel is a staple on many Boeings. If you lost or intentional disabled the electric trim system, the trim wheel is used to mechanically position the stabilizer.

image

Stabilizer control, KNKT.18.10.35.04, figure 12.

  • Main electric trim switches on each control wheel actuate the electric trim motor through the main electric stabilizer trim circuit when the aircraft is flown manually. Automatic trim is accomplished through the autopilot stabilizer trim circuit. The main electric and autopilot stabilizer trim have two rates: high trim rate with flaps extended and low trim rate with flaps retracted. Actuating either pair of main electric trim switches will automatically disengage the autopilot (if engaged), and will override any automatic trim commands. The stabilizer trim wheels rotate whenever the stabilizer is in motion.

Source: KNKT.18.10.35.04, ¶1.6.5.3

The accident pilots used these trim switches several times to override automatic trim inputs; the system appeared to work as intended.

  • The STAB TRIM PRI (stabilizer trim primary) cutout switch and the STAB TRIM B/U (stabilizer trim back up) cutout switch are located next to each other on the aisle stand just aft of the thrust levers. If either switch is positioned to CUTOUT, power is removed from the stabilizer trim motor and neither main electric trim nor automatic trim can move the stabilizer.

Source: KNKT.18.10.35.04, ¶1.6.5.3

The cutout switches would have ended all automatic pitch trim movements, but it does not appear the pilots ever actuated the cutout switches.

The stabilizer control system prevents the stabilizer from moving in opposition to the control column. For example, if the column is being pulled aft (to pitch up), the stabilizer is prevented from trimming in the nose-down direction. The addition of MCAS to the Boeing 737-8 (MAX) required a modification of this function. (Described below.)

Speed Trim System

  • The Speed Trim System (STS) provides speed stability augmentation and pitch stability augmentation. Speed stability augmentation is provided by the Speed Trim Function. Pitch stability augmentation is provided by the MCAS function.
  • The Speed Trim Function is designed to improve flight characteristics during operations at low gross weight, aft center of gravity and high thrust when the autopilot is not engaged. The Speed Trim Function operates most frequently during take-off, climb and go-around. The flight directors may be on or off.

Source: KNKT.18.10.35.04, ¶1.6.5.3

I've heard that the reason for this is the engines are mounted in such a way as to cause pitch up at high power settings that needs to be countered automatically. I've also heard that this is a rare situation that is hardly ever experienced in actual practice.

  • The Speed Trim Function helps keeps the speed set by the pilots with commands to the horizontal stabilizer. As the aircraft speed slows, the stabilizer is moved to a more nose down position to increase the speed. As the speed increases, the stabilizer is moved to a more nose up position to decrease the speed.

Source: KNKT.18.10.35.04, ¶1.6.5.3

MCAS

image

MCAS system configuration, KNKT.18.10.35.04, figure 13

  • The MCAS is a function within the Speed Trim System and, when activated, moves the stabilizer during non-normal flaps up, high angle of attack maneuvers to provide a desirable increase in stick force gradient and a reduced pitch up tendency. Similar to the Speed Trim Function, the MCAS function is also a flight control law contained within each of the two FCCs. MCAS is only active in the master FCC for that flight. At aircraft power-up, the master FCC defaults to the left side FCC; and will then alternate between the left and right FCC by flight. The master FCC is not affected by the position of the Flight Director switches. The FCCs receive inputs from several systems including the air data inertial reference system (ADIRS). Specific to the MCAS, the control law commands the stabilizer trim as a function of the following: Air/Ground, Flap position, Angle of attack, Pitch rate, True Airspeed and Mach.
  • The AOA and Mach inputs are provided to each FCC by the associated Air Data Inertial Reference Unit (ADIRU). Each ADIRU receives AOA information from one of the two resolvers contained within the associated AOA sensor (i.e. the Left ADIRU uses left AOA vane and the Right ADIRU uses the right AOA vane). Information from the other resolver contained within the AOA sensor, along with data from other sources, is provided to the Stall Management Yaw Damper computer (SMYD), which is used, along with data from other sources, for the purpose of calculating and sending commands to the Stall Warning System (SWS).
  • As originally delivered, the MCAS became active during manual, flaps-up flight (autopilot not engaged) when the AOA value received by the master FCC exceeded a threshold based on Mach number. When activated, the MCAS provided a high rate automatic trim command to move the stabilizer AND. The magnitude of the AND command was based on the AOA and the Mach. After the non-normal maneuver that resulted in the high AOA, and once the AOA fell below a reset threshold, MCAS would move the stabilizer ANU to the original position and reset the system. At any time, the stabilizer inputs could be stopped or reversed by the pilots using their yoke-mounted electric stabilizer trim switches, which also reset the system after a 5 second delay.
  • The latter behavior is based on the assumption that flight crews use the trim switches to completely return the aircraft to neutral trim. In the FCC software version current at the time of the accident, if the original elevated AOA condition persists for more than 5 seconds following an MCAS flight control law reset, the MCAS flight control law will command another stabilizer nose down trim input (with the magnitude based on the AOA and Mach sensed at that time).

Source: KNKT.18.10.35.04, ¶1.6.5.4

To the pilot this will appear to be what is called a "stick pusher" or stall barrier" on some airplanes. The airplane senses a stall and pushes the nose down as a result.

  • On all Boeing 737 models, column cutout switches interrupt stabilizer commands, either from the auto-flight system (e.g. FCC) or the electric trim switches in a direction opposite to elevator command. On the Boeing 737NG and Boeing 737 MAX, two column cutout switching modules, one for each control column, are actuated when the control columns are pushed or pulled away from zero (hands off) column position. When actuated, the column cutout switching modules interrupt the electrical signals to the stabilizer trim motor that are in opposition to the elevator command.
  • The MCAS function requires the stabilizer to move nose down in opposition to the column commands when approaching high angles of attack. To accommodate MCAS, the column cutout function in the first officer’s switching module was modified to inhibit the aft column cutout switch while MCAS is active, allowing aircraft nose-down (AND) stabilizer motion with aircraft nose-up (ANU) column input. Once MCAS is no longer active, the normal column cutout function in the stabilizer nose down direction is re-instated.

Source: KNKT.18.10.35.04, ¶1.6.5.4

So how does handling an apparent "runaway trim" in the 737 MAX differ from previous 737s? This appears to be the only substantive difference. In previous 737s, pulling aft on the control column stops nose down stabilizer movement, a nice feature. In the 737 MAX, pulling aft on the first officer's control column does not stop nose down stabilizer movement.

Quick Reference Handbook

  • Check lists can have both memory and reference items. Memory items are critical steps that must be done before reading the checklist. The last memory item is followed by a dashed horizontal line. Reference items are actions to be done while reading the checklist.
  • For checklists with memory items, the pilot monitoring first verifies that each memory item has been done. The checklist is normally read aloud during this verification. The pilot flying does not need to respond except for items that are not in agreement with the checklist.

Source: KNKT.18.10.35.04, ¶1.17.1.5

image

MCAS system configuration, KNKT.18.10.35.04, figure 33.

I like the memory items on this checklist: turn off the automation, set a known pitch and power for the configuration.

The Previous Day's Flight

On the face of it, it appears the accident crew could have saved the day by simply trimming opposite the nose down stabilizer movement, placing the stabilizer switches to the cutout position, pulling the power back, and setting a known pitch and power setting. I think this would be a "normal" reaction. In fact, this occurred on the same aircraft the previous day.

  • On 28 October 2018, the accident aircraft was operated as a passenger flight from I Gusti Ngurah Rai International Airport (WADD), Denpasar to Jakarta as LNI043.
  • During preflight check, the Captain discussed with the engineer the rectification that had been performed on the aircraft. The engineer informed the Captain that the aircraft had SPD and ALT flags on the Captain’s PFD and the left AOA sensor had been replaced and tested accordingly. The Captain was convinced by the explanation from the engineer and the statement on the Aircraft Flight Maintenance Log (AFML) that the problem had been resolved.
  • The Captain conducted the crew briefing and stated that he would act as Pilot Flying on the flight to Jakarta. During the briefing the Captain mentioned the replacement of the left AOA sensor. On this flight, a dead heading crew, first officer of Lion Air Group, rated with Boeing 737-8 (MAX) was seated in the cockpit jump seat.
  • The flight departed about 1420 UTC which was originally scheduled at 1130 UTC, and during takeoff the flight crew did not notice any abnormalities. The aircraft departed from Denpasar with two pilots, five flight attendants and 182 passengers.
  • The crew recalled that about two seconds after landing gear retraction, the Takeoff Configuration Warning activated. However, this warning only occurs when the main gear is still on the ground.
  • About 400 feet, the Captain noticed on the Primary Flight Display (PFD) that the IAS Disagree warning appeared and the stick shaker activated. The DFDR showed the stick shaker activated just after airborne. Following that indication, the Captain maintained a pitch of 15° and the existing takeoff thrust setting. The stick shaker remained active throughout the flight for about 96 minutes until landing.
  • The Captain cross checked the PFDs and determined his were erroneous. He handed over control to the FO (who had good instruments) and called for the airspeed unreliable memory items. After the transfer of control, the Captain cross checked the PFDs with the standby instrument and determined that the Captain’s PFD had the incorrect information. The Captain then switched on the right flight director (F/D) so the FO would have a normal display.
  • After completion of the memory items, the Captain looked down to take the QRH, the dead heading pilot informed to the Captain that the aircraft was diving down. The Captain commanded the FO to pitch up and to follow the F/D command. The FO replied that the control column was heavy. The Captain advised the FO to re-trim the aircraft as required.
  • At 14:25:46 UTC, the Captain declared an urgency message by calling “PAN PAN” to the Denpasar Approach controller and described that the reason was instrument failure and requested to maintain runway heading. The Denpasar Approach controller acknowledged the message and approved the flight crew request. A few second later, the Denpasar Approach controller asked the flight crew whether the flight would return to Denpasar and the Captain responded “standby”.
  • The Captain noticed that a few seconds after the FO had discontinued the electrical trim input, the stabilizer trim was automatically trimming the aircraft nose down (AND). After three automatic AND trim occurrences, the FO commented that the control column was too heavy to hold back. The stabilizer moved without flight crew input, which the Captain considered the automatic trim inputs as a runaway stabilizer. The Captain performed the memory items for Runaway Stabilizer NNC and positioned the STAB TRIM CUTOUT switches in the Cut-Out position. The DFDR recorded at 14:28:08 UTC the automatic trim and manual trim movement stopped.
  • A few minutes later, the Captain re-engaged the STAB TRIM CUTOUT switches to the NORMAL position, and almost immediately the automatic AND trimming re-occurred. The Captain then moved the STAB TRIM CUTOUT switches back to the Cut-Out position and continued with manual trim for the remainder of the flight.
  • The Captain reported that he performed three Non-Normal Checklists (NNCs) consisting of Airspeed Unreliable, Altitude DISAGREE, and Runaway Stabilizer. None of the NNCs performed contained the instruction “Plan to land at the nearest suitable airport”. The Captain decided to continue the flight since none of the NNCs gave instructions to land at the nearest suitable airport and despite the degraded flight instrumentation, flying without autopilot and auto-throttle, and a continuous activation of stick shaker, he convinced himself that the aircraft was able to fly to the scheduled destination. The Captain did not inform the Lion Air ground station in Denpasar about the problems as he assumed that the aircraft would be able to continue the flight to Jakarta.
  • At 14:32:31 UTC, the LNI043 Captain advised to the Denpasar Approach controller that the problem had been resolved and requested to continue the flight at flight level 290 without Reduced Vertical Separation Minima (RVSM). The Denpasar Approach controller then instructed LNI043 to climb to altitude of flight level 280 and contact Makassar Area Control Center (ACC) for further air traffic control (ATC) services.
  • The Captain noticed on the Captain’s PFD, that the minimum speed and maximum speed red and black (barber pole tape) merged and appeared continuous from top to bottom on the speed tape display. Because of that display, the Captain concentrated more on the FO’s PFD and monitored the FO during the flight to Jakarta.
  • At 14:43:36 UTC, the Upper West Madura (UWM) controller of Makassar ACC instructed the LNI043 to climb to altitude of 38,000 feet.
  • At 14:48:27 UTC, the Captain declared urgency message to the UWM controller and requested to maintain flight level 280 due to instrument failure. The UWM controller acknowledged and approved the flight crew request. At 14:54:07 UTC, the UWM controller instructed LNI043 to contact Upper West Semarang (UWS) controller for further ATC services.
  • At 14:55:28 UTC, the LNI043 Captain made an initial call to the UWS controller and advised that the aircraft was maintaining altitude of 28,000 feet. The UWS controller acknowledged the flight crew information and requested the detail of the instrument failure. The LNI043 Captain advised that altimeter and autopilot failed and requested the UWS controller to relay information to Jakarta controller to request an uninterrupted descent. The UWS controller acknowledged the LNI043 request.
  • The flight crew recalled that along the route, the weather was clear. During flight arrival preparation, the Captain received Jakarta weather information which indicated light rain with visibility of 5,000 meters.
  • During the flight, the Captain perceived threat such as difficulty in communication due to stick shaker noise, sense of panic and mental pressure.
  • During the flight, the FA-1 came to the cockpit and the Captain informed FA-1 that the fasten seat belt sign would be kept on all the way due to the previous disturbance and the rest of the flight was due to weather condition.
  • The aircraft landed using runway 25L at 1556 UTC.
  • The DFDR recorded that after landing the electric stabilizer trim was active, which indicated that STAB TRIM CUTOUT switches were moved back to the NORMAL position.
  • After parking, the Captain informed the engineer verbally, about the aircraft problem and filed on the Aircraft Flight Maintenance Log (AFML) that IAS (Indicated Air Speed) and ALT (altitude) DISAGREE and FEEL DIFF PRESS (Feel Differential Pressure) light problems occurred during the flight. The Captain did not mention the activation of stick shaker to the engineer as he believed that the activation was an outcome from the mentioned problems. The Captain did not report that the STAB TRIM CUTOUT guarded switches were positioned to CUTOUT during flight and after landing returned to the NORMAL position.
  • The Captain also reported the flight condition through the electronic reporting system of the company using Air Safety Report (ASR) form. The event was reported as follows:
  • Airspeed unreliable and ALT Disagree shown after takeoff, STS* also running to the wrong direction, suspected because of speed difference, identified that CAPT instrument was unreliable and handover control to FO. Continue NNC of Airspeed Unreliable and ALT Disagree. Decide to continue flying to CGK at FL280, landed safely runway 25L.
  • Note: STS = Speed Trim System
  • The ASR was filed to the reporting system on 29 October 2019 LT in the early morning and the report acknowledged by the SS Department about 0830 LT.
  • The Captain also attempted to reach the Duty Management Pilot through the company group network (online messaging group application) to report the flight condition. The Duty Management Pilot responded; then the Captain sent the information written in the ASR, to the Safety and Security Department, as the Duty Management Pilot was in Jeddah, Saudi Arabia.

Source: KNKT.18.10.35.04, ¶1.18


3

Analysis

The Airline

  • If you were to choose a location in the developing world in which to witness the challenges facing airline safety — the ossification of regulations and in many places their creeping irrelevance to operations; the corruption of government inspectors; the corruption of political leaders and the press; the pressure on mechanics, dispatchers and flight crews to keep unsafe airplanes in the air; the discouragement, fatigue and low wages of many airline employees; the willingness of bankers and insurers to underwrite bare-bones operations at whatever risk to the public; the cynicism of investors who insist on treating air travel as just another business opportunity; and finally the eagerness of the manufacturers to sell their airplanes to any airline without restraint — you would be hard pressed to find a more significant place than Indonesia.
  • The country began deregulating its airline industry in the late 1990s in the hope of providing for the sort of fast, low-cost travel that might help bind its islands together. No-frills newcomers who cared nothing for prestige rushed in to compete for the business of bargain-conscious passengers and undercut the flagship national airline, Garuda, in a booming domestic market that started growing at a rate second only to China’s. The free-for-all soon raised questions about how to manage safety. That is a polite way of putting it. A race to the bottom comes to mind.
  • At the forefront of the boom was a streetwise Jakarta local named Rusdi Kirana, then 36, who came from a humble background, once sold typewriters for a living and became an airport freelancer hustling for scraps of opportunity among the passengers moving through the terminal buildings. Initially that meant wheeling suitcases to and from the curb, holding up name signs in the arrival flows or spotting people who might appreciate some friendly guidance. He was good at the hustle, but little else has been reported about his early work at the airport, except that in the 1990s he and his brother started what they called a travel agency. This was in a pre-electronic era, when the airlines issued paper tickets. In Jakarta, the airport terminals had become marketplaces where thousands of passengers in search of cheap flights hunted for last-minute discounts offered by airlines wanting to fill empty seats at any price. Kirana and his brother stepped in as middlemen, acquiring tickets by the fistful from airline clerks and scalping them to the crowds. The mechanics of the scheme remain murky, but even Garuda profited from Kirana’s hustle. No one complained.
  • Kirana’s travel agency did not make him rich, but it apparently convinced him that a large, unexploited market existed in Indonesia for cheap flights, and that someday, because of the country’s island geography, air travel might be seen as routine by ordinary people. At the time, the industry remained regulated. Kirana seemed to believe that it was price rather than convenience that counted and that the trips would have to cost about the same as those by ferry and bus. To achieve that, he would have to use his own airplanes and control every aspect of the operation. More important than reducing costs, he would have to fill his airplanes to capacity and keep them flying. He would call the airline Lion Air.
  • In Jakarta, a graybeard captain, speaking to [Langewiesche] on the condition of anonymity, described the attitude of the new owners toward their pilots. He said: “The pilots passed the check ride! They can fly the airplanes!” Also, in some owners’ view, the semiannual simulator training is wasteful because the simulators are costly to run and maintain, and while the pilots are playing around in them (while collecting their pay), they are not out producing revenue. Normally two pilots train in a simulator at a time, with an instructor seated behind them — so, three in the box. I was told that in Indonesian simulators, there are sometimes seven in there: two pilots flying, one instructing and four others standing up and logging the time.
  • Dave Carbaugh, the former Boeing test pilot, spent his first 10 years with the company traveling the globe to teach customers how to fly its airplanes. He mentioned the challenge of training pilots in Asia. “Those were the rote pilots,” he said, “the guys standing up in the back of a sim. They saw a runaway trim. They saw where and how it was handled in the curriculum — always on Sim Ride No. 3. And so on their Sim Ride No. 3, they handled it correctly, because they knew exactly when it was coming and what was going to happen. But did they get exposed anywhere else? Or did they discuss the issues involved? No. It was just a rote exercise. This is Step No. 25 of learning to fly a 737. Period.”

Source: Langewiesche

The Pilots

The captain was a 31-year-old Indian named Bhavye Suneja, who did his initial flight training at a small and now-defunct school in San Carlos, Calif., and opted for an entry-level job with Lion Air in 2011. Lion Air is an aggressive airline that dominates the rapidly expanding Indonesian market in low-cost air travel and is one of Boeing’s largest customers worldwide. It is known for hiring inexperienced pilots — most of them recent graduates of its own academy — and for paying them little and working them hard. Pilots like Suneja who come from the outside typically sign on in the hope of building hours and moving on to a better job. Lion Air gave him some simulator time and a uniform, put him into the co-pilot’s seat of a 737 and then made him a captain sooner than a more conventional airline would have. Nonetheless, by last Oct. 29, Suneja had accumulated 6,028 hours and 45 minutes of flight time, so he was no longer a neophyte. On the coming run, it would be his turn to do the flying. His co-pilot was an Indonesian 10 years his elder who went by the single name Harvino and had nearly the same flight experience. On this leg, he would handle the radio communications. No reference has been made to Harvino’s initial flight training. He had accumulated about 900 hours of flight time when he was hired by Lion Air. Like thousands of new pilots now meeting the demands for crews — especially those in developing countries with rapid airline growth — his experience with flying was scripted, bounded by checklists and cockpit mandates and dependent on autopilots. He had some rote knowledge of cockpit procedures as handed down from the big manufacturers, but he was weak in an essential quality known as airmanship. Sadly, his captain turned out to be weak in it, too.

Source: Langewiesche

The Airplane

  • Boeing responded with a rush program to reengineer the 737, modify the wings and make other changes to improve the performance of the airplane and give it some perceptible advantage over the [Airbus] A320Neo. The rush took five years to complete. Boeing called the result the Max. To keep costs down, as with all previous iterations, the redesign had to lie within the original 1968 F.A.A. certification of the type and not be treated officially as a new airplane. Airbus had similar requirements for the Neo. In its marketing literature comparing the Max to the earlier Next-Generation 737, Boeing wrote: “same pilot type rating, same ground handling, same maintenance program, same flight simulators, same reliability.” Equally important was that it had to have the same flying characteristics. This was a regulatory necessity if the Max was to escape onerous reclassification as a new airplane. And there was a problem. Boeing test pilots discovered that the Max had unusual stall characteristics when the wing flaps were up and the engines were thrusting.
  • As the airplane approaches that critical angle, the first event is a stall warning in the cockpit. In the 737, it is a rattling “stick shaker” that vibrates the control columns and is meant as an urgent warning to lower the nose. If the pilot does not respond, the airflow starts to boil across the top of the wings, sometimes causing buffets that shake the airplane, before separating from the wings conclusively at the moment of the stall. At that point, the wings’ effectiveness is hugely degraded, roll control becomes difficult and the nose drops unavoidably in what is known as a G-break, so called because it may be felt as a brief lessening of the normal (unaccelerated) 1-G pull of gravity.
  • The Max’s stall characteristics, which indirectly bear on the accidents, have been widely reported as being an unusual tendency to pitch up when the airplane is flown at high angles of attack, in realms beyond the stick shaker where airline pilots never go. But pitching up into a stall is a characteristic of all jets with underslung engines, and the tendency in the Max, though slightly stronger than in previous 737s, was probably not sufficiently different to rouse the F.A.A. during the airplane’s testing and certification process. Rather, it was an entirely new characteristic that caused regulatory concern. During stall testing in the Max, the area of buffet was found to be unusually wide, and the G-break, when it occurred, was unusually mild. More important, within the buffet zone as the airplane approached the stall, the control forces — the necessary backpressure on the control column — did not increase in a conventional linear manner as they had in previous 737s and as certification standards required. As a mild behavioral quirk, this was a remote concern, and it occurred in an area of the flight envelope where airline pilots never go. But if the Max was to avoid designation as an entirely new model, the control-force problem needed to be addressed.
  • Boeing was in a hurry. Its solution was to create synthetic control forces by cooking up a new automated system known as the MCAS to roll in a burst of double-speed nose-down stabilizer trim at just the right moment, calculated largely by angle of attack. There were two other conditions for MCAS activation: the wing flaps had to be up and the autopilot off. The logic of those conditions is clear, but not worth the digression here. After some initial tweaking, the system produced control forces that closely mimicked those of the earlier 737 models, allowing the Max to avoid onerous recertification. Indeed, on initial impulse the artificial forces were so realistic that Boeing convinced itself (and the F.A.A.) that there was no need to even introduce the MCAS to the airplane’s future pilots. The omission meant that the possibility of a false positive in cruising flight — a pushover occurring where it naturally would not — would likewise not be addressed. Boeing believed that in the worst case, a false positive would present as a mere runaway trim, a problem any pilot would know how to handle. The 737 features two prominent toggle switches on the center pedestal whose sole purpose is to deal with such an event — a pilot simply switches them off to disengage the electric trim. They are known as trim cutout switches. They are big and fat and right behind the throttles. There is not a 737 pilot in the world who is unaware of them. Boeing assumed that if necessary, 737 Max pilots would flip them much as previous generations of 737 pilots had. It would be at most a 30-second event. This turned out to be an obsolete assumption.

Source: Langewiesche

Previous Flight Crew Actions

  • Lion Air flight 043 (LNI043) was from DPS to CGK and was about 1.5 hours long. The LNI043 flight crew was able to successfully land the accident aircraft while experiencing the same conditions as the accident flight. The investigation looked at the flight crew’s situation awareness and handling of flight deck indications, their decision to continue the flight, and their reporting of encountered issues after the flight.
  • Observation of the aircraft to the condition reinforced the Captain to cut-out the Stabilizer Trim. This action made the aircraft under control and enabled the flight crew to fly the aircraft normally using the manual trim.
  • After parking in Jakarta, the Captain made an entry in the AFML about problems experienced during the flight; the IAS DISAGREE and ALT DISAGREE warning and the FEEL DIFF PRESS light illuminated were reported. These three problems were the problems displayed in the messages on the PFD and the overhead flight controls panel. The Captain did not mention the activation of the stick shaker as he believed that the activation was the outcome of the IAS Disagree problem. The Captain also did not report the runaway stabilizer and the use of the STAB TRIM CUTOUT guarded switches or that he had to use manual trim for the majority of the flight and the landing.

Source: KNKT.18.10.35.04, ¶2.1

The previous section says the captain performed the memory items for unreliable airspeed indications which include known pitch and power settings. The MCAS would only activate under high power settings with the flaps retracted. I think their decision to continue the flight was wrong, but they made it work. The incomplete write up might have affected maintenance actions, but that is hard to say for sure.

Maintenance in Jakarta

  • The AFML showed that the engineer in Jakarta conducted the IFIM task for “ALT DISAGREE shows on PFD – captain’s”. However, the conduct of the IFIM task for “IAS DISAGREE shows on PFD – Captain’s” was not recorded on the AFML. The IFIM tasks of “ALT DISAGREE” on the step (3) of the “Fault Isolation Procedure” include the requirement to conduct the flushing by referring to the corresponding AMM task. This means that to complete the IFIM tasks, the flushing procedure on the AMM must be completed. The flushing procedure as mentioned on the AMM (which requires disconnecting the pitot and static lines) included a leak test of the pitot and static system which was described on the step K. The IFIM task point B step (3) states that if the observed fault symptom has gone after the flushing, then the fault has been corrected. After conducting flushing of the left pitot ADM and static ADM, the engineer performed operational test and considered that the problem was solved. Thereafter the engineer released the aircraft to service. The leak test required by the AMM task on step K had not been conducted which mean that the IFIM task point B step (3) could not be considered as complete.
  • The AOA DISAGREE message was not enabled and was inhibited; therefore, it did not appear on the LNI043 flight. If the AOA sensor bias had generated the AOA DISAGREE message, the flight crew most likely would document the alert as it was displayed on the PFD. The AOA sensor bias would have been detected by the IFIM task “AOA DISAGREE” which requires checking the AOA values. The inhibited AOA DISAGREE message contributed to the inability of the engineer to rectify the failure of the AOA sensor.
  • The certified design of Boeing 737-8 (MAX) was to include an AOA DISAGREE message on all aircraft. The software which generates the AOA DISAGREE message was subcontracted by Boeing another company. The installed software did not include the AOA DISAGREE message for aircraft that was not installed with the AOA indicator. The Lion Air elected not to enable the AOA indicators on the PFDs and such the AOA DISAGREE message would not appear on both PFDs even though the DFDR recorded AOA value difference of about 21°.

Source: KNKT.18.10.35.04, ¶2.2

It appears the newly installed AOA sensor was faulty and the fact this particular 737 did not have the AOA DISAGREE message enabled robbed the maintenance team of the clue needed to require the AOA sensor calibration be checked. But I wonder why such a check isn't required for whenever the AOA sensor is replaced.

Accident Flight Crew Actions

  • After the IAS DISAGREE had been identified, the Captain instructed the FO to perform memory items of Airspeed Unreliable, and the FO did not perform them. The first four items of the Airspeed Unreliable NNC are memory items to be performed by memory and must be done before reading the checklist. The Captain repeated the command about two minutes after without mentioning the NNC title and the FO was confused of the memory items to be performed.

Source: KNKT.18.10.35.04, ¶2.3

The memory items on this checklist are actually for the Pilot Flying so it didn't make sense for the PF to direct the PM to perform them.

  • On the accident flight, the aircraft altitude was unable to be maintained and the MCAS activated repeatedly. These conditions did not meet the requirement of the NNC for the flight crew to compare the airspeed indicators and the table as the aircraft would not be in trim and stabilize condition. The FDR recorded that the differences of the Captain’s and the FO’s airspeed indicators was about 15 knots which was below the value to be considered as unreliable.

Source: KNKT.18.10.35.04, ¶2.3

This paragraph serves to obfuscate the issue by saying it was okay the pilots failed to properly execute the checklist because the threshold for having to execute it had not been met. At 23:20:44 the IAS DISAGREE message appeared and the first officer called "indicated airspeed disagree." A second later the captain instructed the first officer to accomplish the memory items. The report's 15 knot statement isn't backed up and even if it was, it does not obviate the fact that the pilots recognized it, failed to execute it properly, and had they done so, it is likely they would have had a simple pitch trim runaway that should have been easily handled.

  • The pitch trim continued decreasing as the following activations of MCAS were not countered by the FO sufficiently trimming the aircraft nose up. The control column force increased up to 103 lbs (46 kg) while the aircraft still descended which indicated that the force exerted was insufficient to maintain aircraft altitude. During the repetitive MCAS activations, the Captain managed to control the aircraft altitude when the pitch trim was maintained above 5 units by commanding the ANU pitch trim to counter the MCAS trim down. The FO was unable to control the aircraft as the repetitive MCAS activations were not countered by adequate trim up input. The common flight crew reaction to a heavy control column is by providing adequate trim. This suggests that while the Captain’s training or experience enabled him to recognize the need for sustained nose up trim, the FO’s training and experience did not.

Source: KNKT.18.10.35.04, ¶2.3

This ignores the fact that the runaway stabilizer nose down trim was automatically stopped when the captain's control column was moved aft, but not with the first officer's control column.

  • This condition was also in agreement with the FO’s training records that showed several comments indicating that the FO had difficulty in aircraft handling.

Source: KNKT.18.10.35.04, ¶2.3

MCAS Certification

  • The Boeing 737-8 (MAX) is derivative of the 737-800 model and is part of the 737 MAX family (737 MAX 7, 8, and 9). The Boeing 737-8 (MAX) incorporated the CFM LEAP-1B engine, which has a larger fan diameter and redesigned engine nacelle compared to engines installed on the 737 Next Generation (NG) family.
  • During the preliminary design stage of the Boeing 737-8 (MAX), Boeing tests and analysis revealed that the addition of the LEAP-1B engine and associated nacelle changes was deemed likely to negatively affect the stick force per g (FS/g) characteristics required by 14 FAR 25.255 and the controllability and maneuverability requirements of 14 FAR 25.143(f). After the study of various options for addressing this issue, Boeing implemented aerodynamic changes as well as a stability augmentation function called the Maneuvering Characteristics Augmentation System (MCAS), as an extension of the existing Speed Trim System (STS), to improve aircraft handling characteristics at elevated angles of attack. The MCAS was needed in order to make the Boeing 737-8 (MAX) handling characteristics so similar to the NG versions that no simulator training was needed for type rating. It was also required so that the 737 MAX passed the certification that the pitch controls could not get lighter on the approach to stall. If the aircraft had substantially different pitch behavior, then there would be a simulator training requirement for the pilots.
  • 14 FAR 25.255 stipulates that the aircraft must have satisfactory maneuvering stability and controllability with the degree of out-of-trim in both the aircraft nose-up and nose-down directions, which results from the greater of a 3-seconds movement of the longitudinal trim system at its normal rate for the particular flight condition with no aerodynamic load, except as limited by stops in the trim system, or the maximum mis-trim that can be sustained by the autopilot while maintaining level flight in the high speed cruising condition.
  • Without prior knowledge of MCAS functions, the flight crew would depend on the visual and motion cues, prior training for runaway stabilizer, and general training on pitch control to be able to analyze the situation and recognize the non-normal condition. Review of the DFDR data showed that during both the accident and the previous LNI043 flights, the flight crew responded within 2-3 seconds using control column to control the flight path and subsequently trimmed out column forces using electric trim. In the previous LNI043 flight, the flight crew required 3 minutes and 40 seconds rather than seconds to recognize and understand the problem, during which repetitive uncommanded MCAS activations occurred. During the accident flight, recognition of the uncommanded stabilizer movement as a runaway stabilizer condition did not occur thereby, the execution of the non-normal procedure did not occur.
  • The Boeing 737-8 (MAX) is equipped with two Flight Control Computers (FCCs) and two Angle of Attack (AOA) sensors. The Speed Trim System (STS), including the MCAS function, is a flight control law contained within each of the two FCCs. STS is only active in the master FCC for that flight. At aircraft power-up, the master FCC defaults to the left side FCC; and will then alternate between the left and right FCC by flight. The master FCC is not affected by the position of the Flight Director switches. The FCCs receive inputs from several systems including the air data inertial reference system (ADIRS). The AOA inputs are provided to each FCC by associated air data inertial reference unit (ADIRU). Each ADIRU receives AOA information from one of the two resolvers contained within the associated AOA sensor (i.e. the Left ADIRU uses left AOA vane and the Right ADIRU uses the right AOA vane).
  • The MCAS software uses input from a single AOA sensor only. Certain failure or anomalies of the AOA sensor corresponding to the master FCC controlling STS can generate an unintended activation of MCAS. Anticipated flight crew response including aircraft nose up (ANU) electric trim commands (which reset MCAS) may cause the flight crew difficultly in controlling the aircraft.
  • Erroneous AOA signals are not frequent events. Boeing reported that 25 activations of stick shaker mostly due to AOA failures occurred in 737 aircraft for the past 17 years during more than 240 million flight hours. The MCAS architecture with redundant AOA inputs for MCAS could have been considered but was not required based on the FHA classification of Major.
  • The accident flight was the first flight of the day therefore after powering up the aircraft, the left FCC acted as the operating STS channel and received input from left AOA sensor. The DFDR showed that on the accident flight, the left AOA sensor had a high bias 21° when compared to the right AOA sensor.
  • The FCC received the biased AOA data and, after the flaps were retracted, commanded MCAS. As stated earlier, a combination of repetitive MCAS-commands coupled with insufficient flight crew electric trim inputs and not using the STAB TRIM CUTOUT switches can lead to significant miss-trim and loss of control.
  • Per Boeing, stabilizer trim cutouts switches were available but not required to counter MCAS activations. The only procedure that directs selecting the stabilizer cutout switches is the Runaway Stabilizer non-normal checklist (NNC). This NNS is used to stop un-commanded stabilizer trim wheel movement, which would stop MCAS-commanded stabilizer trim movement.
  • However, erroneous MCAS activation does not look like a typical stabilizer runaway, which is continuous un-commanded (runaway) movement of the stabilizer. During the accident flight, the stabilizer movement was not continuous; the MCAS commands were bounded by the MCAS authority (up to 2.5°); the pilots were able to counter the nose-down movement using opposing manual electric trim inputs; and after the pilots released the manual electric input and MCAS was reset, there was not another MCAS command for 5 seconds.

Source: KNKT.18.10.35.04, ¶2.5

I don't agree with this statement. If the aircraft is pitching down a pilot's instinctive reaction should be to (1) counter with aft stick/control column, (2) opposite trim, and failing that (3) automatic trim system deactivation. This is precisely what the previous crew did, albeit not as quickly as they should have.

Xtra Aerospace LLC

  • The Xtra Aerospace utilized the Angle Position Indicator (API) Peak Model SRI-201B (Model 7724-00-2) for test and calibration repair of the accident AOA sensor, part number 0861FL1 serial number 14488. Utilization of the Peak API deviates from the equipment described in CMM Revision 8, and thus required an equivalency assessment by the Xtra Aerospace engineering department and subsequent acceptance by local FAA Flight Standards District Office (FSDO).
  • A subsequent comparison of the accuracy specifications found that the Peak SRI-201B API accuracy (+/- .03°) was not equivalent to the CMM recommended North Atlantic 8810 (+/- .004°).
  • The participants involved in the visit concluded that performing the required testing and calibration defined in CMM Revision 8 using the Peak API could potentially introduce a bias into both resolvers if the REL/ABS (Relative/Absolute) switch on the Peak Electronics API was inadvertently positioned to REL.
  • After Xtra Aerospace repair of the accident AOA sensor in November of 2017, the sensor was installed on the PK-LQP aircraft on left side position during the maintenance activity in Denpasar on 28 October 2018. On the subsequent flight, a 21° difference between left and right AOA sensors was recorded on the DFDR, commencing shortly after the takeoff roll was initiated (note it takes some airflow over the vane for the vanes to align with the airflow). This immediate 21° delta indicated that the AOA sensor was most likely improperly calibrated at Xtra Aerospace.

Source: KNKT.18.10.35.04, ¶2.6


4

Cause

The report does not list "causes," per se. I shall list my own conclusions after listing some (but not all) of the report's 89 findings.

Findings

  • The flight crew did not react to MCAS activation but to the increasing force on the control column. Since the flight crew initially countered the MCAS command using control column, the longer response time for making electric stabilizer trim inputs was understandable.
  • In the event of multiple MCAS activations with repeated electric trim inputs by flight crew without sufficient response to return the aircraft to a trimmed state, the control column force to maintain level flight could eventually increase to a level where control forces alone may not be adequate to control the aircraft.
  • The procedure of runaway stabilizer was not reintroduced during transition training and there was no immediate indication available to the flight crew to be able to directly correlate the uncommanded nose down stabilizer to the procedure. Therefore, the assumption of relying on trained crew procedures to implement memory items was inappropriate.

Source: KNKT.18.10.35.04, ¶3.1

The procedure was the same in previous aircraft without MCAS, I'm not sure reintroducing the procedure during transition training is necessary.

  • Boeing considered that the loss of one AOA and erroneous AOA as two independent events with distinct probabilities. The combined failure event probability was assessed as beyond extremely improbable, hence complying with the safety requirements for the Air Data System. However, the design of MCAS relying on input from a single AOA sensor, made this Flight Control System susceptible to a single failure of AOA malfunction.

Source: KNKT.18.10.35.04, ¶3.1

It is hard to argue with this assumption. Most aircraft that I've flown require more than one AOA source prior to taking pitch control away from the pilot.

  • The aircraft should have included the intended AOA DISAGREE alert message functionally, which was installed on 737 NG aircraft. Boeing and the FAA should ensure that new and changed aircraft design are properly described, analyzed, and certified.

Source: KNKT.18.10.35.04, ¶3.1

I agree this capability should have been installed, but I'm not sure the accident crew would have correlated it to the problem.

  • The Flight Standardization Board (FSB) process for the Boeing 737-8 (MAX) utilized airline line pilots to help ensure the requirements are operationally representative. The FAA and OEMs should re-evaluate their assumptions for what constitutes an average flight crew’s basic skill and what level of systems knowledge a ‘properly trained average pilot’ has when encountering failures.

Source: KNKT.18.10.35.04, ¶3.1

There seems to be common consensus amongst designers are regulators that the smarter aircraft become, the less smart pilots have to be. Clearly this is false.

  • The engineer in Denpasar considered that the problem had appeared repeatedly and decided to replace the left AOA sensor. Replacement of AOA sensor proved to be the solution to rectify the SPD and ALT flags that were reported to have appeared on the Captain’s PFD, however the installed AOA sensor was misaligned by about 21° and resulted in different problems.

Source: KNKT.18.10.35.04, ¶3.1

Conclusions

I offer my own conclusions in an attempt to help pilots learn from the mistakes leading up to and during the flight of Lion Air 610, so that they can avoid a similar fate.

  1. Boeing's design allowed the MCAS to aggressively pitch down with a single AOA sensor's input, even though two sensors were available.
  2. Lion Air's maintenance program failed to fully troubleshoot the airplane's air data system and installed a faulty AOA sensor without proper troubleshooting.
  3. Lion Air appeared to have routinely rushed pilot training, allowing pilots to take credit for training they had not personally experienced.
  4. The captain failed to accomplished "Airspeed Unreliable" procedures that would have put the airplane into a regime where the MCAS would not have been able to activate.
  5. The pilots failed to deactivate the electric trim system and revert to manual pitch trim.

References

(Source material)

Aircraft Accident Investigation Report, PT.Lion Mentari Airlines, Boeing 737-8 (MAX); PK-LQP Tanjung Karawang, West Java, Republic of Indonesia, 29 October 2018, Komite Nasional Keselamatan Transportasi (KNKT.18.10.35.04), Republic of Indonesia

Langewiesche, William, What Really Brought Down the Boeing 737 Max?, The New York Times Magazine, Sept 18, 2019.