[Peetwo]

David Learmount on Flight JT610.


Via the Aerosociety news: https://www.aerosociety.com/news/lion-air-lessons/

Lion Air lessons

There is much to learn from the Lion Air Boeing 737 MAX 8 accident in October 2018 that killed all 189 on board, as a preliminary report lays out. DAVID LEARMOUNT considers the potential implications.

The Lion Air Boeing 737 MAX 8 accident may have many specific lessons for the industry but in most respects it is likely to prove yet another casualty of the complicated relationship between pilots and highly automated systems. The pilots found themselves having to deal with what appeared to be a runaway horizontal stabiliser trim system and failed to control it.

Automation issue



So far the Indonesian accident investigator (KNKT) has published only a preliminary factual report but if the automation issue proves to have been a major causal factor when the final report on the crash delivers a verdict, solutions need to be found for this phenomenon. The loss of big jet aircraft and everyone on board just because pilots have difficulty relating to automated control system anomalies is no longer acceptable, even if the results like this are statistically rare. They may be rare but they are plural. Complex systems, especially combined with automation, taking human operators by surprise is an issue that faces not only the aviation industry but many others, including automotive manufacturers seeking automation or vehicle autonomy.

The International Civil Aviation Organisation is quietly working on a new human performance manual that may hopefully, when completed, address many of the human performance issues that are obviously present in the Lion Air accident, even at this early stage in the investigation.

Meanwhile, before considering what could be done to mitigate generic automation-related problems, it is important to understand the specifics of what the Lion Air pilots faced in this very new Boeing 737 MAX 8, if only to discover whether this event contains new lessons, or reveals familiar patterns.

Existing faults

According to the preliminary accident report, the same aircraft (PK-LQP) that crashed fatally on 29 October had suffered faults on flights in the previous three days, many of which appear related to the fault that triggered the aircraft loss. These included speed and altitude disagree alerts on the captain’s primary flight display, speed trim and mach trim warnings, auto-throttle malfunction and, on 27 October, a stall alert.

On each flight where the faults occurred, the crews had decided to continue to their destinations. Then, on arrival, they logged the faults for maintenance, and the engineers – following rectification – had declared them cleared before the next flight. Indeed the left angle-of-attack (AoA) sensor was replaced after the flight on the 27th. But then many of the faults recurred.

The KNKT, also known as the National Transportation Safety Committee (NTSC) has – understandably – devoted a lot of space in its preliminary report to what happened on the 28 October flight, the last flight by PK-LQP before the fatal departure. The NTSC did this because both flights suffered an almost identical succession of system faults but the first flight landed safety, and the other crashed into the sea, killing all 189 people on board.

Stick-shaker

Soon after take-off for the flight on the 28th, the captain’s stick-shaker activated and remained active and he was presented with IAS and ALT Disagree alerts on his primary flight display. After retracting flaps during the climb he noticed that the stabiliser trim system was running away in the nose-down sense. He told the co-pilot to take over the flying, identified that the problem was with the PFD on his own side, and switched the flight director to the right hand side system so it operated normally for the co-pilot. Whenever the co-pilot relaxed his nose-up trim input via his control column thumb switch, the automatic nose-down stabiliser input resumed. Eventually the force needed on the control column to keep the nose up became very high, so the captain selected the STAB TRIM switches to CUT OUT.

The captain may not have known specifically what had caused the unexpected stabiliser trim activity but the NTSC report notes that – before the flight – the captain, after scanning the maintenance log, had discussed the AoA sensor replacement with an engineer. Then, in-flight, having isolated the electrical input to the stabilisers, the captain decided that the flight could proceed to Jakarta, its scheduled destination, with the crew using manual trim inputs via the centre console trim wheel. The checklist suggests landing at the nearest suitable airfield but the flight landed safely at Jakarta anyway.

On the fatal flight the next day, however, after a similar sequence of events, once the aircraft’s stabiliser trim system was triggered, it kept on trimming nose down until the crew could not overcome it with elevator force or the use of control column thumb-switch trim controls, and it dived into the sea at high speed.

The automatic nose-down stabiliser trim on both flights was caused by the programmed reaction of a stall protection system to a faulty AoA sensor on the captain’s side. The system is unique to the MAX series, and is known as the manoeuvring control augmentation system (MCAS). MCAS is effectively an AoA-triggered stall protection system that can operate when the flaps are up. In this case, the left hand AoA sensor provided a high reading, differing by 20° from the one on the copilot’s side, and this caused the MCAS to react, pitching the nose down to reduce the AoA. The faulty AoA sensor system on the captain’s side was the one that had been replaced by the engineers two days before. Discovering the cause of the AoA sensor faults is one of the subjects of the continuing NTSC inquiry.

Boeing’s response



Boeing released a statement in response to publication of the NTSC preliminary report in which it makes this observation: “Unlike as is stated with respect to the prior flight, the report does not state whether the pilots performed the runaway stabilizer procedure or cut out the stabilizer trim switches.”

The Indonesian preliminary accident report raises more questions than it answers for the time being but that is not unusual for a preliminary report. Boeing’s basic contention is that the information on how to deal with a runway stabiliser trim “regardless of source [cause]” is in the MAX’s flight crew operations manual (FCOM), and the company’s statement notes that the captain of the flight on 28 October used the non-normal checklist for stabiliser runaway. However pilot associations for airlines in the USA that operate the MAX have professed publicly that there was a widespread ignorance among MAX-qualified pilots of the very existence of the MCAS and also an assumption that a runaway trim would be dealt with in exactly the same way as for all the earlier 737 marques.

The reason for this professed pilot ignorance about the new MCAS system is not clear. Boeing explains the lack of fanfare about the new system by pointing out that it is a ‘variant’ of the speed-related automatic stabiliser trim system on the 737NG series, but adds: “MCAS does not control the airplane in normal flight. It augments the stall recovery characteristics of the airplane in a non-normal part of the operating envelope.” The manufacturer also insists it has “discussed MCAS flight control functionality with more than 60 airline operators at several Service Ready Regional Conferences globally since 2016,” a statement that is also difficult to reconcile with the claims by US pilot associations.

An experienced Southwest Airlines captain with whom AEROSPACE discussed the MCAS issues says that, in practice, the 737NG and MAX feel the same to fly. He did remark, however, that he was surprised that a single-point AoA sensor failure could be allowed to trigger what feels like a stabiliser trim runaway, venturing his personal opinion that this showed poor system redundancy design.

Pilot conversion to the MAX

Pilots converting from earlier 737 marques to the MAX are not required to undergo a new type rating course, because all 737s are deemed to have sufficient commonality to operate under the same type rating. Thus 737-rated pilots being prepared for the MAX are required only to undergo a brief “differences course”. For example, Southwest Airlines pilots do their differences course entirely online and American Airlines the same, so there is no practice in a flight simulation training device. Southwest anticipates getting its first MAX full flight simulator in March 2019.

The type conversion situation appears the same in Europe. Ryanair, which is to take delivery of its first MAXs at its London Stansted base in April 2019, says its differences course will be delivered via computer-based training, the CBT course designed using a combination of Boeing input and Ryanair’s own. The airline says it will begin installing its first MAX FFS at its London Stansted training base starting in January.

Although the preliminary report does not mention it, this accident is likely to focus minds on the delicate issue of common type ratings. Manufacturers and operators love them but some experts insist aviation authorities need to be far more critical of them. Even more specifically, are the certification standards around trimmable horizontal stabilisers sufficiently robust?

Meanwhile, over and above the technical argument about the AoA sensor fault triggering MCAS and whether this was a causal factor in the Lion Air crash, the simple fact remains that a crew became confused about what was happening, and as a result failed to implement a checklist procedure that could have prevented the loss of control. That description generates a powerful sense of déjà vu.

The preliminary report contains a long list of safety actions to be carried out by Lion Air and the aircraft maintenance providers. The report criticises the crew that survived the 28 October flight from Denpasar to Jakarta for deciding to continue to its destination despite the fact that the captain’s stickshaker was operating continuously from just after take-off, which makes the aircraft un-airworthy. It says Lion Air needs to “improve the safety culture”, implying that a crew that can make a decision to continue a flight to destination with an un-airworthy aircraft demonstrates the absence of such a culture. It also remarks that the weight and balance sheets showed five cabin crew aboard, whereas there were in fact six of them. The sheer number of repeating faults in the accident aircraft have driven the investigators to call for more accurate technical reporting by crews and better fault troubleshooting, and there is much more.

Complexity-related pilot confusion



Aside from the specific Lion Air lessons, the generic problem of complexity-related pilot confusion needs to be addressed. There is much study ongoing about why such crew confusion events have frequently been precursors to loss of control in flight (LOC-I) during the last 20 years, and whether there are solutions. It has already been established that pilots – the commercial air transport system’s goalkeepers – sometimes face shots they did not see coming, so they dive the wrong way.

Answers put forward are many, including improved training inculcating deeper levels of knowledge; conformance with standard operating procedures and improving the quality of information available to pilots. Information, and the way it is presented, is key. Crews in modern flightdecks are bombarded with information to the point where quantity can become the problem rather than the solution.

For example, the classic crew confusion scenario was what happened on Air France flight 447 in the middle of the night over the South Atlantic in 2009. The pitot tubes were momentarily blocked by ice crystals, so the indicated airspeed readings suddenly made no sense and the autopilot tripped out noisily and handed the aircraft back to the pilots because it recognised that its sensor inputs had been corrupted.

There was a drill for the unreliable airspeed scenario, and the AF447 accident report noted that on six previous occasions where airspeed sensor data had been rendered useless, the crews managed to deal with it safely by following procedure. However in AF447 it was two hours after midnight, the pilots were at their absolute circadian low, and the startle effect robbed them of much of their mental capacity. There was plenty of information in front of them providing their aircraft attitude, altitude, power settings and – after about a minute from the IAS loss – a return to accurate airspeed readings. Unable to make sense of what they saw on the instrument panel, they rapidly reverted to instinct, which was disastrous for a crew over a dark ocean on a moonless night.

The aim of improving the quality of data available to pilots is an admirable one but, while it is easy to voice the objective, it is not easy to decide what data should be presented, in what form, and according to what priorities. Messages like “IAS and ALT Disagree” flashing up on one PFD while – simultaneously – the stickshaker is operating (Lion Air), or the autopilot disconnecting and the aircraft’s control law changing from normal to alternate (AF447) do not provide the pilots with the essential information to help them ensure safe flight. What is more, such cryptic information risks becoming a dangerous distraction.

The information essentials for a confused pilot are those which help the crew to follow the absolute pilot priorities: aviate, navigate, communicate. The industry needs to resolve these issues to prevent pilot confusion dooming more flights.

David Learmount
11 January 2019

MTF...P2