Accidents - Overseas

Flight JT610 - Preliminary report released. 

Via the Oz:
Quote:Plane shouldn’t have flown

[Image: b634f4e79567122f90f255b1ba3945f8]ROBYN IRONSIDE

The Boeing 737 Max 8 that crashed off Indonesia last month should not have been allowed to fly on October 29, after experiencing serious technical problems the day before.

That is the key finding of the preliminary report released today by the National Transportation Safety Committee of Indonesia, following the crash that killed all 189 people on board.

The report detailed the flight on October 28 from Denpasar to Jakarta, which experienced the problem of automatic nose trim commands, making the 737 Max difficult to control.

Despite the issues, the engineer in Jakarta did not brief the pilot of flight JT610 about the “very serious” problems with the expectation that he would read the maintenance log.

It was revealed the pilots on the previous flight ran through several checklists to overcome the issues with the automatic nose down commands, thought to have been triggered by erroneous information from an angle of attack sensor.

A statement from Boeing said it was not known if the pilots in the cockpit of flight JT610 carried out the same procedures.

“Data from the flight data recorder summarised in the report makes clear that, as on the previous flight, the aeroplane experienced automatic nose down trim (commands forcing the nose the aircraft down),” said the statement.

“In response, the flight crew repeatedly commanded nose up trim. This sequence repeated for the remainder of the flight during which the flight crew was able to maintain control of the aeroplane for approximately ten minutes.”

The statement went onto say it was unclear if the pilot performed the “runaway stabiliser” procedure or cut out the stabiliser trim switches which should have overcome the issues with the automatic nose down trim, controlled by a system known as MCAS.

“Boeing appreciates Indonesia’s National Transportation Safety Committee for its ongoing efforts to investigate the causes of the accident,” the statement said.

“Boeing is taking every measure to fully understand all aspects of this accident, working closely with the US National Transportation Safety Board as technical advisers to support the NTSC as the investigation continues.”

Although the flight data recorder has been retrieved, search crews are yet to locate the cockpit voice recorder which will reveal just how the pilots responded to the unfolding crisis.

There is much at stake for Boeing which has seen its share price plummet in the weeks after the crash, and revelations pilots were not aware of the MCAS implications in certain conditions.

Today’s statement emphasised the culture of safety at Boeing and said customers and passengers of the 737 Max, should be assured the aircraft was “as safe as any other to have flown the skies”.

The NTSC report recommended pilots “familiarise themselves better with operating manuals and ensure all operation documents be properly filled out and documented”.
And from Oz Aviation: 

written by Australianaviation.Com.Au November 28, 2018

[Image: Lion-Air-737-MAX.jpg?w=1160]
[img=565x0][/img]Lion Air had 11 737 MAX 8s in its fleet before the October 29 2918 accident. (Boeing/Lion Air)

Indonesia’s National Transportation Safety Committee (NTSC) says the pilots of Lion Air flight JT610 were battling a “flight control problem” before the aircraft plunged into the Java Sea.

The NTSC has released its preliminary report on the accident involving Lion Air Boeing 737 MAX 8 PK-LQP, which crashed shortly after it took off Jakarta Soekarno-Hatta International Airport bound for Pangkal Pinang on October 29.

The aircraft was carrying 181 passengers, two pilots and five cabin crew. There were no survivors.
Indonesian search and rescue teams located the flight data recorder on November 1. However, the cockpit voice recorder is yet to be found.

The investigation so far from the Indonesian National Transportation Safety Committee has found the aircraft had experienced airspeed indicator malfunctions on its last four flights.

In particular, the pilots that operated PK-LQP’s second-to-last flight – from Denpasar to Jakarta on October 28 – experienced conflicting information despite an angle of attack (AOA) sensor being replaced.

The preliminary report published on Wednesday afternoon said the digital flight data recorder (DFDR) showed the “stick shaker activated during the rotation and remained active throughout the flight” from Denpasar to Jakarta.

The pilot in command noticed a warning on the primary flight display an indicated air speed warning IAS DISAGREE.

After handing control to the second in command cross checking the PFDs with the standby instrument, the pilot in command determined that the left PFD had the problem.

The pilot in command declared a “PAN PAN” to the Denpasar Approach controller due to instrument failure and requested to maintain runway heading.

Then, after performing three non-normal checklists, none of which contained the instruction “Plan to land at the nearest suitable airport”, the flight continued onto Jakarta and landed safely.

Once on the ground, the pilot in command informed engineers what happened and entered the details in the Aircraft Flight Maintenance Log (AFML).

An engineer then performed the flushing of the left Pitot Air Data Module (ADM) and static ADM and conduction an operation test off the ground. The electrical connector plug of the elevator feel computer was also cleaned and tested on the ground.


The next day, when PK-LQP took off as JD610, the preliminary report said the DFDR “recorded a difference between left and right angle of attack (AoA) of about 20° and continued until the end of recording”.

“During rotation the left control column stick shaker activated and continued for most of the flight,” the preliminary report said.

The preliminary report said the second in command requested approval from air traffic control “to some holding point” due to what was described as a “flight control problem”.

“After the flaps retracted, the FDR recorded automatic aircraft nose down (AND) trim active for 10 seconds followed by flight crew commanded aircraft nose up (ANU) trim. The flaps extended to 5 and the automatic AND trim stopped,” the preliminary report said.

“At 23:25:18 UTC, the flaps retracted to 0 and several seconds later, the automatic AND trim and flightcrew commanded ANU trim recorded began again and continued for the remainder of the flight.”

“The LNI610 PIC advised the controller that the altitude of the aircraft could not be determined due to all aircraft instruments indicating different altitudes and requested to the controller to block altitude 3,000 feet above and below for traffic avoidance.”

The last communication between air traffic control and the aircraft was the pilot in command’s request to block altitude 3,000 feet above and below for traffic avoidance.

“The air traffic controller asked what altitude the pilot wanted.

“At 23:31:35 UTC, the LNI610 PIC responded ‘five thou’,” the preliminary report said.

The recording ended about 20 seconds later and the flight disappeared from the Aircraft Situational Display (ASD) at 23:32:19 UTC.


In response to the accident, the United States Federal Aviation Administration (FAA) issued an emergency airworthiness directive (AD) on November 7 to operators of Boeing 737 MAX aircraft, which called on them to address procedures in the event of pilots receiving erroneous angle of attack sensor information.

“This emergency AD was prompted by analysis performed by the manufacturer showing that if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabiliser,” the AD said.

“This condition, if not addressed, could cause the flightcrew to have difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain.”

The AD followed Boeing issuing an operations manual bulletin (OMB) that asked 737 MAX operators to remind pilots of how to handle “erroneous” information from the aircraft’s angle of attack sensors.

Boeing said in a statement on November 21, before the preliminary report was published, that it was working with investigators to uncover the cause of the crash.

“We are deeply saddened by the loss of Lion Air Flight JT 610. We extend our heartfelt condolences and sympathies to the families and loved ones of those on board,” Boeing said.

“We are taking every measure to fully understand all aspects of this accident, working closely with the investigating team and all regulatory authorities involved.”

“We are confident in the safety of the 737 MAX. Safety remains our top priority and is a core value for everyone at Boeing.”

The investigation has also canvassed the role of the Maneuvering Characteristics Augmentation System (MCAS) that was introduced on the 737 MAX.

The MCAS helps push the nose to reduce the risk of at the aircraft stalling in response to a high angle of attack (AOA) by tilting the horizontal stabiliser. Pilots can override the system by manually adjust the trim.

It was added to the 737 MAX’s systems following some design changes from the 737 NG, with the engines a little further forward and the nose gear a little longer.

Some airlines and pilots groups have claimed information on the stall recovery system was not included in documentation for the 737 MAX.

However, Boeing has rejected the claims, with chief executive Dennis Muilenburg saying it was included in the flight crew operations manual, according to a memo to staff seen by The Air Current.

Indonesian regulators had also temporarily suspended some Lion Air technical staff, including the company’s technical director.


The Lion Air accident has also prompted Australia’s aviation safety regulator to undertake additional checks on Lion Air subsidiaries that currently fly to Australia.

Civil Aviation Safety Authority (CASA) director of aviation safety and chief executive Shane Carmody told delegates at the Australian Airports Association (AAA) national conference on November 13 inspections of Malaysia-based Malindo Air and Indonesia’s Batik Air – both part of the Lion Air group – have been ramped up following the crash of JT610.

“This week and last week, my staff were at aerodromes and airport in Western Australia and in the Northern Territory conducting active surveillance on Malindo and Batik Air as a consequence of the Lion Air tragedy of a couple of weeks ago,” Carmody said.

“Again, doing ramp checks and focusing our inspection regime on looking to see if something had been missed.”


The preliminary report’s safety recommendations called on Lion Air to ensure the “implementation of the Operation Manual part A subchapter 1.4.2 in order to improve the safety culture and to enable the pilot to make proper decision to continue the flight”. 

Further, it recommended “ensuring all the operation documents are properly filled and documented”, noting there flight lists had six flight attendants on board when there were only five.  

“This indicated that the weight and balance sheet did not contain actual information,” the preliminary report said.

The full report can be read on the NTSC website:

MTF...P2  Cool

David Learmount on Flight JT610.

Via the Aerosociety news:

Quote:Lion Air lessons

There is much to learn from the Lion Air Boeing 737 MAX 8 accident in October 2018 that killed all 189 on board, as a preliminary report lays out. DAVID LEARMOUNT considers the potential implications.

The Lion Air Boeing 737 MAX 8 accident may have many specific lessons for the industry but in most respects it is likely to prove yet another casualty of the complicated relationship between pilots and highly automated systems. The pilots found themselves having to deal with what appeared to be a runaway horizontal stabiliser trim system and failed to control it.

Automation issue

[Image: lion-air-wreckage-recovery-web.jpg?width...1111111114]

So far the Indonesian accident investigator (KNKT) has published only a preliminary factual report but if the automation issue proves to have been a major causal factor when the final report on the crash delivers a verdict, solutions need to be found for this phenomenon. The loss of big jet aircraft and everyone on board just because pilots have difficulty relating to automated control system anomalies is no longer acceptable, even if the results like this are statistically rare. They may be rare but they are plural. Complex systems, especially combined with automation, taking human operators by surprise is an issue that faces not only the aviation industry but many others, including automotive manufacturers seeking automation or vehicle autonomy.

The International Civil Aviation Organisation is quietly working on a new human performance manual that may hopefully, when completed, address many of the human performance issues that are obviously present in the Lion Air accident, even at this early stage in the investigation.

Meanwhile, before considering what could be done to mitigate generic automation-related problems, it is important to understand the specifics of what the Lion Air pilots faced in this very new Boeing 737 MAX 8, if only to discover whether this event contains new lessons, or reveals familiar patterns.

Existing faults

According to the preliminary accident report, the same aircraft (PK-LQP) that crashed fatally on 29 October had suffered faults on flights in the previous three days, many of which appear related to the fault that triggered the aircraft loss. These included speed and altitude disagree alerts on the captain’s primary flight display, speed trim and mach trim warnings, auto-throttle malfunction and, on 27 October, a stall alert.

On each flight where the faults occurred, the crews had decided to continue to their destinations. Then, on arrival, they logged the faults for maintenance, and the engineers – following rectification – had declared them cleared before the next flight. Indeed the left angle-of-attack (AoA) sensor was replaced after the flight on the 27th. But then many of the faults recurred.

The KNKT, also known as the National Transportation Safety Committee (NTSC) has – understandably – devoted a lot of space in its preliminary report to what happened on the 28 October flight, the last flight by PK-LQP before the fatal departure. The NTSC did this because both flights suffered an almost identical succession of system faults but the first flight landed safety, and the other crashed into the sea, killing all 189 people on board.


Soon after take-off for the flight on the 28th, the captain’s stick-shaker activated and remained active and he was presented with IAS and ALT Disagree alerts on his primary flight display. After retracting flaps during the climb he noticed that the stabiliser trim system was running away in the nose-down sense. He told the co-pilot to take over the flying, identified that the problem was with the PFD on his own side, and switched the flight director to the right hand side system so it operated normally for the co-pilot. Whenever the co-pilot relaxed his nose-up trim input via his control column thumb switch, the automatic nose-down stabiliser input resumed. Eventually the force needed on the control column to keep the nose up became very high, so the captain selected the STAB TRIM switches to CUT OUT.

The captain may not have known specifically what had caused the unexpected stabiliser trim activity but the NTSC report notes that – before the flight – the captain, after scanning the maintenance log, had discussed the AoA sensor replacement with an engineer. Then, in-flight, having isolated the electrical input to the stabilisers, the captain decided that the flight could proceed to Jakarta, its scheduled destination, with the crew using manual trim inputs via the centre console trim wheel. The checklist suggests landing at the nearest suitable airfield but the flight landed safely at Jakarta anyway.

On the fatal flight the next day, however, after a similar sequence of events, once the aircraft’s stabiliser trim system was triggered, it kept on trimming nose down until the crew could not overcome it with elevator force or the use of control column thumb-switch trim controls, and it dived into the sea at high speed.

The automatic nose-down stabiliser trim on both flights was caused by the programmed reaction of a stall protection system to a faulty AoA sensor on the captain’s side. The system is unique to the MAX series, and is known as the manoeuvring control augmentation system (MCAS). MCAS is effectively an AoA-triggered stall protection system that can operate when the flaps are up. In this case, the left hand AoA sensor provided a high reading, differing by 20° from the one on the copilot’s side, and this caused the MCAS to react, pitching the nose down to reduce the AoA. The faulty AoA sensor system on the captain’s side was the one that had been replaced by the engineers two days before. Discovering the cause of the AoA sensor faults is one of the subjects of the continuing NTSC inquiry.

Boeing’s response

[Image: lion-air-737-max-fleet-web.jpg?width=500...6666666667]

Boeing released a statement in response to publication of the NTSC preliminary report in which it makes this observation: “Unlike as is stated with respect to the prior flight, the report does not state whether the pilots performed the runaway stabilizer procedure or cut out the stabilizer trim switches.”

The Indonesian preliminary accident report raises more questions than it answers for the time being but that is not unusual for a preliminary report. Boeing’s basic contention is that the information on how to deal with a runway stabiliser trim “regardless of source [cause]” is in the MAX’s flight crew operations manual (FCOM), and the company’s statement notes that the captain of the flight on 28 October used the non-normal checklist for stabiliser runaway. However pilot associations for airlines in the USA that operate the MAX have professed publicly that there was a widespread ignorance among MAX-qualified pilots of the very existence of the MCAS and also an assumption that a runaway trim would be dealt with in exactly the same way as for all the earlier 737 marques.

The reason for this professed pilot ignorance about the new MCAS system is not clear. Boeing explains the lack of fanfare about the new system by pointing out that it is a ‘variant’ of the speed-related automatic stabiliser trim system on the 737NG series, but adds: “MCAS does not control the airplane in normal flight. It augments the stall recovery characteristics of the airplane in a non-normal part of the operating envelope.” The manufacturer also insists it has “discussed MCAS flight control functionality with more than 60 airline operators at several Service Ready Regional Conferences globally since 2016,” a statement that is also difficult to reconcile with the claims by US pilot associations.

An experienced Southwest Airlines captain with whom AEROSPACE discussed the MCAS issues says that, in practice, the 737NG and MAX feel the same to fly. He did remark, however, that he was surprised that a single-point AoA sensor failure could be allowed to trigger what feels like a stabiliser trim runaway, venturing his personal opinion that this showed poor system redundancy design.

Pilot conversion to the MAX

Pilots converting from earlier 737 marques to the MAX are not required to undergo a new type rating course, because all 737s are deemed to have sufficient commonality to operate under the same type rating. Thus 737-rated pilots being prepared for the MAX are required only to undergo a brief “differences course”. For example, Southwest Airlines pilots do their differences course entirely online and American Airlines the same, so there is no practice in a flight simulation training device. Southwest anticipates getting its first MAX full flight simulator in March 2019.

The type conversion situation appears the same in Europe. Ryanair, which is to take delivery of its first MAXs at its London Stansted base in April 2019, says its differences course will be delivered via computer-based training, the CBT course designed using a combination of Boeing input and Ryanair’s own. The airline says it will begin installing its first MAX FFS at its London Stansted training base starting in January.

Although the preliminary report does not mention it, this accident is likely to focus minds on the delicate issue of common type ratings. Manufacturers and operators love them but some experts insist aviation authorities need to be far more critical of them. Even more specifically, are the certification standards around trimmable horizontal stabilisers sufficiently robust?

Meanwhile, over and above the technical argument about the AoA sensor fault triggering MCAS and whether this was a causal factor in the Lion Air crash, the simple fact remains that a crew became confused about what was happening, and as a result failed to implement a checklist procedure that could have prevented the loss of control. That description generates a powerful sense of déjà vu.

The preliminary report contains a long list of safety actions to be carried out by Lion Air and the aircraft maintenance providers. The report criticises the crew that survived the 28 October flight from Denpasar to Jakarta for deciding to continue to its destination despite the fact that the captain’s stickshaker was operating continuously from just after take-off, which makes the aircraft un-airworthy. It says Lion Air needs to “improve the safety culture”, implying that a crew that can make a decision to continue a flight to destination with an un-airworthy aircraft demonstrates the absence of such a culture. It also remarks that the weight and balance sheets showed five cabin crew aboard, whereas there were in fact six of them. The sheer number of repeating faults in the accident aircraft have driven the investigators to call for more accurate technical reporting by crews and better fault troubleshooting, and there is much more.

Complexity-related pilot confusion

[Image: af447-fdr-bea-web.jpg?width=500&height=3...2222222223]

Aside from the specific Lion Air lessons, the generic problem of complexity-related pilot confusion needs to be addressed. There is much study ongoing about why such crew confusion events have frequently been precursors to loss of control in flight (LOC-I) during the last 20 years, and whether there are solutions. It has already been established that pilots – the commercial air transport system’s goalkeepers – sometimes face shots they did not see coming, so they dive the wrong way.

Answers put forward are many, including improved training inculcating deeper levels of knowledge; conformance with standard operating procedures and improving the quality of information available to pilots. Information, and the way it is presented, is key. Crews in modern flightdecks are bombarded with information to the point where quantity can become the problem rather than the solution.

For example, the classic crew confusion scenario was what happened on Air France flight 447 in the middle of the night over the South Atlantic in 2009. The pitot tubes were momentarily blocked by ice crystals, so the indicated airspeed readings suddenly made no sense and the autopilot tripped out noisily and handed the aircraft back to the pilots because it recognised that its sensor inputs had been corrupted.

There was a drill for the unreliable airspeed scenario, and the AF447 accident report noted that on six previous occasions where airspeed sensor data had been rendered useless, the crews managed to deal with it safely by following procedure. However in AF447 it was two hours after midnight, the pilots were at their absolute circadian low, and the startle effect robbed them of much of their mental capacity. There was plenty of information in front of them providing their aircraft attitude, altitude, power settings and – after about a minute from the IAS loss – a return to accurate airspeed readings. Unable to make sense of what they saw on the instrument panel, they rapidly reverted to instinct, which was disastrous for a crew over a dark ocean on a moonless night.

The aim of improving the quality of data available to pilots is an admirable one but, while it is easy to voice the objective, it is not easy to decide what data should be presented, in what form, and according to what priorities. Messages like “IAS and ALT Disagree” flashing up on one PFD while – simultaneously – the stickshaker is operating (Lion Air), or the autopilot disconnecting and the aircraft’s control law changing from normal to alternate (AF447) do not provide the pilots with the essential information to help them ensure safe flight. What is more, such cryptic information risks becoming a dangerous distraction.

The information essentials for a confused pilot are those which help the crew to follow the absolute pilot priorities: aviate, navigate, communicate. The industry needs to resolve these issues to prevent pilot confusion dooming more flights.

David Learmount
11 January 2019

MTF...P2 Cool

Users browsing this thread: 4 Guest(s)