Indonesian authorities release preliminary Lion Air crash report

By Bjorn Fehrm

November 28, 2018, © Leeham News.: The Indonesian National Transportation Safety Committee (KNKT) has released the preliminary report about the fatal flight Lion Air LNI610.

The report is 78 pages and gives added information in several areas. Rather than repeat what has been reported before, the article is focused on what new facts are revealed and we make some observations around these facts.

The additional information

The report releases part of the information from the recovered memory of the Flight Data Recorder (FDR) in addition to other circumstantial data.

FDR parameters are presented from the fatal flight, Figure 1 and 2 and from the previous flight, Figure 3. The fatal flight’s selection of parameters are slightly different to what was presented in a Parliament presentation last week. I show the graph from the Parliament presentation in Figure 5.

Figure 1. KNKT’s report flight parameters graph. Source: KNKT report.

Figure 2. Fatal flight’s engine and speed, heading and altitude information. Source: KNKT report.

Figure 3. Preceding flight’s data. Source: KNKT report.

The FDR graphs show the left Angle of Attack (AoA) to track the right sensor but with a 20° higher value for both flights. MCAS (Maneuvering Characteristics Automation System) starts working from around 10° AoA (dependent on pitch rate) and Stall warning with stick shaker starts at around 14° for clean aircraft.

With a pre-bias of 20° for the left AoA vane, stall warning was active from rotation/lift-off for both flights and MCAS was trimming nose down from clean aircraft, countered with Pilot’s manual trim nose up.

Stall warning was on for the complete previous flight and for all of the fatal flight, except for a few seconds in the climb. Stall warning activates the EFS (Elevator Feel Systems) to increase the stick force. The First Officer, who flew the previous flight, complained about the high stick force, saying the control column was too heavy to hold back.

The Captain on the previous flight noted the stick shaker at 400ft and got Speed and Altitude disagree warnings. He concluded by comparing with the third backup Flight data display system his side’s air data was nonreliable and gave control to the First Officer.

With a free mind, he could observe the aircraft besides the warnings and stick force increase. He saw how the aircraft was trimming nose down in the background. He also saw how the First Officer’s trimming stopped the nose down trim. He then tried trim CUTOUT. It stopped the background intermittent nose down trimming. He put the switches back to normal; the intermittent nose down trimming started again. After this, he put the switches in CUTOUT and told the First Officer to trim manually with the trim wheel for the rest of the flight.

The fatal flights’ graphs show the almost exact same behavior of the aircraft, despite maintenance actions and OK tests before the flight. This time the crew was prewarned. Maintenance had been done to fix Airspeed and Altitude disagree and the “STS trimming the wrong way”.

There was no mention in the maintenance logs of a trim runaway as the previous flight Captain had not logged it; neither in the maintenance log nor in the Lion Air Flight crew reporting system, A.SHOR. Here is what he reported in the Flight crew log:

Airspeed unreliable and ALT disagree shown after takeoff, STS also running to the wrong direction, suspected because of speed difference, identified that CAPT instrument was unreliable and handover control to FO. Continue NNC of Airspeed Unreliable and ALT disagree. Decide to continue flying to CGK at FL280, landed safely runway 25L.

NNC stands for Non-Normal Checklist. He doesn’t mention NNC “Trim Runaway”, which Boeing and FAA now says shall be followed for the symptoms the flight had. Yet, he tries trim CUTOUT and decides it helps and reengages it, but without mentioning it in the maintenance log or Flight crew’s log.

Maintenance

Maintenance acted on the four previous flights problems. Here the flights and their maintenance log and actions copied verbatim from the report:

1.6.3 Aircraft Flight and Maintenance Log

The Aircraft Flight Maintenance Log (AFML) recorded that since 26 October 2018 until the occurrence date several problems occurred related to airspeed and altitude flag appeared on Captain (left) Primary Flight Display (PFD) three times, SPEED TRIM FAIL light illumination and MACH TRIM FAIL light illumination two times and IAS (Indicated Airspeed) and ALT (Altitude) Disagree shown on the flight Denpasar to Jakarta the day before the accident flight.

The summary of the aircraft defect recorded on AFML were as follows: No Reported Date Route Defect Description Resolution Description:

Figure 4. The Maintenance logs and their actions and tests. Source: KNKT report.

The logs, like the previous Captain’s report, focus on Speed and Altitude difference problems. There is only one flight, number three, where the FCC (Flight Control Computer) logs a faulty Stall warning and AoA out of range. With this log, the AoA sensor is changed and tested OK.

Every log entry has resulted in maintenance actions and following tests, according to the 737 MAX AAM (Aircraft Maintenance Manual). The KNKT says the aircraft should not have been considered airworthy by the previous flights Captain but has not commented on the airworthiness of the aircraft after maintenance.

For the previous flight’s airworthiness, KNKT reasons; Stall warning was on from TakeOff. The Captain should have abandoned the flight and returned and landed, just like the fatal flight’s Captain decided to do. He never came that far.

The report gives no information why the fight with MCAS trimming ended in a dive for the fatal flight. The last seconds of the flight are not included in the report’s graphs but the presentation to the Indonesian parliament last week had FDR traces which had more information and until the aircraft hit the sea, Figure 5.

Figure 5. Fatal flight’s parameters until the crash. Source: KNKT presentation to the Indonesian Parliament.

The interesting additional information is the stick force traces named CCFORCE_PITCHCWSLOCAL_FDR and CCFORCE_PITCHCWSFOREIGN_FDR. To understand these, here a short description of the 737 manual pitch control system, Figure 6:

Figure 6. The pitch control of the 737 Elevator and the Stabilizer pitch trim manual control. Source: 737 Systems manual

The 737 has two independent mechanical elevator flight controls; the left side which has its own cables to control a hydraulic PCU actuator which controls the left elevator (Red trace CCFORCE_PITCHCWSLOCAL_FDR in Figure 5) and an identical system on the right (Green trace CCFORCE_PITCHCWSFOREIGN_FDR in Figure 5). The systems are joined in the cockpit via a torque tube with a breakout mechanism to get one elevator free, through a very high stick force, in case of an elevator control jam on one side.

The traces come from force transducers located in the cable paths. As the captain pulls the Yoke (Red trace) the First Officer’s force transducer (Green) registers the pull as his Yoke is following the Captain’s movements, but with a little lower force because of the interconnect’s mechanical play. Both paths work against left and right Elevator Feel and Centering (EFS) units.

At Figure 5 (A) the traces are no longer following each other. The First Officer has taken over and his Yoke exerts a higher force to counter MCAS trimming. The Left pitch force remains the same as before. The two sides of the mechanical flight control system give independent force signals. It could mean a Yoke breakout has occurred, but it could also mean something else. A breakout requires an extremely high stick force working against the other side being jammed. Such a Yoke force is not normally encountered when the Yoke has an elevator feel system generating the counter force.

The final report will conclude what is happening here, but I think we have an explanation to the dive in these traces. For some reason, the flight control system experiences a sudden difference of the pitch forces, not appearing at any other stage of the two flights where this trace is available. It could be the Pilots suddenly working against each other on their Yokes or it could be one column being partially jammed for some reason. Difficult to say, we will eventually know. We are missing additional information like pitch and roll angle to access the situation (the investigation has all this information).

The crew’s actions

Why didn’t the Captain execute the NNC for “Trim runaway”?. Observe how the previous Captain, which had his mind free from not flying a troubling aircraft, did not think this was an important checklist point according to his descriptions and reports. He tried the switches and decided they helped, but he did not identify a trim runaway and reported it. The trim worked when the trim switches were used, this is no classical trim runaway. He consequently didn’t mention “Trim Runaway” in his post-flight reports.

The Captain of LNI610 shall have been briefed on the Speed and Alt disagree and STS trimming the wrong way (it’s really the EFS, not the STS=Speed Trim System which gives the high stick forces) at aircraft handover by the mechanics. His focus was if these problems persisted. They did. He had no reliable speed or altitude information according to several demands for this information by his First Officer to Air Traffic Control.

In addition, he was flying the aircraft, difficult to handle with constant stick shaker and ever higher EFS force (look at the Red force graph increasing all the time). He controlled pitch with counter trim and starts flying the aircraft back to the airport. What happens at (A) in Figure 4 throws both pilots of the guard. This can explain the short counter trims. They had other problems.

Conclusions

The preliminary report if focused on reporting facts and first recommendations. It has no conclusions.

We await more information before going beyond the observations made above. I think it’s safe to say; it wasn’t a clear-cut “execute the Trim Runaway” checklist situation for the crew. All 737 MAX crews now know this is the thing to do in the above situation. But these crews didn’t have this information. Secondly, MCAS operating off a single, unverified, AoA signal will not be for long.

91 Comments on “Indonesian authorities release preliminary Lion Air crash report

  1. This is quite sobering: “I think we have the explanation to the dive in these traces. For some reason, the flight control system experience a pitch breakout and half elevators cannot hold a nose down trimmed aircraft.”

    Translation if the pilot doesn’t know/think to disengage the automatic trim (as done by the pilot on the earlier flight), then the aircraft is doomed no matter what other actions the pilots take to try to manually control their aircraft.

    Wow.

    • Hi Bruce, no, not if you trim up when the MCAS trim down. This is natural and was done until A. What happened there is not clear but if the person flying had kept trimming the breakout force would not have happened (if the trace shows a breakout, which I think it does).

      • Thanks Bjorn.

        One thing does puzzle me – how is it that something called “trim” seems to have more authority over what the aircraft does than a pilot’s own inputs? Even if it is intended to be about maintaining a flight characteristic the airframe no longer naturally has thanks to the engine nacelles?

        The word “Trim” suggests to me (a non-pilot, but a deeply sceptical systems engineer amongst other supposed talents) something that ought to be small adjustments, rather than wholesale “push the nose all the way over no matter what”. Certainly whenever I’ve had the good fortune to do a bit of gliding, adjusting trim tabs hasn’t been about massive changes in pitch authority or control force.

        Yet there’s talk here of the pilots having to pull hard on their control columns, and indeed running out of strength to do so to override what the trim system was doing, breaking the torque tube linking R and L in the process. That’s just not making any sense to me at all. Why should such large forces be involved in the first place?

        Am I being too simple? A one word answer “yes” would be perfectly OK!

        Your para “The 737 can be flown and landed with one elevator jammed fixed and only one active…” would presumably apply to any 737 (not just the MAX). That is, any 737 with a stuck elevator and stuck full down trim is going to crash. Is that a reasonable design situation to exist today, given that the two required fault conditions are in the same general area of the aircraft? Accident rates across all 737s would suggest yes, it’s been fine so far.

        However, I wonder whether anyone has actually ever (in 4+ decades) looked at this aspect of the 737 characteristcs from a certification point of view. If not, I wonder if they should, given that it appears pilot input alone can break the torque tube resulting in a loss of elevator authority.

        It looks like MAX has a introduced a new way in which one of those fault conditions can be created (MCAS trims down when it shouldn’t). A plausible hypothesis is that the MCAS behaviour is worse than ordinary stuck down trim, because it’s repeated action is more likely to provoke the pilots into creating the other fault condition (yoke breakout) that then risks an unrecoverable loss of control. Oops.

        Regarding your suggestion that MCAS taking just one AOA sensor input is insufficient, and that it may soon be re-engineered to take both. I’m assuming the goal would be for MCAS to be retained, and to still be a background system that the pilots don’t need to know about so that their NG / MAX type certifications are safely and maximally interchangeable.

        Surely for that to be achieved would mean that MCAS is then going to have to be a full safety critical system, with triplicate redundancy, etc, to make it genuinely something pilots don’t need to know about or monitor? That would require 3 AOA sensors, of different types; MAX is one short AFAIK. Arguably it’d require more than one actuator for stabliser trim movements too – otherwise it’s just another single point of failure. I don’t think that it can be made fully safety critical, in the traditional sense.

        So if it were just duplicate redundancy, running off 2 AOA sensors (of the same type?), it would then have to be pilot monitored so as to be “safe” (they’d have to know when and how to turn it off). But then flying the MAX would be different to flying the NG, wouldn’t it, with reduced interchangeability of pilot license.

        I don’t know if that would dent some of the economic benefit of operating both types at the same time.

        Could one make MCAS “safe” by changing the stabliser/elevator design so that the pitch authority from one elevator alone would be sufficient to override it? It’s then a notably different aircraft to the 737 basic design, which may have pilot training / economic consequences.

        Thanks again for excellent articles of all sorts.

        • Hi Matthew,

          the high speed range of a modern airliner necessitates the powerful trimming mechanism of tilting the whole horizontal stabilator with a rather smaller elevator at the back responding to instantaneous pitch commands. Look at my first Lion Air article how it looks. It’s the same for all airliners, they share the same powerful trim problem at high Mach around the cruise speed.

          Re the logic around different systems for flight control, check out the articles by Peter Lemme at his blog (https://www.satcom.guru). He worked on Flight control systems at Boeing and knows the logic and allowed probailities for different design principles dependent on functions.

          • Thanks very much Bjorn, I’m reading Peter Lemme’s blog with interest (it’s gone straight onto my browser’s link toolbar, right next to leehamnews.com!).

            I was already aware of trimming by moving the whole stabliser, and consequently it could exert quite a lot of pitch authority. But I’d always assumed that the elevators themselves had substantially more authority, without requiring large control column forces.

            Thanks again

  2. The AOA indications were off by 20 degrees even during taxi. I know hindsight bla bla bla. But wouldn’t it be relatively simple to program in a system self-check that requires agreement of the left-and-right AOA sensors whenever the wheels are on the ground? If you were a pilot wouldn’t YOU want to at least have a warning saying “Look buddy, your AOA sensors disagree by an average 20 degrees for the last minute”

    • AoA vanes are inherently unreliable until they get enough airspeed past them to fix their angle. Such checks you recommend can be done at speed on the runway and the dangerous effects of a faulty value can be inhibited.

    • God yes! As soon as you rotate you will get stick shaker. As you are taught to believe the safety devices, your first reaction is purely brain lock up.

      My Attitude is good, speed is (oh crap) my VSI is (huh) and ………..

      Radar mealtime, hmmm, up flaps and all hell breaks loose.

      I don’t know at what point systems transition for the RALT to the pitot system. 3k or so I belive.

  3. Bjorn,
    Here are a couple questions for you (I’m not a pilot):
    1) Is AOA something that the pilot monitors directly, i.e. is it on the display?
    2) Does a discrepancy between AOA sensors cause a fault indication? If so, wouldn’t that fault require resolution before take-off?

  4. Hi Mike,

    1) Is AOA something that the pilot monitors directly, i.e. is it on the display?

    Military pilots who fly the aircraft on the limits have the AoA displayed. It’s one of the most important instruments. Civil aircraft not. It’s a 50-year-old debate why. Having flown AoA myself I don’t understand the counter-arguments to display it (it’s there, you just don’t see it as a Pilot). It’s optional to have it shown on the 737, few airlines have it.

    2) Does a discrepancy between AOA sensors cause a fault indication? If so, wouldn’t that fault require resolution before take-off?

    As in the previous mail, AoA is only reliable with high-speed air passing the vane = at or after takeoff.

  5. It is indeed sobering.

    Of serious interest is why the Co Pilot did not have speed and altitude and if they compared it to the backup instrument cluster (I know there is a different name for it now – to small aircraft pilots they were the backup instruments )

    During all that was going on, they look not to have a stable Artificial Horizon.

    You key cross checks with a stall slamming you is that and the VSI (vertical speed readout in Feet Per min) /Altitude situation.

    If VSI and Altitude and speed are gone, you have a stall alarm, stick shaker and the last reliable ref is the backup instruments.

    Why no alert for a severely disagreeing AOA? – let alone one that is in stall (more or less but 20 deg off) at taxi/takeoff.

    The comments that it was routine are totally bogus.

    Its not that it could not be handled, its that a crew should never have been put into the position they had to handle what they did. This is not a test of people capability in a simulator, its people lives at stake, and 180 of them killed.

    You don’t want the best pilot in the world able to handle it, you want and should count on the least capable.

    Keeping in mind, we all have skills and talents and we all have areas we are weak in.

    Flip of a coin what you get for a pilot who should not be put in that position no matter what the skill level in any given situation.

    Trained on it, then yes they should handle it (and it still should not be there in its current form or occur in the first place)

  6. I don’t think this is about stabiliser trim. Stabiliser trim can ALWAYS be corrected by the stabiliser. The reason is the stabiliser trim is a far smaller control surface than the stabiliser itself.

    In other words, runaway stabiliser trim is one thing, it can be controlled, but runsway stabiliser is another thing. If the pilots don’t have control of the stabiliser then they are done.

    I haven’t had time to read the report. I will do that. I have read media commentary.

    But, from the beginning I took the view that it wasn’t stabiliser trim. I think MCAS put the stabiliser to maximum deflection to prevent stall on the basis of inaccuate AoA. This caused a steep dive.

    Media commentary suggests I’m right. But I need to read the report.

    I welcome comments, but stabiliser trim and stabiliser involve two different forces, the second is far greater than the first

      • Philip:

        I would suggest you look at what trims what on a commercial aircraft.

    • it is not a servo tab that us adjusted via trim
      but the full aerosurface angle of incidence is changed.

    • Just trying to understand this, the two control surfaces mentioned in the article are the stabalator, and elevator. I assume stabiliser and stabiliser trim both refer to the stabalator and it’s the angle it is set at?.

      The stabalator is controlled by one jack screw. The elevators are controlled by two separate mechanisms left and right, so one can work independent of the other?

      • You’ve got me there, I assumed that a stabalalor was an all moving tailplane with no elevators.

        • Phillip:

          Read what is there.

          Stabilizer LARGE

          Elevators SMALL

          Or take one of the online aerodynamics classes.

          Lots of pictures on line. All you have to do is look.

    • “The reason is the stabilizer trim is a far smaller control surface than the stabilizer itself.”

      I think you’re thinking of trim tabs on small aircraft, which are smaller than the elevator & stabilizer. But on large aircraft the entire stabilizer is trimmed rather than a tab on the elevator (e.g. this is why they call it “stabilizer trim” rather than “elevator trim”). The entire stabilizer being trimmed down seems like it could impose massive pitch forces.

  7. Ok, what “geniuses” (previous flight’s pilots) decided to takeoff and complete their flight with the stall warning blaring the whole way? You’re kidding, right? (In the C172s I’ve flown, five seconds of that is about “enough”!) Also, major blame goes on Lion Air maintenance (60% or more). If those A of A sensors were properly fixed, there’d be no issue or issues—including the crash. They weren’t. Also, somebody needs to bring up how —the exact mechanics of—an A of A system that gets 20* “off” on a three month old aircraft. Probe system damage? Lastly, doesn’t anybody do test flights anymore after this type maintenance, or is that “off the table” for LCC and/or ULCC carriers?

    • Answering the last part first, things break. Infant morality is as well known aspect of electronics. Good electronics tend to last forever, sometimes they do fairly early.

      I doubt the stall warning was going off as it rolled (will re-read) but it would activate on rotation.

      Keep in mind, Air Speed was finarky as well as altimeter.

      Flushing the system may have done more damage.

      The real question is why would you put this on an air4craf and not put it in the4 books and inform airlines?

      I am not saying the pilot did a good job, but I also insist they should not have been put in that place in the first place.

      While the Runaway Trim is the same solution, its no where near the same symptoms.

      And why was none of that passed on in the reports. Previous flight did deal with it, but they seem not to have a clue what it was.

      That goes back to they did not know it was there. You can bet the first crew (and the other flights with issues) all were scratching their heads.

      • But: 1) the plane had logged pretty nearly 800 flight hours, so not truly an “infant” electronics failure; 2) it’s gotta be a “world first” for 2 ATP—rated pilots to fly a 180 passenger mission with the stall warning blaring from (even after) takeoff till landing!; 3) I stand by my question: “No more test flights after major flight systems repairs?” (Not even once or twice around the pattern?); and 4) I still am wondering about the A of A probe/sensors—20* out of whack cause on captain’s side—hard landings, or what?

  8. Piffling typo,”into the see”
    What is a breakout?
    Would it be a good idea if mcas was just disabled in the event of the instruments disagreeing?I can’t see how it’s helpful any longer and it unlikely that the pilots will be trying to do anything racy without a very good reason.I don’t pretend to fully understand this subject ,I have only just grasped that the elevator and stabilizer are not the same thing,but I have learned a lot from reading these articles.

    • Grubbier:

      On a large air45caft, the stabilizer is the largest surface.

      Unlike a small aircraft, the WHOLE thing moves. That is the Trim that keeps getting mentioned.

      Elevators are the smaller surfaces the pilots use to move the nose up and down from a trimmed positions.

      It changes as CG changes (fuel burn off) pax load and cruise, climb or decent.

      Simply, as they are climbing, the pilot (if in manual mode) would trim the stabilizer with the large wheel (leverage) to make the controls light so he is not having to horse the wheel back and forth.

      Once in cruise, same thing, neutral trim so just a bit of elevator moves it up or down. Ditto a decent.

      Auto Pilot uses the stabilizer trim as does MCAS.

      In this case a single input causes it (currently) to react.

      As the stabilizer is so much larger, it can overcome the elevators controls. That is why Runaway Trim is such an issue, you have to stop that.

      I think Bjorn said you could counter full stabilizer trim with elevators as the stabilizer does not move as much.

      On a small aircraft, the stabilizer is fixed, the control is done with the elevator and trim is a small tap on the elevator.

      It gets into recognizing what the core issue is and stopping it.

      But with all that was going on too much input and did not get it.

      Its a shame they did not leave the flaps down and then just turn back.

      Once it stopped, even if not the exact right understanding, don’t mess with it and get it down.

      What none of us know (except Bjorn) is how we would have reacted in that situation.

      I had my trail by fire and passed. But if it was something else, I don’t know until I was there and happy I never got there again.

      • Got it wrong, it was previous flight. grrrr

        Read whole thing then comment.

      • Well, at least it wasn’t your “tail on fire”, and I’m sure you meant “trial by fire”. (LOL)

      • “On a large air45caft, the stabilizer is the largest surface.

        Unlike a small aircraft, the WHOLE thing moves. That is the Trim that keeps getting mentioned.”

        Isn’t it related to the design speed of aircraft instead of the size of an aircraft?

  9. The overall concern of mine is, we continually take control out of the pilot’s hands but still make him responsible for the outcome.
    Don’t you just love ungunears(sp)!!

    • That is somewhat valid though Boeing tends to allow the pilot to do things Airbus (in normal) would not.

      I think the biggest issues revolve around putting stuff in that has not been put through a scrub.

      We specify at what point the wing breaks and the G forces, engine failures with birds (updated now).

      Then Boeing is allowed to have one way of Auto Throttle working and Airbus another (I like Airbus that it comes back in regardless of mode at stall, altitude unless you turn it off)

      The recent crashes finally convinced the authorities that pilots need to be trained in how they understand the aircraft, not rote drills taking off and landing.

      Airlines (at least some) are allowing pilots to fly by hand when that was frowned on before.

      Unusual attitudes is being introduced.

      And things like Speed Removal at altitude in simluaror4 of course is introduced so they know how it feels to have a step down in the automation (Airbus) as well as what should be one of the routine memorized items (5 deg attitude and 85% thrust)

      Where I disagree with Airbus is they give all that automation, but in cruise where the only time you will have zero airspeed from one second to another is a bad pitot, they dump auto pilot, drop down a level in control laws and give it to the pilot.

      Why not simply have it move to 5 deg and 85% while announcing pitot issue?

      If you ran into a mountain at cruise nothing is going to change anything (possible, unlikely but you give control to a wrack).

      A 757 pilot going into Ireland did the opposite, Pitot froze, no speed (didn’t see if one or both) and he dumps the nose.

      Again, either you ran into a mountain (its over) or you have a pitot issue. Maintain exactly as is while you cross check.

      NTSB has cited Boeing for their FLCH Trap on the auto throttle, Boeing has not been forced to change it. The Asiana group did a god awfull job into SFO, but the trainee was used to Airbus where it would not do that.

      Back to, a pilot should not be put into a position where he kills the passengers (over stupid stuff like that).

      Agree on common standards for how that stuff all works (granted an old dog like the 737 is an oddity).

      Boeing saying it was the same as a Runaway Trim and it got in in the first place is astonishing to depressing.

  10. One thing jumped out at me, 22:20 departure.

    That is 8:30 pm local time and how much light is there ?

    • At Bali they took off from WADD (great name!) which was two hours after sunset so it was completely dark.

      • The Jakarta departure was 18:30 local time so getting dark or dark. What time I spent in the tropics the Sun just disapreared from one second to the next. Flight went to about 18:43, comments were they had a horizon to see but that may not be true and or what clouds involved.

        • 18:30 in Jakarta is definitely well past sunset.

          I should add; Jakarta metropolitan area emits a lot of light and Jakarta Bay and it’s coast line light up pretty well too. The flight path (according to https://m.youtube.com/watch?v=OH2KeMA1I4E) would suggest pilots in ideal circumstances (no clouds) could use that (no idea if perfect weather was the case)
          Of course that doesn’t include the obviously far from ideal circumstances of being in the cockpit of a plane that has a system you’re unaware off, that intervenes with (and overrides) your direct input to the stick because it thinks it’s about to stall while in reality the plane is in a dive (not sure if I paraphrased that correctly).

          • Forgot to add though the pilots would have been very familiar with the area the lid up metropolitan area could only give some sense of indication of horizon and not a an accurate one.

  11. Reading the Boeing bulletin is chilling.

    They continue to call it a Runway Trim Failure rather than an AOA failure.

    Then slather over it with all the aspects seen.

    AOA does not explain the Speed and Altimeter issues.

    None of the things manifest themselves until rotation.

    The MCAS does not kick in until flaps up and in manual (pilots should never fly in manual of course, they should always use autopilot)

    • Right. They’re basically saying it was just another runaway trim and the pilots didn’t do their job and crashed the plane.

      Sotto voce: you don’t need to know the details of what caused it and how our design contributed to it, although we will be fixing that soon…

  12. Kind of makes you wonder, if the AOA sensor is replaced, but the AOA indication remains the same as the previous flight, was the sensor actually responsible for the false reading

    • Tim: Likely not.

      The problems with electronics is a lot of things can cause a problem.

      So, they have checklists. Very likely they clear the fault because its on the ground not causing the fault.

      But missing a 20 deg difference in AOA? We have to see if it only showed up as speed was gained.

      What is MISSSING, is test of the device to prove its faulty.

      Replacing devices is the time honored (and likely in the manual) and works most of the time (but when it doesn’t?????

      Pulling the connections and reseating them is another. Ok, that fixed it. Well the fault went away.

      But, if the fault goes away anytime you reset the system?

      Yep, fake fix.

      But who cares, unless you add a system that is trying to kill you with all that.

  13. Where was the runaway stick shaker cutoff switch?
    Obviously the airplane was wrong in thinking it was about to stall and shaking the stick for two flights, one flight the entire time. If the pilots are supposed to know better than the machine, where was the cutoff?

    • Ted:

      That is turning off the automation period.

      Stick shaker is a symptom not a fatal issue.

      Runaway trim is a serious issue ergo the switches where they are (it can kill you and your passengers)

      Stick shaker won’t, annoying. But it just vibrates it does not take over the aircraft. Kill the trim and you can live with it even if unpleasantly.

      Add in a speed issue and a altitude issue to sort out and it trying to kill you and ……

  14. Its by now obvious that the fraudulent Indonesian Airline industry is trying to make Boeing accauntable for this crash rather focus their poor pilot training poor maintainance and huge number of aviation disasters which occurred in this country in the past . The 737 max is a reliable aircraft and still in his infancy with little or no complaints from other operators.

    • Alex:

      The aircraft should not do things the pilots are not told about.

      Yes one set of pilots handled it, note that they did not diagnose it or write it up for what it was though.

      The Maint people look to have followed the book.

      The book looks to me to be mislead as the only way to re-test is to fly. Put that in Boeing court as well.

      I have had occasion to follow the directions exactly and it did not fix.

      I see nothing about a follow up test of the components to prove it was bad (when a lot of things can do the same thing in the system)

      So, the pilots are not Chuck Yeager, likely your average pilots.

      There was one Chuck, and thousand and thousands upon pilots.

      Indonesia, Lion all have some blame, but you don’t kill 189 people hoping that you have Chuck at the controls. That is on Boeing.

      They don’t want to put in the book you need a test flight by your BEST pilots do they? Its the only way to confirm its fixed.

    • @Alex, any sources on Indonesian pilots being poorly trained?

      Apart from that, it’s a rather poor argument to blame poor pilot training when it seems to be directly linked to a new system Boeing doesn’t even think pilots should to know about, and the FAA considers the plane (MAX) to be flying the same as the previous model (NG), yet everything we’ve been reading lately suggests it’s quite different (I mean in that particular area).

      Sarcasm on.
      Maybe Boeing should only inform pilots from Indonesia and other equally “poorly trained” pilots about this system and keep all the not “poorly trained” pilots in the dark. Not like well trained pilots would need to know about it.
      Sarcasm off.

  15. Amazing indeed. After all this time, the OEMs still don’t give the pilots of civilian aircraft the benefit of AOA display. Why? I don’t know if that would have helped in this particular case, but isn’t it better to have this crucial piece of information than not have it? Why doesn’t FAA mandate it? What are they waiting for? Perhaps Bjorn could comment on this issue?

    That said, the AOA sensor was replaced and checked before the fatal flight, from what I understand. Correct me if I am wrong. If I am right, this suggests that the sensor was not at fault, but the computer digesting the sensor information. Could this have been some sort of a software bug, where the computer handling Captain’s sensors defaulted to some erroneous AOA value, causing 20 degree difference between the two AOA sensors? In normal straight flight (including takeoff and cruise but no turns say), shouldn’t the two computers have cross-checked the two AOA sensors before activating the fatal MCAS stabilizer trim? Why depend on one AOA sensor and its associated computer in straight flight, when you do not expect the two sensors to have different readings?

    I agree with most of the readers here that a pilot should never be put in a situation such as this. There is simply NO excuse for it. Systems should be built for the least skilled, not aces!!!

    • Kant: It could be anything in that sensing system. Loose connection (or corded) causing a high resistance, bad wiring, computer issues and or program.

      From what I see, the fault cleared, I don’t know when AOA goes active though.

      You can have a fault clear until it goes live again and its back.

      You can do all sorts of things, including feedback from the Artificial Horizon as its level and on the ground before rotation.

      The people who implemented put it in a non lethal category – so no cross check.

      Its a system failure at Boeing and FAA.

      As I have noted, if you reset a system often a fault will clear, until it becomes active again.

      So the drill down also has to account for that.

      Also keep in mind, Pitot Static system (where you get your speed and altitude from) are sensitive things.

      This ALSO was acting up. Also cleared by a procedure that has no follow up test. Yep we fixed it. Nope you did not.

      It has indications the whole Pilot side system had issues.

      Also note that the previous flight shifted to co pilot and then cross checked with the backup instrument to then put the right data (co pilot side) on the Captains display.

      I think some work is a mandatory check flight with a test crew, they don’t want to because of the time and cost issues.

  16. How often do aircraft indicate an incorrect stall? How many NG flights does the stick shaker go off when not stalled, or stay on the entire flight?
    Same with a 787 or A350, how many incorrect stall warnings?

    That seems like something that should be fullproof, and have a minimal occurrence. Is this just a casual routine problem on the 787 or A350? No big deal?

    • Ted: We would need to know how those systems work.

      As they are more advanced generation wise than the 737, they may well have better cross checks and lock out.

    • The AF A330 had a angle of attack sensor fault with one pilot pulling the stick hard to climb without the other knowing about it. There are other Aircraft types with AD’s to replace AoA sensors.
      From the ATWonline article the automated system seems to alternate between flights which AoA sensor it reads, the pilots actions during stick shaker looks to have caused an elevator disconnect having only one elevator fighting the MCAS system poiting nose down. I assume Boeing will revise the Failure Investigation Manual making sure test after AMM maintenance actions catch remaining faults in this system. An ejeted extra FDR&CWR floating on the Surface after the accident would help the investigations, adding cockpit video recordings in the same box would be a benefit to the investigators. Maybe a future requirement for all Airlines that ever had a crash?

  17. from what I get in the report and repair log is that the original AOA sensor was reading 20deg off, the first attempt at repair was to run a self test diag on the sensor and clean a connector.

    second fix was to install a new sensor, run the self test on the component and install, but no mention is made of verifying that the _system_ was receiving data from the sensor that made actual physical sense

    i.e. one guy manually moves the AOA sensor to different positions and another guy in the cockpit verifies that the AOA values agree with physical reality.

    question: is it possible to install the AOA sensor 20deg off from the intended alignment (or is it possible that the sensor within the sensor housing could have rotated 20 deg off the design orientation)?

    • Bilbo: Anything is possible.

      Thats why you have peoe like m to fix things.

      I recnly ran into somethign tht inherialy should ahve been imposisel.

      I had a sensing system that works from 6 volts to 48.

      On engine start, the battery output in my case drops to 18 (24 volt system) while its cranking.

      The last thing I ever expected nor was it in any book, was that the voltage tolerant system would fail and termini the crank.

      It took days going through each relay, board, connection, wire in the system to get down to that point to bypass it and confirm it was doing what it never should have been able to do.

      In this case it does not seem index is an issue as it was not delivered with a 20 deg AOA issue. It developed.

      So all we can say is that somewhere in that system something created a 20 deg AOA when it was not there.

      Wring, a chip, corrosion, a cold solder joint.

      We know where they need to look so that will be a take off item and scrutinized as to what went wrong with it.

      Due to damage and salt water they may never know.

      Engineers will be looking to see how it could happen.

  18. How often and how has the STS system failed on the NG? Maybe it is 100% reliable. If it got bad inputs, wouldn’t it do the opposite of what it is supposed to do on landings and takeoffs, which would be catastrophic?

    • We get down into levels of complexity and multiple computers (at least on the newer FBW aircraft)

      No single point of failure is supposed to cause a loss.

      This recent one from Peter Leems looks to have been assessed on the next level down of criticality.

      Ie, does not need redundancy as the pilots take care of it.

      While that is somewhat true – you should know about it so your first action is to stop it not have to figure out what it is and apply the same correction that is there for a different failure (when its commanded trim and not run a way then its a different failure even if the immediate correction is the same)

      If multiple computers are involved then there are cross checks.

      So then you drill down into what each of the systems consists of not just a block diagram but detailed.

      Fixes can include pilots shutting off automation though I don’t know if there is one that requires that as a first step.

      As generations of aircraft are more modern differences occur until you get to the full FBW (787 only I think) then likely pretty common.

      Some like Auto Throttle are the same but 737 may not have the FLCH feature for example.

  19. I finally saw mention that the Indonesian air safety authorities are looking into why there was/were no test flight(s) after days of issues and having to install a new flight critical A of A sensor, To me, this is a failure on Lion Air and Boeing. They don’t want to hear it, but maintenance test flights, not just ground electronic tests are the way to go on critical flight systems. Nothing like two to three times around the pattern (and maybe a climb up and back to thirty five thousand cruise also) to settle “it’s airworthy”. Also, I’m guessing Airbus is just as guilty with overeliance on ground electronics on their a/c and a/c maintenance. (Murphy’s just not biting them in the a$s this time.) And, just where are those lauded, major “governmental guardians” (i.e. FAA and EASA) on this issue?

    • One of my key questions. What is the process and procedure for confirming repair.

      Critical ones as you note should require a test flight

      Clearly the MCAS was deemed non single point of failure critical (no cross check, purely pilot action)

      Does that apply to the Air Speed an altimeters and AOA failures?

  20. I can sort of see the logic of not performing a test flight for a product as mature as the 737(perhaps the MAX wasn’t quite as mature as they thought)because if it’s not acceptable to kill 189 people, it’s not really acceptable to kill the test crew and people on the ground either.If you have any doubts that the aircraft is airworthy, it shouldn’t fly at all.The airline has to put its trust in its maintainers and the original certification programme.

    • Someone has to fly it at some point.

      A test crew would be full alert and turn off automation.

      Clearly you have to do tests, but some of those require a complete takeout of the aircraft systems to convince it its i flight and no one is set for that other than Boeing at Renton.

  21. Let me get this, the left elevator is linked to the captain’s yoke, and the right elevator is linked to the copilot’s yoke. They are coupled, but can be decoupled by breakout force on the y0ke?

    Did the EFS elevator feel system contribute to an unnecessary decoupling?

    Is there a shutoff for the EFS, just like the stab trim, when the system is determined to be in error?

    What is the definition of “runaway trim”? The motor running in one direction without stopping, the typical definition of runaway. Or, a more broad definition, any errors in the operation of the auto trim, an uncontrolled motor, the speed trim system ostensibly malfunctioning, or the MCAS ostensibly malfunctioning?
    I would argue semantics, and call that ‘power trim malfunction’, or something more appropriate.

    • Hello Ted,

      Regarding: “What is the definition of “runaway trim”?”

      See below for the trigger condition for calling the “Runaway Stabilizer” checklist from a circa 2002 Continental Airlines 737-300/500/700/800/900 Flight Manual. Revision date for this checklist is 11-15-02.

      “This condition is recognized by continuing rotation of the stabilizer trim wheel in a manner not appropriate for flight conditions.”

      Although the control wheel trim switch, autopilot, speed trim system, or a wiring or motor short, could all cause the stabilizer to move in ” a manner not appropriate for flight conditions”, there are not separate checklists for all possible causes of a “Runaway Stabilzer”. There is one checklist to use to take control of the stabilizer if you decide that it is, for whatever reason or cause, doing something that you don’t want or like.

      Question: Was the stabilizer on the Lion Air accident flight moving in “a manner not appropriate for flight conditions”?

      If it was, then why was this checklist not called?

      Finding the particular defective component, wiring bundle, or bad line of software code that caused a particular problem is the job of mechanics and engineers. Pilots will not often have time for this type of troubleshooting in flight, and need checklists organized by the observed problem with generic solutions for the problem, not 20 different checklists dealing separately with all different possible causes of the problem.

      Here is the rest of the checklist. I don’t have access to a MAX flight manual; however, the existing MAX checklist that the FAA AD highlighted, was highly similar.

      “Maintain normal flight attitude by moving control column smoothly in opposite direction to runaway. Stabilizer brake should engage.

      Control Column……………………………………………………………HOLD FIRMLY
      Autopilot (If Engaged) ………………………………………………………DISENGAGE
      Do not re-engage the autopilot.

      IF Runaway Continues:
      Stabilizer Trim Cutout Switches ……………………………………….CUTOUT
      Continued trimming opposite to an electric trim runaway may result in
      overheating and/or stalling of the stabilizer trim motor. In the unlikely
      event that both stabilizer brake systems have malfunctioned, placing
      the stabilizer trim cutout switches to cutout will have no effect on the
      runaway. Control column displacement with no trim input can cause
      air loads to aggravate the runaway condition.

      IF Runaway Continues:
      Stabilizer Trim Wheel……………………………………GRASP & HOLD
      If positioning the stabilizer trim cutout switches to cutout does not
      stop the runaway, stabilizer travel can be stopped by grabbing and
      holding the stabilizer trim wheel.

      Stabilizer …………………………………………………..TRIM MANUALLY
      Anticipate trim requirements.

      Complete IN RANGE, APPROACH, and LANDING
      CHECKLISTS.

      Establish proper airspeed and establish an in-trim airspeed early
      on final approach.”

      • As for what the checklist is named. I think that is an issue of potential interest to English and Philosophy professors but no importance to 737 pilots.

        What is of high importance to 737 pilots is to know that if the stabilizer is doing something you don’t like, for whatever reason, you should execute the following actions in the following order.

        DISENGAGE THE AUTOPILOT.

        If that doesn’t make the stabilizer behave.

        FLIP THE CUTOUT SWITCHES.

        If that doesn’t work.

        GRAB THE TRIM WHEEL AND STOP IT FROM TURNING.

        If you cannot execute the above actions in 20 seconds from memory on a simulator checkride, you should failed on the checkride and removed from flight duty until you have completed remedial training and passed a repeat checkride.

        Once you have safely landed, you can engage in debates with mechanics and engineers, if you are so inclined, about whether the cause was, a bad autopilot, STS malfunction, a short in a control wheel trim switch, a wiring short, a bad motor, bad MCAS software, cosmic rays from outer space corrupting the flight control computer memory, or something else; however, finding the root cause is really the mechanic’s and engineer’s job, not yours.

        • See below for the revised 737 MAX Runaway Stabilizer Procedure from the recent 737-8/9 AD.

          The major steps are the same as in the Continental 737 Classic and NG manual from year 2002 that I quoted above, i.e. turn off the autopilot, if that doesn’t work flip the cutout switches, if that doesn’t work grab the trim wheel, and GASP!, trim manually.

          “Required by AD 2018-23-51

          Runaway Stabilizer

          Disengage autopilot and control airplane pitch attitude with control column and main electric trim as required. If relaxing the column causes the trim to move, set stabilizer trim switches to CUTOUT. If runaway continues, hold the stabilizer trim wheel against rotation and trim the airplane manually.

          Note: The 737-8/-9 uses a Flight Control Computer command of pitch trim to improve longitudinal handling characteristics. In the event of erroneous Angle of Attack (AOA) input, the pitch trim system can trim the stabilizer nose down in increments lasting up to 10 seconds.

          In the event an uncommanded nose down stabilizer trim is experienced on the 737-8/-9, in conjunction with one or more of the indications or effects listed below, do the existing AFM Runaway Stabilizer procedure above, ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight.

          An erroneous AOA input can cause some or all of the following indications and effects:
          • Continuous or intermittent stick shaker on the affected side only.
          • Minimum speed bar (red and black) on the affected side only.
          • Increasing nose down control forces.
          • IAS DISAGREE alert.
          • ALT DISAGREE alert.
          • AOA DISAGREE alert (if the option is installed).
          • FEEL DIFF PRESS light.
          • Autopilot may disengage.
          • Inability to engage autopilot.

          Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT.

          http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/0/83ec7f95f3e5bfbd8625833e0070a070/$FILE/2018-23-51_Emergency.pdf

          • “Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT.”

            I suppose this means the motor can be overpowered by hands on the trim wheel.

          • Hello Ted,

            Regarding: “I suppose this means the motor can be overpowered by hands on the trim wheel.”

            It is true that the manual trim wheel overrides all other inputs; however, I kind of half remember that this may be through some type of clutch mechanism rather than through directly overpowering the motor if it is running. The following is from the circa 2002 Continental Airlines 737 Classic and NG manual that I quoted above.

            “Stabilizer Trim Wheel
            · Provides for manual operation of stabilizer.
            · Overrides any other stabilizer trim inputs.
            · Rotates when stabilizer is in motion.
            Note: Handle should be folded inside stabilizer trim wheel for normal operation.”

          • I found a reference for my vague recollection that manual trim wheel movements on 737’s override the trim motors through a clutch mechanism, rather than directly.

            “The stabiliser trim wheels are mechanically connected through cables to the aft cable drum. When pilots turn the trim wheels, the aft cable drum turns a jackscrew through a gearbox. When the jackscrew turns, the stabiliser changes its pitch.

            During electrical trim, stabiliser trim actuator (multi-speed DC motor powered by AC transfer bus 2) turns the jackscrew through the stabiliser gearbox. The actuator also back drives the stabiliser trim wheels (trim wheels move whenever jackscrew turns regardless of manual or electric operation).

            The gearbox consists of two ratchet type brakes and mechanical clutch. The clutch lets the stabiliser manual trim wheel input override the stabiliser trim actuator input.”

            https://www.facebook.com/737handbook/posts/stabiliser-trim-system-and-runaway-stabiliserhorizontal-stabiliser-controls-the-/1074500519285886/

        • “This condition is recognized by continuing rotation of the stabilizer trim wheel in a manner not appropriate for flight conditions.”

          Having read that, I agree that it clearly covers all conditions.
          Also, I’d never known about trim control, but the fact that there are giant wheels to grab on to, is an intuitive design cue.

          • Hello Ted,

            See the video at the link below for a demonstration of grabbing the trim wheel to stop stabilizer movement on a 737.

            https://www.youtube.com/watch?v=cQirIH_DuAs

            Can someone explain to me a reason why grabbing the trim wheel, as long called for by 737 runaway stabilizer checklists from the very first 737 models, would not have stopped the Lion Air Accident? Over a span of several minutes of fighting for pitch control, should a properly trained crew have tried this?

          • @ap robert,I would have thought that it would be so intuitive that it’s a bit like putting your arms out when falling over.There has to be more to it than that. Maybe they had become so confused that they started to believe that the aircraft knew best or there’s some other factor.

          • Grabbing a rapidly spinning wheel is a recipe for a broken hand.

            Your first action wold be to turn off the drive system.

  22. Runaway trim is when the trim moves in either direction UN-commanded.

    In this case, its not, it was commanded.

    Easy enough to see/feel occur if no other stuff present.

    Obviously not so clear when stall, stick shaker kicks in.

    Yes, left and right can de-couple and I believe you can have one up and one down (read the Egyptian 767 crash off the US report)

    And you may get issues at high speeds in low atmosphere on controls.

    • What I (and probably a lot of other people)am wondering, is how there can be a stage after cut out?The odds of having got to this stage ought to be lottery winning.

      • A guess is you can get it reset by re-sink.

        But that would require a auto tr4im removal and adjustment to a position where you would not make the nose go down more.

  23. While this has some errors its worth reading

    https://mybroadband.co.za/news/science/287784-the-dark-side-of-aeroplane-automation.html

    One part is the issue with automation and it being the initial trigger. Its not these are no easily handled, its been clear for some time that they aren’t being handled and the need now being implemented the training has to change for the old days to the new days.

    I disagree with Cox in that if the reaction is not correct, then the people who die have been let down by them not being trained so they react correctly and that is a reality training based issue. You ignore backup horns because they are constant background. Same with stall squawking at you. Find out what works, boht down to the only issue and how pilots react and train them to do so correctly. Clearly what we had failed and continues to do so. Letting Boeing add in a system with no documentation in pilots manuals is another system failure from Boeing on up through the FAA

    If I understand it, Brazil did make them put in in the manual (and trained on it?) so it was there in the certification’s, EASA missed it as did Japan (the big three in the cert world)

    This is a very good piece and out of Fiji times of all things. Others would be well advised.

    https://www.fijitimes.com/optional-warning-light-could-have-aided-lion-air-engineers-before-crash-experts/

    So others at least picked the alert light, so even that was an option

  24. Well, this is intresting, in a lot of ways.

    Still it’s not clear why the plane crashed in the end.
    You could have trimed the problem away manually, and it did work well at least to a certain point , otherwise the plane would have crashed shortly after takeoff.
    So why did it crash at all?

    Looks like there are many flaws and issues that would have avoided this accident.
    1. the previous crew flying their mission with a stall warning and a trim issue. You should abort your mission and land that plane asap.
    2. the previous crew not beeing precise on their report, they should have mentioned the trim issue and that they fixed the issue with deactivating auto trim. Of course they might have thought that the problem was just the diverting numbers.
    3. the maintenance: they were unable to find and fix the problem, and it does look like they just changed sensors. But how could they test and find them working?
    4. the maintenance and the actualy crew who were not really clear about the issue. As a PIC i would have checked what kind of problem was around and how it was solved.

    Therer are many more to come, I don’t know the system well enough to blame Boeing, but it looks like there’s a major share on them too.

    Still, the reason of the actual crash is not yet namend.
    It seems to be natural if your nose goes down to trim manually the oppsoit way and pull your stick.
    Why did taht plane crash?

    • Sash:

      Its easy to say as PIC what you think you would have done, but with your job on the line and an airlines attitude, loosing your job is a human reaction (you are at the pointy end and you are sure you can handle things)

      My guess he felt it was fixed and the previous report lacked the detail to ask more question even if inclined.

      Add in loss of at least one of the Pitot Static systems and an aircraft actively trying to kill you…… and you don’t know about that new bug (er feature according to Boeing you didn’t need to know about)

      In this case the crew never got past the crisis to figure out what worked. So yes there is a pilot issue involved here.

      With 4 flights on the books and no turn back, there is an airline culture issue.

      Boeing cute trick with the MCAS took that over the edge.

      It crashed because a number of realities crossed at the wrong time.

      Each of which should be fixed.

    • The aircraft was not airworthy for the last 4 flights.

      MCAS aside, that is a severe airline issue.

  25. Maybe they should have one button, incorrect stall alert, that shuts off the stick shaker, the Electronic Feel System, and the MCAS. If, the pilots are charged with knowing when the aircraft is in error.

    Why were they fighting the EFS in a dive? And, if the EFS in any way contributed to the loss of one elevator, that’s a problem.

    • Ted:

      You do need to read up on basic aircraft.

      You never want to turn off a SAFETY. That is what the stick shaker is.

      Each system is selectively capable of being shut off for a reason. This is not the only way an aircraft can get into a crisis.

      None of the exclude Boeing blame for the MCAS and no mention of it so the pilots stand some chance of realizing what is going on and dealing with it.

      You also miss that there was a Pitot Static issue that fed false info to the PIC side for both speed and altidue.

      If you had read up on cross instrument procedures, you would know that those are two immediate references that you use to determine what the aircraft is doing.

      The crew failed to use the full spectrum of cross check, but there was a huge amount of confusion.

      Reacting to stalls is extremely important – having it even say stall and the stick shaker alone would be a confusing event with speed confirming stall, the altitude possibly confirming stall and the control system doing what you thought it could not do.

      • The stick shaker may just be a distraction, so no need for a way to turn it off. The previous flight should have realized the seriousness of it and turned around, and this issue should have been 100% fixed before next flight.

        I would say that the EFS does need a shutoff switch, if it can be wrong, which it was.

        Looking at the AF 447 crash, I thought the sidestick design was crap, since the pilots weren’t on the same page, and CRM doesn’t work with two people not knowing what controls are being input. Of course somebody berated me as ignorant, but I stand by my thoughts that it is a poor design. The sticks should be linked and the inputs in obvious display and easy to ascertain, just as a yoke functions.

  26. The above discussions do not see the forest (safety culture) because they are concentrating on the trees (hardware). The above discussions address the symptoms, not the cause of the accident. The following are the prime symptoms:
    1) Self-imposed financial priorities which put profit over the lives- Lion Air had taken on the largest debt ever for the purchase of Airbus and Boeing planes. The airline forced itself to cut corners on safety
    2) Regulatory oversight-The NY Times describes when the government overruled a Regulator and permitted a plane with deficient equipment to take off and meet its schedule. Regulators were/are understaffed and did/do impose safety requirements.
    3) Identification, resolution and repair of deficiencies-A good safe aviation program should encourage finding deficiencies, and resolving them. It is reported that hardware deficiencies were resolved by moving the faulty equipment to another plane. Deficiencies include both hardware, and more importantly programmatic shortcomings.
    4) Control of changes-If a change is not controlled and adequately implemented, consequences can be serious. The pilots did not understand the modifications of the 737 Max
    The information cited in the above points is largely taken from recent articles in the NY Times.
    The above and the previous discussions address contributing deficiencies, but the root cause is that there was no good safety culture. The lives of passenger and crew were not the prime priority.

    • Howard: I disagree that other aspects are missed.

      I have mentioned that its pilots and airlines issues as well as have others.

      Clearly there was a breakdown. Clearly Lion is severely at fault for their process and procedures.

      However, separately there was a push over the edge with MCAS.

      The Pilots are not blameless, I do understand the confusion, but they did not use the full resources to at least start to stabilize.

      The hardware did fail in multiple areas that cause the fog of war. Pilots side Pitot Static system clearly failed as did the MCAS in kicking in.

      They had a clear alert that they could stop the MCAS even if they did not know what it was with flaps down. They did so and then reverted.

      What I can’t say is that Pilot training issue or just pilot deficiency (good pilot training would catch and correct that).

      But I will also add what I have said before, no system should kill passengers and then blame the people at the pointy end of the spear.

      189 people were killed due to the system.

      The system consists of people issues (Airline culture etc) as well as pilots but in the end hardware took it over the edge.

      Each and every aspect of that has to be dealt with to preclude (maybe) future crashes though I have not a lot of faith.

      We can’t force a fix on Indonesia corruption and what looks to be free wheeling practices by Lion air.

      We can smack Boeing big time.

  27. Something non pilot should keep in mind.

    There an aspect of flying that is drilled into you. It has several Commandments. All around STALL.

    1. Thou shall not stall (short of training and deliberately which teach you both how to recover but also what it takes to stall and what to avoid)
    Stall an aircraft at 500 feet and you are not going to recover.

    2. If you stall, push the nose down no matter how close to terrain you are. They now call it Unloading the wing.

    3. Many people cannot push the nose down, its an evolutionary reaction to pull back. Much like the Prime Directive, you have that drilled into you (I knew one pilot who had to do that and he said it was the hardest thing he ever did, but he did do it despite his body screaming at him to pull back)

    The background is you aircraft should NEVER say its stalled unless it is. In that, the Pilots of Lyon Air were severely let down by the system.

    The other Commandment or Prime Directive is cross check your instruments.

    And what does the Pilot see when he goes to cross check?

    Low Airspeed (I have not seen the altitude readout but that was bogus as well).

    Low Airspeed is one major factor in STALL.

    His artificial horizon indicates ok (not a given, there are a lot of combinations that can look ok and be stalled) its an indicator not a given.

    So to simply be pulling back on the controls at that point is a major bust, but they seem to have realized that stall was bogus contrary to all their training.

    Clearly the previous crew overcame that, but not all crews are equal and it should never come down to that.

    Both the Lion Air and Boeing put 189 people in that position where it spiraled out of control.

    The FAA was lax as were most authorities approving (Brazil aside apparently they caught it)

    Boeing put it in to appease the FAA. Obviously they had skin in the game to minimize it.

    https://www.wsj.com/articles/behind-boeings-decision-to-omit-details-on-safety-system-in-lion-air-crash-from-manual-1544025884

    Lion Air is trying to blame it all on Boeing, Boeing should accept the blame, but Lion Air also is fully complicit and the end result is 189 people dead.

  28. Pingback: Para liberar Boeing 737 Max no Brasil, Anac exigiu treinamento que EUA e Europa julgaram desnecessário – Curiosidade e Tecnologia

Leave a Reply

Your email address will not be published. Required fields are marked *