29 Oct 2018 - PK-LQP 737 MAX-8 Loss of Control after take-off
On 29 October 2018, a Lion Air 737 MAX-8, PK-LQP (43000/7058) FF 30/7/18, departed Jakarta (WIII), Indonesia, runway 25L, at 23:21 UTC (06:21 local time).
After two minutes the plot from flight radar (see below) shows a drop in altitude from 2150ft to 1600ft and increase in speed to 334kts G/S. 3 minutes after takeoff, the crew requested to return to Jakarta; ATC granted the request.
The aircraft turned to the North East heading out over the Java Sea and climbed to 5,400ft but not holding a steady altitude. It then descended over the sea and was lost from radar 12 minutes after departure.
The two month old aircraft broke up and sank on impact. The wreckage settled under 30m of water. Flight JT610 was enroute from Jakarta to Pangkal Pinang with 181 passengers and 8 crew members on board. There were no survivors.
The weather conditions were good and it was daylight.
The KNKT reported on 9 Nov that the angle of attack sensor had been replaced the previous day (28 Oct) following pilot reports of unreliable airspeed. The pilots of the previous flight experienced a 20 dgeree difference in the LH AOA sensor.
The CVR was recovered on 14 Jan under 8m of mud and 30m of water thanks to the pinger still being active after 73 days.
*** Updated 23 Nov 2020 ***
The final report was published by the KNKT on 25 Oct 2019. Significant extracts are as follows:
On 29 October 2018, at about 0632 Local Time (23:32 UTC 28 October 2018), a PT Lion Mentari Airlines (Lion Air) Boeing 737-8 (MAX) aircraft registered PK-LQP, was being operated as a scheduled passenger flight from Soekarno-Hatta International Airport (WIII), Jakarta with intended destination of Depati Amir Airport (WIPK), Pangkal Pinang, when the aircraft disappeared from radar after informing Air Traffic Controller (ATCo) that they had flight control, altitude and airspeed issues. The aircraft impacted the water in Tanjung Karawang, West Java, all person on board perished and the aircraft destroyed.
On 26 October 2018, the SPD (speed) and ALT (altimeter) flags on the Captain’s primary flight display first occurred on the flight from Tianjin, China to Manado, Indonesia. Following reoccurrence of these problems, the left angle of attack (AOA) sensor was replaced in Denpasar on 28 October 2018.
The installed left AOA sensor had a 21° bias which was undetected during the installation test in Denpasar. The erroneous AOA resulted in different indications during the flight from Denpasar to Jakarta, including IAS (indicated airspeed) DISAGREE, ALT (altitude) DISAGREE, FEEL DIFF PRESS (feel differential pressure) light, activations of Maneuvering Characteristics Augmentation System (MCAS) and left control column stick shaker which were active throughout the flight. The flight crew was able to stop the repetitive MCAS activation by switched the stabilizer trim to cut out.
After landed in Jakarta, the flight crew reported some malfunctions, but did not include the activation of stick shaker and STAB TRIM to CUT OUT. The AOA DISAGREE alert was not available on the aircraft therefore, the flight crew did not report it. The reported problem would only be able to rectify by performing tasks of AOA Disagree.
The following morning on 29 October 2019, the aircraft was operated from Jakarta with intended destination of Depati Amir Airport, Pangkal Pinang. According to the DFDR and the CVR, the flight had same problems as previous flight from Denpasar to Jakarta.
The flight crew started the IAS DISAGREE Non-Normal Checklist (NNC), but did not identify the runaway stabilizer. The multiple alerts, repetitive MCAS activations, and distractions related to numerous ATC communications contributed to the flight crew difficulties to control the aircraft.
The MCAS was a new feature introduced on the Boeing 737-8 (MAX) to enhance pitch characteristics with flaps up during manual flight in elevated angles of attack. The investigation considered that the design and certification of this feature was inadequate. The aircraft flight manual and flight crew training did not include information about MCAS.
On 10 March 2019, similar accident occurred in Ethiopia involved a Boeing 737-8 (MAX) experiencing erroneous of AOA (details here).
As the result of the investigation safety actions have been taken by related parties. KNKT issued safety recommendations to address safety issues identified in this investigation to Lion Air, Batam Aero Technic, Airnav Indonesia, Boeing Company, Xtra Aerospace, Indonesia DGCA, and Federal Aviation Administration (FAA).
The DFDR parameters graphs of the accident flight showed:
1. Since the beginning of the plot, the DFDR recorded differences between the left and right AOA. The AOA data considered invalid when the aircraft was not moving. The AOA differences between left and right were constant, about 21°, from the time the aircraft accelerated for take-off until the end of recording.
2. During rotation, the aircraft lifted off then briefly touched prior to becoming fully airborne.
3. There were no recorded indications of autopilot engagement during the flight.
4. The computed airspeed and altitude parameters showed differences (split) between left and right from the time the aircraft became airborne until the end of recording.
5. For most of the flight, the recorded altitude fluctuated around 5,000 feet and never maintained a constant altitude.
6. The left control column stick shaker activated just after the aircraft became airborne. It temporarily stopped about 2322 UTC when the aircraft descended with flaps extended. About 15 seconds later the left control column stick shaker activated again and was continuously active until the end of recording.
7. About 2322 UTC the flaps were selected to zero and few seconds later, the automatic trim down command triggered by MCAS became active. The automatic trim down command stopped when the trim manual up activated.
8. About 2325 UTC, the flaps were selected to zero and remained at zero until the end of recording. The automatic trim down activated repeatedly until the end of the recording, and was generally followed by manual electric trim up. From the time the flaps were set to zero until the end of the recording there were at least 26 automatic trim down commands and at least 34 manual electric trim up inputs.
9. During the activation of the manual electric trim up and automatic trim down, corresponding changes in the pitch trim position were recorded. For most of the accident flight, the pitch trim position was above 5 units after the activations of manual electric trim up and decreased after the activation of automatic trim down.
10. From about 2331 UTC until the end of the recording, the activations of manual electric trim up were shorter than the activations of automatic trim down and the pitch trim position gradually decreased to near zero at the end of recording. When the pitch trim position was about 1.5 units, the aircraft started to descend rapidly and the air speed and engine power (N1) increased.
11. At 23:31:54 UTC, the DFDR stopped recording.
Findings are statements of all significant conditions, events or circumstances in the accident sequence. The findings are significant steps in the accident sequence, but they are not always causal, or indicate deficiencies. Some findings point out the conditions that pre-existed the accident sequence, but they are usually essential to the understanding of the occurrence, usually in chronological order. The KNKT identified findings as follows:
1. MCAS is designed to function only during manual flight (autopilot not engaged), with the aircraft’s flaps up, at an elevated AOA. As the development of the 737-8 (MAX) progressed, the MCAS function was expanded to low Mach numbers and increased to maximum MCAS command limit of 2.5 of stabilizer movement.
2. During the Functional Hazard Analysis (FHA), unintended MCAS-commanded stabilizer movement was considered a failure condition with Major effect in the normal flight envelope. The assessment of Major did not require Boeing to more rigorously analyze the failure condition in the safety analysis using Failure Modes and Effects Analysis (FMEA) and Fault Tree Analysis (FTA), as these are only required for Hazardous or Catastrophic failure conditions.
3. Uncommanded MCAS function was considered Major during the FHA. Boeing reasoned that such a failure could be countered by using elevator alone. In addition, stabilizer trim is available to offload column forces, and stabilizer cutout is also available but not required to counter failure.
4. FMEA would have been able to identify single-point and latent failures which have significant effects as in the case of MCAS design. It also provides significant insight into means for detecting identified failures, flight crew impact on resolution of failure effect, maintenance impact on isolation of failure and corresponding restitution of system.
5. Boeing conducted the FHA assessment based on the FAA guidance and was also based on an assumption that the flight crew was highly reliable to respond correctly and in time within 3 seconds. The assessment was that each MCAS input could be controlled with control column alone and subsequently re-trimmed to zero column force while maintaining flight path.
6. The flight crew did not react to MCAS activation but to the increasing force on the control column. Since the flight crew initially countered the MCAS command using control column, the longer response time for making electric stabilizer trim inputs was understandable.
7. During the accident and previous LNI043 flights, the flight crew initially responded by pulling back on the control column, however, they did not consistently trim out the resulting column forces as had been assumed. As a result the Boeing assumption was different from the flight crew behavior in responding to MCAS activation.
8. During FHA, the simulator test had never considered a scenario in which the MCAS activation allowed the stabilizer movement to reach the maximum MCAS limit of 2.5 degrees. Repetitive MCAS activations without adequate trim reaction by the flight crew would make the stabilizer move to maximum deflection and escalate the flight crew workload and hence failure effects should have been reconsidered. Therefore, their combined flight deck effects were not evaluated.
9. In the event of multiple MCAS activations with repeated electric trim inputs by flight crew without sufficient response to return the aircraft to a trimmed state, the control column force to maintain level flight could eventually increase to a level where control forces alone may not be adequate to control the aircraft. The cumulative mis-trim could not be countered by using elevator alone which is contrary to the Boeing assumption during FHA.
10. Any out of trim condition which is not properly corrected would lead the flight crew into a situation that makes it more difficult for them to maintain desired attitude of the aircraft. The flight crews in both the accident flight and the previous flight had difficulty maintaining flight path during multiple MCAS activations.
11. The procedure of runaway stabilizer was not reintroduced during transition training and there was no immediate indication available to the flight crew to be able to directly correlate the uncommanded nose down stabilizer to the procedure. Therefore, the assumption of relying on trained crew procedures to implement memory items was inappropriate.
12. During the accident flight, multiple alerts and indications occured which increased the flight crews workload. This obscured the problem and the flight crew could not arrive at a solution during the initial or subsequent automatic aircraft nose down stabilizer trim inputs, such as performing the runaway stabilizer procedure or continuing to use electric trim to reduce column forces and maintain level flight.
13. In the event of MCAS activation with manual electric trim inputs by the flight crew, the MCAS function will reset which can lead to subsequent MCAS activations. To recover, the flight crew has 3 options to respond, if one of these 3 responses is not used, it may result in a miss-trimmed condition that cannot be controlled.
14. The flight crew of LNI043 eventually observed and recognized the un-commanded stabilizer movement and moved the stabilizer trim cutout switches to the cutout position. Stopping the stabilizer movement enabled the flight crew to continue the flight using manual trim wheel to control stabilizer position. On that flight, stabilizer cutout was used to counter the repetitive MCAS-commanded stabilizer. Boeing reasoning that the stabilizer cutout is available but not required is incorrect.
15. Boeing considered that the loss of one AOA and erroneous AOA as two independent events with distinct probabilities. The combined failure event probability was assessed as beyond extremely improbable, hence complying with the safety requirements for the Air Data System. However, the design of MCAS relying on input from a single AOA sensor, made this Flight Control System susceptible to a single failure of AOA malfunction.
16. During the single and multiple failure analysis from the air data system worst case scenario of “failure of one AOA followed by erroneous AOA”, Boeing concluded that the effect would be hazardous until the flight crew recognized the problem and took appropriate action to mitigate it. Since the training or the guidance for actions taken in such situation were not provided, the effect category should have remained hazardous.
17. Since the FCC controlling the MCAS is dependent on a single AOA source, the MCAS contribution to cumulative AOA effects should have been assessed.
18. The MCAS software uses input from a single AOA sensor only. Certain failures or anomalies of the AOA sensor corresponding to the master FCC controlling STS can generate an unintended activation of MCAS. Anticipated flight crew response including aircraft nose up (ANU) electric trim commands (which reset MCAS) may cause the flight crew difficultly in controlling the aircraft.
19. The MCAS architecture with redundant AOA inputs for MCAS could have been considered but was not required based on the FHA classification of Major.
20. If the probability of an undesirable failure condition is not below the maximum allowable probability for that category of hazard, redesign of the system should be considered. If the uncommanded MCAS failure condition had been assessed as more severe than Major, the decision to rely on single AOA sensor should have been avoided.
21. The DFDR data indicated that during the last phase of the flight, the aircraft descended and could not be controlled. Column forces exceeded 100 pounds, which is more than the 75-pound limit set by the regulation (14 CFR 25.143).
22. Pulling back on the column normally interrupts any electric stabilizer aircraft nose-down command, but for the 737-8 (MAX) with MCAS operating, that control column cutout function is disabled.
23. During the accident flight erroneous inputs, as a result of the misaligned resolvers, from the AOA sensor resulted in several fault messages (IAS DISAGREE, ALT DISAGREE on the PFDs, and Feel Differential Pressure light) and activation of MCAS that affected the flight crew’s understanding and awareness of the situation.
24. The stick shaker activated continuously after lift-off and the noise could have interfered with the flight crew hearing the sound of the stabilizer trim wheel spinning during MCAS operations. Therefore, the movement of stabilizer wheel might not have been recognized by the flight crew.
25. The aircraft design should provide the flight crew with information and alerts to help them understand the system and know how to resolve potential issues.
26. Boeing did not submit the required documentation and the FAA did not sufficiently oversee Boeing ODA. Without documenting the updated analysis in the stabilizer SSA document, the FAA flight control systems specialists may not have been aware of the design change.
27. Boeing considered that MCAS function is automatic, the procedure required to respond to any MCAS function was no different than the existing procedures and that crews were not expected to encounter MCAS in normal operation therefor Boeing did not consider the failure scenario seen on the accident flight. The investigation believes that the effect of erroneous MCAS function was startling to the flight crews.
28. The investigation believes that flight crew should have been made aware of MCAS which would have provided them with awareness of the system and increase their chances of being able to mitigate the consequences of multiple activations in the accident scenario.
29. Without understanding of MCAS and reactivation after release the electric trim, the flight crew was running out of time to find a solution before the repetitive MCAS activations without fully retrimming the aircraft placed the aircraft into in an extreme nose-down attitude that the flight crew was unable to recover from.
30. Flight crew training would have supported the recognition of abnormal situations and appropriate flight crew action. Boeing did not provide information and additional training requirements for the 737-8 (MAX) since the condition was considered similar to previous 737 models.
31. The aircraft should have included the intended AOA DISAGREE alert message functionally, which was installed on 737 NG aircraft. Boeing and the FAA should ensure that new and changed aircraft design are properly described, analyzed, and certified.
32. The absence of an AOA Disagree message made it more difficult for the flight crew to diagnose the failure and for maintenance to diagnose and correct the failure.
33. For the safety assessment of aircraft systems, the 14 FAR 25.1309 set the requirements for the design and installation of systems which include analysis of effects and probabilities of single, multiple and combined failures of systems. It assumed that flight crew would correctly respond to flight conditions in case of such failures. Human error is not included in the probability analysis, even though the flight crew is often used as a means to mitigate a failure condition.
34. When performing safety assessments to comply with 14 FAR 25.1309, Boeing followed the procedures set in FAA AC 25.1309-1A and the SAE ARP 4761 as the acceptable means of compliance. When doing the analysis, Boeing assumed that the flight crew are completely reliable and would respond correctly and appropriately to the situations in time. During the accident and previous LNI043 flights, some of these assumptions were incorrect, since the flight crew responded differently from what was expected.
35. 14 FAR 25.671 (c) requires that probable malfunctions of the flight control system must be capable of being readily counteracted by the flight crew. This necessitates that normal flight crew should be able to readily identify problems and respond quickly to mitigate them. However, during the accident flight multiple alerts and indications concealed the actual problem and made it difficult for the flight crew to understand and mitigate it.
36. The Flight Standardization Board (FSB) process for the Boeing 737-8 (MAX) utilized airline line pilots to help ensure the requirements are operationally representative. The FAA and OEMs should re-evaluate their assumptions for what constitutes an average flight crew’s basic skill and what level of systems knowledge a ‘properly trained average pilot’ has when encountering failures.
37. In the accident flight, the system malfunction led to a series of aircraft and flight crew interactions which the flight crew did not understand or know how to resolve. It is the flight crew response assumptions in the initial design process which, coupled with the repetitive MCAS activations, turned out to be incorrect and inconsistent with the FHA classification of Major.
38. The first problem reported on PK-LQP aircraft of SPD and ALT flags appeared on Captain’s PFD occurred on 26 October 2018 during the flight from Tianjin to Manado and reappeared 3 times within 5 flight sectors
39. The SPD and ALT flag did not occur on the flight from Denpasar to Lombok and return. This was consistent with the result of AOA sensor examination which indicated that the resolver 2 became unreliable during cold temperature. 40. The engineer in Manado suggested to the flight crew to continue the flight as problem rectification would be better to be performed in Denpasar and considering that the SPD and ALT flags had no longer appeared on the Captain’s PFD. This indicated that the aircraft was released with known possible recurring problem. 41. On the flight from Manado to Denpasar on 28 October 2018, the DFDR recorded the A/T disengaged on takeoff roll and the SPD and ALT flags on the captain’s PFD most likely had appeared after the engine start. The altimeter and speed indicator are airworthiness related instruments and must be serviceable for dispatch. The decision to continue the flight was contrary to the company procedure.
42. The engineer in Denpasar considered that the problem had appeared repeatedly and decided to replace the left AOA sensor. Replacement of AOA sensor proved to be the solution to rectify the SPD and ALT flags that were reported to have appeared on the Captain’s PFD, however the installed AOA sensor was misaligned by about 21° and resulted in different problems.
43. The Boeing test result indicated that a misaligned AOA sensor would not pass the installation test as the AOA values shown on the SMYD computer were out of tolerance and “AOA SENSR INVALID” message appeared in the SMYD BITE module. This test and subsequent testing verified that the alternate method of the installation test could identify a 20 or 21° bias in the AOA sensor.
44. Comparing the results of the installation test in Denpasar and Boeing, the investigation could not determine that the AOA sensor installation test conducted in Denpasar with any certainty.
45. The BAT LMPM required the engineer to record the test values to ensure that the test results were within tolerance. The engineer did not record the value of the AOA angle deflection during the AOA sensor installation test. Therefore, neither BAT nor Lion Air identified that the documentation had not been filled out.
46. After LNI043 was airborne, the left control column stick shaker was active and several messages appeared. The Captain of LNI043 was aware to the aircraft condition after discussion with the engineer in Denpasar. This awareness helped the Captain to make proper problem identification.
47. The Captain action of transferring the control prior to crosscheck of the instruments may have indicated that the Captain generally was aware of the repetitive previous problem of SPD and ALT flags and the replacement of the left AOA sensor on this aircraft.
48. The LNI043 flight crew performed NNC of Runaway Stabilizer Trim by selecting the STAB TRIM switches to cut-out, which resulted in termination of AND activations by MCAS, and the aircraft became under control with consequences of inability to engage the autopilot, and requirement for manual operation of stabilizer trim by hand.
49. The Captain’s decision to continue to the destination was based on the fact that a requirement to “land-at-the-nearest-suitable-airport” in the three Non-Normal-Checklists was absent.
50. The Captain of LNI043 felt confident to continue the flight to the destination because the aircraft was controllable and the expected weather along the route and at the destination was good.
51. The LNI043 flight crew decision to continue with stick shaker active is not common in comparison to previous events of erroneous stick shaker. When combined with the runaway stabilizer situation recognized by the flight crew, the decision to continue was highly unusual.
52. During the descent to destination they requested uninterrupted descent path profile. This action suggested that the flight crew were aware of their existing flight condition (continuous stick shaker, manual flying, manual trimming, FO PFD was the primary instrument) required a simplified flight path management until approach and landing.
53. During flight, the Captain of LNI043 kept the fasten seat belt sign on and asked the deadheading flight crew to assist the cockpit tasks. These actions indicated that the Captain was aware of the need to use all available resources to alleviate the matter to complete the flight to the destination, despite the increased workload and stressful situation.
54. The AFML entry for LNI043, which did not contain additional details about what was experienced, was not in accordance with company guidance provided in OM-Part A, Section 11.4.9 which lists reportable events to include “Warning or alert, including flight control warnings, door warnings, stall warning (stick-shaker), fire/smoke/fumes warning.”
55. The SS Directorate did not notice the occurrence since the report was filed outside normal office hours and the report to SS Directorate was not processed until the office hours on the following day.
56. The insufficient SMS training and inability of the employees to identify the hazard might also be indicated by the incomplete post-flight report of the problems that occurred on LNI043. The incomplete report became a hazard as the known or suspected defects were not reported which might make the engineer unable to properly maintain the airworthiness of the aircraft.
57. Content of the report did not trigger the Duty Management Pilot to assess this as a Serious Incident and enable a safety investigation. The risk of the problems that occurred on the flight LNI043 were not assessed to be considered as a hazard on the subsequent flight.
58. The LNI043 flight that experienced multiple malfunctions were considered caused or could have caused difficulties in controlling the aircraft. According to the ICAO Annex 13, CASR part 830 and OM-part A, the flight is classified as serious incident which required investigation by the KNKT in accordance with the Aviation Law Number 1 of 2009 and Government Decree Number 62 of 2013.
59. The definition of an aircraft repetitive problem was different between Lion Air CMM and BAT AMOQSM. This difference indicated that the Lion Air did not monitor the repetitive problem policy of the BAT as a subcontracted entity.
60. The requirement to report all known and suspected defects is very critical for engineering to be able to maintain the airworthiness of the aircraft.
61. The fault code was not documented in the AFML. The engineer did not record the maintenance message that appeared in the OMF in the AFML. Being unaware of the maintenance message and the fault code, this would increase the difficulty for trouble shooting by the engineer.
62. The IFIM tasks of “ALT DISAGREE” and “IAS DISAGREE” have repetition on the leak test in steps (3) and (4) as they are referring to the same AMM tasks. This repetition was inefficiency and does not contribute to the problem solving.
63. The inhibited AOA DISAGREE message contributed to the inability of the engineer to rectify the problems that occurred on the LNI043 flight which were caused by AOA sensor bias.
64. The lack of an AOA DISAGREE message did not match the Boeing system description that was the basis for certifying the aircraft design. The software not having the intended functionality was not detected by Boeing nor the FAA during development and certification of the 737-8 MAX before the aircraft had entered service.
65. During the LNI610 flight preparation, the CVR did not record flight crew discussion about previous aircraft problems recorded in the AFML. This might have made the flight crew of LNI610 would not be aware of aircraft problems that might reappear during flight, including the stick shaker activation and uncommanded AND trim. This would lead to the inability of the flight crew to predict and be prepared to mitigate the events that might occur.
66. Just after liftoff, the left stick shaker activated and numerous messages on the PFD were displayed, repetitive MCAS activation after the flaps were retracted and the ATCo communication increased the flight crew workload.
67. The FO asked the controller of the aircraft altitude and the indicated speed on the ATC radar display in an attempt to obtain another source of information. However, the ATC radar receives altitude data transmitted by the aircraft therefore, no additional data may be acquired. Being unable to determine reliable altitude and airspeed might increase stress to the flight crew.
68. The inability for the FO to perform memory items and locate the checklist in the QRH in a timely manner indicated that the FO was not familiar with the NNC. This condition was reappearance of misidentifying NNC which showed on the FO’s training records.
69. Despite the flight crew’s attempt to execute the NNC, due to increased workload, and distractions from the ATC communication, the NNC was unable to be completed in that situation. The unfinished NNC made it difficult for the flight crew of LNI610 to understand the aircraft problem and how to mitigate the problem.
70. The reappearance of difficulty in aircraft handling identified during training in the accident flight indicated that the Lion Air training rehearsal was not effective.
71. The controller provided eight heading instructions after the flight crew reported that the aircraft was experiencing a flight control problem, which was not considered as an emergency condition according to ATS SOP of AirNav Indonesia branch JATSC. There was also no objection by the flight crew to the heading instructions and the flight crew did not declare an emergency. These conditions increased the flight crew workload.
72. The absence of a declaration of urgency (PAN PAN) or emergency (MAYDAY), or asking for special handling, resulted in the ATCo not prioritizing that flight. With priority, ATC would not require LNI610 to maneuver repeatedly.
73. The AOA DISAGREE message was inhibited on the accident aircraft therefore, flight crews would not be aware that this message would not appear if the AOA DISAGREE conditions were met. This would contribute to flight crew being denied valid information about abnormal conditions being faced and lead to a significant reduction in situational awareness by the flight crew.
74. No information about MCAS was given in the flight crew manuals and MCAS was not included in the flight crew training. These made the flight crew unaware of the MCAS system and its effects. There were no procedures for mitigation in response to erroneous AOA.
75. Both flight crew of LNI610 being preoccupied with individual tasks indicated that the crew coordination was not well performed. The Captain and FO did not have a shared mental model of the situation as exhibited by their lack of clear and effective communication. Most of the components of effective crew coordination were not achieved, resulting in failure to achieve the common goal of flying the aircraft safely.
76. During the multiple MCAS activations, the Captain managed to control the aircraft altitude. The Captain did not verbalize to the FO the difficulty in controlling the aircraft and the need for repeated aircraft nose up trim. The FO was preoccupied with completing the NNC and not monitoring the flight progress. Subsequently, the FO did not provide adequate electric trim to counter multiple MCAS activations.
77. The requirement to describe specific handling situation to the flight crew receiving the control was not required per Lion Air procedure or Indonesia requirement. The absence of Captain’s specific description contributed to the FO’s difficulty to understand the situation and may have contributed to his inability to mitigate the problem.
78. The content of the manual of Lion Air and BAT contain several inconsistencies, incompleteness, and unsynchronized procedures.
79. The investigation found that the engineers were prone to entering the problem symptom reported by the flight crew in the IFIM first instead of reviewing the OMF maintenance message. Conducting this method might lead the engineers into the inappropriate rectification task.
80. The investigation found that all AFML pages received by the investigation did not contain fault codes. The absence of the fault code reported by the flight crew may increase the workload of the engineer and prolong the rectification process.
81. The investigation considered that the amount of time to cover the hazard identification topic in the SMS training syllabus was insufficient. This may reduce the ability of employees to define and report a hazard.
82. A subsequent comparison of the accuracy specifications found that the Peak SRI-201B API accuracy met the requirement stated on the CMM revision 8. The investigation did not find a written instruction to operate the Peak Electronics SRI-201B API.
83. Despite the lack of API specific written instructions for the alternate equipment, Xtra Aerospace nevertheless obtained acceptance of their API equipment equivalency report from the FAA FSDO. The lack of an API written procedure was not detected by the FAA’s FSDO. This indicates inadequacy of FAA oversight.
84. The Xtra Aerospace visit concluded that performing the required testing and calibration defined in CMM Revision 8 using the Peak API could potentially introduce a bias into both resolvers if the REL/ABS (Relative/Absolute) switch on the Peak Electronics API was inadvertently positioned to REL.
85. The OMF has the history page which contains record of the aircraft problems which can be utilized as a source for aircraft problem monitoring. The BAT has not utilized the OMF information as the source of aircraft problem monitoring.
86. On the subsequent flight, a 21 difference between left and right AOA sensors was recorded on the DFDR, commencing shortly after the takeoff roll was initiated. This immediate 21 delta indicated that the AOA sensor was most likely improperly calibrated at Xtra Aerospace.
87. As noted, utilization of the Peak Model SRI-201B API by Xtra Aerospace for the test and calibration of the 0861FL1 AOA sensor should have required a written procedure to specify the proper position of the REL/ABS switch.
88. The aircraft was equipped with an airframe-mounted low frequency underwater locator beacon (ULB) which operated at a frequency of 8.8 kHz. The beacon was mounted on the forward side of the nose pressure bulkhead. During the search phase, multiple surveys were conducted to detect a signal at 8.8 kHz, however no such signals were detected in the area where wreckage was recovered.
89. On 10 March 2019, an accident related to failure of an AOA sensor occurred involving a Boeing 737-8 (MAX) registered ET-AVJ operated by Ethiopian Airlines for scheduled passenger flight from Addis Ababa Bole International Airport (HAAB), Ethiopia to Jomo Kenyatta International Airport (HKJK), Kenya with flight number ET-302.
Contributing factors defines as actions, omissions, events, conditions, or a combination thereof, which, if eliminated, avoided or absent, would have reduced the probability of the accident or incident occurring, or mitigated the severity of the consequences of the accident or incident. The presentation is based on chronological order and not to show the degree of contribution.
1. During the design and certification of the Boeing 737-8 (MAX), assumptions were made about flight crew response to malfunctions which, even though consistent with current industry guidelines, turned out to be incorrect.
2. Based on the incorrect assumptions about flight crew response and an incomplete review of associated multiple flight deck effects, MCAS’s reliance on a single sensor was deemed appropriate and met all certification requirements.
3. MCAS was designed to rely on a single AOA sensor, making it vulnerable to erroneous input from that sensor.
4. The absence of guidance on MCAS or more detailed use of trim in the flight manuals and in flight crew training, made it more difficult for flight crews to properly respond to uncommanded MCAS.
5. The AOA DISAGREE alert was not correctly enabled during Boeing 737-8 (MAX) development. As a result, it did not appear during flight with the mis-calibrated AOA sensor, could not be documented by the flight crew and was therefore not available to help maintenance identify the mis-calibrated AOA sensor.
6. The replacement AOA sensor that was installed on the accident aircraft had been mis-calibrated during an earlier repair. This mis-calibration was not detected during the repair.
7. The investigation could not determine that the installation test of the AOA sensor was performed properly. The mis-calibration was not detected.
8. Lack of documentation in the aircraft flight and maintenance log about the continuous stick shaker and use of the Runaway Stabilizer NNC meant that information was not available to the maintenance crew in Jakarta nor was it available to the accident crew, making it more difficult for each to take the appropriate actions.
9. The multiple alerts, repetitive MCAS activations, and distractions related to numerous ATC communications were not able to be effectively managed. This was caused by the difficulty of the situation and performance in manual handling, NNC execution, and flight crew communication, leading to ineffective CRM application and workload management. These performances had previously been identified during training and reappeared during the accident flight.
On 18 Sep 2019, the KNKT said that the final report will be published in the first half of November. “The draft was already sent to the relevant parties on August 24, 2019,” KNKT spokesman Anggo Anurogo said in a statement. “The parties have 60 days to respond to the final draft.”
Reports from leaked copies of the draft report say that the KNKT has cited failures in the MAX design and oversight as contributing to the accident. The report also blames pilot error and maintenance issues for the crash.
The KNKT released their Preliminary Report on 28 Nov 2018
According to factual information during the investigation, the KNKT identified findings as follows:
According to Bloomberg, an off-duty pilot in the flightdeck helped the crew disable the Stab Trim as the MCAS kicked in.
This is an alleged copy of the maintenance report that is circulating the internet. It is unconfirmed.
"Airspeed unreliable and alt disagree shown after take off. STS was also running to the wrong direction, suspected because of speed difference. Identified that CAPT instrument was unreliable and handover control to FO. Continue NNC of Airspeed Unreliable and ALT disagree. Decide to continue flying to CGK at FL280, landed safely rwy 25L"
On 7 Nov 2018 the FAA issue an Emergency AD (2018-23-51) and Boeing issue an Ops Manual Bulletin (TBC-19) for MAX Runaway Stabilizer procedure directing operators to “existing flight crew procedures" to address circumstances involving erroneous angle-of-attack sensor information.
FAA Emergency AD 2018-23-51 - This emergency AD was prompted by analysis performed by the manufacturer showing that if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer. This condition, if not addressed, could cause the flight crew to have difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain.
Ops Manual Bulletin TBC-19
This is a copy of the bulletin, it has a different reference (MLI-15) because it is with a different airline; TBC = The Boeing Company
On 22 Nov 2018 the KNKT released a presentation in Indonesian which included various FDR printouts. It showed that the Captains AoA indicated 20 degrees more than the F/Os AoA triggering the left stick shaker. There then followed various automatic nose down inputs which are presumed to be from MCAS. These inputs were counteracted by the crew with nose up trim until they ran out of trim authority.