We have explored the aircraft registered as PK-LQP in quite some detail, looking at the sequence of events leading up to the crash of Lion Air flight 610.

The Maintenance
The Faulty AOA Sensor
The AOA Disagree Alert

These pieces explore how the aircraft went into service with a faulty AOA sensor. It also shows issues with Lion Air’s maintenance culture, in which pilots were somewhat slapdash in their logging of faults while maintenance was slow to respond with fixes and deferred the work to be done at other airports.

We followed the story of the ongoing issues with the Boeing 737 MAX registered as PK-LQP. We saw how an AOA sensor was repaired but miscalibrated to be 21° out of alignment before being sent to Denpasar. And we witnessed the evidence that the engineer at Denpasar could not have properly tested his installation of the AOA sensor before putting the aircraft back in service.

The aircraft was returned to service on the evening of the 28th of October, the night before the crash, for an already-late scheduled flight from Denpasar to Jakarta.

The captain and the engineer discussed the overnight maintenance that was done.The engineer explained that the aircraft had displayed SPD and ALT flags on the captain’s (left-side) Primary Flight Display which signify that there has been a data failure. He told the flight crew that in order to rectify the issue, the left AOA sensor had been replaced and tested. The captain, who had experienced this fault in the aircraft previously, was happy that the issue had been resolved.

There were three pilots in the cockpit that day: the captain, who was Pilot Flying, the first officer, who was Pilot Monitoring, and a deadheading first officer who needed to reposition to Jakarta. All three pilots were rated for the Boeing 737-8 (MAX).

As a part of the crew briefing, the captain mentioned the maintenance work and that the left AOA sensor had been replaced.

The passenger flight was cleared for take-off three hours after its originally scheduled departure time. There were seven crew (two pilots, five cabin crew) and 182 passengers on board.

Directly after the flight crew had retracted the landing gear, the Takeoff Configuration Warning sounded. This is an alert that some part of the aircraft is not configured correctly for take-off.

(Side note: We recently discussed a Take-Off Configuration Warning in a Boeing 737-900 taking off from Kathmandu, where the rejected take-off ended with the aircraft going off the runway. In that instance, it was caused by a slight misalignment of the brale lever switch which caused an incorrect alert that the speed brake was not properly stowed.)

There’s no reason that the Takeoff Configuration Warning would sound after take-off, it should only alert while the wheels were on the ground. There is no clear action for this scenario.

There wasn’t any time to think about it, though. As the 737 climbed through 400 feet, the captain noticed the IAS DISAGREE warning appear on his Primary Flight Display. The disagree warnings are to inform the flight crew that data being collected from multiple sources did not all match, in this case, the indicated airspeed data.

As we now know, the left AOA sensor was approximately 21° higher than the right AOA sensor, which was causing an AOA DISAGREE. This misaligned sensor should have been detected during the installation test at Denpasar but it wasn’t.

The Boeing Flight Crew Operations Manual, which had been delivered to Lion Air in August 2018 documented the situation if the left and right angle of attack vanes disagreed (did not match). Normally, the the AOA DISAGREE alert would light up, but as we’ve seen, Boeing had discovered a year earlier that the software behind the AOA DISAGREE alert incorrectly required the operator to have the optional AOA indicator, which Lion Air had not purchased. As a result, the Lion Air Boeing 737s did not have a working AOA DISAGREE alert.

The manual notes that airspeed errors and the IAS DISAGREE alert may occur in conjunction with the AOA DISAGREE alert. This is what was happening that night in the 737. However, the flight crew weren’t getting the primary information: the AOA DISAGREE alert, because it was being wrongly suppressed by the software.

The aircraft was now in worse shape than it had been in the first place and the flight crew were not given the information they needed to understand what was wrong.

The stick shaker activated, a warning that the aircraft’s angle of attack is dangerously high and that the pilot must take urgent action to reduce it by adding power and adjusting the pitch nose-down. The stick shaker is driven by the AOA sensors and serves as a poor man’s AOA indicator. The only real time that the pilot needs to know the angle of attack is if the aircraft is approaching a stall. This is why the angle of attack indicators were optional on the 737 MAX.

However, the aircraft’s angle of attack was completely normal and the thrust was still set for take-off. The same misaligned AOA sensor was causing the stick shaker to vibrate, even though the right-side sensor showed the AOA as within limits. Either sensor could trigger the stall warning.

The captain ensured that he was maintaining a pitch of 15° and kept the high-powered take-off thrust, which he would normally reduce once established in the climb. The stick shaker continued to vibrate the controls.

The captain checked the first officer’s primary flight display and quickly came to the conclusion that his own might be displaying bad information. He handed control to the first officer and checked the standby instruments against the pilot flight displays, which confirmed that the first officer’s primary flight display was correct and the captain’s display was wrong.

He called out the 737 airspeed unreliable memory items, one of a number of “non-normal checklists” which pilots are asked to memorise for use in emergencies. This involves turning off the autopilot and the autothrottle, setting the flight director switches to OFF and configuring the aircraft such that the pilots can use look-up tables to ensure they have the correct pitch and thrust for landing without needing to know their airspeed.

Airspeed is a vital piece of information for maintaining safe flight and the memory items are to quickly stabilise the aircraft before doing anything else. The pilot has been trained to understand that various other pieces of information are unreliable under these conditions, depending on the cause, including the stick-shaker activation. There’s no way to get rid of these alerts and warnings, one has to simply disregard them.

After the captain completed the memory items, he reached for the Quick Reference Handbook. The dead-heading pilot who was seated in the jumpseat suddenly pointed out that the aircraft was pitched nose-down instead of established in the climb. The captain commanded the first officer to pitch up and to follow the flight director. The first officer complained that the control column was very heavy and the captain advised him to retrim the aircraft as necessary.

Trimming an aircraft is modifying the control surfaces such that the pilot does not need to exert pressure to continue flying in a specific attitude. Pitch trim is the most common, allowing the aircraft to be set up to maintain a specific pitch (nose-up, nose-down or straight-and-level) for the current aircraft configuration. Heavy controls is a clear indication that an aircraft is out of trim.

It strikes me here that the captain was giving very basic instructions (maintain the climb, retrim as necessary), although its not clear whether the first officer was panicking or the captain just thought he was.

The captain called a PAN-PAN. A PAN-PAN is an alert to ATC that a flight crew have an urgent situation requiring assistance, whereas a MAYDAY distress call would be a demand for immediate action in an emergency situation.

The captain told the Denspasar Approach controller that they had suffered an instrument failure and he requested that they be cleared to maintain runway heading rather than follow the departure route.

The controller asked if the flight was returning to Denpasar and the captain told him to standby. At this stage, he clearly had not yet decided what to do.

The first officer had attempted to trim the aircraft but once he stopped applying trim using the switch, the captain saw that the stabiliser trim automatically trimmed the aircraft nose down again. After the stabiliser trim had trimmed nose down three times, the first officer complained that the control column was too heavy to hold back: he was using physical strength to maintain the climb.

The captain now had clear evidence that the stabiliser trim had trimmed the aircraft nose down without any input from the first officer. He suspected a condition known as “runaway stabiliser”.

The tail has a horizontal stabiliser which provides pitch stability to the aircraft and it has hinged elevators in order to control the pitch of the aircraft. When the pilot pushes or pulls the control column, cables move the elevators via a hydraulic system and the aircraft pitches down or up. The stabiliser on the 737 is powered with a small motor and linked to the trim wheel. Trim inputs to the stabiliser can be done by the pilot flying or through the aircraft systems, such as the autopilot and the flight envelope protection. There are some circumstances where pilots may feel that the trim is working against them, most notably in the case of a runaway stabiliser. The most common example of a runaway stabiliser is when the trim wheel begins to start rotating without stopping, steadily increasing the trim and thus modifying the pitch of the aircraft.

The captain performed the 737 Runaway Stabilizer memory items. These start with holding the control column firmly and to disconnect the autopilot, both of which had already happened. If the runway does not stop, then the next step is to set the STAB TRIM switches to CUTOUT, that is, to disable the stabiliser trim switches completely.

This is what the captain did and the flight data recorder shows that the automatic trim movement stopped as he positioned the STAB TRIM switch to CUT OUT.

He then re-engaged the STAB TRIM switches, setting them to NORMAL, and almost immediately the stabiliser trim began to trim the aircraft nose down. He moved the STAB TRIM switches back to CUT OUT and left them there, relying on manual trim for the rest of the flight.

The captain ran through three non-normal checklists connected to the issues that he was seeing: Airspeed Unreliable, Altitude DISAGREE and Runaway Stabilizer. None of these checklists advised that he should break off the flight or land at the nearest suitable airport. The captain decided that they should continue the flight to Jakarta.

This was a questionable decision. They had no autopilot and no autothrottle and the captain had false information on his instrument display. As pilot monitoring, he had to rely on his first officer’s display for information. The stick shaker was continuing to vibrate the flight controls so violently that it was hard for the flight crew to hear each other.

The captain did not report these problems to the Lion Air ground station at Denpasar. Instead, he contacted Denpasar Approach to say that they had resolved the situation and that he wished to continue the flight at FL290 (29,000 feet). The controller cleared the flight to FL280 and asked the flight crew to contact the Makassar Area Control Centre for further air traffic control services.

The Makassar Area Control Centre controller asked the flight to climb to FL380 (38,000 feet). A few minutes later, the captain replied with a PAN-PAN call that they were experiencing an instrument failure and to request that they maintain FL280.

The controller agreed and passed them to Upper West Semarang for further services.

When the captain checked in with Upper West Semarang, the controller asked him the nature of the instrument failure. The captain replied that the altimeter and autopilot had failed and asked the controller to relay that information to Jakarta as they would require an uninterrupted descent. The controller did this.

The senior cabin crew member came into the cockpit for an update and the captain reported that the fasten seat belt sign would be left on for the full flight.

The flight crew received the Jakarta weather information: light rain with a visibility of 5,000 metres. The report mentions here again that the pilots were under high stress and struggling to communicate over the noise of the stick shaker.

They received the straight-in approach and the Boeing 737 MAX landed safely at Jakarta with no further issues.

After they landed, the digital flight data recorder logged that the STAB TRIM switches were moved from CUTOUT back to NORMAL.

Once on the ground, the captain told the engineer about the problems that they had experienced and wrote in the Aircraft Flight Maintenance Log that they the lights for IAS (indicated airspeed) DISAGREE, ALT (altitude) DISAGREE and FEEL DIFF PRESS (Feel Differential Pressure) had illuminated during flight.

He didn’t mention the stick shaker activation, later saying that he presumed that this was just a side effect of the other issues.

He also didn’t mention that he needed to set the STAB TRIM switches to CUTOUT during the flight but had returned them to NORMAL after landing.

Following procedure, he reported the occurrence to the company as an Air Safety Report. His report is as follows:

Airspeed unreliable and ALT Disagree shown after takeoff, STS also running to the wrong direction, suspected because of speed difference, identified that CAPT instrument was unreliable and handover control to FO. Continue NNC of Airspeed Unreliable and ALT Disagree. Decide to continue flying to CGK at FL280, landed safely runway 25L.

That’s a lot of jargon so here is a quick translation into everyday speech:

After take-off, the airspeed unreliable and the altitude disagree warnings appeared. The Speed Trim System was running in the wrong direction, which I suspect was because of the speed difference. I identified that the captain-side instruments were unreliable and handed over control of the flight to the first officer. I followed the non-normal checklists of airspeed unreliable and altitude disagree and then decided to continue flying to Jakarta at 28,000 feet. We landed safely on runway 25 left.

The captain submitted his Air Safety Report in the early hours of the morning on the 29th of October.

The engineer at Jakarta flushed the left pitot and the static Air Data Module. He ran an operational test, whicvh passed. Then he cleaned an electrical connector and ran a self-test, which passed. At 02:30 on the 29th, he released the aircraft back into service, still with the miscalibrated AOA sensor.

Lion Air flight 610, the now-famous passenger flight from Jakarta to Pangkal Pinang was scheduled to depart with new crew in the same aircraft at 0545. The pre-flight briefing was normal but did not include any discussion of that morning’s entry in the Aircraft Flight and Maintenance Log. The flight departed with a half hour delay at 06:20 with 189 souls on board.

The Air Safety Report submitted by the captain of the previous flight was acknowledged by Lion Air’s Safety and Security department at 08:30 local time.

PK-LQP had been released a second time with a faulty AOA sensor to a new flight crew who would have to work out for themselves what was wrong with the aircraft.

Every safety net had failed.