Lion Air flight 610 : The Previous Flight
We have explored the aircraft registered as PK-LQP in quite some detail, looking at the sequence of events leading up to the crash of Lion Air flight 610.
The Faulty AOA Sensor
The AOA Disagree Alert
These pieces explore how the aircraft went into service with a faulty AOA sensor. It also shows issues with Lion Air’s maintenance culture, in which pilots were somewhat slapdash in their logging of faults while maintenance was slow to respond with fixes and deferred the work to be done at other airports.
We followed the story of the ongoing issues with the Boeing 737 MAX registered as PK-LQP. We saw how an AOA sensor was repaired but miscalibrated to be 21° out of alignment before being sent to Denpasar. And we witnessed the evidence that the engineer at Denpasar could not have properly tested his installation of the AOA sensor before putting the aircraft back in service.
The aircraft was returned to service on the evening of the 28th of October, the night before the crash, for an already-late scheduled flight from Denpasar to Jakarta.
The captain and the engineer discussed the overnight maintenance that was done.The engineer explained that the aircraft had displayed SPD and ALT flags on the captain’s (left-side) Primary Flight Display which signify that there has been a data failure. He told the flight crew that in order to rectify the issue, the left AOA sensor had been replaced and tested. The captain, who had experienced this fault in the aircraft previously, was happy that the issue had been resolved.
There were three pilots in the cockpit that day: the captain, who was Pilot Flying, the first officer, who was Pilot Monitoring, and a deadheading first officer who needed to reposition to Jakarta. All three pilots were rated for the Boeing 737-8 (MAX).
As a part of the crew briefing, the captain mentioned the maintenance work and that the left AOA sensor had been replaced.
The passenger flight was cleared for take-off three hours after its originally scheduled departure time. There were seven crew (two pilots, five cabin crew) and 182 passengers on board.
Directly after the flight crew had retracted the landing gear, the Takeoff Configuration Warning sounded. This is an alert that some part of the aircraft is not configured correctly for take-off.
(Side note: We recently discussed a Take-Off Configuration Warning in a Boeing 737-900 taking off from Kathmandu, where the rejected take-off ended with the aircraft going off the runway. In that instance, it was caused by a slight misalignment of the brale lever switch which caused an incorrect alert that the speed brake was not properly stowed.)
There’s no reason that the Takeoff Configuration Warning would sound after take-off, it should only alert while the wheels were on the ground. There is no clear action for this scenario.
There wasn’t any time to think about it, though. As the 737 climbed through 400 feet, the captain noticed the IAS DISAGREE warning appear on his Primary Flight Display. The disagree warnings are to inform the flight crew that data being collected from multiple sources did not all match, in this case, the indicated airspeed data.
As we now know, the left AOA sensor was approximately 21° higher than the right AOA sensor, which was causing an AOA DISAGREE. This misaligned sensor should have been detected during the installation test at Denpasar but it wasn’t.
The Boeing Flight Crew Operations Manual, which had been delivered to Lion Air in August 2018 documented the situation if the left and right angle of attack vanes disagreed (did not match). Normally, the the AOA DISAGREE alert would light up, but as we’ve seen, Boeing had discovered a year earlier that the software behind the AOA DISAGREE alert incorrectly required the operator to have the optional AOA indicator, which Lion Air had not purchased. As a result, the Lion Air Boeing 737s did not have a working AOA DISAGREE alert.
The manual notes that airspeed errors and the IAS DISAGREE alert may occur in conjunction with the AOA DISAGREE alert. This is what was happening that night in the 737. However, the flight crew weren’t getting the primary information: the AOA DISAGREE alert, because it was being wrongly suppressed by the software.
The aircraft was now in worse shape than it had been in the first place and the flight crew were not given the information they needed to understand what was wrong.
The stick shaker activated, a warning that the aircraft’s angle of attack is dangerously high and that the pilot must take urgent action to reduce it by adding power and adjusting the pitch nose-down. The stick shaker is driven by the AOA sensors and serves as a poor man’s AOA indicator. The only real time that the pilot needs to know the angle of attack is if the aircraft is approaching a stall. This is why the angle of attack indicators were optional on the 737 MAX.
However, the aircraft’s angle of attack was completely normal and the thrust was still set for take-off. The same misaligned AOA sensor was causing the stick shaker to vibrate, even though the right-side sensor showed the AOA as within limits. Either sensor could trigger the stall warning.
The captain ensured that he was maintaining a pitch of 15° and kept the high-powered take-off thrust, which he would normally reduce once established in the climb. The stick shaker continued to vibrate the controls.
The captain checked the first officer’s primary flight display and quickly came to the conclusion that his own might be displaying bad information. He handed control to the first officer and checked the standby instruments against the pilot flight displays, which confirmed that the first officer’s primary flight display was correct and the captain’s display was wrong.
He called out the 737 airspeed unreliable memory items, one of a number of “non-normal checklists” which pilots are asked to memorise for use in emergencies. This involves turning off the autopilot and the autothrottle, setting the flight director switches to OFF and configuring the aircraft such that the pilots can use look-up tables to ensure they have the correct pitch and thrust for landing without needing to know their airspeed.
Airspeed is a vital piece of information for maintaining safe flight and the memory items are to quickly stabilise the aircraft before doing anything else. The pilot has been trained to understand that various other pieces of information are unreliable under these conditions, depending on the cause, including the stick-shaker activation. There’s no way to get rid of these alerts and warnings, one has to simply disregard them.
After the captain completed the memory items, he reached for the Quick Reference Handbook. The dead-heading pilot who was seated in the jumpseat suddenly pointed out that the aircraft was pitched nose-down instead of established in the climb. The captain commanded the first officer to pitch up and to follow the flight director. The first officer complained that the control column was very heavy and the captain advised him to retrim the aircraft as necessary.
Trimming an aircraft is modifying the control surfaces such that the pilot does not need to exert pressure to continue flying in a specific attitude. Pitch trim is the most common, allowing the aircraft to be set up to maintain a specific pitch (nose-up, nose-down or straight-and-level) for the current aircraft configuration. Heavy controls is a clear indication that an aircraft is out of trim.
It strikes me here that the captain was giving very basic instructions (maintain the climb, retrim as necessary), although its not clear whether the first officer was panicking or the captain just thought he was.
The captain called a PAN-PAN. A PAN-PAN is an alert to ATC that a flight crew have an urgent situation requiring assistance, whereas a MAYDAY distress call would be a demand for immediate action in an emergency situation.
The captain told the Denspasar Approach controller that they had suffered an instrument failure and he requested that they be cleared to maintain runway heading rather than follow the departure route.
The controller asked if the flight was returning to Denpasar and the captain told him to standby. At this stage, he clearly had not yet decided what to do.
The first officer had attempted to trim the aircraft but once he stopped applying trim using the switch, the captain saw that the stabiliser trim automatically trimmed the aircraft nose down again. After the stabiliser trim had trimmed nose down three times, the first officer complained that the control column was too heavy to hold back: he was using physical strength to maintain the climb.
The captain now had clear evidence that the stabiliser trim had trimmed the aircraft nose down without any input from the first officer. He suspected a condition known as “runaway stabiliser”.
The tail has a horizontal stabiliser which provides pitch stability to the aircraft and it has hinged elevators in order to control the pitch of the aircraft. When the pilot pushes or pulls the control column, cables move the elevators via a hydraulic system and the aircraft pitches down or up. The stabiliser on the 737 is powered with a small motor and linked to the trim wheel. Trim inputs to the stabiliser can be done by the pilot flying or through the aircraft systems, such as the autopilot and the flight envelope protection. There are some circumstances where pilots may feel that the trim is working against them, most notably in the case of a runaway stabiliser. The most common example of a runaway stabiliser is when the trim wheel begins to start rotating without stopping, steadily increasing the trim and thus modifying the pitch of the aircraft.
The captain performed the 737 Runaway Stabilizer memory items. These start with holding the control column firmly and to disconnect the autopilot, both of which had already happened. If the runway does not stop, then the next step is to set the STAB TRIM switches to CUTOUT, that is, to disable the stabiliser trim switches completely.
This is what the captain did and the flight data recorder shows that the automatic trim movement stopped as he positioned the STAB TRIM switch to CUT OUT.
He then re-engaged the STAB TRIM switches, setting them to NORMAL, and almost immediately the stabiliser trim began to trim the aircraft nose down. He moved the STAB TRIM switches back to CUT OUT and left them there, relying on manual trim for the rest of the flight.
The captain ran through three non-normal checklists connected to the issues that he was seeing: Airspeed Unreliable, Altitude DISAGREE and Runaway Stabilizer. None of these checklists advised that he should break off the flight or land at the nearest suitable airport. The captain decided that they should continue the flight to Jakarta.
This was a questionable decision. They had no autopilot and no autothrottle and the captain had false information on his instrument display. As pilot monitoring, he had to rely on his first officer’s display for information. The stick shaker was continuing to vibrate the flight controls so violently that it was hard for the flight crew to hear each other.
The captain did not report these problems to the Lion Air ground station at Denpasar. Instead, he contacted Denpasar Approach to say that they had resolved the situation and that he wished to continue the flight at FL290 (29,000 feet). The controller cleared the flight to FL280 and asked the flight crew to contact the Makassar Area Control Centre for further air traffic control services.
The Makassar Area Control Centre controller asked the flight to climb to FL380 (38,000 feet). A few minutes later, the captain replied with a PAN-PAN call that they were experiencing an instrument failure and to request that they maintain FL280.
The controller agreed and passed them to Upper West Semarang for further services.
When the captain checked in with Upper West Semarang, the controller asked him the nature of the instrument failure. The captain replied that the altimeter and autopilot had failed and asked the controller to relay that information to Jakarta as they would require an uninterrupted descent. The controller did this.
The senior cabin crew member came into the cockpit for an update and the captain reported that the fasten seat belt sign would be left on for the full flight.
The flight crew received the Jakarta weather information: light rain with a visibility of 5,000 metres. The report mentions here again that the pilots were under high stress and struggling to communicate over the noise of the stick shaker.
They received the straight-in approach and the Boeing 737 MAX landed safely at Jakarta with no further issues.
After they landed, the digital flight data recorder logged that the STAB TRIM switches were moved from CUTOUT back to NORMAL.
Once on the ground, the captain told the engineer about the problems that they had experienced and wrote in the Aircraft Flight Maintenance Log that they the lights for IAS (indicated airspeed) DISAGREE, ALT (altitude) DISAGREE and FEEL DIFF PRESS (Feel Differential Pressure) had illuminated during flight.
He didn’t mention the stick shaker activation, later saying that he presumed that this was just a side effect of the other issues.
He also didn’t mention that he needed to set the STAB TRIM switches to CUTOUT during the flight but had returned them to NORMAL after landing.
Following procedure, he reported the occurrence to the company as an Air Safety Report. His report is as follows:
Airspeed unreliable and ALT Disagree shown after takeoff, STS also running to the wrong direction, suspected because of speed difference, identified that CAPT instrument was unreliable and handover control to FO. Continue NNC of Airspeed Unreliable and ALT Disagree. Decide to continue flying to CGK at FL280, landed safely runway 25L.
That’s a lot of jargon so here is a quick translation into everyday speech:
After take-off, the airspeed unreliable and the altitude disagree warnings appeared. The Speed Trim System was running in the wrong direction, which I suspect was because of the speed difference. I identified that the captain-side instruments were unreliable and handed over control of the flight to the first officer. I followed the non-normal checklists of airspeed unreliable and altitude disagree and then decided to continue flying to Jakarta at 28,000 feet. We landed safely on runway 25 left.
The captain submitted his Air Safety Report in the early hours of the morning on the 29th of October.
The engineer at Jakarta flushed the left pitot and the static Air Data Module. He ran an operational test, whicvh passed. Then he cleaned an electrical connector and ran a self-test, which passed. At 02:30 on the 29th, he released the aircraft back into service, still with the miscalibrated AOA sensor.
Lion Air flight 610, the now-famous passenger flight from Jakarta to Pangkal Pinang was scheduled to depart with new crew in the same aircraft at 0545. The pre-flight briefing was normal but did not include any discussion of that morning’s entry in the Aircraft Flight and Maintenance Log. The flight departed with a half hour delay at 06:20 with 189 souls on board.
The Air Safety Report submitted by the captain of the previous flight was acknowledged by Lion Air’s Safety and Security department at 08:30 local time.
PK-LQP had been released a second time with a faulty AOA sensor to a new flight crew who would have to work out for themselves what was wrong with the aircraft.
Every safety net had failed.
The last photo does not show the wreckage of Lion Air flight 610, it was a 737-800, not a Max. It overran the runway after an abortive attempt to go-around in Bali. The year was 2013. Although not related, this accident – all on boards survived – demonstrated already then that Lion Air should have improved its crew training, as well as maintenance which was in urgent need of some tightening up.
Flight 610 ended in a tragedy which could have been prevented, as Sylvia’s excellent summary demonstrates.
The preceding flight could already have ended in tragedy. The first paragraph mentions that “… pilots were slapdash in their logging of faults while (Lion Air’s) maintenance was slow to respond with fixes and deferred the work to be done at other airports.”
Already, in itself, this could lead to a break in communication between various stations. Especially with a culture that did not attach much importance to work being done as quickly as possible, it created a lack of urgency. The AOA being replaced at one station, but not properly calibrated is a link in the situation that led to its tragic and nearly inevitable end. The crew did OK, until their decision to continue the flight in spite of serious instrument- and resulting control problems, even resulting in a “PAN-PAN” call. This was another link that was fatal – for the next crew and all occupants.
Their failure to properly discuss the problems in full detail with the mechanics seems, in the light of what I read here, a nearly criminal act and gross lack of professionalism. They failed, for instance, to report that they had disconnected the trim but decided to re-engage it to improve pitch control for the landing. Nor did they mention the stick shaker activation. These two facts could have prompted the engineers to probe a bit further than just clearing pitot and static systems and do a ground test. The air safety report was not received by the company’s Safety Department until about two hours after the accident had already occurred. Which makes me wonder if there should not have been a procedure to ensure that such reports will get immediate attention, regardless of the time of the day. The mechanics who never gave the problem their full attention also deserve criticism.
A chilling story of a chain of events, each successive link could have triggered a warning that should have preventing the accident.
Boeing also played part in the chain, mainly by downplaying the substantial differences between the -Max and preceding versions of the 737. When Fokker introduced the F50, it was initially intended to be certified as a variant, an improved version of the F27. The authorities determined that there were sufficient differences to warrant it being a new type. There are more profound differences between the Boeing 737-200 and the Max, yet for commercial reasons it was still certified as a Boeing 737.
It cost hundreds of people their lives and tarnished the reputation of Boeing. Quite apart from the loss of many millions of $$$.
For us, aviation freaks: the origins of “PAN-PAN” and “Mayday” are supposed to have their origins in the French language (don’t ask me why French).
PAN comes from “panne”, which is French for a defect or technical problem. So if you are in France with your car, and it breaks down you say “Je suis en panne”.
Mayday, again supposedly, is an anglicisation of the French “M’aidez”: Help me!.
True? I am not sure but it sounds plausible,
In the early days of aviation France played a leading role. Many French words found their way into the lingo, but English won out eventually.
Oh damnit. I knew that and then in a rush to add some imagery to the post, I did a quick search of creative commons photographs and was struck by this one. I’ve always liked it but I did know (once upon a time when I still had a brain) that it was from another incident.
I’ve fixed the caption, at least. Thanks for the reminder.
In fact, now I see why it looked so familiar. I used it in my article about ditching just last month.
You are forgiven Sylvia, and to you and all readers a Happy Easter. And may we soon fly again whenever and wherever we will want to travel.
Small typo: “break lever switch”
Gah! I clearly was too quick to post this one! Thanks, fixed.