Lion Air Down

[J.O.]

One of the best phone calls I've ever taken was from a colleague who'd recently landed in the aircraft I was due to take over. He'd had some "fun" on the previous leg and wanted to tell me first hand exactly what had happened. Some of it was stuff you couldn't write in even the most detailed of log entries. It was very helpful as I dealt with Maintenance Control because I knew what I was willing to accept - and what I wasn't. I still owe that guy a beer.

[Seeker]

I always try to get the MTC guy to meet me at the airplane so I can give the background and clarify what happened, what we saw and did, etc.  I've had some very good interactions, and learned a lot myself by talking directly to the guy who's going to address the snag.  I consider waiting at the aircraft after the flight to discuss snags with the AME to be one of my main responsibilities  - and I don't shirk my responsibilities.

[Kip Powick]

1 hour ago, seeker said:

.....and I don't shirk my responsibilities.

Oh my  !!

[blues deville]

1 hour ago, seeker said:

I always try to get the MTC guy to meet me at the airplane so I can give the background and clarify what happened, what we saw and did, etc.  I've had some very good interactions, and learned a lot myself by talking directly to the guy who's going to address the snag.  I consider waiting at the aircraft after the flight to discuss snags with the AME to be one of my main responsibilities  - and I don't shirk my responsibilities.

Finally.... AME. I wondered when you were going get closer to his/her correct title. They don’t give away those licenses either.

[Seeker]

6 hours ago, Kip Powick said:

Oh my  !!

Well....I don't.  I knew when I wrote that I'd probably get a response from someone.  What I was trying to get across is that I see handling snags, making sure cosmetic and grooming issues are called in to the right dept and passing info to the outgoing crew as an important part of my job - irritates me to no end the guys who are already out on the 401 before the last passenger is off the airplane.

[blues deville]

4 hours ago, seeker said:

Well....I don't.  I knew when I wrote that I'd probably get a response from someone.  What I was trying to get across is that I see handling snags, making sure cosmetic and grooming issues are called in to the right dept and passing info to the outgoing crew as an important part of my job - irritates me to no end the guys who are already out on the 401 before the last passenger is off the airplane.

I believe that’s all a part of good airmanship as well as being a good employee. The added bonus is what you can learn about systems or your airplane in general when you do get speak directly to a qualified engineer. There’s also the mutual respect gained for each other’s job in the airline because the next time you’ve got a serious problem it’ll be someone who now knows you working with you to solve it. 

[Kip Powick]

3 hours ago, seeker said:

Well....I don't.  I knew when I wrote that I'd probably get a response from someone.  What I was trying to get across is that I see handling snags, making sure cosmetic and grooming issues are called in to the right dept and passing info to the outgoing crew as an important part of my job - irritates me to no end the guys who are already out on the 401 before the last passenger is off the airplane.

Of course..... I certainly agree with you within the context concerning your intent  to post a personal opinion with respect to your aviation industry work ethic.

My comment was in jest...... in that  your remark  could be construed  as rather pompous if that opinion has to do with the functionality  of your entire life.

No harm...no foul...have a great one

 

 

[Don Hudson]

 

Wall Street Journal

By

Andy Pasztor and

Andrew Tangel

Updated Nov. 13, 2018 1:56 p.m. ET

. . . .

"Boeing marketed the MAX 8 partly by telling customers it wouldn’t need pilots to undergo additional simulator training beyond that already required for older versions, according to industry and government officials. One high-ranking Boeing official said the company had decided against disclosing more details to cockpit crews due to concerns about inundating average pilots with too much information—and significantly more technical data—than they needed or could digest. "

. . . .

https://www.wsj.com/articles/boeing-withheld-information-on-737-model-according-to-safety-experts-and-others-1542082575

 

 

[boestar]

I have seen some horrible write ups in my time.  I once had a crew (probably more than once actually)  Tell me their autopilot was not working but when pressed for specifics were unable to elaborate.  Once I took the MEL out and was questioned as to what I was going to do, I said Defer it to an overnight when troubleshooting can be done since I do not have sufficient information.  Suddenly there was a plethora of information which led to a simple fix.  The devil is in the details.

[Guest]

Likely the first of many:

December 28, 2018 / 3:25 PM / Updated 6 hours ago

Family of Lion Air co-pilot sues Boeing in Chicago over fatal crash

•  

CHICAGO (Reuters) - The family of the Indonesian co-pilot of a Lion Air flight that crashed in October, killing all 189 on board, has filed a wrongful death lawsuit against Boeing Co in Chicago, adding to litigation piling up against the manufacturer in its hometown.

The lawsuit, filed on Friday in the Circuit Court of Cook County, Illinois, alleges that a Lion Air-operated Boeing 737 MAX 8 was unreasonably dangerous because its sensors provided inconsistent information to both the pilots and the aircraft.

Boeing declined to comment on pending litigation.

[DEFCON]

All the industry discussion seems to be focused on NG pilots not being made aware of a very critical 'difference' between sub-types.

What about the pilot that's never flown the type before?

It seems kind of odd that the manufacturer and regulators all missed and or ignored the need for new pilots to be informed of the workings of a major aircraft system?

This situation has the same sort of stink about it as followed the AA A 300 tail loss due to rudder inputs that exceeded structural limits even though the aircraft was well below Vma.

 

 

 

[Seeker]

20 hours ago, Rich Pulman said:

That accident wasn’t caused by using full-scale rudder deflection in itself, but because of a rapid full-scale rudder reversal. Imagine the lateral force & inertia involved with that, even at low speed. 

Lots of misconceptions out in the pilot community about this accident.  I carry a copy of the accident report with me and will frequently discuss it with new pilots.

From the report:

The National Transportation Safety Board determines that the probable cause of this accident was the in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate design that were created by the first officer’s unnecessary and excessive rudder pedal inputs. Contributing to these rudder pedal inputs were characteristics of the Airbus A300-600 rudder system design and elements of the American Airlines Advanced Aircraft Maneuvering Program.

Accident report

[DEFCON]

Thanks Rich; yes, the forces would be fantastic.

Thanks for posting the link to the accident report Seeker; it's been an interesting re-read and a good memory jog.

From the report you can see that AA and the FAA were a big part of the problem beginning with the fact the pilots weren't even issued AFM's.

And as primitive as the aircraft was technologically, much like the Max, a form of 'maneuvering augmentation system' that managed rudder deflection angles etc. was included, but not well understood by pilots.

The more I read, the greater the stink.

The way the Max was introduced to pilots seems to suggest the industry failed to fully appreciate 'all' the lessons contained within the NTSB's A300 crash findings?

 

   

 

[boestar]

every large airplane out there has a rudder limiter that limits rudder travel based on airspeed.  Mostly they are automatic systems or even hydraulic pressure reduction systems.  Without it flying would be much more difficult.

 

[GDR]

They have the voice recorder.

https://www.ctvnews.ca/world/indonesia-finds-lion-air-jet-cockpit-voice-recorder-1.4252009

[blues deville]

6 hours ago, GDR said:

They have the voice recorder.

https://www.ctvnews.ca/world/indonesia-finds-lion-air-jet-cockpit-voice-recorder-1.4252009

Buried under 26’ of mud. That airplane must have been vertical when it hit. Don’t think I want to hear their voices. 

[Kip Powick]

The sea bottom was stated as 98 feet. I would assume that the bottom of the sea in that area has a very large covering of soft sand, slurry mud  and silt. It would be impossible for the recorder to penetrate 26 feet on a normal sandy ocean bottom, no matter what the speed of the aircraft was when impacting the ocean surface.

Normally, at 100 feet, there is little surge on the ocean floor unless it has been subjected to extreme storms . Seeing victims were found during the dredge, one has to assume the bottom was very soft .

[Guest]

From the BBC:

Lion Air crash: 'Black box' voice recorder recovered

• 3 hours ago

• https://www.bbc.com/news/world-asia-46860074

 

Image copyright EPA Image caption The bright orange voice recorder was discovered on Monday

The "black box" voice recorder from a Lion Air flight which crashed off the coast of Jakarta in October has been recovered, said officials on Monday.

All 189 people on board died when Flight JT610 fell into the sea shortly after taking off for the short journey to Pangkal Pinang.

The pilot had asked air traffic control for permission to turn back to the airport but then contact was lost.

Investigators say the plane had encountered technical problems.

The aircraft - a new Boeing 737 Max - broke into many pieces when it hit the water at high speed. The plane should not have been flying on the day it went down as it was not airworthy, Indonesian investigators have said.

The bright orange voice recorder was found at least 50m (165ft) from where the first black box - the plane's flight data recorder - was found last November.

The voice recorder was found on Monday morning but was "broken into two pieces".

"Hopefully it's still useful [to investigators]," Haryo Satmiko, deputy head of Indonesia's transport safety committee (KNKT) told Agence France-Presse.

Image copyright Reuters Image caption Officials have been working for months to recover debris from the flight

Indonesia's Navy spokesman Agung Nugroho told Reuters that the recorder was found 8m deep, under mud on the sea floor.

Mr Nugroho said that a weak signal from the recorder had been detected "for several days".

He added that the recorder had "obvious scratches on it", but that it was unclear what damage it had suffered.

Human remains had also been found near where the voice recorder was discovered, said Mr Nugroho.

When the flight data recorder was found in November, officials said that it could take up to six months to analyse data.

Image copyright AFP Image caption The plane's flight data recorder was recovered last November

Listening to the last conversations between the pilots and ground control on the CVR should help investigators finish piecing together what went wrong in the short flight.

'Not airworthy'

Flight JT610 took off from Jakarta at 06:20 on Monday (23:30 GMT on Sunday).

It crashed minutes after the pilot asked for permission to turn back to the airport.

Findings by Indonesia's transport safety committee (KNKT) suggest that Lion Air had put the plane back into service despite it having had problems on earlier flights.

The pilots appeared to struggle with an automated system designed to keep the plane from stalling - a new feature of the Boeing 737 Max.

The anti-stalling system repeatedly forced the plane's nose down, despite efforts by pilots to correct this, the findings suggest.

Investigators have now said that the plane was not airworthy and should have been grounded.

Some victims' families are suing Boeing over the accident.

[GDR]

A New York Times investigation of the Oct. 29, 2018, Lion Air Boeing 737 MAX crash suggests marketing considerations were at least partly behind Boeing’s and the FAA's joint decision to not specifically train pilots in the maneuvering characteristics augmentation system (MCAS) that may have played a role in the crash. The Times story quotes various named sources as saying that Boeing wanted to maintain the cross compatibility between the new aircraft and earlier versions of the 737, thus simplifying conversion training and reducing costs for airlines buying the MAX.

 

The difficulty was that the physically larger engines that accomplish the plane’s main selling point—better fuel economy—had to be mounted higher and farther forward than on its predecessors and that significantly changed low-speed flight characteristics. MCAS was designed to compensate for the MAX’s increased tendency to stall in a low-speed turn by adjusting the angle of the horizonal stabilizer. The system takes data from one of two angle of attack indicators (there’s no redundancy or agreement requirement) and was designed to automatically push the nose down if an incipient stall was detected. Boeing convinced the FAA that because the system maintained the basic flight characteristics of earlier versions that pilots did not need specific training on MCAS even though its inclusion was considered necessary for certification of the aircraft.

The Times story also notes that other regulators at least initially determined that pilots should be made aware of MCAS. European regulators wanted pilots to be trained on it but eventually accepted the FAA’s and Boeing’s position. Brazil, however, stuck to its guns and required specific training for pilots on MCAS.

Boeing didn’t hide the addition of MCAS. It’s described in operation and maintenance manuals and was explained in technical briefings with prospective customers. It also included an emergency checklist covering disabling the system. But because they were not specifically trained in its use, most pilots didn’t know it was there and that it operated fundamentally differently from the speed trim system that operated the stabilizer setting on earlier 737s. Notably, pulling back on the yoke on older aircraft disables the automatic trim. Pulling back does not deactivate MCAS on the MAX.

Something the Times couldn’t determine was whether MCAS was tested in a failure mode, either in the simulator or on the aircraft itself. The predominant theory on the root cause of the crash was that faulty AOA data resulted in an erroneous and extreme reaction from the MCAS, pushing the aircraft into a high-speed dive that the pilots could not recover from. Boeing and the FAA are under investigation by the National Transportation Safety Board and Indonesian authorities to determine if the decision to skip pilot training in the new system played a role in what became the worst air crash of 2018.

 

https://www.avweb.com/avwebflash/news/Boeing-FAA-Probed-In-Lion-Air-Crash-232225-1.html

[boestar]

Systems like this are designed to be "invisible" to the pilot.  The system "just works"....until it doesn't.

Boeing must have known that faulty inputs from the AOA would cause the system to react in unexpected ways.  They also probably deduced that the risk was minimal of a failure...until it failed.

Risk management 101

 

[Don Hudson]

It remains to be examined and stated by the NTSB whether Boeing actually did the testing required. Whether they knew this was a potential single-point-of-failure, (like "O-rings"), made an assessment and felt they had accounted for the potential, or knew about the potential and satisfied themselves that the risk was in the neighbourhood of 10^-9 , is a question that must be answered by the investigation. Even though they are contributory I don't think that this is primarily a "human-factors" accident. Airline training issues, reasons why a crew didn't write up a snag that mentioned the continuous stall warning and the control difficulty which they resolved by using the stabilizer cut-off switch and so on, cannot be cited as primary causes. In my view as a retired pilot, Boeing was not forthright in their work. Given the underlying fundamental design change in a primary flight control system which behaved differently than expected by B737 pilots, should the airplane have been declared a new type rather than falling under the same rules that governed the issuing of the original B737-100 type certificate? The question is a natural one to submit, and is intended to point to an area of investigation that should be part of the overall examination of the Lion Air accident. I hope it will be.

(text in blue is edited)

 

[boestar]

Agree Don.  

If the change to the system becomes visible to the pilot through a failure mode then there should have been some form of training to that end.  Will the plane behave differently now than it did before if there is a failure?  if the answer to that question is yes then there should be training to the pilot adn something added to the QRH. 

If a failure makes the plane go up when I push down then the pilot needs to know that.

 

[Don Hudson]

boestar...I can't imagine what the crew thought and experienced as they dealt with elevator forces that continued to increase even as they countered by trimming nose-up every time.

The data traces make clear the roughly-5-second intervals between their attempt to maintain a trimmed aircraft and how the MCAS fought them every time, until a control transfer to the right seat when, for a few seconds more, the MCAS increased control forces beyond the ability of the crew to sustain resistance.

The runaway stab drill has been around since the sixties when stabilizers gained their enormous power, and everyone knows the drill. But this was not a "runaway". This was a system operating "correctly" with data input that was incorrect.

Up until this accident, no pilot could have known about the MCAS or how it worked because there was no practical information in the FCOM, no information about what information it used or why the system was necessary.

There are lots of "what-if's" in this terrible tragedy but they parallel alongside a direct line between cause and effect. This is a single point of failure which resulted in the loss of the mission and all on board. The questions about organizational failures are Boeing's. In the end there is no other way to assess it.

[conehead]

Don, I think you mentioned earlier something about the system voting on the three AOA sensor inputs... I’d be interested in learning the architecture of the system and how the control “decision” was made. Why wasn’t the faulty input ignored?  Seems to me that this is a HUGE design fault.

[Don Hudson]

Hi conehead - I'll have a look at past posts but I think it was in reference to the notion of "decidability" in systems with 3 inputs. The B737 type has just two AoA sources on either side of the lower nose so I'm wondering if I was referring to pitot system which does have 4 sources, (three on the nose, and one on the vertical stabilizer for the elevator trim system).

I'm not an engineer and certainly not a scientist but I have wondered about "voting systems" and the tolerance (or resiliency) of auto-flight systems since the AF447 accident. The problem is how computers come to a decision about the correctness of data (and the implicit "correctness" of the response), when there is significant disagreement. As far as I know, this kind of problem hasn't been resolved yet and computers can only make a "best guess", which usually defaults to "majority rule". But a simple majority is problematic between 3 data sources in that two can indeed be wrong and only one correct, (Perpignan A320 accident, QF72 'dive' due data spikes in a flight control computer).

This is a far more complex and difficult problem than it first appears. The matter of decidability sometimes comes under the interesting heading of the "Byzantine General's" problem*. It turns out that for complete decidability, one requires seven independant sources of data. I am not about to inflict an explanation on anyone here, particularly because I only have a half-baked, very limited comprehension of why this is so in the first place! But the problem is real and has real and crucial implications for safety/reliability of systems in which software must decide about the correctness of the inputs received and then act accordingly. (I think this is a significant challenge for those who believe that true AI is possible...another thread!)

I'm very interested in the architecture of the system as well but schematics for the MAX either are generic block diagrams in aircraft manuals without sufficient detail or the kind that would be useful (AMM diagrams) aren't available online, but I have some leads.

Edit to add:

Conehead, to your question & comment on faults, "Why wasn’t the faulty input ignored?  Seems to me that this is a HUGE design fault.", and after further looking:

The AoA input to the MCAS was a single input with no voting incorporated due no matching data source with which to compare. The assumption, one supposes (so far, without evidence), one increment of MCAS movement was not a safety issue and that the crew would bring the aircraft back into trim prior to prior to MCAS activation, source: https://www.pprune.org/tech-log/615709-737max-stab-trim-architecture-3.html#post10335193

* If you're really having trouble sleeping, here's a link on fault tolerance...https://www.cs.indiana.edu/classes/p545/post/lec/fault-tolerance/Driscoll-Hall-Sivencrona-Xumsteg-03.pdf