Lion Air crash: Jakarta Boeing 737 'had prior instrument error'

[MT]

Time for a AirFrance thread reminder, so whatever potentially disastrous during flight always:
1:Aviate , 2:Navigate , 3:Communicate. Also for pilots taking off is optional, landing is mandatory.
Just sayin!

[EEVblog]

Lion Air was a daytime flight, with largely visual conditions prevailing. I'm going to fully withhold judgment until more information (including CVR transcripts) is available, but based on the information available, this seems a lot closer to "speedometer was covered up by a piece of paper fluttering around the cabin and operator couldn't keep the car between 40 and 80 mph without that reference" than the scenario you describe (which I'd argue was still salvageable by fully-qualified crew, on an average day, but not by that crew on that evening).

At this stage that's my guess too (with my obvious in-depth knowledge of aviation with one flight and 3hrs flying time under my belt  ).
No bad weather, daytime, maybe some clouds making horizon reference a bit tricky, but with no actual fault in the plane control systems, it should have been work-aroundable and completely flyable.
But of course one small thing can often send you down a path that doesn't end well.
They did report issues and were returning to the airport at the time of the incident, so should have been in super-alert troubleshooting mode fresh into the lfight, and not half way across the atlantic 8 hours in and tired and shit suddenly hits the fan.

[raptor1956]

Lion Air was a daytime flight, with largely visual conditions prevailing. I'm going to fully withhold judgment until more information (including CVR transcripts) is available, but based on the information available, this seems a lot closer to "speedometer was covered up by a piece of paper fluttering around the cabin and operator couldn't keep the car between 40 and 80 mph without that reference" than the scenario you describe (which I'd argue was still salvageable by fully-qualified crew, on an average day, but not by that crew on that evening).

At this stage that's my guess too (with my obvious in-depth knowledge of aviation with one flight and 3hrs flying time under my belt  ).
No bad weather, daytime, maybe some clouds making horizon reference a bit tricky, but with no actual fault in the plane control systems, it should have been work-aroundable and completely flyable.
But of course one small thing can often send you down a path that doesn't end well.
They did report issues and were returning to the airport at the time of the incident, so should have been in super-alert troubleshooting mode fresh into the lfight, and not half way across the atlantic 8 hours in and tired and shit suddenly hits the fan.

Modern commercial fly by wire AC don't let the pilot have full control even when the autopilot is disengaged.  The AOA factor is critical and I expect Boeing will be releasing updated flight control software sometime in the not too distant future. 

In order for a pilot to override the control decisions of the computer the pilots must deactivate a number of systems and until they do this the computer is still in charge.

Beyond what I've already posted on this I think what Boeing did today was the first step in addressing an actual control problem that can occur when the right, or wrong, set of airspeed, altitude and AOA data is presented to the computer.  The fact that the previous flight had pretty similar problems, issued a Pan-Pan and asked to return, but then the problem went away and they decided to continue with the flight would not be permitted most places in the world but Lion Air appears to operate with the schedule being more important than safety.

There are many at fault here and the consequence is going to be expensive.


Brian

[Nusa]

However, the Boeing 737 is NOT a fly-by-wire aircraft.

[IanMacdonald]

1:Aviate , 2:Navigate , 3:Communicate.

4: M....bate.

Though  if you are flying a Dalek mothership you may have more success with:
1:Aviate , 2:Navigate , 3:Exterminate 4: Communicate.
Than with 3 and 4 in conventional order. By which time The Doctor has gotten away.

[sokoloff]

The fact that the previous flight had pretty similar problems, issued a Pan-Pan and asked to return, but then the problem went away and they decided to continue with the flight would not be permitted most places in the world but Lion Air appears to operate with the schedule being more important than safety.

The captain/pilot-in-command has significant discretion as to the conduct of the flight. I can think of several valid reasons a flight may initially decide they need to return only to overcome the problem and elect to continue. A mis-programmed FMS/FD may very well give the crew reason for concern and then the crew may overcome that and safely continue the flight. Weather is another. An abnormal or emergency may crop up that is subsequently remedied by reference to the QRH/checklist procedures. Continuing may very well be the safest (or equally safe and more economical) choice.

BA268 is a classic example of that. They lost an engine (with external flames) 300 feet into the climb off LAX en route to Heathrow. ATC declared an emergency on their behalf (also permitted by their job orders (section 10-1)). Crew shut the engine down, continued the climb, and did an assessment to continue the flight rather than dump fuel and return. Passing the east coast of the US, another assessment by them allowed them to continue for England. Ultimately, crew declared an emergency for fuel and landed in Manchester, short of Heathrow.

The first actual section of Federal law governing aviation in the US is 14 CFR 91.3, which reads:

§ 91.3 Responsibility and authority of the pilot in command.
(a) The pilot in command of an aircraft is directly responsible for, and is the final authority as to, the operation of that aircraft.

(b) In an in-flight emergency requiring immediate action, the pilot in command may deviate from any rule of this part to the extent required to meet that emergency.

(c) Each pilot in command who deviates from a rule under paragraph (b) of this section shall, upon the request of the Administrator, send a written report of that deviation to the Administrator.

Airline Ops are additionally governed by part 121, which includes 14 CFR 121.557, with substantially similar text. Of course there is pressure in the airline world to complete trips as planned. Because the pilots are generally the first ones to arrive at the scene of the crash, there's also a high degree of pressure to complete flights safely.

[IanMacdonald]

"Ultimately, crew declared an emergency for fuel and landed in Manchester, short of Heathrow."

Which underlines that in aviation, once you are in an unfamiliar situation you may encounter other unfamiliar situations. In this case an increased fuel burn. 

[khs]

The AOS sensor sounds harmless.

But it is not.

As I've learned, the AOS sensor controls the trim system of the aircraft.

The trim system of the aircraft sounds harmless.

But it is not.

As I've learned (from the comments from avherald.com), trimming is not a little bit nose up or down.
In the worst case, trimming cannot be compensated by the pilot's input, because the range of the trim system is greater(!!) than the range of the stick.

If the AOS sensor is faulty, the STAB TRIM CUTOUT switches must be set to CUTOUT by the pilot.

I do not understand why Boeing does not turn off the trim system by software when the AOS sensor generates bad data.

[sokoloff]

IIRC, the issue was the flight crew's uncertainty that they could access all the fuel onboard during one-engine-INOP operations, not that they didn't have enough overall fuel onboard.
IOW, they were concerned about fuel starvation, not fuel exhaustion.

[Nusa]

IIRC, the issue was the flight crew's uncertainty that they could access all the fuel onboard during one-engine-INOP operations, not that they didn't have enough overall fuel onboard.
IOW, they were concerned about fuel starvation, not fuel exhaustion.

Then the FAA tried to fine them for not being airworthy. A UK aircraft in international or UK airspace when the fuel emergency was called. The UK CAA (their equivalent of the FAA) disagreed and said the plane was certified airworthy with only 3 engines. I gather the FAA accepted that in the end.

[sokoloff]

They did. The FAA concern was over the engine out in California, not the later emergency in Manchester. But the FAA backed down as the aircraft was certified to operate on 3. (Uncomplicated loss of engine in a 747 is an "abnormal" procedure, not an "emergency" procedure.)

[IanMacdonald]

Large airliners undergo substantial changes in elevator trim, particularly when landing flaps are deployed. It is often marginal as to whether the pilots could exert enough force on the controls to maintain attitude without the help of the trim tabs. Conversely if a trim tab goes to an extreme position and cannot be reset, this can be a mission critical situation.

Interestingly, in the event of elevator drive failure it is often possible for a skilled pilot to make a safe landing by flying the plane with the trim control.

[raptor1956]

However, the Boeing 737 is NOT a fly-by-wire aircraft.

It's not a 100% fly by wire AC but it does have fly-by-wire control of spoilers.


Brian

[Nusa]

However, the Boeing 737 is NOT a fly-by-wire aircraft.

It's not a 100% fly by wire AC but it does have fly-by-wire control of spoilers.


Brian

I learned something new. You're right, but ONLY for the ~200 737-MAX's that have been delivered. Most of the thousands of 737's out there are 0% fly-by-wire. So for the MAX, let's call it 5% to be generous? Spoiler use in normal flight is limited to descents and landings. Most of its advanced features have to be enabled by the pilots, and most features are locked out when the flaps are not extended, even if turned on.
http://www.b737.org.uk/max-spoilers.htm

I'd be pretty surprised if the spoilers were a negative factor in this crash.

[Bratster]

I have a Raspberry Pi + $12 USB Software Defined Radio in my garage

o you share? I use a proper Equipment for.

I wouldn't mind setting up a receiver, but i can't find a map of existing installations?

https://flightaware.com/adsb/coverage#feeder-sites

I just got the stuff to set up a receiver and came across this page that shows the existing feeder sites and coverage.

[alsetalokin4017]

Lion Air was a daytime flight, with largely visual conditions prevailing. I'm going to fully withhold judgment until more information (including CVR transcripts) is available, but based on the information available, this seems a lot closer to "speedometer was covered up by a piece of paper fluttering around the cabin and operator couldn't keep the car between 40 and 80 mph without that reference" than the scenario you describe (which I'd argue was still salvageable by fully-qualified crew, on an average day, but not by that crew on that evening).

At this stage that's my guess too (with my obvious in-depth knowledge of aviation with one flight and 3hrs flying time under my belt  ).
No bad weather, daytime, maybe some clouds making horizon reference a bit tricky, but with no actual fault in the plane control systems, it should have been work-aroundable and completely flyable.
But of course one small thing can often send you down a path that doesn't end well.
They did report issues and were returning to the airport at the time of the incident, so should have been in super-alert troubleshooting mode fresh into the lfight, and not half way across the atlantic 8 hours in and tired and shit suddenly hits the fan.

Actually the weather was very hazy so, over the water, the horizon would have been very indistinct and maybe even invisible. And the aircraft was undergoing radical pitch excursions resulting in wildly varying g-forces, and several different audible alarms were going off in the cockpit. Cabin crew, unsecured in seats, may have been injured or having to deal with passenger injuries due to the aircraft's attitude changes during the struggle to maintain control. This is why I described the "roo" situation as I did. In many ways this event was _worse_ than AF447, which was in a stable "mushing stall" all the way to the water and could have been flown out to normal flight had the pilots actually flown it out by simply lowering the nose and adding power. This aircraft was broken, and even if the pilots could have recovered it, it would still be broken and causing problems all the way until landed -- or crashed.

So yes -- pilot error, but in an environment where it was incredibly easy to make errors and be distracted, and at an altitude that did not allow time for evaluation -- or mistakes.

[Nusa]

When the cabin crew is seated in their jumpseats, they are typically secured by shoulder straps. This plane was in trouble so soon after takeoff, I doubt the cabin crew was ever given clearance to move around, nor are they likely to do so on their own when things are clearly going wrong. Not that it mattered in the end, dead is dead.

[raptor1956]

However, the Boeing 737 is NOT a fly-by-wire aircraft.

It's not a 100% fly by wire AC but it does have fly-by-wire control of spoilers.


Brian

I learned something new. You're right, but ONLY for the ~200 737-MAX's that have been delivered. Most of the thousands of 737's out there are 0% fly-by-wire. So for the MAX, let's call it 5% to be generous? Spoiler use in normal flight is limited to descents and landings. Most of its advanced features have to be enabled by the pilots, and most features are locked out when the flaps are not extended, even if turned on.
http://www.b737.org.uk/max-spoilers.htm

I'd be pretty surprised if the spoilers were a negative factor in this crash.

All aircraft have autopilot and this is true for more than 50 years -- these system permit the computer to control the aircraft even in AC that are not fly-by-wire.  So, the fact remains that modern aircraft place a computer between the pilot and the control surfaces even when the plane is not fly-by-wire in the technical sense.  In operation the computer fly's the plane most of the time including climb-out and descent.  If the pilots are not well versed in the methods to arrest control from the computer they are in trouble -- and again, this also applies to non fly-by-wire AC though to a lessor extent. 

It will be interesting to find out which system, the pilots or the computer, were responsible for the dive that doomed them!


Brian

[djacobow]

But of course one small thing can often send you down a path that doesn't end well.

Just a nit here, but few aviation accidents are caused by one thing going wrong. There is usually a rather long accident chain. In this case, we already know that there is a) potentially a design error b) definitely a flight manual documentation error (this is what the AD that Boeing put out modifies) c) a known sensor issue that was sent for repair d) a plane that was not test-flown after a sensor repair and then e,f,... whatever happened in the cockpit that we do not know about yet, but I'm willing to bet that more than one mistake was made.

I'm not an airline pilot, but I am an instrument-rated private pilot with about 500 hours and I'm also a voracious consumer of accident reports.

[djacobow]

Just for reference, this is the actual emergency Airworthiness Directive that Boeing has sent out:


https://c-3sux78kvnkay76x24znkgox78iax78x78ktzx2eius.g00.flyingmag.com/g00/3_c-3ccc.lreotmsgm.ius_/c-3SUXKVNKAY76x24nzzvyx3ax2fx2fznkgox78iax78x78ktz.iusx2fcv-iutzktzx2favrugjyx2f8674x2f77x2fH393-SGD-GJ-7763.vjl_$/$/$/$/$/$?i10c.ua=1&i10c.dv=14

It is, in its entirety, an update to the flight manual.

I see three basic elements to it:

 1. x, y, and z are signs of a AOA sensor failure, with certain confusing instrument indications, including a potentially erroneous and changing minimum speed bar on the ASI
 2. pilots should respond to such failures by disconnecting the auto stabilizer trim system
 3. pilots should expect to need to use extra control force to overcome the auto stab system until it has been disconnected

Based on this, it would seem that Boeing suspects that the airplane was flyable, but that the crew did not react as they should, perhaps due to poor training or lack of awareness of this particular failure mode. Of course, that's what Boeing would say. OTOH, crashes are really bad PR and they'd ground the planes if they suspected there was areal system problem.

[raptor1956]

Just for reference, this is the actual emergency Airworthiness Directive that Boeing has sent out:


https://c-3sux78kvnkay76x24znkgox78iax78x78ktzx2eius.g00.flyingmag.com/g00/3_c-3ccc.lreotmsgm.ius_/c-3SUXKVNKAY76x24nzzvyx3ax2fx2fznkgox78iax78x78ktz.iusx2fcv-iutzktzx2favrugjyx2f8674x2f77x2fH393-SGD-GJ-7763.vjl_$/$/$/$/$/$?i10c.ua=1&i10c.dv=14

It is, in its entirety, an update to the flight manual.

I see three basic elements to it:

 1. x, y, and z are signs of a AOA sensor failure, with certain confusing instrument indications, including a potentially erroneous and changing minimum speed bar on the ASI
 2. pilots should respond to such failures by disconnecting the auto stabilizer trim system
 3. pilots should expect to need to use extra control force to overcome the auto stab system until it has been disconnected

Based on this, it would seem that Boeing suspects that the airplane was flyable, but that the crew did not react as they should, perhaps due to poor training or lack of awareness of this particular failure mode. Of course, that's what Boeing would say. OTOH, crashes are really bad PR and they'd ground the planes if they suspected there was areal system problem.

Boeing seems to have acted quickly and responsibly here though time will tell.  And, as I pointed out before and in spite of the fact that this plane is not technically fly-by-wire, the computer interposes itself between the pilot and control surfaces in a myriad of ways so taking 100% manual control is rather more complicated than pressing a single button. 

Best guess is that the pilots were too 'heads down' trying to make sense of things and didn't notice the plane was in descent until it was too late.  Again, there is going to be blame enough for everyone and the lawyers will profit...


Brian

[djacobow]

And, as I pointed out before and in spite of the fact that this plane is not technically fly-by-wire, the computer interposes itself between the pilot and control surfaces in a myriad of ways so taking 100% manual control is rather more complicated than pressing a single button. 

You have said this, and I'm pretty sure it's not correct in any operational sense in any Boeing airliner. Disconnecting the AP is indeed a single button push -- and that button is on the yoke, too, right where it can be pressed in an instant. The plane can also adjust the trim automatically, and as the AD makes clear, that can also be turned off. But even if not turned off, it can be overridden by the pilot's controls without any special action other than pushing or pulling harder than usual. Similarly, there's an  trim and automatic yaw damper on the rudder which the pilot can disengage, but he can also kick the rudder however he wants and the machine will obey.

Boeing has aircraft such as the 777 that have FBW, but their philosophy is quite a bit different than Airbus's. The machine will essentially inform the pilot that he is about to exceed the aircraft's envelope by making it increasingly difficult for him to assert his control input (by pushing back against his inputs), but it will not override him. Check out section 11.3 of this document: http://www.davi.ws/avionics/TheAvionicsHandbook_Cap_11.pdf

So, though there are systems (electric, hydraulic) between the pilot an the control surfaces, the pilots commands ARE obeyed unless something has actually broken.

This is totally different from an Airbus aircraft, where the computer under "normal law" enforces the flight envelope no matter the control inputs. There are several other modes the aircraft can be in, such as "alternate law 1" where the plane continues to enforce most of the envelope except AOA and overspeed, and "alternate law 2" where only load factor is enforced, and of course "direct law" which is basically "you're on your own kid."



In this case, it looks like the computer might have pushed the nose down, but the pilot could have counterracted that with the normal controls, albeit, with extra force.

[sokoloff]

And, as I pointed out before and in spite of the fact that this plane is not technically fly-by-wire, the computer interposes itself between the pilot and control surfaces in a myriad of ways so taking 100% manual control is rather more complicated than pressing a single button. 

You have said this, and I'm pretty sure it's not correct in any operational sense in any Boeing airliner. Disconnecting the AP is indeed a single button push -- and that button is on the yolk, too, right where it can be pressed in an instant. The plane can also adjust the trim automatically, and as the AD makes clear, that can also be turned off. But even if not turned off, it can be overridden by the pilots controls without any special action other than pushing or pulling harder than usual.

The problem with applying continued force to overcome the airplane's trim is that the auto-trim will continue to trim against you (essentially by design). Airplane is on autopilot and trying to fly a course consistently lower than the aircraft is heading? The airplane will add nose-down trim. If the pilot continues to pull against that, they can, but the airplane will sense that the autopilot is not following the programmed pitch and will continue to trim nose down. On every aircraft I've flown, which is mostly piston singles and twins, but includes a few jets, pressing and holding the AP Disconnect switch will kill power to the auto-trim system and pitch trim motors.

Minor nit: it's "yoke" not "yolk"

[djacobow]

Minor nit: it's "yoke" not "yolk"

Hah, I promised myself I would never do that again. Oh well.

I think we're in agreement. Yes, the AP/trim will work against you more and more but at the same time, that feeling of working against trim is going to be very familiar to any pilot who has ever flown with an AP. Particularly when you're having a "what is Otto doing now" moment, I can't think of anything more natural than disconnecting the AP and putting the plane into the state I want, while I figure out why the AP has different plans.

Admittedly, this is coming from someone whose time is mostly in older light singles with reliably unreliable autopilots.

[sokoloff]

I suspect we agree on almost everything about this crash, at least based on what is known now.

One difference in larger aircraft than in the light singles that you have experience in is that many larger aircraft trim systems work by changing the angle of incidence of the horizontal stabilizer with respect to the fuselage. (It literally cranks the tail "nose up" or "nose down" usually with a jackscrew.) Systems like this have the capability to overpower the pilot's inputs to a much greater extent than the "flying trim tabs" on most light singles. (Among light singles, as far as I know the only common types to use this system are most Mooneys, Piper's TriPacer, and the Cessna 185.)