Tt’s been nearly two years since the tragic crash of Lion Air flight 610, a Boeing 737 MAX airplane that descended into the sea a few minutes after takeoff from Jakarta, Indonesia with 189 souls on board (see graphic showing flight path on page 37). It was the first of two MAX accidents that occurred within a five-month period that prompted the grounding of the hottest selling airliner in the world.
Before the accident, Boeing was riding high with orders for thousands of the jets. Some people now have doubts that the company will recover from the damage to its reputation. Just last month, a Congressional committee released a scathing report that detailed numerous missteps by Boeing and the FAA in the design of the “Maneuvering Characteristics Augmentation System” — or MCAS — that was added to the 737 series airframe to provide anti-stall movements to compensate for improvements in engine power and aerodynamic efficiency. During the accident, the MCAS received faulty indications from a broken Angle of Attack (AOA) sensor which repeatedly attempted to nose the airplane over after takeoff.
I get it. Assumptions that were made by FAA and Boeing about flight crew response to malfunctions — even though consistent with current industry guidelines — turned out to be incorrect. More shocking to me as an aeronautical engineer is that MCAS was designed to rely on only a single AOA sensor, making it vulnerable to erroneous input. I freely admit that Boeing and FAA must be accountable to a portion of the culpability of this crash.
However, the lessons learned from the equally shocking investigative findings — findings of improper maintenance — have not been heard above the roar of the public’s red meat appetite to rail against the greed and arrogance of a U.S. corporation, and the excessive delegation of FAA certification. Simply put, these lesser-known findings clearly indicate that the Lion Air accident would not have occurred if proper maintenance was performed by the airline, its maintenance provider, and a U.S. repair station.
The Accident and a Foreign Investigation
The flight 610 accident occurred at 6:33 a.m. on a Monday morning in Indonesia, which was Sunday evening for me in Washington DC. The date was October 29, 2018, and I was a couple months away from my planned retirement as the director of FAA’s Accident Investigation Division. When the call came in, I knew it was a big deal. A newly designed U.S. airplane model had crashed on a clear day after the flight crew reported a flight control problem a few minutes after takeoff. The airplane was three months off the factory floor and had logged only 443 total flights at the time of the accident. With an investigation of this magnitude, so much for coasting into retirement.
Because the accident occurred in a foreign country, the NTSB and FAA were only “participants” in the investigation which was led by the Indonesian authorities in accordance with longstanding international protocols. If a country designs, builds or operates and aircraft that crashes in another country’s territory, then the country — in this case the U.S. — has a right to participate in the other country’s investigation so that it can take care of any in-house issues. The U.S. sent a team of 12 investigators led by the NTSB with “advisors” from Boeing, GE Engines and the FAA. I immediately dispatched one of my investigators to serve as the FAA lead advisor, and he was accompanied by an FAA 737 project test pilot.
The recorded ADS-B data of the Flight 610’s track indicated a series of roller coaster maneuvers. Given the pilot’s air traffic transmissions about a flight control problem, it didn’t take long for Boeing and FAA to determine that MCAS was commanding repeated movements of the horizontal stabilizer trim system. MCAS is activated without pilot input and only during manual, flaps up flight. The MCAS function becomes active when the AOA exceeds a threshold based on airspeed and altitude (see graphic above). I was literally getting a crash course on the airplane’s design from the FAA certification engineers, and they were hitting me up for any scrap of information from the accident. Three days after the accident, the FAA issued an Emergency Airworthiness Directive to all 737 MAX operators to immediately shut off the electric stabilizer trim switches should a similar scenario occur. Meanwhile, Boeing promised to fix the software.
Suspicious Maintenance Activity
But, as with all accidents, there was more to the story. The Indonesians immediately interviewed the mechanics who last worked on the airplane, but they did not allow any of the U.S. team to participate in those interviews. Instead, they relayed what the mechanics said. A review of flight and maintenance logs from the accident airplane revealed write-ups from previous flights indicating problems with the altimeter readings and indicated airspeed during the three days leading up the accident.
All the faulty indications occurred on the left (captain’s) side of the cockpit displays. The respective crews wrote them up repeatedly. In between flights, mechanics attempted to resolve the problems. They conducted built-in (BITE) tests, reset circuit breakers, cleaned parts and reconnected electrical plugs. They kept zeroing the fault messages and approving the airplane for revenue flight without determining a root cause. They kept dispatching a faulty aircraft, over and over again, with passengers.
When the flight data recorder was recovered from the sea floor (see graphic), it indicated the pilots took off on one of the flights even though the captain’s airspeed indicator was inoperative at start-up! Lion Air had a spotty record of 11 accidents and incidents since its founding in 1999. Rumors of a deficient safety culture were circulating around the rapidly expanding low-cost air carrier in Indonesia. Unfortunately, the investigation did not delve deeply into these issues.
Replacement of the AOA Sensor
Two days before the final flight, the accident airplane arrived in Bali and the flight crew reported that the airspeed and altitude flags appeared again along with disengagement of the auto throttle. The 737 MAX is equipped with a unit that provides stored system information for maintenance personnel. If a problem is annunciated in the cockpit, a mechanic can access the Onboard Maintenance Function (OMF) to determine the necessary maintenance actions (see graphic this page).
In response to an error message indicating a possible AOA failure, the mechanics in Bali needed to replace the left-side AOA vane on the nose of the airplane (see graphic). However, no spares were in stock, so the mechanic requested one from airline’s Maintenance Control Center in Jakarta. Instead of receiving a new part, he received a used one that was older than the airplane itself. The AOA probe had been reworked at a Part 145 repair station in Florida and shipped to Lion Air one year before. More on that issue later. Still, why not have several new AOA indicators in stock if your airline is purchasing billions of dollars of 737 MAX airplanes?
In the maintenance log in Bali, the company technicians documented the replacement of the AOA vane and completion of a required “installation test” to ensure it was properly calibrated. The test involves deflecting the AOA vane up and down while observing the digital display indication on the Stall Management Yaw Damper (SMYD) computer box in the avionics compartment for each position. While the log indicated that the test was completed, it did not contain the recorded test values that were required to be recorded as per the company’s maintenance procedures. The airplane was buttoned up, passengers were loaded, and the airplane departed Bali for Jakarta.
On the flight to Jakarta, the FDR recorded the value in the left AOA sensor was approximately 21 degrees higher than the right AOA sensor. This discrepancy should have been discovered by the installation test that the mechanic claimed had been performed. As a result of the erroneous AOA input, the airplane’s stick shaker on the captain’s side began to shudder, multiple cockpit annunciators were lit, and the crew struggled to keep the airplane level. They finally shut off the electric trim switches but continued to fly for more than an hour with the stick shaker vibrating. When they landed in Jakarta, they reported a couple of annunciator lights, but did not convey the actual trauma of what occurred during the flight. As a result, mechanics again checked and reset some buttons, and cleared the airplane for the next flight — the accident flight.
What’s Wrong with this Picture?
About two weeks after the crash, NTSB and FAA investigators asked the Indonesians for additional details from the mechanic who said he performed the AOA sensor installation test in Bali. A few hours later, the mechanic provided investigators photographs of the SMYD unit that were purported to be taken during the actual test on the accident airplane as evidence of a satisfactory installation test result. Why would a mechanic take photographs of his maintenance work? And why provide this information so late in the investigation? Something was not right.
I took a look at the pictures and worked with Boeing and FAA engineers as they gleaned information from the digital displays and unit part numbers. The part numbers did not match the accident airplane. The time shown on one of the displays was a time before the arrival of AOA sensor spare part. Investigators confirmed that the photographs of the SMYD units and cockpit displays were not that of the accident aircraft. To my amazement, these facts, which were cited in the final report, garnered very little attention. As a former employee of the DOT Inspector General’s office, I can tell you that someone would be going to jail if something like that happened in the U.S.
The Aftermath and Lessons Not Yet Learned
To add insult to injury, the Florida repair station that provided the faulty AOA sensor utilized several pieces of test equipment that were not specified in the AOA’s Component Maintenance Manual. Additionally, no written instructions were produced to operate the test equipment that was being used. Investigators opined that the improper test equipment could potentially introduce a bias into the AOA probe, a bias of a similar magnitude to that seen on the flight data recorder, if a certain mode switch was inadvertently positioned. It was clear to me that the AOA sensor was improperly calibrated at the FAA-certificated repair station. Enforcement action by FAA’s Flight Standards office followed.
As a result of the Lion Air accident, I stayed on with the FAA a bit longer until the dust settled a bit from the investigation. The final report was issued by the Indonesians a few months later. I retired about two weeks before the second 737 Max accident that occurred in Ethiopia. That investigation is still pending. I have read in the media that a bird strike may have taken out one of the AOA probes on takeoff, prompting the MCAS to fire. Still, I have questions about how that accident occurred given the issuance of the FAA Emergency Airworthiness Directive after Lion Air.
Yes, Boeing and FAA must accept a portion of the culpability for a flawed design. However, accidents are always due to a series of events, like links in a chain (see graphic). In my view, the Lion Air accident exhibited maintenance malpractice that rivaled the Alaska flight 261 accident from 20 years ago that I wrote about in the March 2020 issue of Aviation Maintenance. The similarities with that accident and Lion Air 610 are undeniable. Both airliners plummeted into the sea following the unintended movement of the horizontal stabilizer that was later determined to be a single-point failure.
With Alaska flight 261, the lessons learned about the improper maintenance were plentiful and impactful. Unfortunately, the same cannot be said about Lion Air 610 because of the anti-Boeing buzz. If you are reading this article, please allow these lessons to be heard.