Accident reports issued during the second half of 2019

Final report: Lion Air 737 Max 8, loss of control in flight, 29 October 2018

The Indonesian national transport safety committee (KNKT) found that the aircraft (PK-LQP), during the climb-out from Jakarta international airport on a short domestic flight, crashed when the crew lost control following a technical malfunction. It dived into the sea north-east of Jakarta with a 10,000ft/min rate of descent some 11min after take-off, and all eight crew and 181 passengers on board were killed in the impact, according to the KNKT.

The Indonesian report is unusual in how deeply it examines Boeing’s aircraft and systems design parameters, design assumptions, and design oversight relating to the components failures and systems failures that triggered the accident sequence.

In the “Conclusions” section of the report, the investigators do not present causal factors or probable causes as such, but a series of 89 “findings”. It defines these as “statements of all significant conditions, events or circumstances in the accident sequence.” They are mostly chronological events, but also examine Boeing’s design assumptions and system testing parameters, particularly with reference to system components that, in the accident aircraft, did not work as intended or predicted. These include statements contrasting Boeing assumptions about pilot reactions to malfunctions with what the crew actually faced, and how they actually reacted.

Basically, the Conclusions section lays out the story of how the pilots lost control, and what was happening to make them lose control. For a full understanding of everything that contributed to the accident, the report needs to be read in its entirety.

Paragraph No 1 in the Conclusions section immediately mentions the MCAS (manoeuvring characteristics augmentation system). It describes the circumstances under which MCAS is supposed to operate, and why Boeing was not required by regulations to carry out an exhaustive examination of “unintended MCAS-commanded stabilizer movement”. It explains: “Boeing conducted the FHA [functional hazard analysis] assessment based on FAA guidance and also based on an assumption that the flight crew was highly likely to respond correctly within three seconds.“

The final paragraph in the Conclusions section – paragraph No 89 – refers not to the Lion Air crash but to the Ethiopian Airlines disaster five months later. It highlights, in the Ethiopian case, a causal factor that was common to both cases, but does not mention that this detail was taken from the preliminary report of the Ethiopian investigation, because the final report was not (still is not) yet completed.

The following is the KNKT’s last statement in the Conclusions section: “On 10 March 2019, an accident related to failure of an AOA sensor occurred involving a Boeing 737-8 (MAX) registered ET-AVJ operated by Ethiopian Airlines for scheduled passenger flight from Addis Ababa Bole International Airport (HAAB), Ethiopia to Jomo Kenyatta International Airport (HKJK), Kenya with flight number ET-302.”

Critical factors in the accident sequence are made clear in the report. It describes the triggering fault: before the Lion Air accident flight, the AOA sensor in the aircraft that connects with the MCAS had been replaced with one that had been repaired by an American maintenance company, Xtra Aerospace of Miramar, Florida, but it had been mis-calibrated in re-assembly and this major fault went unnoticed. As a result, the AOA was reading higher than the stalling AOA, and from take-off through almost all of the rest of the flight the stick-shaker stall-warning was operating. There were also related warnings of “airspeed disagee”, “altitude disagree”, and “Feel Differential pressure”, triggered by the same AOA sensor fault.

The report argues that, under the circumstances of this flight, it is not surprising that the crew lost control. “During the accident flight, multiple alerts and indications occurred which increased the flight crew’s workload. This obscured the problem and the flight crew could not arrive at a solution during the initial or subsequent aircraft nose-down (AND) stabilizer trim inputs.”

When the aircraft reached the phase of flight where MCAS operation was enabled (manual flight, flaps up), triggered by the false AOA input, the MCAS-controlled stabilizer reaction kicked in, but its operation is not the same as the pilots would normally expect. The report explains: “Pulling back on the control column normally interrupts any electric stabilizer AND command, but for the 737-8 with MCAS operating, that control column cutout function is disabled.” Crews had not been instructed or trained in MCAS operation, says the report.

The report observes: “The stick-shaker activated continuously after lift-off and the noise could have interfered with the flight crew hearing the sound of the stabilizer wheel spinning during MCAS operation.” Finally, the investigators observe: “The digital flight data recorder indicated that that, during the last phase of the flight, the aircraft descended and could not be controlled. Column forces exceeded 100lb, which is more than the 75lb limit set by the regulation.”

The report provides considerable detail about failings in Lion Air’s aircraft maintenance management and in its record-keeping discipline. Similarly there are criticisms of crew disrespect for standard operating procedures, particularly in the case of the crew which flew the same aircraft the previous day. It also details remedial measures Lion Air has already set in train. But none of these deficiencies were causal in the accident on 29 October 2018.

 

Air France A380, engine failure over Greenland, 30 September 2017

Operators of Airbus A380s with Engine Alliance power units have been told to conduct inspections of their fan hub blade locks to check for damage caused during disassembly or reassembly. In the event that caused the airworthiness directive, the entire fan and inlet cowling separated from the No 4 engine of an Air France A380 (F-HPJE) over Greenland, and the aircraft diverted safely to Goose Bay, Canada with no injury to any of its 24 crew and 497 passengers. But because of snow-covering, it took months to find the detached component parts to investigate what had happened to the GP7200 fan, but investigators eventually recovered the material for examination. The FAA says the manufacturer has developed a new design for the fan hub blade lock.

 

Khabarovsk Airlines L-410, propeller control, Nelkan, Russia, 15 November 2017

EASA has drawn up an order requiring operators of the Let L-410 twin turboprop commuter aircraft to fit a new control mechanism. It is also setting out an inspection regime for the control at intervals of 100h. The measures follow the fatal accident involving a Khabarovsk Airlines L-410, which suffered a propeller reversal – a shift in pitch to the beta range – at low height on approach to Nelkan, Russia. GE Aviation Czech manufactures the H80-200 engines for the L-410 variant involved, a UVP-E20. EASA has previously issued directives requiring inspection and adjustment of the engine push-pull control as well as replacement of the beta switch, but the engine manufacturer has since developed an “improved” push-pull control, says EASA, which “reduces further” the risk of uncommanded in-flight propeller reversal. It is this modification which the EASA directive now requires.

 

Saratov Airlines An-148, airspeed certainty, Moscow, 11 February 2018

Analysis of a Saratov Airlines Antonov An-148 (RA-61704) crew’s actions soon after take-off from Moscow Domodedovo shows the two pilots applied opposite inputs to the control columns. The twinjet’s captain had pushed the aircraft into a dive in response to an apparent loss of airspeed – a false indication caused by icing of the aircraft’s pitot-static sensors, the heaters for which had not been switched on. When the ground-proximity warning system issued a “pull up” alert at about 1,500m (5,000ft) altitude as the aircraft descended at more than 9,800ft/min, the co-pilot pulled on the control column in a bid to bring the nose up. The Russian Interstate Aviation Committee (MAK) says the captain was pushing nose-down with a force of 412N while the first officer countered with a 382N nose-up command. The opposite inputs effectively cancelled one another out, and the elevators “practically did not deviate” from their nose-down position, so initially the An-148 continued its dive. Finally, at a height of 300-400m the flight-data recorder shows the two pilots both suddenly started pulling together on the control columns. The MAK report says: “Most probably, the aircraft emerged from the clouds at this time and the pilots realised the ground was rapidly approaching.” The sudden nose-up inputs generated a 4.2g load on the An-148, but was insufficient to arrest the descent, and the aircraft – still in a 30° dive and with 25° right bank – struck the ground at around 430kt, completely disintegrating with the loss of all 71 occupants. Analysis of the whole sequence, from the moment of take-off for Orsk, just after 14:21 local time, states that a “no heating” warning for the pitot-static sensors was displayed on the instrument panel, and it remained for the entire flight. On departure, gear and flaps were retracted by the time the jet had climbed to 640m, triggering an attitude alert. Flight-data recorder information shows that, at about 1,100m (3,600ft) and 250kt, a discrepancy between the aircraft’s actual and recorded airspeed began to emerge. As the pilots were working through the checklist for passing the transition altitude, 3min 40s into the flight, they received a speed-comparison alert. This showed that one of the three speed sensor channels had already been rejected, and that the readings of the other two were starting to differ by more than 5.4kt. The pilots’ airspeed indications were showing around 245kt, and the rejected channel was significantly lower at 230kt, while the actual estimated figure was about 265kt, says the inquiry. The crew disengaged the autopilot, and investigators believe that is when the captain pushed his control column forward, taking the aircraft from 5° nose-up to 5° nose-down, putting the jet into a descent at up to 3,900ft/min. When the action was queried by the first officer, the captain’s “hold” reply suggested that he was attempting to prevent the aircraft’s speed from falling below 215kt. But then as the speed sensor readings varied, the captain’s speed channel was suddenly rejected in favour of the third channel which was registering 259kt – meaning that his displayed airspeed abruptly leapt by more than 50kt. At the suggestion of the first officer, who had noticed rising airspeed indications on his side, the crew disengaged the autothrottle and retarded the thrust levers to idle before advancing them, and then retarding them again. The aircraft continued to descend, from 2,050m to 1,760m, and its indicated airspeed increased; that on the captain’s side showed more than 300kt, and an overspeed warning sounded. Investigators estimate the actual speed was around 313kt. Subsequently the aircraft began a climb, at a rate of up to 2,100ft/min, reaching a maximum height of 1,900m. The captain’s airspeed reading began to fall rapidly – the result of further deterioration from sensor icing – and the aircraft was put into another dive, with a 16° nose-down attitude, while the engine thrust levers were advanced initially before being retarded again. The crew did not discuss any of the notifications being displayed on the central information system, says the inquiry. Just before 14:27 the captain, in response to a further drop in his speed indication, pushed the aircraft into its final dive, 30° nose-down, and advanced the thrust levers to the “maximum continuous” position before once again retarding them. The enhanced ground-proximity warning system called “Terrain ahead, pull up.” Two seconds later, in response to the warning, the first officer tried to pull the aircraft out of the dive but – with the captain still pushing the jet nose-down – the attempt was unsuccessful.

 

Korean Air 737-900, tailstrike, Osaka, 9 April 2018

Japanese investigators believe a Korean Air Boeing 737-900 suffered a tail-strike at Osaka’s Kansai airport as it pitched up during a go-around, after the aircraft bounced on landing. The aircraft (HL7725) had conducted its approach to runway 06L in a tailwind and the captain, who was the pilot flying, opted to reduce thrust to idle earlier than usual in order to avoid a long touchdown. But as the aircraft entered the flare at 30ft, with 2° nose-up attitude, the first officer felt the rate of descent was excessive. He intervened – without making any call-out – by pulling the control column aft. This increased the pitch to 3.5° as it touched down with an impact of 1.87g. Its main landing-gear weight-on-wheels switches activated and the spoilers began to deploy. The captain expected the aircraft to bounce, and began to execute a go-around. The aircraft made runway contact a second time, with a 1.66g impact, and FDR information shows the aircraft’s pitch then increased from about 7° to some 10° – above the 8.2° threshold for a tail-strike. “It is highly probable that the lower aft fuselage of the aircraft was damaged [by] contacting the runway because its pitch angle became too high,” says the Japan Transport Safety Board. It states that the excessive pitch was probably the result of the captain’s attempt to avoid the second runway contact by pulling the nose up. None of the eight crew or 99 passenger was injured, but the aircraft sustained cracks and scratch marks to its aft fuselage underside over a length of 2m, and its tail-skid was broken.

 

Norwegian 737-8007, runway incursion, Alicante, Spain, June 2018

A failure in air traffic control oversight at Alicante, Spain allowed a Norwegian Boeing 737-800 to be cleared for departure from an occupied runway, resulting in its having to abort its take-off roll. The aircraft, bound for Oslo, had been cleared for take-off from runway 10. Two vehicles, however, had been granted approval to enter the runway for a routine surface check some 4min earlier. The vehicle clearance had been passed in Spanish, and investigation authority CIAIAC says the 737 crew had not understood the transmission. The vehicle crews, however, understood the take-off clearance to the aircraft – spoken in English – and took immediate action to vacate the runway. The Norwegian crew was ordered to abort the take-off roll after it had travelled about 160m from the threshold. CIAIAC says the distance and gradient of the runway “impeded” visual contact between the aircraft and the vehicles. The separation between them did not fall below 1,000m at any point. The inquiry primarily attributes the incursion to the situation in the control tower, which was running a single-position operation, and the controller on the frequency was a student under instruction by an instructor who had “little training experience”. There was also an assistant, on his first day on the job. At the time of the event the instructor had been speaking with the assistant over an error involving the flight strip board. Visibility at the time was good, with a full view from the tower of the runway and vehicles on it, but the take-off clearance was issued “without doing a full visual scan”, says the inquiry. CIAIAC has recommended that air navigation service provider FerroNATS reinforces its training modules for controllers to take into account the circumstances of the incursion. After aborting the take-off roll the Norwegian aircraft vacated the runway via the C2 taxiway and lined up again for departure 7min later.

 

Swift Air 737-800, runway overrun, Pardubice, Czech Republic, 1 August 2018

Czech investigators have determined that a Boeing 737-800 crew’s failure to comply with sterile cockpit procedures during an approach to a wet runway at Pardubice contributed to its landing long and overrunning onto rough ground. The US-registered Swift Air aircraft (N624XA) was arriving from Heraklion, Crete. Cockpit-voice recordings captured a “lively discussion” between the pilots on topics “not directly related to the flight performance” for the “whole approach and landing”, says Czech investigation authority UZPLN. The aircraft overflew the threshold of runway 27 at a height of 64ft and touched down at 965m (3,166ft) – almost 40% along the 2,500m runway – after a prolonged flare. UZPLN says the crew “did not perform” a landing calculation in spite of acknowledging the wet runway status. The selection of 30° flap and the “autobrake 2” setting was “most likely only by guess and prior experience” of landing at Pardubice, it adds. While the first officer, who was flying, queried whether to use a higher autobrake setting, the captain responded that this would not matter because reverse-thrust would be available. The crew did not take into consideration tailwind information reported by air traffic control, says the inquiry, and a factored calculation should have warned the pilots that the true stopping distance could be longer than the landing distance available. The jet touched down with a groundspeed of 152kt and the pilots immediately applied reverse thrust. As the aircraft decelerated through 80kt the captain took control of the aircraft – the investigators say that this was done “indifferently” – and commenced manual braking. Only after the aircraft had reached this 80kt threshold did the crew observe visual markings indicating it was approaching the runway end. The report criticises the captain’s slow decision-making rate. The aircraft overran onto grass and stopped with its main landing-gear about 12m beyond the end of the runway. UZPLN says the distraction resulting from non-compliance with sterile-cockpit procedures meant the crew lost situational awareness. In testimony to the inquiry the captain and the first officer each underestimated the touchdown point. The captain had also believed the runway was wet, owing to reflective glare, and that the aircraft aquaplaned. But investigation says the runway was not very wet, and “It is possible that, in fact, no aquaplaning was experienced.” None of the 159 passengers and six crew members was injured, and the aircraft - operating on behalf of Smartwings – was undamaged.

 

Air Niugini 737-800, crash on final approach, Chuuk, Micronesia, 28 September 2018

The captain of an Air Niugini Boeing 737-800 that crashed on final approach to Chuuk, according to the investigators, became fixated with landing the aircraft to the extent of ignoring several warnings that the aircraft had an excessive sink rate and eventually dipped below the glideslope. The final report into the fatal accident of the aircraft (P2-PXE) by Papua New Guinea’s Accident Investigation Commission (AIC) concluded that the aircraft was unstable on its approach, and the co-pilot should have taken control of the aircraft and initiated a missed approach, in accordance with the operator’s standard operating procedure manual. “The pilots’ actions and statements indicated that they had lost situational awareness from 625ft on the approach and their attention had become channelised and fixated on completing the approach and landing the aircraft.” It notes that the pilots failed to respond to 16 aural alerts from the EGPWS, “pull up” visual warnings at the bottom of the primary flight display, and indications from the PAPI that the aircraft’s approach angle was too high, choosing instead to continue. The pilot-in-command also reported that there was no visibility for the last 30 seconds of the flight due to encountering a small storm cell. The report says: “The co-pilot was completely unaware of the hazardous situation unfolding and did not challenge the PIC and attempt to take control of the aircraft and execute a go-around, in accordance with company instructions.” As a result, the aircraft impacted the water of Chuuk Lagoon around 1,500ft (460m) short of the runway threshold, glancing across the water several times and turning clockwise before coming to rest partially submerged. Of the 12 crew and 36 passengers on board, 46 occupants were evacuated from the aircraft. Six passengers sustained serious injuries. The report observes that the evacuation was slowed by passengers’ attempts to recover baggage. Most passengers were rescued by local boats, and some assisted by US Navy divers that were in the area. There was one fatality, which a post-mortem concluded was due to injuries from the force of the impact with the water and the fact he was not wearing a seat belt. The body was retrieved three days later by local divers. The AIC made 12 recommendations to Air Niugini, mostly relating to training on evacuations, safety placards and other safety deficiencies, which were addressed and subsequently closed off by the Commission. However, a recommendation to Honeywell that the EGPWS be upgraded to include a continuous “pull up” aural and primary flight display warning replace the “sink rate” warning below 500ft radio altitude remains open. A comment added by the US NTSB disagrees that a change to the aural warning would have succeeded in alerting the crew. Discussions are continuing with the US FAA, NTSB and the manufacturer.

 

Porter Dash 8-400, depressurisation, 17 July 2019

A preliminary report by the Transportation Safety Board of Canada (TSB) on a rapid cabin depressurisation event involving a Porter De Havilland Canada Dash 8-400 (C-GLQO) suggests there are problems with the aft cargo door, and a similar fault has affected two other Porter Dash 8-400s and a WestJet one. All the aircraft landed safely with no injuries. In January, following the three previous incidents, both Porter and WestJet said they were making aircraft modifications to address a known depressurisation issue caused by a cargo door problem. On the Porter flight from Toronto City to Boston, near Albany, New York, the “crew experienced a pressurisation issue” that caused the cabin altitude to climb “at a very high rate”, says the TSBC report. The pilots initiated an emergency descent and declared mayday. When the aircraft descended to 10,000ft “it was determined there was no structural damage” and the aircraft continued safely to Boston. A post-flight inspection revealed the aft baggage blowout panel was loose. TSB reports on the earlier incidents said pilots of those aircraft received fuselage door warnings prior to depressurisations. These were later traced to cargo door handles being either improperly secured or “moving out of the flushed, latched position”. As a result, the cargo compartments depressurised, which, in one instance, dislodged the aft cabin bulkhead blowout panel. This was later determined to be affected by an imperfection in the door seal. Then in January Porter and WestJet said they were making modifications to address the issue. They said manufacturer Bombardier had issued guidance for a fix involving modifying the door latches. TSB says there is no risk to the aircraft’s safety.