November 14, 2019

On Oct. 25, the Indonesian National Transportation Safety Committee (Indonesian acronym KNKT) released its final report into last year’s crash of Lion Air (JT) Flight 610, which killed all 189 people onboard and contributed to the later worldwide grounding of all Boeing 737 MAX aircraft. The report linked the crash to flaws in the Boeing 737 MAX’s flight control system, poor government oversight of Boeing, maintenance shortcomings at Lion Air, and inadequate piloting standards at Lion Air.

As a result of the KNKT’s findings, WorldAware is keeping Lion Air and all Lion Air subsidiaries at Not Preferred status in the Worldcue Airline Monitor. WorldAware also recommends that travelers consider avoiding flying on the 737 MAX for one year after the aircraft returns to service.


About the Lion Air Flight 610 Crash

According to the Oct. 25 KNKT report, the trigger for the series of events that led to Flight 610’s crash was a faulty angle of attack (AOA) sensor. The sensor appeared to have been miscalibrated by a US-based maintenance company that was repairing the sensor, and Lion Air’s maintenance subsidiary failed to detect the calibration error when they installed it on the aircraft that operated Flight 610, despite the fact that a calibration test is a required step in the AOA sensor installation process.

The faulty AOA sensor caused multiple error messages as soon as Flight 610 took off. The flight’s captain continued to fly the aircraft, while the first officer attempted to diagnose the error messages, but the first officer had considerable difficulty completing basic tasks and finding the appropriate checklists in the aircraft’s handbook. As the pilots diagnosed these issues, the faulty AOA sensor caused an erroneous activation of the aircraft’s Maneuvering Characteristics Augmentation System (MCAS), a new system on the 737 MAX that used the aircraft’s trim system to automatically push the aircraft’s nose down if the AOA got too high.

The pilots of Flight 610, like nearly all 737 MAX pilots around the world, were unaware that MCAS existed, as Boeing did not mention it in their manuals or training materials. Flight 610’s pilots were also unaware that the same sequence of error messages and nose-down inputs had occurred on the previous flight, and that the pilots had resolved the issue by turning off the electronic trim system, as the pilots on the previous flight had not mentioned the nose-down inputs or turning off the trim system in their post-flight reporting.

The captain repeatedly counteracted the MCAS activations by using nose-up trim inputs while the first officer struggled to diagnose the error messages. Approximately five minutes after the first MCAS activation, the captain handed control of the flight to the first officer, without mentioning the nose-down inputs or the fact that he was using nose-up trim to counteract the inputs. The first officer failed to use nose-up trim, and the captain did not respond to the first officer’s increasing struggles to control the aircraft. Within a minute of the handover, the aircraft crashed into the ocean.


Where the Failings Occurred

According to the KNKT’s investigation, the crash of Flight 610, like most modern airliner crashes, did not have a single cause; rather, it involved a chain of events with multiple failures that contributed to the tragic outcome. Had any one of these failures not occurred, the aircraft likely would have landed safely. The failures highlighted major safety concerns with the maintenance standards, piloting standards, and safety culture at Lion Air as well as major concerns regarding the design and certification of the 737 MAX aircraft.


Boeing and the MCAS Design

The KNKT found that Boeing made several mistaken assumptions when designing and certifying the MCAS, which led Boeing to design a system that could be erroneously activated by a single faulty AOA sensor. Recent reports from the US National Transportation Safety Board (NTSB) and the Joint Authorities Technical Review (JATR) convened by the FAA drew similar conclusions. Boeing assumed that pilots would react within three seconds to an erroneous MCAS activation by counteracting the nose-down inputs, then disabling the electronic trim system. Based on this assumption, Boeing determined that it would be safe to have the MCAS rely on data from only one of the aircraft’s two AOA sensors. Boeing, however, only assessed the risk of an erroneous MCAS activation in isolation. In practice, a faulty AOA sensor would cause multiple error messages and alarms on an aircraft before it activated MCAS; therefore, pilots would be busy addressing the other faults when MCAS activated. In practice, none of the pilots on the three known flights that encountered erroneous MCAS activations reacted as Boeing assumed they would.


Boeing’s Communication with the FAA and Airlines

The KNKT and JATR also found that Boeing failed to adequately communicate with the US Federal Aviation Administration (FAA) and airlines regarding the MCAS. The FAA approved Boeing’s initial risk assessment allowing it to operate the MCAS with only one sensor, but Boeing later more than tripled the rate at which MCAS changed the aircraft’s trim and failed to adequately communicate the change to the FAA. The FAA’s outsourcing of much of its certification responsibility to Boeing employees, who according to reputable media reports, were under significant pressure to keep the 737 MAX’s tight development schedule on track, may have contributed to the FAA’s failure to adequately understand MCAS. Boeing also did not mention MCAS in its manuals or training materials for the 737 MAX, as the company was determined to design the aircraft so that pilots upgrading to the 737 MAX from the older 737 NG model would not have to go through simulator training.


Lion Air Maintenance

The KNKT investigation found major shortcomings in Lion Air’s maintenance standards, piloting standards, and safety culture. The KNKT report questioned whether Lion Air’s maintenance subsidiary omitted a key calibration test when it installed the new AOA sensor on the aircraft that later crashed. Lion Air submitted photos claiming to show that the test had been performed properly, but the KNKT found that these photos were of a different aircraft. At best, Lion Air’s maintenance subsidiary did not perform the calibration test correctly and submitted the wrong photos due to disorganized documentation; at worst, the company reported doing work that had not been done, then attempted to mislead investigators with the photos of the different aircraft.


Lion Air Pilots’ Incident Reporting

The KNKT also criticized several actions by the Lion Air pilots who flew the same aircraft the day before it crashed, and encountered the same erroneous MCAS activations. While the pilots on that flight eventually resolved the MCAS activations by disabling the electronic trim system, they failed to report the repeated nose-down inputs or the method they used to stop them in their post-flight maintenance report. Had the pilots reported the issues properly, the pilots of Flight 610 would likely have known how to resolve the nose-down inputs when they occurred on their flight and would have almost certainly prevented the crash. An accurate report of the issues on the previous flights would have also increased the likelihood of Lion Air’s technicians linking the issue to the AOA sensor and discovering the calibration error with the sensor.


Lion Air Pilots’ Teamwork and Flying Skills

The KNKT found serious shortcomings in Flight 610’s pilots’ communication and flying skills. Flight 610’s captain did a poor job of communicating with his first officer during the flight. He failed to inform the first officer about the details of the flight’s control issues and did not provide adequate instructions. The first officer, meanwhile, struggled with basic tasks and checklists as he sought to diagnose and address the aircraft’s error messages. After the captain handed control of the flight over to the first officer, the first officer failed to control the aircraft, and the captain failed to take back control of the aircraft once the first officer began to struggle. According to the KNKT, each pilot’s shortcomings were consistent with issues that had appeared during the pilots’ respective training sessions, and Lion Air had failed to adequately address the shortcomings.


WorldAware Recommendations

WorldAware will continue to list Lion Air and all of its subsidiaries as Not Preferred until we receive clear indications that the airline has addressed the shortcomings that contributed to Flight 610’s crash. WorldAware also recommends that travelers consider avoiding flying on the 737 MAX for a year after it returns to service despite changes Boeing has made to the MCAS.

WorldAware downgraded Lion Air and its subsidiaries Batik Air (ID), Malindo Air (OD), Thai Lion Air (SL), and Wings Air (IW) to Not Preferred status in the Worldcue Airline Monitor after the KNKT released its interim report into the crash of Flight 610. That report provided the initial indications that maintenance and safety culture shortcomings at the airline contributed to the crash. The final report into Flight 610’s crash has reinforced this decision to downgrade the airlines, as it identified further shortcomings in the airline’s piloting standards and safety culture. The possibility that Lion Air attempted to deliberately mislead investigators over whether its maintenance subsidiary performed the calibration test on the AOA sensor is also deeply concerning.

Lion Air’s subsidiaries will remain at Not Preferred status for the near future as Lion Air’s maintenance subsidiary is also responsible for maintaining these airlines’ aircraft. The faulty AOA sensor installed on Flight 610 was originally sourced from Malindo Air. The fact that it was subsequently installed on a Lion Air aircraft instead of a Malindo Air or other Lion Air subsidiary aircraft was a matter of chance, not a difference in safety standards between the carriers.

The 737 MAX will likely return to service in the first half of 2020. While WorldAware is confident that Boeing and the FAA will address the shortcomings of the MCAS, the fact that the design and certification process of the 737 MAX failed to pick up on the flaws in the MCAS raises the question of whether any other parts of the 737 MAX’s design are similarly flawed. Both the NTSB and JATR outlined significant deficiencies in the FAA’s certification process and Boeing’s communications with the FAA during the 737 MAX’s certification, but neither Boeing nor the FAA have outlined any specific plans to review the assumptions, certification standards, and overall safety of any system on the 737 MAX besides the MCAS. WorldAware, therefore, recommends that travelers consider waiting a year after the 737 MAX has returned to service before flying on it. This delay will allow the aircraft to accumulate additional time in service, which should help to expose any other safety issues that may exist. 


About WorldAware

WorldAware provides intelligence-driven, integrated risk management solutions that enable multinational organizations to operate globally with confidence. WorldAware's end-to-end tailored solutions integrated world-class threat intelligence, innovative technology, and response services to help organizations mitigate risk and protect their employees, assets, and reputation.