Ignored SymptomsThe ADIRS provides air and position data to several other systems within the aircraft. Each ADIRU consists of two parts, Air Data Reference, and Inertial Reference. The Air Data Reference collects the analog data of the on-side pitot tubes, static ports, and angle of attack (AOA) vane. The data is digitalized and sent out over a single data bus to under others the on-side Flight Control Computer (FCC), Flight Management Computer (FMC), Display Electronic Unit (DEU) and Stall Management Yaw Damper (SMYD). Each of these systems copies the relevant information off the bus and ignore the rest.
During these four days, the maintenance response was to several times reset the circuit breakers, clean the electrical connectors and replace the AOA sensor. Most maintenance organizations and airlines specify in their procedures that, if a fault recurs three times, the affected aircraft must remain grounded until the faulty system can be thoroughly inspected and repaired. Had this happened, Boeing 737MAX PK-LQP would have been grounded on 27 October 2018, two days before its fatal last flight.
As the AOA data recorded by the flight data recorder, also, is pulled off the digital output bus of each ADIRU, it can not be said with certainty yet whether the AOA sensor or the ADIRU itself was the reason for the left angle of attack value to be 20 degrees higher than the right sensor. Recovery and inspection of the affected parts by the investigating authorities may shed more light on that. Still, with the information currently known in the preliminary report, valuable lessons may be learned which apply to other aircraft types too.
To Know or not to KnowThe system knowledge taught to pilots is usually limited to the information the manufacturer considers required for the safe conduct of flight. The underlying reasoning is that the pilot's job is to fly the aircraft and perform the prescribed procedures, not trouble-shoot faults. The downside of this philosophy is that pilots may not always truly understand the potential consequences of a fault. This lack of understanding could lead to unforeseen related faults.
In the case of LT610, the appearance of the SPEED TRIM FAIL light, MACH TRIM FAIL light, A/T ARM DISC light, FEEL DIFF PRESS light, and AIS/ALT DISAGREE flag over several previous flights could alert the pilots to a potential issue with the ADIRS and secondary failures in systems dependent on this information. In the event of Lion Air 610 this included the MCAS, leading to the ultimate fatal nose-down trim and ensuing crash. This behavior is not unique to the 737MAX however. The Boeing 737NG manuals specify the following:
During a stall, the FCCs command the stabilizer to trim the airplane nose down. The EFSM and column cut-out switch modules operate to make sure the pilot cannot easily stop this automatic stabilizer movement with the elevator control column nose up input. Boeing 737NG Aircraft Maintenance Manual, 27-32-00 As airspeed decreases towards stall speed, the speed trim system trims the stabilizer nose down and enables trim above stickshaker AOA. With this strim schedule the pilot must pull more aft column to stall the airplane. With the column aft, the amount of column force increase with the onset of EFS module is more pronounced. Boeing 737NG Flight Crew Operating Manual Vol.2, 9.20.11Some specific 737NG configurations do not have this behavior, however, most do. Options may differ between airlines.
Root CauseWhen pilots have an understanding of the potential root causes of faults that aren’t threatening on itself, they can also better estimate the possible consequences. A good example of this is Air Canada Flight AC850 on the November 2nd, 2015 (B767-300 from Calgary to London Heathrow). Climbing out after take-off the pilots noticed a TAT PROBE warning on their Engine Indicating and Crew Alerting System (EICAS) display. A little later they discovered LNAV and VNAV navigation modes where unavailable and the FMS (Flight Management System) did not permit viewing the flight plan waypoints. The crew elected to abort the flight, declared an emergency and landed safely on Calgary. Post-flight analysis found a faulty relay in the Air/Ground Sensing System. A minor fault, however, one which could have led to potentially disastrous secondary failures.
When faults can be anticipated, the consequences may be mitigated. Valuable response time may be saved and quick and effective action taken. Early awareness of potential problems requires for the crew to carefully analyze clues and signs, both in the maintenance logbook and on the actual flight. Seemingly minor faults should not be disregarded as a nuisance. Instead, their potential as early warning sign should be evaluated. Aircraft manufacturers and training providers have a responsibility to make sure the required information for the crew to make such evaluation is available and practiced in realistic scenarios.
ConclusionPilots should pay attention that certain failures may be indicative of deeper problems and can lead to unexpected secondary failures. Any problems, no matter how seemingly minor, with core systems like the ADIRS, should always be regarded as very serious. Pilots could benefit from additional training on how various systems affect each other, and the potential of secondary failures. It is not the first time we suggest this, but these accidents make painfully clear we need to keep emphasizing the importance of crew's knowledge.
At D&V, our training is not about checking boxes and completing a fixed syllabus. Our training is about maximizing competence and deeper understanding. If you want to know how our competency-based training can help your airline be safer, reach out to us and we will be happy to help you find a tailored solution.