When One Sensor Fails

In early January 2024, Boeing 737 MAX safety was back in the news. After a cabin panel on a 737 MAX 9 operated by a US airline broke off in flight on 5 January, operations of the three 737 MAX 9 aircraft flown by Lion Air were suspended from 6 January, according to the Transport Ministry. The aircraft were inspected with a focus on the mid-cabin emergency exit door, whose configuration differs from the aircraft in the US incident (The Jakarta Post, 2024a), and were cleared to fly again from 11 January (The Jakarta Post, 2024b).

The caution is understandable given this aircraft type's history in Indonesia. To see why, we return to a completed official investigation: the final report of Indonesia's National Transportation Safety Committee (KNKT) on the 2018 PK-LQP accident. Our focus is not aviation as such but the lessons for the digital safety systems now spreading through workplaces.

The Accident

On 29 October 2018 at about 06.32 local time, Boeing 737-8 (MAX) PK-LQP, flying from Jakarta to Pangkal Pinang, disappeared from radar after the crew reported flight control, altitude, and airspeed problems. The aircraft hit the water off Tanjung Karawang and all 189 people on board died (Komite Nasional Keselamatan Transportasi [KNKT], 2019).

The trouble had started three days earlier. Speed and altitude flags first appeared on the captain's display on 26 October, and the left angle of attack (AOA) sensor was replaced in Denpasar on 28 October. The replacement sensor had a bias of about 21 degrees that went undetected during the installation test. On the flight from Denpasar to Jakarta, the erroneous AOA data triggered multiple alerts, repeated activation of the Maneuvering Characteristics Augmentation System (MCAS), and a stick shaker that stayed active throughout. The crew stopped MCAS by switching the stabiliser trim to cut out, but the post-flight report did not mention the stick shaker or that action (KNKT, 2019). According to the flight data and cockpit voice recorders, the next morning's flight from Jakarta had the same problems, and the crew did not identify the runaway stabiliser (KNKT, 2019).

Contributing Factors

KNKT (2019) listed nine contributing factors in chronological order rather than by weight. Those most relevant to digital systems:

• MCAS was designed to rely on a single AOA sensor, making it vulnerable to erroneous input from that sensor.
• Assumptions about crew response to malfunctions, made during design and certification, turned out to be incorrect.
• The AOA DISAGREE alert was not correctly enabled. The software tied it to the AOA indicator, an optional feature that Boeing said about 20 percent of airlines had selected, so the alert never appeared on PK-LQP.
• Flight manuals and crew training contained no information on MCAS.
• The sensor's mis-calibration was not detected during repair or installation, and the maintenance log did not carry all the symptoms from the previous flight.

An Automation Lens

Parasuraman and Riley (1997) distinguish use, misuse, disuse, and abuse of automation. Misuse is over-reliance on automation; disuse is often triggered by alarms that go off falsely; abuse is automation of functions by designers and its implementation by managers without due regard for the consequences for human performance.

In our reading, PK-LQP fits abuse in that sense best: an automatic function acted quietly on one sensor, the alert meant to aid diagnosis depended on a feature option, and users were not told the function existed. None of these was one person's error on the day; all were design and management decisions made long before (KNKT, 2019).

Lessons for Digital OHS

Plants and projects now use fixed gas detectors, temperature sensors, safety instrumented systems, and OHS apps that raise alarms or shut processes down automatically. We draw five lessons from the report:

• Identify which safety functions rely on a single sensor, and decide deliberately whether that dependence is acceptable (KNKT, 2019).
• Test alarm logic in every configuration in use, including when optional features are switched off (KNKT, 2019).
• Require recorded calibration checks after any sensor is replaced or repaired (KNKT, 2019).
• Make sure anomalies are logged in full and handed over to the next shift. After the accident, Lion Air instructed pilots to fill in defect reports in as much detail as necessary (KNKT, 2019).
• Train users on what the automation does and how to take over, to avoid both over-reliance and ignored alarms (Parasuraman & Riley, 1997).

How Nusa Safety Helps

Nusa Safety helps companies design and review digital OHS systems, including alarm flows and anomaly logging, through its HSE digitalization service. To build the skill of tracing the design and organisational factors behind an event, the Nusa Safety team offers incident investigation and RCA training. Nusa Safety issues internal training certificates only.

This article is general information and not legal or professional advice for any specific case.

References

1. Komite Nasional Keselamatan Transportasi. (2019). Aircraft accident investigation report PT. Lion Mentari Airlines Boeing 737-8 (MAX); PK-LQP, Tanjung Karawang, West Java, Republic of Indonesia, 29 October 2018 (Report No. KNKT.18.10.35.04). https://skybrary.aero/bookshelf/final-report-b38m-pk-lqp-en-route-northeast-jakarta-indonesia-29-oct-2018
2. Parasuraman, R., & Riley, V. (1997). Humans and automation: Use, misuse, disuse, abuse. Human Factors, 39(2), 230-253. https://doi.org/10.1518/001872097778543886
3. The Jakarta Post. (2024a, January 8). Lion Air temporarily halts Boeing 737 MAX 9 operations. https://www.thejakartapost.com/business/2024/01/09/lion-air-temporarily-halts-boeing-737-max-9-operations.html
4. The Jakarta Post. (2024b, January 19). Indonesia allows Boeing 737 MAX 9 planes to fly again. https://www.thejakartapost.com/business/2024/01/19/indonesia-allows-boeing-737-max-9-planes-to-fly-again-