Indonesia 737 crash caused by “safety” feature change pilots weren’t told of
On November 6, Boeing issued an update to Boeing 737 MAX aircrews. The change, directed by the Federal Aviation Administration (FAA), came because Boeing had never provided guidance to pilots on what to do when part of an updated safety system malfunctioned—the very scenario that the pilots of Indonesia’s Lion Air Flight 610 faced on October 29. Not knowing how to correct for the malfunction, the aircrew and their passengers were doomed. All aboard were lost as the aircraft crashed into the Java Sea.
First approved for commercial operation by the FAA on March 8, 2017, the MAX is just beginning to be delivered in large volumes. Lion Air was one of Boeing’s primary foreign customers for the MAX, which is also flown by Southwest Airlines, American Airlines, and Air Canada. The Lion Air aircraft lost in the accident was virtually brand new, delivered by Boeing in August; this was the first accident involving an aircraft touted for its safety.
Update: But Boeing never told pilots about one key new safety feature—an automated anti-stall system—or how to troubleshoot its failure. The manual update raised an outcry from pilots in the US.
Allied Pilots Association spokesperson and 737 captain Dennis Tajer told Reuters that his union members were only informed of a new anti-stall system that had been installed by Boeing on 737 MAX aircraft after the Lion Air crash. “It is information that we were not privy to in training or in any other manuals or materials,” Tajer told Reuters.
Jon Weaks, president of the Southwest Airlines Pilots Association, told Bloomberg, “We don’t like that we weren’t notified.” Southwest has ordered 257 737 MAX aircraft; American has orders for 85 still pending.
A stall is a dangerous situation where the lift from an aircraft’s wings no longer is enough to counter the weight of the plane, causing it to lose control and fall. Stalls usually happen when an aircraft’s angle of attack (AOA)—the angle relative to the motion of air over the aircraft that the aircraft’s nose is pointing—reaches an angle that reduces the lift the wings can produce at its current air speed; pulling the nose of the aircraft up at lower air speed can result in a stall.
In the past, anti-stall systems have either issued audible warnings to pilots or, as in newer systems, used a sensory feedback system that warns the pilot by putting more resistance on the aircraft’s control stick or yoke when the pilot is approaching the critical angle. But the new system in the 737 uses data from the aircraft’s AOA and airspeed sensors to proactively counter pilot error, adjusting the aircraft’s controls to push the nose down if the sensors indicate the aircraft could stall.
Initial data from the investigation of the crash of Lion Air Flight 610 indicates that the AOA sensor was providing “erroneous input,” according to a Boeing statement. The aircraft had recently had an AOA sensor replaced, and had experienced additional unidentified issues; a maintenance technician was aboard at the time of the crash, but not because of the AOA sensor.
The Operational Manual Bulletin sent out by Boeing on November 6 provides procedures for dealing with that sort of situation, but no prior training provided by Boeing ever mentioned the automated system.
[Update 4:30 pm ET] The text of Boeing’s bulletin read:
This bulletin directs flight crews to existing procedures to address this condition. In the event of erroneous AOA data, the pitch trim system can trim the stabilizer nose down in increments lasting up to 10 seconds. The nose down stabilizer trim movement can be stopped and reversed with the use of the electric stabilizer trim switches but may restart 5 seconds after the electric stabilizer trim switches are released. Repetitive cycles of uncommanded nose down stabilizer continue to occur unless the stabilizer trim system is deactivated through use of both STAB TRIM CUTOUT switches in accordance with the existing procedures in the Runaway Stabilizer NNC. It is possible for the stabilizer to reach the nose down limit unless the system inputs are counteracted completely by pilot trim inputs and both STAB TRIM CUTOUT switches are moved to CUTOUT.
Additionally, pilots are reminded that an erroneous AOA can cause some or all of the following indications and effects:
– Continuous or intermittent stick shaker on the affected side only.
– Minimum speed bar (red and black) on the affected side only.
– Increasing nose down control forces.
– Inability to engage autopilot.
– Automatic disengagement of autopilot.
– IAS DISAGREE alert.
– ALT DISAGREE alert.
– AOA DISAGREE alert (if the AOA indicator option is installed)
– FEEL DIFF PRESS light.In the event an uncommanded nose down stabilizer trim is experienced on the 737 – 8 / – 9, in conjunction with one or more of the above indications or effects, do the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight.
The faulty AOA sensor data may have caused the aircraft’s trim system to lower the nose down in order to avoid a stall. This would only occur during manual flight; when in autopilot, the AOA sensor data would not have affected flight controls.
The failure of an air safety system is exceedingly rare but not unheard of for new aircraft. This accident shows the inherent risk of taking control of critical systems away from humans without their knowledge, and the unforseen consequences of increasingly complex systems.
Update: a graphic attached to this report earlier showed how a “deep stall” occurs, which is not relevant to the 737 design. That image has been replaced.
