Tuesday, November 13, 2018

It Looks Like That Indonesian Boeing 737 That Went Down Was Boeing's Fault

Word is breaking today on Ars Technica that the Indonesian Lion Airways Boeing 737 Max that went down two weeks ago was due to failure of a system on which Boeing had released almost no training information.
On November 6, Boeing issued an update to Boeing 737 MAX aircrews. The change, directed by the Federal Aviation Administration (FAA), came because Boeing had never provided guidance to pilots on what to do when part of an updated safety system malfunctioned—the very scenario that the pilots of Indonesia's Lion Air Flight 610 faced on October 29. Not knowing how to correct for the malfunction, the aircrew and their passengers were doomed. All aboard were lost as the aircraft crashed into the Java Sea.

First approved for commercial operation by the FAA on March 8, 2017, the MAX is just beginning to be delivered in large volumes. Lion Air was one of Boeing's primary foreign customers for the MAX, which is also flown by Southwest Airlines, American Airlines, and Air Canada. The Lion Air aircraft lost in the accident was virtually brand new, delivered by Boeing in August; this was the first accident involving an aircraft touted for its safety.
In what I can only describe as incredibly shocking, Boeing never told pilots about one key new safety feature—an automated anti-stall system—or how to troubleshoot its failure.

In aviation, the word "stall" doesn't mean what it does in a car.  The engines are running, it's that the aircraft's wings can no longer achieve lift.  An aircraft's wing can only generate lift over a relatively narrow range of angles to the oncoming air, called the angle of attack (AOA).  This graphic, from Ars, illustrates an example.

From the top down, the nose is angled at 6 degrees to the horizontal for cruising.  More lift can be achieved by increasing that angle, which is done by raising the nose, and maximum lift (for this wing) occurs with the aircraft at a 15 degree angle.  The aircraft can go beyond that while maintaining lift but as it does, the lift goes down as the region of separated air gets larger, eventually destroying the ability to lift.  In the right conditions, passengers can see the air separating on the top side of the wing, usually during takeoff, and it appears as fog forming in the area shown as the "separation point" in the middle figure.

The way the original piece said, "Boeing issued an update to Boeing 737 MAX aircrews. The change, directed by the Federal Aviation Administration (FAA)" sounds like an airworthiness directive (AD);  ADs are generally considered serious in the business because they mean the aircraft isn't considered safe to fly unless the subject of the AD is fixed.  The November 6th update raised an outcry from pilots in the US.
Allied Pilots Association spokesperson and 737 captain Dennis Tajer told Reuters that his union members were only informed of a new anti-stall system that had been installed by Boeing on 737 MAX aircraft after the Lion Air crash. “It is information that we were not privy to in training or in any other manuals or materials,” Tajer told Reuters.

Jon Weaks, president of the Southwest Airlines Pilots Association, told Bloomberg, “We don’t like that we weren’t notified.” Southwest has ordered 257 737 MAX aircraft; American has orders for 85 still pending.
In the past, aircraft had manual ways of notifying the pilot that it was going into a stall, by sensing the AOA and when it got into regimes likely to stall, turning on motors that shook the control stick or yoke in the pilot's hands.
But the new system in the 737 uses data from the aircraft's AOA and airspeed sensors to proactively counter pilot error, adjusting the aircraft's controls to push the nose down if the sensors indicate the aircraft could stall.

Initial data from the investigation of the crash of Lion Air Flight 610 indicates that the AOA sensor was providing "erroneous input," according to a Boeing statement. The aircraft had recently had an AOA sensor replaced, and had experienced additional unidentified issues; a maintenance technician was aboard at the time of the crash, but not because of the AOA sensor.

The faulty AOA sensor data may have caused the aircraft's trim system to lower the nose down in order to avoid a stall. This would only occur during manual flight; when in autopilot, the AOA sensor data would not have affected flight controls.
It's worth emphasizing here that the issue is that Boeing never mentioned this system in training materials with the new Max deliveries and nobody in the air crew knew what to do with erroneous AOA data because they were never trained in what to do.  A system the pilot didn't know was on the aircraft failed and caused the aircraft to behave unexpectedly.  

Boeing has apparently released new training materials; materials that should have preceded delivery of the first 737 Max.  The text of the Service Bulletin for the newly delivered Maxes is in the Ars link. 

This one strikes close to home.  I've met a few people in that program at Boeing.  When I retired from Major Avionics Corporation, some of the radios (and radar) for the Max were things I'd designed in the past.  It's hard for me to wrap my head around a screw-up like this. 


  1. I'm stunned. I worked for Boeing, and several guys I worked with came from Boeing Commercial Aircraft. These guys are straight-shooters, and Boeing has controls in place to prevent something like this from happening.

    This is completely inexcusable in the commercial aircraft field.

    Somebody's head will roll over this.....

    1. A smaller company might be destroyed by this, but I think Boeing has enough resources to withstand 200 lawsuits (rough number). I agree that someone's going to be gone soon. Maybe a handful of folks.

      When I first saw the story, I had to do some more research to make sure it was right, but it has gone widely reported.

  2. Reason # 40,256 not to fly... Haven't flown since 1976 and I don't miss it.

  3. Of all of the things this system could do, why does it have to override the input the pilot is providing via the stick? Sure, raise all hell, klaxons alarms, stall stall stall, but let the guy fly the damn plane!

    This kind of sensor issue is common in automobiles, this is why I think self driving cars will always be a couple of years away, there is just too much to go wrong.

    1. There's a few real WTF things here, but the biggest one is not assuming the system will fail some day and developing procedures for figuring out what failed and working around it. Boeing is ordinarily completely anal about such things.

      These are the guys who kept the "Gimli Glider" from spreading wreckage over a square mile by having an emergency power source, a Ram Air Turbine, that drops out of the bottom of the aircraft when all other power goes away. If that's not thinking of every possible problem and designing a way around it, I don't what is.

      The basic philosophy of "let the pilot in command be in command, not the computer" was more Boeing's approach than Airbus'. This just shouldn't have happened.

  4. Sounds like Boeing is trying to emulate Airbus. Big mistake. BIG mistake. Absolutely stupid thinking on their part. THAT is one of the basic differences between them. Actually, it DEFINES the difference. Airbus is all about the plane ignoring the pilots inputs. It knows better. Lots of people die due to it. Seems Boeing wants to join the club.

    1. I will second your comment as that is the exact thoughts that ran through my head as I read SiGraybeard's article. This is not good for passengers. My bona fides are as a former AF Transport Pilot and degreed engineer. Boeing should be financially hurt for doing this; I just don't know how.

  5. I had not heard that they'd found the aircraft. With the news cycle what it is, if you're not plugged in completely, this stuff just passes and vanishes into the traffic on the information superhighway.

  6. I'm skeptical. Too soon to know. BUT the lawyers (and governments) go after the deep pockets, hence; it's Boeing's fault.

  7. I wonder why only Lion Airways had this problem? And I note that the pilots of this plane on previous flights ALSO reported anomalies, but nothing was done? To me, it sounds like typical fourth world culture...

    You might want to note what Lion Air's safety record is. And where they were banned from flying as a result. Yeah, it might be Boeing's fault. Or not. And unfortunately, in the current environment, one cannot even have faith in the "investigation".

  8. Re: "faith in the "investigation"." Do you believe flight 800 blew itself up?