It Looks Like That Indonesian Boeing 737 That Went Down Was Boeing's Fault

Word is breaking today on Ars Technica that the Indonesian Lion Airways Boeing 737 Max that went down two weeks ago was due to failure of a system on which Boeing had released almost no training information.

On November 6, Boeing issued an update to Boeing 737 MAX aircrews. The change, directed by the Federal Aviation Administration (FAA), came because Boeing had never provided guidance to pilots on what to do when part of an updated safety system malfunctioned—the very scenario that the pilots of Indonesia's Lion Air Flight 610 faced on October 29. Not knowing how to correct for the malfunction, the aircrew and their passengers were doomed. All aboard were lost as the aircraft crashed into the Java Sea.

First approved for commercial operation by the FAA on March 8, 2017, the MAX is just beginning to be delivered in large volumes. Lion Air was one of Boeing's primary foreign customers for the MAX, which is also flown by Southwest Airlines, American Airlines, and Air Canada. The Lion Air aircraft lost in the accident was virtually brand new, delivered by Boeing in August; this was the first accident involving an aircraft touted for its safety.

In what I can only describe as incredibly shocking, Boeing never told pilots about one key new safety feature—an automated anti-stall system—or how to troubleshoot its failure.

In aviation, the word "stall" doesn't mean what it does in a car.  The engines are running, it's that the aircraft's wings can no longer achieve lift.  An aircraft's wing can only generate lift over a relatively narrow range of angles to the oncoming air, called the angle of attack (AOA).  This graphic, from Ars, illustrates an example.

From the top down, the nose is angled at 6 degrees to the horizontal for cruising.  More lift can be achieved by increasing that angle, which is done by raising the nose, and maximum lift (for this wing) occurs with the aircraft at a 15 degree angle.  The aircraft can go beyond that while maintaining lift but as it does, the lift goes down as the region of separated air gets larger, eventually destroying the ability to lift.  In the right conditions, passengers can see the air separating on the top side of the wing, usually during takeoff, and it appears as fog forming in the area shown as the "separation point" in the middle figure.

The way the original piece said, "Boeing issued an update to Boeing 737 MAX aircrews. The change, directed by the Federal Aviation Administration (FAA)" sounds like an airworthiness directive (AD);  ADs are generally considered serious in the business because they mean the aircraft isn't considered safe to fly unless the subject of the AD is fixed.  The November 6th update raised an outcry from pilots in the US.

Allied Pilots Association spokesperson and 737 captain Dennis Tajer told Reuters that his union members were only informed of a new anti-stall system that had been installed by Boeing on 737 MAX aircraft after the Lion Air crash. “It is information that we were not privy to in training or in any other manuals or materials,” Tajer told Reuters.

Jon Weaks, president of the Southwest Airlines Pilots Association, told Bloomberg, “We don’t like that we weren’t notified.” Southwest has ordered 257 737 MAX aircraft; American has orders for 85 still pending.

In the past, aircraft had manual ways of notifying the pilot that it was going into a stall, by sensing the AOA and when it got into regimes likely to stall, turning on motors that shook the control stick or yoke in the pilot's hands.

But the new system in the 737 uses data from the aircraft's AOA and airspeed sensors to proactively counter pilot error, adjusting the aircraft's controls to push the nose down if the sensors indicate the aircraft could stall.

Initial data from the investigation of the crash of Lion Air Flight 610 indicates that the AOA sensor was providing "erroneous input," according to a Boeing statement. The aircraft had recently had an AOA sensor replaced, and had experienced additional unidentified issues; a maintenance technician was aboard at the time of the crash, but not because of the AOA sensor.

The faulty AOA sensor data may have caused the aircraft's trim system to lower the nose down in order to avoid a stall. This would only occur during manual flight; when in autopilot, the AOA sensor data would not have affected flight controls.

It's worth emphasizing here that the issue is that Boeing never mentioned this system in training materials with the new Max deliveries and nobody in the air crew knew what to do with erroneous AOA data because they were never trained in what to do.  A system the pilot didn't know was on the aircraft failed and caused the aircraft to behave unexpectedly.  

Boeing has apparently released new training materials; materials that should have preceded delivery of the first 737 Max.  The text of the Service Bulletin for the newly delivered Maxes is in the Ars link. 

This one strikes close to home.  I've met a few people in that program at Boeing.  When I retired from Major Avionics Corporation, some of the radios (and radar) for the Max were things I'd designed in the past.  It's hard for me to wrap my head around a screw-up like this.