Boeing issues 737 Operations Manual Bulletin after Lion Air accident

By Bjorn Fehrm

November 7, 2018, © Leeham News.: Boeing issued a message to the operators of 737 MAX aircraft yesterday to remind their pilots of the procedures if an unreliable Angle Of Attack (AOA) information is suspected while flying.

Below we describe what these procedures are and why Boeing is reminding its customers about what to do when suspecting a false AOA reading.

Lion Air Boeing 737 MAX 8. Source: Wikipedia.

Boeing’s 737 AOA sensors and how it affects the aircraft

We have read the Boeing bulletin, what has been issued from the Indonesian crash investigators and the FAA, and what has been discussed in media. Below, we try to bring some clarity and perspective into what is sometimes sensational headlines out of a minimum of facts.

The Federal Aviation Administration has today issued an Airworthiness Directive for the 737-8 and -9:

The FAA has issued an Emergency Airworthiness Directive (AD) that addresses possible erroneous angle of attack (AOA) inputs on Boeing 737 Max aircraft. These erroneous inputs can potentially make the horizontal stabilizers repeatedly pitch the nose of the airplane downward, making the aircraft difficult to control. The AD orders operators to revise the airplane flight manual (AFM) to give the flight crew horizontal stabilizer trim procedures to follow under certain conditions. The AD is effective immediately. Operators have three days to revise the AFM. The FAA continues to work closely with Boeing, and as a part of the investigative team on the Indonesia Lion Air accident, may take further appropriate actions depending on the results of the investigation.  The FAA has alerted foreign airworthiness authorities who oversee operators that use the 737 MAX of the agency’s action. “.

The Flight Crew Operations Manual (FCOM) bulletin from Boeing reminds operators that the existing procedures are the correct actions to be taken if an aircraft encounters a false stall warning and flight control recovery triggered by a faulty Angle Of Attack signal.

These procedures and the sensor system triggering them has stayed the same since 20 years as far as we understand. The system and its sensors have not been changed since the introduction of the 737NG in 1998.

In the case of the Lion Air Flight JT610 the correct identification and action upon an incorrect AOA sensor information seem not to have been made. This might have been made more difficult by a simultaneous false reading of airspeed from the same system (one of three systems generating airspeed on the aircraft).

To explain how a false AOA value can affect the aircraft, we need to understand the 737 flight control system for the pitch function. Figure 1 shows the flight control surfaces which exist on the 737NG and MAX.

Figure 1. Boeing 737NG and MAX flight control surfaces. Source: 737NG Flight Crew Operations Manual (FCOM).

Figure 2 shows the pitch control flight control system. This is unchanged for the MAX. The spoiler system, which is not involved in keeping the aircraft controlled in pitch, was changed (from mechanical control to Fly-By-Wire), but not the pitch system.

Figure 2. The 737NG and MAX pitch flight control system. Source: 737NG FCOM.

The systems have a classical architecture for a mechanical flight control system with a 100% hydraulic boost for moving the elevators. The 100% hydraulic boost of the movements from the pilots in pitch, necessitates an Elevator Feel and Centering unit (otherwise the pilots don’t know how much nose up or down command they’ve given as the hydraulics isolates them from the aerodynamic forces acting on the elevators).

This Elevator Feel unit is controlled by an Elevator Feel Computer getting its data from the Air Data Inertial Reference Units (ADIRU). The ADIRUs are the collectors of the data from the Pitot, Temperature and Angle Of Attack sensors, Figure 3. Note the last Alternative static ports and Auxiliary pitot probe shown in the figure; these go to a third totally independent standby Air Data Computer and Display unit in the cockpit.

Figure 3. Boeing 737NG and MAX primary air data sensors with processing systems. Source: 737NG FCOM.

Faulty signals and their effects

The Indonesian crash investigators have said the 737 MAX involved in the crash has flown with unreliable airspeed information in the last four flights. We interpret this as one of the primary ADIRU systems has delivered unreliable airspeed. The flight crew prior to JT610 identified the unreliability to the captain’s displays, which should mean the left ADIRU with sensors had a problem. Exactly what’s the root cause of this unreliable information (sensors, computer, communication to displays…) is not known.

The actions to correct the problem after the prior flight seem not to have worked. In the crash flight, the problem seems to have affected the Angle Of Attack information. Whether the Alpha Vane or some other part of the system generated this false reading is not known.

The AOA sensor measures how large the angle is between the approaching air and the wings pitch incidence. If this angle is too large, the wing stalls (loses lift). To combat such a situation, the 737 (as other airliners) has an implemented Stall warning and recovery system.

The angle of attack is also used to control an Automatic trim action during manual flight to gradually relieve the pilot of any constant stick forces. This action is not described in the 737NG FCOM and might be the reason why the bulletin is restricted to the 737 MAX type, which has implemented this to increase longitudinal stability for this type.

Any such Automatic trim action which doesn’t makes sense has the feel of a runaway pitch trim which is a very common emergency simulator training scenario. In isolation, this should be easy to spot and the correct action (Cut out the trim as described below) could be taken in relative calmness. I’m inclined to think the JT610 crew had to handle a more difficult and stressing false Stall warning and recovery situation, which is the same between the 737NG and the 737 MAX.

The Stall warning and recovery functions are:

  • Above a preset AOA, a stall warning audio voice says: “Stall, Stall, Stall” and the Pilots control yoke on the side with the high AOA start shaking as an additional physical warning
  • If the AOA does not decrease after the triggered Stick Shaker but stays at a high angle, the system then creates a stronger control Yoke force through the Elevator Feel & Centering unit by applying a nose down stick force for the present Yoke position.
  • As an additional measure, the Flight Control Computer starts a stabilizer trim nose down movement using the Autopilot trim channel. The trim action lasts 10 seconds. The Pilot’s can counteract the trim by using their trim buttons, it overrides the Stall system trim.
  • If the AOA persists, the Pitch trim nose down will trigger again after a certain time lapse. If the PIlots have counter trimmed, the system waits 5 seconds until it repeats the trim nose down for 10 seconds.

If the crew suspects an Automatic trim action or Stall warning to be false, the Operating Procedure is to switch off the Nose down trim action by disengaging both trim channels of the Pitch trim system and trimming the stabilizer manually by the wheel. These switches are placed on the central pedestal, Figure 4.

Figure 4. Control stand Switch to Cut Out the AUTO PILOT’s STAB TRIM function (No 6) and the PIlot’s trim channel (No 5). No 4 are the Pilot’s trim buttons operating the MAIN ELECTrical trim (No 5) in normal operation. Source: 737NG FCOM.

It’s this action that Boeing’s message conveys, reminding the 737 operators this is the procedure for suspected false stall actions caused by a false AOA reading.

The 737 stall warning and recovery system

One can react to the above actions of the flight control system in the 737. But one should know this chain of actions have been defined by the 737 Flight Control team after flying the 737 since 1967, with many thousands of work hours research behind the design and over 50 years of airliner flight control design experience. It has also operated without known adverse effects in thousands of 737NG over the last 20 years.

In this case, the events might have overloaded the Flight Crew on JT610. We don’t know why. And it’s best to wait until we do. We need to understand what exactly the flight crew was confronted with and their actions as a result.

It’s by now clear it’s not a simple fact of them stalling the aircraft due to one side airspeed readings being unreliable. They had more to fight, so far is understood. But exactly what, we don’t know and therefore we don’t speculate further.

What we wanted to do with this article is pointing out, as far as we know, the system involved is a tried and tested system. Why this didn’t help the JT610 crew, we don’t know, but it will be communicated in due course.

61 Comments on “Boeing issues 737 Operations Manual Bulletin after Lion Air accident

  1. “The spoiler system, which is not involved in keeping the aircraft controlled in pitch, was changed (from mechanical control to Fly-By-Wire), but not the pitch system.”

    This is (strictly speaking) incorrect. An un-commanded spoiler deployment can effect the airplane pitch-rate severely.

    A possible scenario could be: spoilers pop up un-commanded (for whatever reason) during climb, leading to a pitch up, the pilot would then counter to level off and investigate. Spoilers go back to neutral (for whatever reason), airplane dives, the process gets repeated. Ultimately a divergent Phugoid oscillation could occur.

    • The Boeing Bulleting is sent out after getting information from the Flight Data Recorder from JT610 via the Indonesian Investigation authorities. And it’s done in coordination with the FAA.

      The bulleting speaks about the correct actions to take regarding the Automatic trim and Stall warning and recovery system in case of a false AOA information. This has no connection to the Spoiler system.

      Yes, a faulty spoiler deployment can affect pitch, as can a faulty flap, slat and even landing gear deployment. But this is not what the Boeing Bulletin is about.

  2. Key for me in Bjorn’s explanation is the statement: “…we try to bring some clarity and perspective into what is sometimes sensational headlines out of a minimum of facts.” Time will tell as they piece this accident together. It is comforting to know that the basic design of some of the components involved has been proven over decades. But one last speculation could lie, as someone mentioned in the earlier story here, is that it could be FADEC, or possibly a faulty board affecting software. But this article is a strong explanation of the redundancies built into this airplane.

    • Personally I would find it informative if the words “Boeing 737 MAX Emergency Airworthiness Directive (AD)” would be in the title or anywhere in the first paragraph. Because it is. But I understand it is sensitive and we don’t want the analyzes being overshadowed with emotions.

  3. Hello Bjorn,

    I very much appreciate your posts, such as this one, that report with a level of detail and expertise that is hard to find in the popular aviation press, on technical and engineering information that is hard for those of us not working in commercial aviation to come by.

  4. Hi Bjorn,

    If you get an unreliable airspeed indication, a stall warning and an automatic nose down, how do you decide what to trust and which procedure to apply? If for instance, the pilots thought insufficient airspeed was the problem, wouldn’t they have ‘helped’ along the automatic stall recovery by confirming the nose down attempt instead of stopping it?

    There have been some reports that the final dive was at high speed. I wonder if this was due to the wrong procedure being applied where the pilots thought the airspeed was not enough.

    • The Pilots have an independent air data/display unit.

      737 Standby PFD placed between Primary PFDs.They are trained to check this against the two Primary flight displays and through observing all three decide which one is not to rely on. I’m convinced they did and identified one of the three air data channels as having a problem.

      In this case, one of the results was a trigger of erroneous Automatic trim or false Stall warnings. It seems the JT610 investigation sees from the Black box data the crew did not cut out the trim action of the Automatic trim or Stall warning system, why we don’t know.

      • Maybe they trusted “the system” more than their own observations / interpretations..

        Flight profiletracking indicates they where going through their checklists for at least 5-6 minutes.

        https://pbs.twimg.com/media/DqpE2AFX0AE6MI5.png:large

        Maybe something then happened / was triggered / activated that let to the dive. As you indicate their are so many signals that push you to keep up speed..

  5. This is the most disgusting post that LNC have produced. The pilots were very experienced The pilots knew the manual. The manual didn’t work.

    Somethings wrong!

    • Philip, your company before Companies House dissolved it was an information retrieval service. What do you know that Bjorn, as an aerospace engineer and pilot, doesn’t know?

      • Silly sod. That’s how I ended my career not started it. Bjorn is what now? I’m retired so I desolved my company.

        • AF447 also had a highly trained crew with plenty of hours in time on the aircraft.

          In this case it begins to look like the crew had to sort out not just one bad data set but several.

          Shifting gears when you have bad data and what to trust is a poster child for confusion.

          Pilots are human beings, some are better at it than others.

          The other aspect we would need to know is what kind of training Indonesia mandates.

      • This is going to cost Boeing a lot of money. The FCC (Flight Control Computer) went into meltdown.

        But as you say lighten up. Only 190 people died

        • Clearly a case of arguing with someone who has an agenda and not into facts.

  6. That sounds all reasonable, but I wonder why the official Emergency Airworthiness Directive is only for the MAX and not for the NG?

    • Exactly same question here. The AD had to be for both NG and MAX (or the entire 737) if nothing changed for the MAX.

      • In addition to the trim action described in the Stall warning case, the MAX uses the AOA to activate an automatic trim during a manual flight of the aircraft. This increases the likelihood of an erroneous AOA to cause the nose down trim action described. Without a simultaneous Stall warning, the runaway trim should be easier to spot and the corrective action taken. I believe the JT610 crew was fighting an erroneous automatic trim which quickly went to false Stall warning and continued nose down trim. This creates a very stressful environment with many false warnings. The correct trim runaway action is then harder to remember in the resulting very charged situation.

        • That sounds worrying to me. What if they also had an UAS situation? There has been a lot of talk in recent years how Boeing products let the pilots fly as opposed to Airbus products, and how useful it is to have a manual trim to help the pilots understand what the plane is doing in critical situations. And yet here we have a non FBW Boeing in MANUAL flight, possibly going through other air data anomalies in addition to a suspected false AoA measurement, triggering uncomanded changes to the trim configuration, which can sometimes be just like an uncomanded control input. It could make sense if the autopilot was engaged, but it was not. To me it would seem that Airbus planes give full control to the pilots when there are air data issues (the exception being the ADIRU anomalies near Perth which necessitated the autopilot be turned off manually), while the Lion Air pilots could have been totally thrown off by the automation. It really doesn’t matter much that this has never happened before, even more so as we are not sure the 737 MAX is not unique in this respect. I can’t believe no one is shocked.

        • Where the crew flying NGs in between flying MAXs? Most likely. It is easy to forget a small design change like the new Auto trim here. As a simple example, I own 2 Skodas, both manual but one 5 speed and one in 6. How often do you think I try and put the 5 speeder in 6th?

          • That also has relevance to the Asian Crash of the 777 in SFO

            While you can’t begin to understand the monitoring pilot and the check pilot not paying attention, you can understand that underlying the PF frame of mind, that he was used to Auto Throttle coming back in under the same sort of Mode he had put the 777 in to hit his glide slope.

  7. Daylight? Good visibility? Too simple to do right… something bad happened, let’s wait for the experts and their report.

  8. Hi Bjorn,

    Can you please kindly explain how the flight computer handle the AOA disagreement ? KNKT suggested the “previous flight” (the one before 610) has AOA differences in 20 degree. “IF” this is the identical situation faced by the crew of 610, I found it alarming if flight computer didn’t do anything regarding the AOA disagreement.
    (I would assume on Airbus side the flight control law drops to alternate law)
    Also, KNKT mentioned LionAir did replace faulty AOA and let’s assume the newly installed sensor functions properly. Can you please elaborate other potential sources for such behavior ?
    Thanks !

    • An AOA vane is sensing the airflow around the aircraft. There are two vanes placed on each side of the nose.

      A stall can be everything from entry into stall with straight-ahead airflow to a full spin with airflow hitting a rotating aircraft. This is why there are two vanes, one on each side of the fuselage. And this is why any voting between them which one is wrong when they show different values is dodgy stuff. One can have a full airstream while the other is completely shadowed by the nose. How to cover all the myriad of situations and the ones you didn’t think off.

      These exist as we have seen in the AF477 accident where the AOA varied with up to 30-40° when it was in the fully developed stall.

      I have worked with flight control systems and I would not like to be the one to implement a voting between the two vanes on the sides of an airplane.

      • That’s exactly my point ! IF flight 610 encounter the exact same problem in previous flight, I can’t understand why Boeing will design automation to trim aircraft pitch down …..

      • “And this is why any voting between them which one is wrong when they show different values is dodgy stuff. ”

        Going by my design experience it is easier than one would think:
        a warning flag pops out and you do nothing. here: AutoTrim off (together with a warning that is benign behaviour).
        Never done flight controls obviously :-).
        Railway(safety) and instrument control things though.

  9. I recall a similar accident perhaps 10 or more years ago, when a 737 suddenly dove to the ground and crashed I think outside Pittsburg. If me memory serves, the cause had something to do with the horizontal stabilizer.

    • Christopher: the Pittsburgh crash (and one about two years earlier in Colorado Springs) were rudder PCU issues, not the horizontal tailplane.

    • 1994 about. Servo mechanical control unit in the rudder assembly, although was a combination of circumstances. Interesting procedure was called for before the OEM re-designed this equipment. Pilots were to go with the unintended rudder inputs till they got the airplane under control.

      • Yeah, that was one very bizarre procedure but made sense as the rudder was doing the opposite of what input was given when it malfunctioned.

  10. Okay I accept that is been the same way for years. That doesn’t help the people who died or their relatives. Even once is too much. It not an excuse for Boeing not to revise or improve the system. The system is inadequate. Sad to say the obvious, but if this was Airbus, the reaction would be vastly different. Boeing does not deserve a free pass on this.

    • I welcome the info Bjorn is giving over this, but it would be a storm from outsiders if Airbus side stick controllers were involved

      • I think being partisan on this is not very helpful. The issue of losing situational awareness seems to be the price paid by all OEMs for putting safety systems into their aircraft but presumably the benefits outweigh the painful costs.

        This was a new aircraft straight out of the box and there seemed to be some problem from the off that was never adequately resolved. If this was the case I am sure the truth will out at some stage.

        As we all know there standard refrain with any system vs pilot argument the pilot seems to lose. Possibly because there is more money invested in the system

        • I also agree is not an either or.

          If its anything its an example of having to add “stuff” to deal with.

          Clearly not a Side Controller or a control column issue.

          Both Boeing and Airbus have had crashes that are at the core a result of their respective approaches.

          To me Airbus has the better Auto Throttle and the NTSB has said as much.

          Correspondingly AF447 all the system had to do was be program to put it in the right attitude and thrust setting when the Pitots went and then the alert why.

          • The ‘side controller’ reference was just a metaphor for a certain manufacturer’s system of flight control, which is resisted by some as against the natural order of things

    • “Sad to say the obvious, but if this was Airbus, the reaction would be vastly different. Boeing does not deserve a free pass on this.”

      What a load. Sometimes it’s best to just put away your partisan whines…

      • There is now some indication that Boeing deliberately did not advise pilots of the new feature so as to not “overburden” them…

        If true, I can see a line up of lawyers forming their battalions for a series of mammoth lawsuits.

        Will ALPA and sundry pilot unions sit still for this? Will US carriers be willing to operate the airplane until the situation is clarified and settled? The potential liabilities are staggering.

        We may yet get to test the”too big to fail” tag for Boeing.

        Perhaps we shall test

    • Hello Marcello,

      Reagardong: “Are you sure the 737 has stick pusher?”

      My understanding of the following from Mr. Fehrm’s post was that the stall warning system changes control forces and trims nose down, but that there is no actual forward movement of the control yoke.

      “◾If the AOA does not decrease after the triggered Stick Shaker but stays at a high angle, the system then creates a stronger control Yoke force through the Elevator Feel & Centering unit by applying a nose down stick force for the present Yoke position.
      ◾As an additional measure, the Flight Control Computer starts a stabilizer trim nose down movement using the Autopilot trim channel. The trim action lasts 10 seconds. The Pilot’s can counteract the trim by using their trim buttons, it overrides the Stall system trim.”

      • Thanks AP Robert, but Marcelo was right. Thanks Marcelo, I tipped to fast and had the pusher in there at first. Pushers are mandated by FAA when there is a risk of a deep stall like for a T tail aircraft (DC-9, Biz jets…). The 737 is fine re deep stall, doesn’t need a pusher. It does force the stick neutral forward with the feel system and with increased force to get a similar effect though.

  11. “One can react to the above actions of the flight control system in the 737. But one should know this chain of actions have been defined by the 737 Flight Control team after flying the 737 since 1967, with many thousands of work hours research behind the design and over 50 years of airliner flight control design experience. It has also operated without known adverse effects in thousands of 737NG over the last 20 years.”

    TK 1951 also had wrong altitude data feeding the autopilot & crashed. Maybe we should do further research rather than automatically defend the OEM’s. Do the vocal stall warnings send out serve their goal? Is improvement possible? I think those are the question’s that build the aviation safety culture. Not assuming “the system worked” something else must be wrong.

    • Within the vast and unbelievably accident free Ryanair and Southwest fleets a similar situation must have happened at sometime, but not resulting in an accident. Why not?I am suspicious that the question of what would happen if the crew response was sub optimal was not asked. Any human who has operated a machine will know how hard it is to cope when the controls are reversed or modified unexpectedly in a high stress situation. This crew seems to have had a lot on.

      • Yep, I saw my dad get a U control plane under control when the found it had reversed control on takeoff.

        Sadly he also moved out of the circle doing so and it crashed into a flagpole.

        The Cascade of event overtook him and he was one of the best I have ever seen.

      • The question goes back to training, people on a bell curve and how they respond.

        When I wrestled in high school my opponent was the greatest practice wrestler around.

        Come a match and he could not execute.

        I got more focused.

        I was not better than he was, I was just fortunate that how my physiology worked.

        How to sort that out if at all possible as well as what kind of training they receive is the bit picture question.

  12. Does the inertial side of the ADIRU provide any kind of ‘sanity check’ to the AoA reading? Could it do so?

  13. Bjorn: Thank you for such an excellent write-up.

    Never flew anything with AOA so that is a outlier for me having any feeling for it.

    It does seem to be a case of an older design adding complexity to make it work then cascading into the sequence of events.

    I continue to ponder, if there is a process that is recognizable as an issue with a solution, why do they not design (both Boeing and Airbus, maybe more so Airbus with their more automated approach) an automatic response?

    I call it “Sometimes I feel like a nut and sometimes I don’t”

    Its from a US Candy bar maker called Almond Joy

    One had almond in it and the other had coconut in it.

    Most time you have all the good stuff then its taken away and you have to do it right or unlike on the ground, there are no air bags to save you.

    • Layer cake.
      Adding further onion layers to an already layered design is “Mist”.
      the worst design example is the Windows OS product.
      But the 737 from Jurassic to MAX should be a close contender.

      the Airbus FBW product is much less of a layer cake afaics.

  14. This is also an excellent write up on the situation.

    https://www.seattletimes.com/business/boeing-aerospace/faa-follows-boeings-737-safety-alert-with-an-emergency-directive/

    Its worth noting the response comes from a single input.

    The following is also a chilling story of what one (I would not even call it poorly) executed system could crash an aircraft when equipment damage is the last factor that should be considered.

    https://www.flightglobal.com/news/articles/ba-747-crew-commended-for-escaping-near-stall-on-tak-343738/

    Note that the response was to deactivate the system response of the switch.

    • It seems that this issue might be unique to the MAX then.That raises some questions about the pilots previous experience and training.
      As a non pilot, I don’t pretend to have a full understanding but I wonder about the effect of banking when they attempted to return to base added to all the chaos they were already experiencing.
      As a fairly keen reader about aviation, I am aware that the statistics and testing ,etc are excellent for the 737.As a passenger, I am not quite convinced.

      • Well Southwest had to delay its introduction of the Max series , even though it was launch customer, because its pilots couldnt have a common rating on all 3 of 300-NG- Max series. I seem to remember them offloading a lot of the oldest 300/500 series.
        Remember the Auto throttle and the FMC werent indroduced to the 737 line till the last of the 200 series. Boeing has done common pilot aids piecemeal on the various 737 variations over the years, with the stability management being just the latest.

        • Apparently Boeing has many 737 line pilot’s gaming this scenario. It’s not inconceivable that something has been missed, presumably they test this specific failure, but maybe it’s different for test pilots.
          As l say, I don’t know what I’m talking about, but I could imagine a situation where one could become deferential to an insistent machine, I’m confused and the machine keeps trying to do the same thing, it must be right

  15. This is worth a read on a pilot having background Airbus system and not getting the trap on the Boeing

    http://aviationweek.com/awin/were-asiana-pilots-caught-flch-trap

    Some horribly errors by the other two pilots in not monitoring the operation as well as poor piloting by the PF, but also how it can cascaded based on other equipment and underlying expectations of what odes what when and how.

  16. Apparently Boeing has many 737 line pilot’s gaming this scenario. It’s not inconceivable that something has been missed, presumably they test this specific failure, but maybe it’s different for test pilots.
    As l say, I don’t know what I’m talking about, but I could imagine a situation where one could become deferential to an insistent machine, I’m confused and the machine keeps trying to do the same thing, it must be right

  17. Hi Bjorn,

    Great article. You wrote “The angle of attack is also used to control an Automatic trim action during manual flight … restricted to the 737 MAX type ….”

    More information is coming to light on this new feature (https://www.seattletimes.com/business/boeing-aerospace/u-s-pilots-flying-737-max-werent-told-about-new-automatic-systems-change-linked-to-lion-air-crash/). Its formal name is MCAS (Maneuvering Characteristics Augmentation System) and apparently pilots were unaware of its existence.

    I was wondering if you know the answer to this question: When the MCAS engages and applies nose down stabilizer trim, does the stabilizer trim wheel spin to provide pilots with a visual indication of the trim that is being applied? Alternatively, is there any indication in the EFIS? In a more general sense, how does the pilot know that the MCAS has applied nose down stabilizer trim apart from observing that the aircraft is pitching down?

Leave a Reply

Your email address will not be published. Required fields are marked *