Lion Air crash probe turns to systems that command 737 pitch

By Dominic Gates / The Seattle Times

SEATTLE — The safety bulletin Boeing sent out Tuesday to all airlines flying its 737 MAX jets points at least to a possible contributing cause of the fatal crash of the Lion Air flight that last week killed 189 passengers and crew.

Boeing’s alert, which applies only to the MAX model of the Renton-built single-aisle 737, highlighted an automated system that is designed to prevent a plane from aerodynamically stalling but can potentially go haywire if false data is fed from a small bladelike sensor on the exterior of the plane.

Although there is not enough information to be certain what caused the crash, investigators’ attention is focused on that system, which can move the jet’s horizontal tail to pitch the nose up or down.

John Cox, a former pilot and chief executive of aviation consultancy Safety Operating Systems, said that although a version of this automated system has been on the 737 since the first ones were built in 1967, only on the MAX is this particular sensor able to trigger uncommanded movements of the jet’s horizontal tail.

Countering the problem, if it arises in flight, should require only a standard pilot procedure — one that was newly emphasized by Boeing in its safety bulletin Tuesday.

Because of that, Cox said he considers the MAX safe and would fly on one tomorrow without hesitation.

But he suggested accident investigators and Boeing’s own engineers will have to study closely the chain of events on the Lion Air flight deck and how the pilots handled the chaos, which should be clear from the cockpit voice recorder, to determine if Boeing needs to fix the system design.

Another expert, Bjorn Ferhm, an analyst with Leeham.net who is a former jet-fighter pilot and an aeronautical engineer, said that while it’s possible a change to the internal logic of the MAX’s flight computer system could have gone awry, he thinks a more likely suspect is a hardware fault in the flight computer on the specific aircraft that crashed.

He recalls that when an Airbus A320 operated by AirAsia in Indonesia crashed in 2014, killing 162 people, the pilots also had to deal with a cascading series of repeated instrument failures, which the accident investigation determined were initiated by a cracked solder joint.

So Ferhm too believes the MAX is as safe as any 737. If anything happens to the pitch control system, pilots just have to follow the procedures outlined in Boeing’s warning, he said.

After Boeing’s safety warning, the FAA on Wednesday issued an emergency airworthiness directive, effective immediately, mandating that airlines must update pilot procedures according to the instructions in the alert. The FAA said the directive is based on an analysis performed by Boeing.

An FAA engineer, speaking on condition of anonymity, said Boeing is cycling pilots through 737 MAX simulators trying to understand how they react to the various instrument failures indicated in the Lion Air crash.

If the accident investigation were to find fault with Boeing’s design of the nose pitch control system, it would raise questions about the safety-certification process, much of which is delegated by the FAA to Boeing itself.

Boeing on Wednesday declined to comment.

FAA mandates action

The FAA said its directive addresses the potential effects of false information coming from the sensor on the plane’s exterior that reports the plane’s “angle of attack” (AOA), which is the angle between the wing and the flow of air the jet is moving through.

This key data point is fed into the flight computer along with the temperature and air speed. These three metrics affect one another and are used by various systems that control the airplane’s flight.

The FAA said false AOA readings “can potentially make the horizontal (tail) repeatedly pitch the nose of the airplane downward, making the aircraft difficult to control.”

The danger, the FAA warns, is that this could “lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain.”

The Boeing service bulletin to airlines notes that though pilots may pull back on the yoke and adjust the horizontal tail to get the nose pointed back up, the condition pulling the nose down may then restart five seconds later.

The flight data of the Lion Air jet in the 12 minutes before it crashed shows a pattern of the plane repeatedly losing altitude and regaining it before it finally dived steeply into the sea.

Automated system acting on false data

The problem is with the “automated trim” system, which adjusts the position of the horizontal tail so as to pitch the nose up or down.

When a pilot pulls or pushes the control column he or she exerts a force to adjust the movable horizontal tail and raise or lower the aircraft’s nose. Trimming it means setting the system to hold the tail in that position without further effort by the pilot. The force on the control column is relaxed to zero and the system holds the position.

A pilot can trim manually each time he adjusts speed or direction. Or he can set the system to automatic, so that it makes adjustments by itself to hold position.

But if the automatic trim system is fed false angle of attack (AOA) measurements, it will go awry.

If the sensor tells the system the AOA is too high, the automatic system begins moving the tail to point the nose down. Even when the pilot corrects that by pulling the column, if the sensor continues to say the AOA is too high, the system will begin to pitch the nose down again.

“On no other 737 is there a system based on the angle of attack that will move the (horizontal tail) trim. That is unique to the MAX,” said Cox, the CEO of the aviation consultancy. “I was surprised that a single angle of attack indicator could cause the activation of this system.”

The FAA directive orders operators to revise the airplane flight manual to give the flight crew procedures on exactly what to do when this condition arises to avoid the plane repetitively pitching downward.

The Boeing instructions tell pilots they should pull back hard to control the nose-down condition, then use a cutout switch to turn off the system that automatically trims the horizontal tail to maintain speed and level flight.

Instead of using this automatic trim system, which is going awry every 10 seconds, the pilot must then set the trim positions manually each time he changes speed or direction.

However, in the stress of a real-life situation, this may not be so straightforward.

The FAA directive tells operators that the false AOA reading can create a cascade of false indications on the flight deck that may confuse the flight crew.

These include a continuous or intermittent shaking of the control column and a low-speed indication, both suggesting the plane is approaching a stall; increasing nose-down control forces, which the pilot must pull strenuously back on the control column to counteract; and warning lights indicating false airspeed and altitude readings.

Ferhm said that a “runaway trim” scenario, in which an automated system is moving the flight-control surfaces the wrong way, “is something you train for in every aircraft.”

“It’s one of the most common situations you have,” he said. “You train for it and learn to shut down the system.”

Still, he said, he wouldn’t jump to blaming the pilots. He said the flight pattern of the Lion Air jet suggests “they had hell up there” as they struggled to control the plane.

“The aircraft was throwing them curveballs all the time. Why they didn’t cut out the automatic trim system, we don’t know. Somehow, they didn’t hit the cutout switches. We need more information. We need to listen to the voice recorders to learn why these pilots were so stressed,” Ferhm said.

Altogether 246 MAXs are flying worldwide, with 45 of these in the U.S. at Southwest, American and United.

The FAA in a statement said it “continues to work closely with Boeing, and as a part of the investigative team on the Indonesia Lion Air accident, may take further appropriate actions depending on the results of the investigation.”