The Hidden Message in Boeing’s Lion Air Service Bulletin

November 8, 2018 / 5 Comments

(photo courtesy

From the time the pilots retracted the flaps of the new Lion Air jetliner that flew as Flight 610, they were presented with anomalous readings, chaotic warnings and an airplane that was not flying as it should. This is what can be learned reading between the lines of the service bulletin Boeing sent to airlines operating the planemaker’s newest 737, the MAX.

The airplane crashed into the sea 13 minutes after taking off from Jakarta on October 29th killing 189 people. In the bulletin, Boeing says during the Lion Air crash investigation, it was determined that a faulty reading of the flight sensor measuring the plane’s angle of attack “can cause uncommanded nose down stabilizer trim movements” without the pilots’ input.

Further, the nose down maneuvers could last as long as 10 seconds and reoccur every 5 seconds even when the autopilot is turned off.  Boeing says “there will be no indication to the pilots that the stabilizer trim is activating.”  In response, pilots are told to disconnect the system controlling the position of the horizontal stabilizer.

It is an indication that very early in the flight, possibly as soon as the flaps were retracted, (extended flaps inhibiting the stabilizer trim) the pilots of the brand new airliner were dealing with an unexpected loss of altitude, a problem the pilots may not have understood and from which they did not have sufficient time to diagnose and respond.

At American, which has sixteen MAX aircraft it its fleet, spokesman Ross Feinstein said the document reiterated “existing, well-established procedures for 737 MAX 8 pilots.” And some pilots to whom I spoke to agree, instances of uncommanded nose down can occur for reasons other than this faulty sensor and pilots are trained to deal with them.

“There has been training for a runaway stabilizer trim since the beginning of time. We train for it in the sim,” said Cort Tangeman, an airline pilot who flies the MAX. You can have a ground fault on the side of the motor and you have to know how to stop it.”

Many factors could have increased the difficulty of recovery for the Lion Air pilots;  including the lack of an indication that the plane was going nose down and a series of sensory alarms on the flight deck triggered by the erroneous information.

“There are so many hidden things in there and it’s only getting more complicated,” Tangeman said. “You can get a stick shaker and it has nothing to do with airspeed. That’s the confusing part of having data in an electronic airplane send information to the jet telling it to do stuff and telling you to do stuff that’s not right. You have to figure it out and the only way to figure that out is with experience, unfortunately.”

The pilots of Lion Air Flight 610 reportedly had five and six thousand hours of flight time, though it is not clear whether that was total accumulated time or time in the 737. But their time in the MAX had to be brief considering it came into the fleet just months earlier. It is possible that given the choice of trusting their own judgment or the information offered from their brand spanking new airplane, they opted to believe the airplane and its erroneous data.

One factor commands attention; the early onset of the problem. Automatically sending the airplane into a nose down orientation could have begun as soon as the crew retracted the flaps after takeoff. Looking at Flight 610’s flight profile from Flight Aware, two 737 pilots told me it had an unusual flight profile from the time of takeoff. Meaning that the pilots were burdened during a time of high workload and without the benefit of altitude and therefore time.

“Unreliable airspeed tricks the airplane into thinking its stalling. It’s showing you are stalling on the airspeed indicator. You have to determine by what its really doing. And again, that takes a lot of experience,” Tangeman told me.

This dilemma is likely to get closer scrutiny according to an American air safety investigator to whom I spoke but who wished to remain unidentified. Pointing to other accidents in which pilots failed to recognize bad data or mishandled an airplane in an auto recovery mode, this investigator said the Lion Air probe “should be part of a broader question about airplane design and pilot training and whether the procedures generated are predicated on basic assumptions on how pilots will react and interpret information.”

Assuming that pilots will be able to quickly diagnose and react appropriately to an unexpected event is nothing new. That’s what simulator training is for. What’s still a work in progress are effective methods for managing safety in the digital age – when the computer competes with the pilot for control of the flight.

“Does this whole system have one failure mode which could cause a cascading failure with a human component? It appears as if it does,” John Gadzinski, of Four Winds Aerospace Safety Corp and a Boeing 737 Max pilot told me in a discussion of the Boeing service bulletin.

“If that one failure mode can make the system work against its intended function,” which is to prevent the airplane from stalling, “then the whole system is working against the pilot.”

So while Boeing’s alert to airlines may be – as American says – a reiteration of procedures already taught to pilots, make no mistake, the logic that allows pilots to find themselves in a situation like Lion Air 610 is about more than the pilots. It’s about the airplane too.


Categories: Flying Lessons
Tags: , , , , , , ,

5 responses to “The Hidden Message in Boeing’s Lion Air Service Bulletin”

  1. Dan says:

    According to the news articles I have read, the plane suffered from the same problems in an earlier flight. I would be interested to know what the prior crew did and what the ground crew did to make them think the problem was solved.

  2. Bob Smoot says:

    Total crap!

    Nothing between the lines but your innuendo and hearsay!

    Sorry I even tead it…

  3. Jay Carpenter says:

    So, why did you “tead” it?
    Why not just accept it as a point of view and shut up?

  4. Tom Casey says:

    As a Captain on the A300-600, I experienced a loss of all pitot-static systems IMC. I was hand flying at the time, passing FL270 in a climb to FL330. Pilot, co-pilot and standby airpeed systems indicated stall. I told the First Officer to notify ATC that we had a problem and needed block altitude clearance, which was immediately approved. Both throttles were at 107 percent, or climb power. When I attempted to reduced power, the right throttle was stuck. I pulled the left throttle back to 60 percent for a nominal level flight thrust. Then I began talking out loud to the First Officer. My mind ran through systems potentially affected: artificial feel, or Q; rudder deflection (a potential for 20 degrees of displacement rather that 5), stick shaker and overspeed warnings. I told the first officer that while maintaining power we would decent until high speed buffet and then pull back. This we did, without the overspeed warning, which told me that the air data computer was corrupted. I then, cautiously, engaged the basic mode of the auto-pilot without incident. We then diverted to a fair weather alternate. The problem was that the pitot-static heater did not shift from low (ground) heat to high (flight) heat, and the low heat was insufficient in the saturated air at higher, frigid altitudes. Because the low heat was functioning, we got no system fail indication. There was no checklist for our problem. We worked through it as experienced pilots. The right throttle linkage had gotten wet on the ground and froze at altitude. All problems disappeared when we got out of the clouds.
    Frankly, I think we have an over-packaging problem creeping into aircraft design. In a world rapidly moving into AI, there is a tendency toward overdesign that, with best intentions, might move human error from the cockpit to the aircraft itself.

  5. Simon Gunson says:

    Christine I just don’t buy Boeing’s excuse blaming the Angle of Attack sensors. This sensor was replaced following the crazy roller coaster ride of JT43 from Bali the day before. Furthermore if JT43’s autopilot was engaged at the time it suffered an upset climbing from Denpassar (Bali) then the MCAS (Manuvering Augumentation Control System) is configured not to intervene when autopilot is engaged which would suggest digital software problems.

    In my view it is more likely the fault was in the DFDAU (Digital Flight Data Acquisition Unit) causing uncommanded operation of spoilers. Why else would pilots have accelerated to speeds well in excess of VMO (ie 295kts – 345kts) and selected nose down trim except prevent a stall?

    What would threaten to stall PK-LQP other than FBW spoiler operation?

Leave a Reply

Your email address will not be published. Required fields are marked *

Enter to Win

Want to receive some free swag from Christine? Sign up for the mailing list!