Stabilizer Trim

LionAir JT610 plunged into the sea from what may have been the result of runaway stabilizer trim.  The details are not released, but the FAA has issued an Airworthiness Directive drawing attention to the recovery from such an event.  What is stabilizer trim and why would it runaway?

http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/0/83ec7f95f3e5bfbd8625833e0070a070/$FILE/2018-23-51_Emergency.pdf

REVISED 13 NOV: Stall Detection added more discussion around the SMYD
MCAS Discussion

A Stabilizer runs away when it is moving towards a mechanical stop without pilot control, and without intended function.

The Stabilizer provides the majority of pitch attitude control. A stabilizer runaway could either cause the airplane to pitch up into a stall, or pitch down into a dive depending on the direction of the runaway; neither a desirable undertaking.  The pilot must take immediate action to stop the runaway and to trim the stabilizer back to a manageable setting using alternate means.

The pilot is alerted to an impending stall by stick shaker (vibrating on the pilot column) and low speed buffet, and is associated with an excessive pitch up attitude.

The pilot is alerted to overspeed in a dive notably by excessive pitch down attitude, vertical speed, and aural annunciators.

The fault that is being emphasized by Boeing and the FAA is a runaway stabilizer commanding nose-down, into a dive scenario, as a result of erroneous (valid but misleading) Angle of Attack (AOA) sensor data. 

The same AOA erroneous reading failure can have compounding alerts, creating a host of associated troubling annunciations for the flight crew to comprehend and respond to.

TAKE NOTE! 

This discussion is purely commentary, is based on incomplete information, does not profess to be accurate because of unknown information or because of misunderstanding, and does not contain any information known to be specifically applicable to the 737 Max, nor to Lion Air JT610.  In fact, there is nothing here that describes why the issue is limited to 737 Max. I welcome any comments or suggestions, corrections and criticism.

Every attempt is made to be accurate, yet none of the detailed information is at hand to be certain. Revisions to errors or omissions will reflect a continuing goal for accuracy. This report should be used to appreciate or understand the factors that will be released in the official accident report. The official report is authoritative by definition, and nothing herein should be used to dispute those facts.  

The information discussed is applicable in part to Boeing 707, Boeing 737 Classic (-300, -400, -500), and Boeing 737 Next Generation (NG) (-600, -700, -800, -900). The information provided is for informational use as part of public service, without compensation. In the spirit of fair-use, only limited snapshots are presented for illustration and readers should take note of the enormous amount of complexity and detail that are not depicted. Furthermore, within every airplane is a unique configuration, and under a unique status, the subtleties from which may not be understood.

The trim system detects when the control column is moved in opposition to the direction of stabilizer trim. Notably, a pilot pulling back on the column would oppose a runaway nose-down trim, and the stabilizer trim logic should disengage in response, as an override.

The elevator feel computer has a feature where it creates four times the forces to pull back on the column than normal.

When the stall identification function is trimming stabilizer nose down...

(with the thinking that this is a stall recover, believing AOA perhaps erroneously, and assuming that engine thrust is going to increase rapidly),

...column feel forces are designed to fight the pilot pulling back on the stick (to encourage the nose dropping), and also to avoid the pilot tripping the column stabilizer override switch if they pull it back far enough.

The pilot can always physically grab the spinning stabilizer trim wheel to stop runaway trim regardless (not withstanding issues with the jackscrew components). Furthermore, there are switches to cutout runaway autopilot stabilizer trim commands in isolation, leaving electric trim manual controls available.

Boeing 737NG example of Flight Controls along each axis

Pitch Axis Control

The fundamental flight controls on the pitch axis are

1. horizontal stabilizer
2. elevator

The elevator is attached to the trailing edge of the stabilizer and managed by trim tabs.

Pioneering airplanes like the Boeing 707 used a mechanical control system to drive the elevator trim tabs.

The Boeing 737 uses Power Control Units (PCU), a hydraulic actuator, to drive the elevator. The indirect control introduces the need for an elevator feel computer, to artificially provide "representative aero loads" onto the pitch control yoke with a variable "neutral shift".

Boeing 737NG Elevator Control

The stabilizer is fully movable nose-up to nose-down on a jackscrew.

There are three means to move the stabilizer: 

1. Mechanically through a cable attached to control wheels in the flight deck
2. Manual electric trim motor commands from the pilot through control yoke switche
3. Automatic electric trim motor commands

3a) from the autopilot, which includes Mach trim (Boeing 707, not Boeing 737)

3b) from the autopilot, to center the elevator while in command

3c) from the autopilot, which includes speed trim and stall identification, in conjunction with the stall management yaw damper (SMYD)

Column switches mounted forward and aft provide a means to cutout electric trim if the column is pushed too far while trimming (presumably, in opposition to the trim

737NG Column Cutout Switch Module

The control stand includes two stabilizer trim cutout switches.

737NG Control Stand showing Stabilizer Trim Cutout Switches

737NG Stabilizer Trim Control System

Stabilizer trim requires power to the trim motor. A cutout switch provides a means for the pilot to remove power from the trim motor.

Autopilot trim commands are routed through a second cutout switch, which isolates the autopilot command from the trim motor.

The flaps up switch is used to change the speed of the trim motor based on flaps up or down.

Finally, stab trim commands are stopped if the stabilizer reaches a "hard" limit.

Stab trim override provides a means to override the cutout function (if it failed and prevented electric trim operation).

In the end, the trim motor moves an assembly that is tied by cables to the trim wheels in the flight deck. The flight crew have ultimate authority over stabilizer trim by grabbing the trim wheel.

The flight crew display of stabilizer is in units from 0 (nose down) to about 17 (nose up). 

The stabilizer moves from 4.2 degrees leading edge up (pitch nose down) to 12.9 degrees leading edge down (pitch nose up). The travel is about 17 degrees.

Boeing 737NG Stab Trim Indicator (0 =  nose down, 17 = nose up)

How did we get here?

In the beginning there was a stabilizer trim, a wheel the pilot moved to apply a normalizing pitch up or pitch down force.

The point of stabilizer trim was to reduce the pilot column forces to zero, the airplane in "trim".

A moving stabilizer is an advancement that benefits operating safely at high Mach numbers.

From there, the steps that followed:

1. Electric trim, a motor that could move the trim wheel for the pilot. The motor was commanded by a switch that pushed up or down, would trim nose up or nose down.
2. Proximity switches were added to trip stabilizer trim if the pilot column was moved in opposition to the stabilizer trim (e.g. if heading into a complete mistrim)
3. To offset Mach tuck, a stabilizer trim schedule was added. The autopilot is tasked with Mach trim (whether by trimming stabilizer or shifting the center point of the elevator trim tab).
4. Column trim switch could jam and cause a runaway stabilizer, so the column switch was split into two.
5. Providing hydraulic controls (Power Control Units, PCU) that lacked aerodynamic feedback, mandating the use of a "feel computer". The feel computer artificially loads the control column movements to mimic the aerodynamic loads.  The feel computer can also offer a centering function, which permits elevator offset compared to neutral column.
6. Speed Trim function is introduced to enhance longitudinal stability.  The speed trim adds a stabilizer increment to return the airplane towards a reference speed as an aid to the pilot, especially under certain flight conditions, and maintaining normal control forces.
7. The pitch moment coupled from thrust changes becomes an issue, especially at low speed. A significant thrust increase can overwhelm the elevator pitch down command authority, leading to excessive pitch and likely stall. The Speed Trim function is enhanced to include a stabilizer nose-down trim command as part of stall identification.
8. Elevator feel feature increases the pitch-up column forces to prevent the pilot from tripping the stabilizer trim commands based on column proximity switches during stall identification.

Boeing 737NG Pitch Controls

The Boeing 737NG has incredibly sophisticated flight controls that have evolved over the course of generations.  The following sections will describe each of these elements to gain a better understanding. 

NOTE: the materials presented are from unofficial references that may not be accurate. The information is presented for familiarization and may not be relevant or accurate.

Boeing 737NG Elevator and Tab Control System

Boeing 737NG Stabilizer Control

Boeing 737NG Stall Management Yaw Damper (SMYD)

Boeing 737NG FCC Functions

Mach Trim

The critical Mach number is prescribed around the creation of shock waves on the wing and control surfaces. The critical Mach number changes with angle of attack.

High speed buffet is the result of the lift shifting about because of the shock wave formation.  Wing sweep provides some relief.

Low speed buffet is the result of airflow disturbance at high angles of attack.

Low speed buffet occurs at higher and higher true airspeed as air density decreases with altitude.

High speed buffet occurs at lower and lower true airspeed as the speed of sound reduces with altitude as a function of temperature.

Herein arises the coffin corner.  Where the minimum and maximum speeds converge.

https://www.boldmethod.com/learn-to-fly/aerodynamics/coffin-corner-where-vne-and-mmo-meet/

The coffin corner can be avoided simply by not climbing too high.

Airplane wings generate lift centered about 25% back from the leading edge of the wing "mean aerodynamic chord" (MAC).

A swept-wing center-of-lift is complicated by the shifting of the lift inboard to outboard, but we can ignore that effect for now.

As an airfoil approaches the speed of sound, a shock wave forms. This shock wave trails from the leading edge. The shock wave can shift the effective center of lift rearwards to as much as 50% MAC. The shifting of the center of lift rearwards has the effect of pitching the airplane nose-down.

Gen. Chuck Yeager credits the movable (trimmable) stabilizer as the "secret sauce" that allowed the X-1 to successfully fly supersonic long before anyone else.  Without trimming the leading edge of the stabilizer, the shock wave can both cause the airplane to pitch down, and cause a blanking/reduction of the elevator, leading to an out-of-control dive and inflight breakup called Mach tuck.

Mach tuck intrudes directly into the operational envelope due to the desire to cruise at high Mach number.

A Mach Trim function provides nose-up trim as Mach number increases, which is the reverse of what is normal at lower speeds.

The Mach Trim function ensures that the pilot control yoke forces remain aligned with load factors.

Boeing 707 Mach Trim

Without Mach Trim, airplanes are forced to fly at slower speeds.

Boeing 707 Speed Restrictions with Mach Trim Inoperative

The Boeing 737NG trims the *elevator* nose-up to counteract Mach tuck (not the stabilizer).  The 737NG maximum mach operating is 0.82, slow enough to put Mach tuck into a nice to have, with no operational restriction if failed.

Mach trim also provides some benefits for takeoff rotation:

The mach trim actuator also causes the elevator to be in a more nose down position during takeoff which allows the pilots to move the stabilizer to a more nose up position. This allows a more nose up attitude if there is an engine failure during takeoff and is called the FCC controlled neutral shift enable (FCNSE) region.

The Mach trim function has not changed, from what I can gather, at least going back to the 737 Classic, except possibly for the schedule.

The mach trim system moves the elevators to prevent a nose down maneuver at high speeds. This occurs when the speed is between Mach 0.615 and 

Mach 0.84 (737-700), 

Mach 0.860 (737-800,-900). 

The mach trim system also moves the elevators to increase a nose up maneuver at takeoff.

Boeing 737NG Mach Trim System

Boeing 737NG Mach Trim Schedule

Splitting the Switch

Catastrophe is the most somber teacher of all.

In 1961, the US figure skating team boarded a Sabena flight to Brussels on an ill-fated Boeing 707.

https://www.baaa-acro.com/sites/default/files/import/uploads/2017/11/OO-SJB.pdf

The FAA disagreed with the Belgium Director General of Civil Aviation.

In any case, there was full agreement that a change to the trim switch would be prudent. At that point, there was one switch installed in each of the pilot's and first-officer's control yoke.  

The switch has three positions (nose up - neutral/off - nose down)

Boeing 707 Original Captain's Yoke

Boeing 707 Original First-Officer's Yoke

It became apparent that a switch can jam, just due to minor mechanical issues. This would lead to a runaway stabilizer.  Boeing notes this concern in their 707 flight manual.

As a result of the Sabena catastrophe, Boeing issued a service bulletin to replace the single switch on the control yoke with a dual switch, meaning both switches need to jam to create a runaway, which is a square of the likelihood as compared to a single switch. 

The Sabena report included the Boeing service bulletin in their recommendation.

The FAA followed up with an Airworthiness Directive to require the service bulletin installation.

I do not have a copy of the service bulletin 1410, and can only be mostly confident that this was the split switch AD. I have it on authority from a colleague that had first-hand memory.

Column (Limit) Switching

Column switches are used to turn off trim commands if the column is moved in a direction opposite of stabilizer trim.

For example, if the airplane is nose-heavy, the pilot will be holding the column back. By applying nose up stabilizer trim, the pilot can relax the column.  Conversely if the pilot applies nose-down stabilizer trim, the pilot will have to hold additional back pressure on the column.  In this case, continuing to run the stabilizer nose-down will result in more and more back pressure, and in this case the column switching module will trip the stabilizer trim command.

The column switching module sends signals to the FCCs to show when the control column moves to the forward or aft position. If the control column moves opposite of the stab trim command, the column switching module will stop the trim signal. The column switching module sends a clutch engage signal through the A/P cruise trim cutout switch to the stabilizer trim actuator. It also sends the trim up and trim down drive signals to the stab trim cutout relay. These signals then go through the stab nose limit switches to the stabilizer trim actuator.

Flare Spring Bias

Autoland failure conditions include consideration of untimely nose-down elevator commands.  One method to limit elevator nose-down authority is by deliberate mis-trim of the stabilizer nose-up. This is referred to as the flare spring. It is only active in a dual-channel approach (737).

The flare spring bias commands the stabilizer to a nose up position. The autopilot commands the elevator to move down to hold the nose in the present attitude. If there is an autopilot disconnect, the elevators return to the neutral position. This flare spring bias then causes the airplane to pitch nose up.

These conditions must occur for the autopilot to calculate the flare spring bias:

* Airplane in dual approach mode * Radio altitude below 400 feet* Airplane not in pitch G/A mode.

The autopilot uses the stabilizer position and flap position to calculate the flare spring bias.

Elevator Feel Control

The elevator feel computer changes the control column forces as the airspeed changes and the horizontal stabilizer moves.

The elevator feel computer receives pitot pressure, hydraulic pressure, and mechanical inputs. The elevator feel computer sends metered hydraulic pressure output to the dual feel actuator on the elevator feel and centering unit. Feel hydraulic pressure in the elevator feel computer varies between 180 psi (base feel) and 1400 psi (maximum). The actual feel pressure to the dual feel actuator is determined by the hydraulic pressure from system A and system B, pitot pressure, and stabilizer mechanical inputs.

As the airspeed increases, pitot pressure goes through the pitot port and pushes on the Q diaphragm. The Q diaphragm pushes and moves the relief valve. This movement is in proportion to the airspeed. When the relief valve moves, it pushes the force balance valve. The force balance valve controls hydraulic pressure that goes to the dual feel actuator. As the airspeed increases, the feel force increases.

The stabilizer actuated cam position affects the range that the Q diaphragm can move due to the pitot pressure. As the stabilizer moves from 0 to 17 units of trim, the cam turns. This limits the increase in feel force from increased airspeed. If the stabilizer input to the elevator feel computer disconnects, the spring moves the cam to the maximum feel pressure position.

Boeing 737NG Elevator Feel Computer System

Elevator Neutral Shift

The stabilizer controlled elevator neutral shift function changes the neutral position of the elevators during stabilizer movement.

The neutral shift function causes the elevators to move when the stabilizer moves. The stabilizer neutral position is at 4 units of trim.

The elevator is down-rigged 4 degrees when the stabilizer is at the neutral position (4 units of trim). 

When the stabilizer moves in either directions from neutral position, it moves the elevator neutral shift rods and gives a mechanical input to the elevator PCUs. The elevator moves up as the stabilizer moves either direction from the stabilizer neutral position. The amount of elevator movement due to stabilizer movement is shown by the stabilizer controlled neutral shift (not including FCC input) line.

The primary function of the flight control computer (FCC) controlled neutral shift is to reduce the pilot column force necessary to trim the airplane during initial climb out after takeoff with a forward CG and both engines operating.

The FCCs provide inputs to the mach trim actuator when these conditions occur:

• TE flaps not up

• Either engine N1 more than 18%.

FCC controlled neutral shift changes the elevator neutral position based on stabilizer and flap position. When active, the FCCs command a neutral shift when any of these occurs:

• Captain or F/O stabilizer trim switches operated 

• Flap setting is changed.

Manual trim wheel inputs, autopilot, and speed trim will not command elevator movement by the FCC controlled neutral shift function.

The incremental elevator input commanded by the FCC controlled neutral shift varies with flap position and stabilizer position. 

The amount of elevator movement due to FCC controlled neutral shift at flap position from 1 unit to 25 units is shown by the FCC controlled neutral shift (F1-F25) line. The input is slightly different at flap positions of 30 units and 40 units.

The elevator input commanded by the FCC controlled neutral shift varies in a very different manner as a function of stabilizer setting.

During forward CG takeoffs and the stabilizer at 7.0 to 10.5 units, the FCCs input some elevator downrig. The increased airplane nose up takeoff stabilizer settings give increased control during takeoff.

During aft CG operations, as more airplane nose down stabilizer trim is necessary, less elevator downrig is commanded. This occurs as the stabilizer moves from 7 to 0 units of trim. Removal of the elevator downrig allows more nose down control.

During forward CG landings, as the stabilizer moves from 10.5 to 17.0 units, the FCCs remove the elevator downrig and add some uprig. By removal of the downrig and the addition of uprig, not as much airplane nose up stabilizer is necessary to trim. This decreases the stabilizer angle of attack and decreases the potential for tail buffet if there is ice on the stabilizer.

The elevator movement due to stabilizer position and the FCC controlled neutral shift function add together. The total amount of elevator movement due to stabilizer controlled neutral shift and FCC controlled neutral shift is shown at flap positions from 1 unit to 25 units is shown by the total elevator neutral shift (F1-F25) line.

Boeing 737NG Elevator Neutral Shift Schedule

Autopilot Stabilizer Trim

The elevator controls interact with the stabilizer trim to combine for pitch control. The stabilizer is trimmed by the autopilot when the elevator position is sufficiently offset from the neutral position.

The autopilot calculates how far it can move the elevator (elevator authority) and how far it commands the elevator to move (elevator command). If the ratio of the command to the authority is too large, the autopilot trims the stabilizer to decrease this ratio. If it did not do this, the elevator movement may reach its limit and the autopilot could no longer move the elevator in one direction.

Stabilizer Trim Detector

The trim detector looks at the ratio of the elevator command to the elevator authority. If the elevator command is between 10% and 25% of the elevator authority for a limited time, it supplies a trim nose up or trim nose down signal. It stops the signal when the elevator command is less than 2% of the elevator authority.

If the airplane is in the pitch G/A mode, the detector supplies a trim signal if the ratio is more than 10% for 500 out of 800 milliseconds.

A/P Stab Trim Commands

The autopilot must meet these conditions before the stab trim nose up or stab trim nose down signal from the detector becomes a trim command:

* A/P is engaged
* Airplane is not in flare
* Airplane is not in the pitch CWS out of detent mode.

When the radio altitude is less than 60 feet, the FCC does not allow a nose down command.

The stab trim nose up command also occurs for 5.5 seconds after these conditions occur:

* Airplane is in the air and not in the flare mode JPL ALL
* Airplane is not in the G/A mode 
* A/P G/S is engaged.

This stab trim nose up command causes the airplane to nose up as it starts the flare maneuver just before touchdown.

The stab trim nose down command also occurs from 0.2 to 5.5 seconds after the airplane is in the A/P G/A mode.  Also during this time, the FCC does not allow any nose up commands.

Boeing 737NG Autopilot Stabilizer Trim Function

A jammed elevator with the autopilot engaged apparently has led to stabilizer runaway.  There is mention of the FCC using stabilizer as a reversionary mode if elevator is jammed, but I cannot confirm that behaviour.  To me, it looked like stabilizer trim was trying to center the elevator, and it would not move in feedback to the stabilizer moving, so it just kept moving.

737-800 with Jammed Elevator

During approach to Kittilä (EFKT) in Finland on 26 December 2012, LN-DYM, a Boeing 737-800 NG on Norwegian Air Shuttle's (NAS') air service NAX5630 from Helsinki airport (EFHK), came close to stalling. The outcome of a stall would most likely have been catastrophic, primarily because the elevator system at that time did not function normally. The elevator system worked only at a ratio of 1:250.

AIBN's investigation has uncovered that de-icing fluid had ingressed the tail section and frozen on three or four of the input cranks for the aircraft's two elevator Power Control Units (PCUs) and thus prevented them from functioning as intended. The investigation has documented that, even after the introduction of new de-icing procedures from Boeing, considerable amounts of fluid and humidity are entering the tail section (Tail Cone Compartment) during de-icing. 

Boeing and the NTSB have subsequently conducted additional analyses of the aircraft's flight data for the flight in question to Kittilä, as well as flights during the days leading up to this. In January 2014, AIBN received an analysis from Boeing which indicated that LN-DYM's elevator had been gradually blocked while enroute at cruising altitude. The analysis could only determine that at least three of the input arms had to be blocked to match the flight data.

The aircraft was positioned to intercept the glide slope from below. As it was in the process of establishing itself on the glide slope, the electrical stabiliser trim started to engage. On the Boeing 737, it is normal for the stabiliser trim to engage for a few seconds in such a phase, but this time the trim continued for 12 seconds in the nose-up direction. The electric trim changes the position of the entire horizontal stabiliser. Before this happened, the aircraft's nose angle had been +1.5°, but as a result of the new trim setting, the aircraft's nose rose considerably. This caused the airspeed to rapidly decline, thus engaging the aircraft's autothrottle system at full engine power. On the Boeing 737, the engines are located below the aircraft's lateral axis (pitch). Full engine power caused the aircraft's nose to rise further,

With the autopilot engaged in approach mode, the Flight Control Computer (FCC) will follow the glideslope beam with pitch commands to the elevator. If elevator PCU’s does not respond, the Flight Control Computer will apply command to change horizontal stabilizer angle in order to have the airplane to maintain glideslope.

In connection with the draft report, Norwegian has informed about a mismatch in Boeing 737 manuals regarding when the autopilot will automatically disconnect. In Flight Crew Operations Manuals (FCOM) 4 20 date 9. September 2014, it is described that when the autopilot is in approach mode and with both channels engaged, the autopilot shall not disconnect when the control column is pushed or pulled. In the Aircraft Maintenance Manual (AMM) 22-11-00-093 rev55 it is a more general text which does not tell whether or not this is valid when one or both autopilot channels is engaged. Norwegian considers the text in the AMM as correct.

On 11 January 2013, a one-hour test flight was conducted with LN-DYM from Gardermoen with the assistant chief pilot as commander. An excerpt from “Boeing 737- 800 Customer Demonstration Check Flight Report (CDCFR)” was used. During the test flight, the pilots e.g. verified that the necessary force needed on the control column in order to achieve automatic disengagement of the autopilot functioned as normal. 

AIBN is of the opinion that the active Flight Control Computer (position A) functioned as intended during the phase of the flight where the incident occurred.

The elevator system on 737-600 through -900 series airplanes was improved by the addition of several mechanical override mechanisms. 

Norwegian Reports of Excessive Column Force Incidents 2011-2014

Speed Trim 

Speed Trim is a form of stability augmentation. 

Boeing has a patent that describes the function, from which I will quote heavily in this section.

Speed Trim is a form of Longitudinal Stability Augmentation that moves the Stabilizer

A fundamental artifact of longitudinal stability is the phugoid.  Start from a trimmed condition, and then provide a pitch-up upset.  The airplane will start to climb, and in result it will begin to slow.  As it slows, it starts to descend. As it descends it starts to speed up. As it speeds up, it starts to climb.

Phugoid

Pilot controls are intended to be straightforward. A big criteria is that the slope of stick force remains positive with respect to load factor. An airplane with under-wing engines suffers from a pitch moment as a result of thrust changes.

An increase in thrust will cause the airplane to pitch up and accelerate. A fundamental goal is to ensure that the pilot does not reverse their control forces in response to adverse pitching moment.

The can be expressed in form of a slope of column (stick force Vs. airspeed (1g load factor).  As the airplane slows down, the stick force to maintain level flight should steadily increase.

Stability augmentation for both phugoid and stick force gradient can be achieved simply by providing a small stabilizer offset.  The offset is scaled such that the stabilizer trims nose down as the airplane slows down, and conversely stabilizer trims nose up as the airplane speeds up.

A stabilizer nose down trim increment as an airplane slows down will increase the stick force than otherwise, maintaining the stick force gradient.

If the upset is a phugoid, the nose down increment will hasten the return to the target altitude and settle more quickly than otherwise.

A rate-of-climb (vertical speed) component is added to allow for additional damping and responsiveness.

Speed Trims Stabilizer Nose Down with Slowing Airspeed

The need for longitudinal stability enhancements is more pronounced in certain flight conditions, notably when the center of gravity is more aft, and when the engines are producing more power.

Speed Trim Stabilizer Trim is only commanded when Engines above Thrust Threshold

An aft center of gravity decreases the moment arm from the wing center of lift, where the cg is forward of the wing center of lift.  The incremental motion of cg toward the center of lift is effectively a pitch up, which creates a need for more nose down stabilizer trim.  A gain schedule can roughly associate aft cg to trim stabilizer position, essentially scheduling the speed trim function only for aft c.g.

In this figure, as elsewhere, nose up stabilizer position is negative.  That is because the stabilizer is a down-force, and if leading-edge up is positive, leading-edge down is both negative and increasing down force.

Aft Center of Gravity Speed Trim Gain Schedule

Boeing 737NG Speed Trim Gain

Speed trim was added in the 737 classic series, alongside the patent that was referenced above. The system appears to quite similar.

The 737 classic Speed Trim System came under analysis as a part of an accident investigation. The report provided some example of speed trim in action.

On November 17, 2013 at 15:24 UTC at night time, a Boeing 737-500 registered VQ-BBN operated by Tatarstan Airlines JSC crashed while conducting a go- around after the terminated approach to RWY29 of Kazan International Aerodrome. The airplane had been conducting a domestic scheduled passenger flight ТАК 363 from Moscow (Domodedovo, UUDD) to Kazan (UWKD). 

A go-around performed at low speed with an unusual nose-up trim position can lead to a stall and a loss of control. Before the go-around, the speed drops and the aircraft systems compensate for this loss of speed by pitching up the stabilizer more and more.  

Both elevators were deflected symmetrically, compatible with the column deflection. There were no signs of elevator PCU cable jamming (that would have required excessive control column input forces). The Speed Trim System was operating as per design.

The accident report included some information on the speed trim function.  The schedule shows that stabilizer is commanded progressively nose down as airspeed decreases.

Speed Trim Schedule Boeing 737-500
https://mak-iac.org/upload/iblock/459/report_vq-bbn_eng.pdf

As the airspeed decreased from 145 knots to 118 knots the stabilizer made an increment 1.7° nose down deflection

Despite the extensive airspeed increase the stabilizer did not deflect nose up as the crew deflected the column nose down to a value exceeding the threshold value, which deactivated the Speed Trim System as per design.

The speed trim system for the 737NG appears to be largely unchanged.  Speed trim and autopilot stab trim (nose up, nose down) are each combined into a single output command from the autopilot (noting that autopilot trim is active with autopilot engaged and speed trim when autopilot is not engaged).

The FCCs send speed trim signals to the stabilizer trim primary electric actuator to control the horizontal stabilizer movements. This control increases the airplane stability at low air speeds. As the airplane speed slows, the stabilizer is moved to a more nose down position to increase the speed. As the speed increases, the stabilizer is moved to a more nose up position to decrease the speed. This function only operates if the autopilot is not engaged.

Boeing 737NG Speed Trim and Autopilot Stab Trim

Boeing 737NG Speed Trim and Autopilot Stab Trim

Stall Warning and Stall Identification

Stall Warning System (737 Classic) only triggered stick shaker, and took no action on the flight controls directly.

Natural stall warning (buffet) usually occurs at a speed prior to stall. In some configurations the margin between stall and natural stall warning is less than desired. Therefore, an artificial stall warning device, a stick shaker, is used to provide the required warning.

The stall warning “stick shaker” consists of two eccentric weight motors, one on each control column. They are designed to alert the pilots before a stall develops. The warning is given by vibrating both control columns. The system is armed in flight at all times. The system is deactivated on the ground.  

• wing configurations 

• air/ground sensing 

• thrust 

• angle of attack 

• Air Data Computer outputs.

Two independent, identical computers determine when stall warning is required based upon:

The stall warning computers provide outputs for all stall warnings to include stick shaker, signals to the pitch limit indicator and airspeed displays, as well as the GPWS windshear detection and alert.

Control Column Shaker (Stick Shaker) 

737NG Stall Identification functionality is split between the Stall Management Yaw Damper (SMYD) and the Flight Control Computer (FCC), or autopilot.

The SMYD delivers a host of functions solely for the purpose of managing speed limit functions.  The stall warning system shakes the control column when the airplane gets close to a stall. The SMYD Stall ID function increases aft control column feel forces during a stall.

The FCC Stall ID function is an extension of the speed trim function, which drives the stabilizer nose down as speed decreases. In speed trim, the stabilizer is driven incrementally by a position schedule. In Stall ID, the stabilizer is driven nose down until it stops.

The stall warning system shakes the control column when the airplane gets close to a stall.
The stall ID system makes sure the pilot cannot easily overcome automatic nose down trim of the airplane during a stall. During a stall, the stall warning system increases control column feel forces. 

These are the components of the stall warning system:

• Stall management yaw dampers (SMYDs) 

• Control column shakers

• Elevator feel shift module (EFSM)

• Stall warning test panel.

During a stall, the FCCs command the stabilizer to trim the airplane nose down. The EFSM and column cut-out switch modules operate to make sure the pilot cannot easily stop this automatic stabilizer movement with the elevator control column nose up input.

It should be noted that Stall ID is active when the airplane systems believe the airplane is encountering a low speed upset.  The nose down trim and increased column forces are intentional to encourage reducing angle of attack and avoid an uncontrolled pitch-up with a thrust-induced pitching moment.  Once angle of attack is reduced, Stall ID is turned off, and the pilot resumes control smoothly.

The unintentional activation of Stall ID could create a host of alarms, and in effect, a runaway stabilizer coupled with column forces opposing the pilot wanting to pull up. However, since the functions are split between the SMYD and the FCC, there is a possibility that only one of the two systems will fail - the other would not respond.  So it may be possible for the FCC to enter Stall ID without the SMYD entering Stall ID. 

Stall Management Yaw Damper (SMYD)

The SMYD takes airplane configuration and angle of attack and airspeed to determine if the airplane is operating too slowly.  The Stall ID functions include a stick shaker mounted on each control column, and a command to the Elevator Feel Shift Module (EFSM) to boost aft column feel forces.

SMYD Stall ID System Functionality

The SMYD includes an autoslat system.

The autoslat system commands the leading edge slats to extend from the mid-extended to the full-extended position for flaps 1, 2, 5, 10, 15 and 25 when the speed is less than a safe margin above stall. Autoslat operates at an angle-of-attack that is less than for stick shaker speed

Inherent in both the FCC and SMYD is the angle of attack sensor, or AOA sensor. The AOA sensor sends analog angle of airflow vane data. This data is used to determine airplane pitch attitude to set the stall warnings and to calculate performance data.

Amongst the many analog interfaces, the SMYD outputs discretes for stick shaker and to activate the elevator feel shift module.

737NG SMYD Analog Interfaces

In addition, the SMYD calculates speed and pitch limits for other aircraft systems.

The SMYD sends minimum operating speeds and flap position data to the (autothrottle) A/T computer and on-side FCC. The FCC and A/T use this data for their minimum speed calculations. 

The SMYD sends minimum operating speeds and flap and AOA data to the (Ground Proximity Warning Computer) GPWC for windshear alert calculations. 

The SMYD calculates the (Pitch Limit Indicator) PLI symbol and minimum/maximum safe operating airspeeds and sends this data to the on-side (Display Electronics Unit) DEU for display on the (Common Display System) CDS. 

The SMYD sends engine N1 and N2 RPM data (received from the DEU) to the  (Cabin Pressure Controller) CPC. The CPC uses this as part of the takeoff logic to detect throttle advance at the start of the takeoff roll for pressurization of the airplane to prevent a cabin pressure bump at rotation. 

The SMYD sends on-side AOA data and other discrete data to the (Flight Data Acquisition Unit) FDAU for data recording.

Speed Floor Stall Warning

The SMYDs do two calculations for stall warning. These are the normal stall warning and the speed floor stall warning calculations. Either calculation can cause an SMYD to send a stall warning signal to a column shaker.

Note that regardless of AoA, there is a minimum speed for each flap position (which, would be mindful of a specific gross weight and is not fully relevant to any given flight).

The speed floor stall warning uses TE flap position data and airspeed data. If the airspeed is too low for a specific TE flap position, the SMYDs send a stall warning signal to the column shakers. AOA is not used for the speed floor stall warning calculation.

737NG Speed Floor Stall Warning

Stall Warning System and Elevator Feel Shift

The stall warning system is a stall management function that activates the control column stick shakers when airspeed is close to a stall. Each SMYD activates its on-side stick shaker motor. 

When airspeed is close to a stall, the SMYDs do the EFS function by operating the EFSM which provides 850 psi hydraulic system A pressure to the elevator feel computer and the dual feel actuator. This causes the elevator feel force in the feel and centering unit to increase and to counteract or resist elevator up movement at the control column. 

Activation of the EFSM occurs at an AOA of 8 to 11 degrees depending on flap position. There are no other flight deck indications when this system operates.

EFSM Operation

At stall onset, either SMYD sends a signal to energize the dual coil solenoid valve on the EFSM. The EFSM operation occurs when all of these conditions occur: 

• Stick shaker is active

• AOA is 8 to 11 degrees more than thermal anti-ice (TAI) biased stickshaker AOA

• EFSM is not inhibited due to low altitude or the airplane is on the ground. 

When all of these conditions occur, the SMYDs energize the dual coil solenoid valve. The solenoid valve sends 3000 psi system A pressure to the pressure-operated mode valve. 

The mode valve opens and sends pressure between 820 psi to 880 psi from the pressure reducer to the system A side of the dual feel actuator. This increases the control column feel forces up to four times nominal feel. The increased feel force makes sure the pilots cannot easily override automatic stabilizer movement to nose down pitch of the airplane.

737NG Elevator Feel Shift Module

Flight Control Computer (FCC) Stall ID 
When the 737NG was being developed, additional functions were added to the FCC using speed trim during low speed upset recovery. This change was made literally at the last minute, as a result of JAA insistence for type certification after FAA had issued their type certificate. 

In October of 1998, Honeywell released the "-704" software for the Flight Control Computer (FCC). One of the changes is described as "Revised speed trim to include changes associated with JAA stall identification requirements." (The Boeing 737 Technical Guide, Chris Brady).  I would note that there is little further mention of mach trim, speed trim, or stall identification in the FCC change log, and none in the Rockwell Collins listings.

Significant new Stall ID features are added  to the FCC.

The stall warning system shakes the control column when the airplane gets close to a stall.

The stall ID system makes sure the pilot cannot easily overcome automatic nose down trim of the airplane during a stall. During a stall, the stall warning system increases control column feel forces.

These are the components of the stall warning system:

• Stall management yaw dampers (SMYDs) 

• Control column shakers

• Elevator feel shift module (EFSM)

• Stall warning test panel.

During a stall, the FCCs command the stabilizer to trim the airplane nose down. The EFSM and column cut-out switch modules operate to make sure the pilot cannot easily stop this automatic stabilizer movement with the elevator control column nose up input.

From what this states, for virtually all of the 737NG fleet, the speed trim function has been changed to trim the stabilizer nose down until either the stabilizer reaches the nose down limit, or the aft column cutout position is reached. 

JPL 701-799, 803-899, 901-999

The stall detection circuit monitors the flap position and the angle of airflow. Near stall, the speed trim function trims the stabilizer to a nose down condition to allow for trim above the stick shaker AOA and idle thrust. The trim continues until the stabilizer gets to its limits or the aft column cutout position is exceeded.

If the roll angle from the ADIRU is more than 40 degrees, it opens an electronic switch and stops the speed trim signals. 

JPL 801, 802

The stall detection circuit monitors the flap position and the angle of airflow. If it calculates that the airplane is near a stall condition, it opens a switch and stops the speed trim signals.

If the roll angle from the ADIRU is more than 40 degrees, it opens the same switch and stops the speed trim signals.

Boeing 737NG Speed Trim with Stall Detection

In the above figure, the ALPHA MAX PROGRAM applies a fixed stabilizer trim command while AOA exceeds a maximum threshold based on flaps.  A roll-angle greater than 40 degrees will shut off the command. The command is washed out by the fade-out gain if either the stabilizer trims down to a limit position, or if engine N1 is reduced below 60%. 

TK1951 Accident Report (2009)

TK1951 was a 737NG that stalled while on autopilot approach. The manual recovery was unsuccessful due to failure to apply sufficient thrust in recovery. The accident report makes no mention of a feature to drive the stabilizer nose down in stall recovery, rather it laments the fact that recovery is dependent on applying timely nose down trim. I cannot reconcile this accident report with the above description, and am somewhat surprised there is no mention of it.

A Boeing 737-800 (flight TK1951) operated by Turkish Airlines was flying from Istanbul Atatürk Airport in Turkey to Amsterdam Schiphol Airport, on 25 February 2009. As this was a ‘Line Flight Under Supervision’, there were three crew members in the cockpit, namely the captain, who was also acting as instructor, the first officer who had to gain experience on the route of the flight and who was accordingly flying under supervision, and a safety pilot who was observing the flight. There were also four cabin crew members and 128 passengers on board. During the approach to runway 18 Right (18R) at Schiphol airport, the aircraft crashed into a field at a distance of about 1.5 kilometres from the threshold of the runway. This accident cost the lives of four crew members, including the three pilots, and five passengers, with a further three crew members and 117 passengers sustaining injuries.

During the approach, the left radio altimeter system displayed an incorrect height of -8 feet. 

When the aircraft started to follow the glidepath (the ideal path to the runway) because of the incorrect altitude reading, the autothrottle moved into the ‘retard flare’ mode. This mode is normally only activated in the final phase of the landing, below 27 feet. This was possible because the other preconditions had also been met, including flaps at (minimum) position 15. The thrust from both engines was accordingly reduced to a minimum value (approach idle).

However, the right-hand autopilot, which was activated, was receiving the correct altitude from the right-hand radio altimeter system. Thus the autopilot attempted to keep the aircraft flying on the glide path for as long as possible. This meant that the aircraft’s nose continued to rise, creating an increasing angle of attack of the wings. This was necessary in order to maintain the same lift as the airspeed reduced.

The reduction in speed and excessively high pitch attitude of the aircraft were not recognised until the approach to stall warning (stick shaker) went off at an altitude of 460 feet.

The first officer responded immediately to the stick shaker by pushing the control column forward and also pushing the throttle levers forward. The captain however, also responded to the stick shaker commencing by taking over control. Assumingly the result of this was that the first officer’s selection of thrust was interrupted. The result of this was that the autothrottle, which was not yet switched off, immediately pulled the throttle levers back again to the position where the engines were not providing any significant thrust. Once the captain had taken over control, the autothrottle was disconnected, but no thrust was selected at that point. Nine seconds after the commencement of the first approach to stall warning, the throttle levers were pushed fully forward, but at that point the aircraft had already stalled and the height remaining, of about 350 feet, was insufficient for a recovery.

The Autopilot was engaged and as the airplane slowed on glide slope, the autopilot progressively trimmed the stabilizer nose up. NOTE: Speed trim does not operate with Autopilot engaged.

The noise of the automatic trim system can be clearly heard during 16 of the 23 seconds before the stall warning, when the speed went below the selected target speed for the aircraft. This is longer than usual.

It is concluded that the system of a safety pilot on board flight TK1951 did not work sufficiently well.

The European rules for training pilots that applied to Turkish Airlines - the Joint Aviation Requirements, Operations 1 and Joint Aviation Requirements, Flight Crew Licensing - only prescribed approach to stall training in the context of type qualification training. The training required for qualification to be allowed to fly a particular aircraft type. This may explain the first officer’s rapid reaction to the stick shaker. He had recently undergone his type qualification training.

There is no rule prescribing training in recovery after an approach to stall warning in the recurrent training. The thinking behind this is apparently that an approach to stall situation will be unlikely to occur, and pilots know how to deal with it. Furthermore all of the standard communication and coordination procedures in relation to monitoring the flight path and airspeed are aimed precisely at avoiding such a situation.

The investigation revealed the importance of having an appropriate recovery procedure for stall situations and the importance of recurrent training. The Board has thus formulated the following recommendations:

4. Boeing should review its ‘Approach to stall’ procedures with regard to the use of autopilot and autothrottle and the need for trimming.

The report elaborates on the stall recovery system, which makes no mention of a stabilizer trim feature.

Stall warning system

A stall is the situation where the air flow can no longer follow the profile of the wing due to an increase of the angle of attack of the wing. The wing will then lose its lift to a large extent and, therefore, the aircraft will soon lose altitude should the pilot not intervene. The stall warning system is used to generate the required warning before a stall starts. This warning (hereafter to be referred to as stick shaker) is emitted by vibration of the control columns. The operations of the system produces a distinctive noise which is audible to the flight crew. The pilot applying the prescribed recovery procedure must, subsequently prevent that the aircraft actively ends up in a stall situation. It should be noted that a full stall is different than a stick shaker warning situation. The aircraft can continue to fly normally at an angle of attack at which the stick shaker is activated. When the angle of attack is increased more the aircraft will stall and loose altitude rapidly.

TK1951 was flown into a stall while on autopilot. As a result of the flight condition, the stabilizer had been trimmed to fully nose-up. The investigation revealed the necessity to trim stabilizer nose down in the recovery to avoid uncontrollable pitch up, but makes no mention of this feature already available.

Investigation was also performed into the recovery characteristics of the B737-800 at the moment of the approach to stall warning onset, with and without autopilot engaged. Maximum thrust was selected 1 second after the stick shaker warning to account for reaction time. The aircraft was flown with autopilot engaged and the stabiliser trimmed until an airspeed slightly above the approach to stall warning onset speed. With this speed the stabiliser reached its airplane nose-up stop (full nose-up electrical trim) and could not be trimmed further in the nose-up direction. This was also the case with flight TK1951. Because of the stabilizer’s maximum nose-up moment and corresponding low speed just above the stall speed, which was beyond the FAR 25.103 criteria (see below), the effectiveness of the elevator might be less than demonstrated during certification tests.

The FAR 25.103 stall procedures during (certification) tests state:

...The airplane should be trimmed for hands-off flight at a speed 20 percent to 40 percent above the stall speed,....

With the selection of maximum thrust, with underwing engines, an additional pitch-up moment is produced. If the speed is sufficiently low, nose down trimming is necessary to maintain full pitch authority. This situation was confirmed during the M-Cab sessions.

Manual recovery

During the manual recovery, under the above given conditions, it was necessary to push the control column fully forward in order to prevent the pitch value from becoming higher than the pitch limit indicator leading to aircraft stall. As the recovery progressed it was not always possible to maintain the aircraft pitch at or below the pitch limit indicator without trimming the stabilizer in most cases, but adequate elevator authority was available for at least 40 seconds before trimming was required.

Control forces were maximum between 30-50 pounds and such that with one hand full forward control column deflection was possible. Evaluations of various recovery techniques showed that timely application of thrust could ensure recovery after stick shaker. In the event that thrust was not applied within a few seconds of stick shaker, the airplane could still be recovered by making control inputs to prevent the airplane from stalling.

Single channel autopilot recovery

Recovery with one autopilot engaged was satisfactory for the first 15-20 seconds. After that, the autopilot lacked sufficient pitch authority leading to an uncontrollable pitch increase far beyond 25 degrees, with a stall as result. Taking over manually within 20 seconds and trimming within approximately 40 seconds was necessary to control the pitch and to prevent the aircraft from stalling.

Dual channel autopilot recovery

Also in this situation the pitch increased beyond 25 degrees, although less pronounced, because of the autopilots increased capacity to apply forces on the elevator. Manually disconnecting the autopilot and reducing thrust or trimming the stabiliser resulted in successful recoveries.

Conclusion

Stabilizer can be trimmed based on many inputs.  The need to trim 737 stabilizer nose-down in a stall recovery has been noted consistently. While there is mention of this feature in for the 737NG, at least one accident report in 2009, eleven years after the feature was implemented, makes no mention of it, and even emphasizes the importance of trimming nose down.

The fact that the Boeing Service Bulletin (FAA Airworthiness Directive) applies only to 737MAX, in spite of what appears to be the same feature described in 737NG, is an issue unresolved, and will need Boeing to explain.

The combination of failure modes, the system behaviours, airplane performance, the actions of the flight crew, and other factors will be investigated and a report for JT610 will shed more light on what factors led to this tragedy, the extent of the issues in the field, and the plan to prevent a recurrence.

Since Stall ID functions are split between SMYD and FCC, it is possible a failure would only falsely trigger one of the two functions: either EFSM or Stab Trim may be tripped, but not necessarily both.

Sorrow for the victims, recently and in the past, who have lost their lives or have been injured as a result of failure to manage the pitch controls effectively. 

The emphasis on adding automation features to aid pilots has limiting returns. 

By accounts to date, a system was added to trim the stabilizer down to aid the pilot, but that system failed and itself became the villain instead of the saviour. 

Failure modes and effects are not always apparent, but hopefully these issues will be resolved quickly.

The entire series on 737 MCAS

Connecting the Dots: From Command to Action

Movable Stabilizer
737 Pitch Trim Incidents

The Beat Goes On

What Happened on ET302?
AoA Vane must have Failed, the Boeing Fix is In, Senate Grills FAA
How Did MCAS Get Here and What Hurdles Remain?
Taking the Next Steps while Awaiting on the Preliminary Report from ET302
Ethiopian ET302 similarities to Lion Air JT610
What have we learned this week?
Comparing Ethiopian ET302 to Lion Air JT043, JT610
Angle of Attack Vane Failure Modes
First Look at JT610 Flight Data
737 FCC Pitch Axis Augmentation - Command Integrity Mandate for Dual Channel, Fail-Safe
737 MCAS - Failure is an Option
Stabilizer Trim 

Stay tuned!

Peter Lemme

peter @ satcom.guru

Follow me on twitter: @Satcom_Guru

Copyright 2018 satcom.guru All Rights Reserved

Peter Lemme has been a leader in avionics engineering for 37 years. He offers independent consulting services largely focused on avionics and L, Ku, and Ka band satellite communications to aircraft. Peter chairs the SAE-ITC AEEC Ku/Ka-band satcom subcommittee, developing ARINC 791 and 792 characteristics and contributes to the Network Infrastructure and Interfaces (NIS) subcommittee developing Project Paper 848, standard for Media Independent Secure Offboard Network.

Peter was Boeing avionics supervisor for 767 and 747-400 data link recording, data link reporting, and satellite communications. He was an FAA designated engineering representative (DER) for ACARS, satellite communications, DFDAU, DFDR, ACMS and printers. Peter was lead engineer for Thrust Management System (757, 767, 747-400), also supervisor for satellite communications for 777, and was manager of terminal-area projects (GLS, MLS, enhanced vision).

An instrument-rated private pilot, single engine land and sea, Peter has enjoyed perspectives from both operating and designing airplanes. Hundreds of hours of flight test analysis and thousands of hours in simulators have given him an appreciation for the many aspects that drive aviation; whether tandem complexity, policy, human, or technical; and the difficulties and challenges to achieving success.