Highlights
- Crashes occurred after erroneous readings by a single angle-of-attack (AOA) sensor
- Sensor triggered software that pushed the jet's nose down until pilots lost control
- Planemaker didn't share its findings with airlines or the Federal Aviation Administration (FAA) until after a Lion Air plane went down
- Latest disclosure raises new questions about the 737 Max's development and testing
Boeing Co. knew months before a deadly 737 Max crash that a cockpit alert wasn't working the way the company had told buyers of the single-aisle jetliner.
But the planemaker didn't share its findings with airlines or the Federal Aviation Administration (FAA) until after a Lion Air plane went down off the coast of Indonesia in October, according to a Boeing statement Sunday.
Erroneous readings
The accident occurred after erroneous readings by a single angle-of-attack (AOA) sensor triggered software that pushed the jet's nose down until pilots lost control.
● An AOA vane works by aligning itself with the local airflow, like an arrow. The angle to some reference line (normally aircraft fuselage horizontal) is then measured (using a potentiometer).
● Information from the AOA sensors are fed into the flight computer. It it rises too high, suggesting an approaching stall, the MCAS (Maneuvering Characteristics Augmentation System) activates.
● Most transport airplanes have 2 vanes. If either vane shows an angle of attack that is approaching stall, the stall warning will alert the pilot(s) that stall is near.
● If both AOA vanes are at the stall AOA, a stick pusher will activate to alleviate the aerodynamic stall.
Boeing's latest disclosure raises new questions about the 737 Max's development and testing — and the company's lack of transparency.
The alert was supposed to flash when two angle-of-attack vanes sent conflicting data about the relation of the plane's nose to the oncoming air stream.
● On November 7, 2018, the FAA issued an Emergency Airworthiness Directive (EAD) to operators of the Boeing 737- and -7 airplanes.
● The emergency directive was prompted by analysis performed by Boeing which shows that if an erroneously high single AOA sensor input is received by the flight control system, there is a potential for "repeated nose-down trim" commands of the horizontal stabiliser.
● If this condition is not addressed, the EAD stated, it could cause the flight crew to have difficulty controlling the airplane, and lead to excesssive nose-down attitude, significant loss of altitude, and possible impact with terrain.
● Following the two crashes that killed 346 people, Boeing recently decided to make the AOA Disagree alert a standard, standalone feature on the 737 MAX before the grounded jets return to service.
● Reuters reported that the AOA sensor was previously an optional item on the MAX and the previous NG model of the 737 narrowbody series, and is one of several ways of measuring the state of the aircraft
● When the MAX returns to service, all MAX production aircraft will have an activated and operable AOA Disagree alert and an optional angle of attack indicator, Boeing said on Sunday.
Boeing had told airlines and pilots that the so-called AOA disagree warning was standard across the Max fleet, as on a previous generation of 737 jets.
The software delivered to Boeing linked the signal with a second cockpit gauge — available for a fee — that displayed the readings from the two vanes.
If this condition (repeated nose-down trim commands of the horizontal stabiliser, as a result of erroneously high single angle of attack sensor input) is not addressed, the EAD stated, it could cause the flight crew to have difficulty controlling the airplane, and lead to excesssive nose-down attitude, significant loss of altitude, and possible impact with terrain.
The software delivered to Boeing linked the signal with a second cockpit gauge — available for a fee — that displayed the readings from the two vanes.
As a result, the AOA disagree light, which warned pilots of issues with the sensors, functioned only for customers that purchased the optional indicator.
"The question I have is just like we asked them in Reno, 'Is that all there is?' That's the biggest question," said Jon Weaks, head of the Southwest Airlines Pilots Association, referring to a meeting union leaders had with Boeing after the Lion Air crash.
"It's obviously troubling that here is something else Boeing didn't get to us."
As a result, the AOA disagree light, which warned pilots of issues with the sensors, functioned only for customers that purchased the optional indicator.
"The question I have is just like we asked them in Reno, 'Is that all there is?' That's the biggest question," said Jon Weaks, head of the Southwest Airlines Pilots Association, referring to a meeting union leaders had with Boeing after the Lion Air crash.
"It's obviously troubling that here is something else Boeing didn't get to us."
FAA Criticism
The inactive alert was later deemed to be "low risk" by the FAA's Corrective Action Review Board, the regulator said Sunday.
"However, Boeing's timely or earlier communication with the operators would have helped to reduce or eliminate possible confusion," the FAA said.
Boeing's timely or earlier communication with the operators would have helped to reduce or eliminate possible confusion.
Boeing engineers discovered the discrepancy "within several months" of the initial Max deliveries in May 2017, the company said as it provided additional details of an issue that first came to light last week.
The disclosures followed criticism from airlines and crash victims' relatives that Boeing hasn't been forthcoming about issues with the 737 Max, which has been grounded since a second crash in March, in Ethiopia.
346
number of people killed following the two Boeing 737 Max disastersThe two disasters killed 346 people.
The manufacturer's own experts reviewed the issue and "determined that the absence of the AOA Disagree alert did not adversely impact airplane safety or operation," according to the Boeing statement.
The company's review board decided the setup was acceptable until the two alerts could be unlinked with the next planned software update for the plane's display system.
Airline discussions
Rockwell Collins, which was acquired last year by United Technologies Corp., provides the cockpit displays and flight-control computers for the 737 Max.
Another United Technologies division makes the angle-of-attack (AOA) vanes for the plane.
United Technologies referred questions to Boeing.
The Chicago-based planemaker said its senior leadership wasn't involved in the review and first became aware of the issue after the Lion Air accident.
Boeing also broke the news of the glitch to Max operators such as Southwest Airlines Co. in the aftermath of the initial crash.
"Why weren't the manuals changed? Until after Lion Air, our manuals said that worked," Weaks said.
"You can't blame Southwest because that's the information they had from Boeing. We don't know what we don't know."
Boeing said it also told the FAA that company engineers had identified the issue in 2017, along with the findings from their internal review process.
In December, a safety review board convened by the manufacturer confirmed that the absence of a functional AOA disagree light didn't present a safety issue.
Software Update
Boeing briefed the FAA's Seattle aircraft certification office in November, and the information was forwarded to the agency's Corrective Action Review Board for evaluation, an FAA representative said Sunday.
The panel determined the issue to be "low risk," and said Boeing would have to fix it as part of an overall package of enhancements to the Max in response to the Lion Air accident.
Before the Max returns to service, Boeing plans to issue a software update that will allow the AOA disagree light to operate as a standalone feature.
Boeing has separately been working to finalize a redesign of the software, known as MCAS, that was mistakenly triggered by the faulty sensor readings. The last major milestone is an FAA certification flight that the company expects to conduct shortly.
Boeing had prior knowledge: What it means
The new statement from Boeing indicates that the aerospace manufacturer knew about a problem with the 737 Max aircraft well before the deadly October 2018 Lion Air crash, but decided not to do anything about it.
Boeing previously acknowledged that an alert system that was supposed to be a standard feature in the fleet "was not operable on all airplanes."
But a statement released Sunday describes a troubling timeline that shows how long some at the company were aware of the problem before finally deciding to act.
In its statement Sunday, Boeing maintained that the software issue "did not adversely impact airplane safety or operation."
It's not known if the lack of the alert function played a role in the crashes of Lion Air and Ethiopian Airlines planes, which killed 346 people.
Disagree alert
But the "disagree alert" could have notified pilots that a sensor was malfunctioning.
In both disasters, preliminary investigations suggest faulty data from a malfunctioning angle of attack (AOA) sensor triggered the aircraft's anti-stall software, known as MCAS, which pitched down the nose of the planes as pilots struggled for control.
Boeing says its senior leadership and the Federal Aviation Administration (FAA) did not know about the issue until after the Lion Air crash.
Neither the FAA or Boeing interfered with the fleet's operations until the Ethiopian Airlines crash in March 2019.
The Trump administration grounded all 737 Max jets worldwide, creating financial and logistical problems for three major US airlines, while Boeing continues working to fix the problem.
Why the alert function is important
The AOA disagree alert only worked on an aircraft if the airline had purchased an additional, optional feature, known as the AOA indicator, Boeing said.
The AOA indicator lets pilots know if one of the AOA sensors is not working, while the disagree alert shows if the sensors contradict each other.
Boeing relied on single sensor for 737 Max that had been flagged 216 times to FAA.
Boeing contends the alert function was not necessary for the safe operation of the airplane.
But former Boeing engineers and aviation analysts criticised Boeing's original software design for relying on data from a single AOA sensor, claiming that those devices are vulnerable to defects.
Boeing also did not flight test what would happen to the MCAS system if the single AOA sensor failed, CNN earlier reported.
In 2017, after 737 MAX deliveries began, Boeing engineers "identified" that the 737 Max display system software did not correctly meet the AOA Disagree alert requirements, the statement reads.
Yet, after a review, Boeing's engineers decided not to immediately correct the problem, concluding that "the existing functionality was acceptable until the alert and the indicator could be delinked in the next planned display system software update."
The response
Then, one week after the Lion Air crash on October 29, Boeing added a line in an FAA airworthiness directive that said the disagree light was optional. It's not clear if Boeing alerted its airline customers to the issue.
Boeing also convened a Safety Review Board to consider whether the absence of the AOA Disagree alert from certain 737 MAX flight displays presented a safety issue, the statement said.
When the SRB confirmed Boeing's conclusion, Boeing shared it — along with supporting SRB analysis — with the FAA, the statement said.
AOA Disagree alert as a standard
Boeing said it is issuing a display system software update "to implement the AOA Disagree alert as a standard, standalone feature before the MAX returns to service."
"When the MAX returns to service, all MAX production aircraft will have an activated and operable AOA Disagree alert and an optional angle of attack indicator," the company said.
"All customers with previously delivered MAX airplanes will have the ability to activate the AOA Disagree alert."
