It’s been six months since a Lion Air flight on a Boeing 737 Max 8 crashed in Indonesia and killed 189 people, and revelations about the aircraft’s design and induction are still springing alarming surprises.
Just ahead of Boeing’s shareholder meeting yesterday (April 29), the Wall Street Journal reported that Boeing didn’t inform at least some airlines and the US Federal Aviation Administration (FAA) that a warning cockpit light on the 737 Max wouldn’t work as it had in the past, and was now dependent on an optional suite of indicators being purchased (paywall). The alert in question would have warned that readings from the plane’s two angle-of-attack sensors—which gauge the angle of the plane in relation to oncoming air—were in disagreement. Angle-of-attack (AoA) data can indicate if the plane is in danger of stalling, but a “disagree” warning tells pilots they’re not giving the same readings, meaning something’s faulty.
In both the Lion Air crash, and the second disaster involving the Max, the crash of an Ethiopian Airlines flight on March 10 that killed 157 people, an erroneous AoA sensor reading triggered a new anti-stall flight system that pointed the plane’s nose sharply downwards. Neither craft had the optional package that would activate the disagree light. The pilots in both cases were unable to successfully counter the automated system, called the Manuevering Characteristics Augmentation System, or MCAS. The Max was grounded globally within a few days of the second crash.
Late yesterday, Boeing said it “did not intentionally or otherwise deactivate the disagree alert on its MAX airplanes.” It also said:
The disagree alert was intended to be a standard, stand-alone feature on MAX airplanes. However, the disagree alert was not operable on all airplanes because the feature was not activated as intended.
The disagree alert was tied or linked into the angle of attack indicator, which is an optional feature on the MAX. Unless an airline opted for the angle of attack indicator, the disagree alert was not operable.
By definition, a “standalone” feature shouldn’t require something else to work, and especially not an optional package. It now seems that instead of intending the feature to be optional, this might have been another oversight—or possibly even another design issue (paywall).
More worryingly, if the deactivation was unintentional, does it mean the company itself wasn’t entirely aware this alert wasn’t working the way it used to when it sent the plane to carriers? Southwest Airlines, for example, has said the manuals that Boeing provided with the planes it ordered had incorrect information about how the alert would work:
Upon delivery (prior to the Lion Air event), the AOA Disagree lights were depicted to us by Boeing as operable on all MAX aircraft, regardless of the selection of optional AOA Indicators on the Primary Flight Display (PFD). The manual documentation presented by Boeing at Southwest’s MAX entry into service indicated the AOA Disagree Light functioned on the aircraft, similar to the Lights on our NG series. After the Lion Air event, Boeing notified us that the AOA Disagree Lights were inoperable without the optional AOA Indicators on the MAX aircraft. At that time, Southwest installed the AOA Indicators on the PFD, resulting in the activation of the AOA Disagree lights…
According to the Journal, some airlines do appear to have been aware that the optional AoA indicator was required for the disagree light to work. American Airlines has them, and they go off when readings are 10 degrees apart for more than 10 seconds.
With the software update that Boeing is developing, MCAS will no longer be triggered on a single sensor’s data, and won’t be triggered if the plane’s two AoA sensors disagree. The optional indicator that activates the disagree light will also be standard.
Without that software update, it’s unclear how the presence of a working disagree light would have changed the situation for either the Lion Air or Ethiopian passengers once they were in the air. But it’s possible that if such a warning triggered while on the ground—the Lion Air sensors apparently showed a 20-degree disparity while taxiing—the plane would have been held back so technicians could diagnose and repair the problem.
Boeing’s CEO Dennis Muilenburg told shareholders yesterday that the company is continuing to work on the software update that will prevent incorrect readings from setting off the MCAS, calling that “one link in a longer chain of events. We know we can break this link in the chain.”
Of the many links in this particular chain—a design that changed the 737’s aerodynamics for the worse, the addition of a software “kludge” to counteract those dynamics, the fact the system flew in the face of typical design choices by triggering off of a single sensor, the fact that pilots weren’t trained for or even told about it—it’s looking increasingly like Boeing’s own decisions are the common thread.