Some months after Boeing delivered its first 737 Max planes to a carrier in Indonesia, engineers at the company realized that a cockpit alert wasn’t actually activated on most of the jets. After an internal review, people at Boeing decided airlines—and even the company’s top management—didn’t need to know that.
The plane has since been involved in two deadly crashes that jointly killed nearly 350 people, and in both cases incorrect sensor data measuring the plane’s angle in relation to oncoming air—know as “angle-of-attack” (AoA)—was a factor. The nonworking alert would have signaled a malfunction with those AoA sensors.
Boeing yesterday (May 5) said that it initially designed the AoA disagree alert as “a standard, standalone feature,” but later realized it was effectively optional. The Max’s software would only allow the disagree alert to work on airlines that had purchased an optional AoA indicator as well. After a review, Boeing decided it could fix the issue later:
That review, which involved multiple company subject matter experts, determined that the absence of the AOA Disagree alert did not adversely impact airplane safety or operation. Accordingly, the review concluded, the existing functionality was acceptable until the alert and the indicator could be delinked in the next planned display system software update. Senior company leadership was not involved in the review and first became aware of this issue in the aftermath of the Lion Air accident.
Boeing’s statements come after reports in the Wall Street Journal on the problems with the AoA alert (paywall). Sunday’s disclosure adds to the number of changes in the 737 Max that carriers and pilots were not made aware of by Boeing, the biggest by far being the existence of the Maneuvering Characteristics Augmentation System, or MCAS, which responds to AoA data suggesting the plane could be facing a stall by pointing the plane’s nose down sharply and repeatedly. Neither of the planes that crashed had the optional indicator that would activate the disagree alert, and it’s unclear if its presence would have helped.
In the wake of the first crash involving the Max, when a Lion Air plane went down on Oct. 29 in Indonesia a little over 10 minutes post takeoff after pilots battled the MCAS system unsuccessfully, Boeing convened a committee to reconsider if the absence of the disagree alert was a safety issue, and again decided it wasn’t.
In March, a similar situation to the Lion Air crash occurred with the crash of an Ethiopian Airlines flight, even though pilots carried out a checklist of steps provided by Boeing and the US Federal Aviation Administration (FAA) after the Lion Air crash. Boeing Max planes have been grounded globally since then.
Some airlines did have a working version of the disagree alert. American Airlines told Quartz its standard practice has been to order both the disagree alert and the optional gauge, both for the Max and in its older 737s. But there’s also been confusion about how the alert works on the Max—the pilots’ union says Boeing told them after the Lion Air crash that the alert could go off on the ground, preventing a plane with a sensor problem taking off, but has since said it only begins working at 400 feet above ground level. “None of those details is in our flight manual,” said captain Dennis Tajer, spokesman for the Allied Pilots Association, which represents American Airlines pilots.
Other carriers, such as Southwest Airlines, believed they had a working disagree alert, when they actually didn’t.
The FAA told Quartz Boeing made it aware of the issue after the Lion Air crash, and that an internal FAA review board decided the issue was “low-risk” and could wait to be addressed in the software update Boeing was working on. “However, Boeing’s timely or earlier communication with the operators would have have helped to reduce or eliminate possible confusion,” the regulator said. In the upcoming software updates, the disagree light will be delinked from the optional indicator, and MCAS won’t fire if the sensors disagree by a set amount.
Aviation experts have noted that the way the Max is designed, there is absolutely no way for the MCAS system to signal to pilots when it isn’t working as it is supposed to. The lack of such a warning might have been an oversight, or part of efforts to reduce and simplify training.
“The issue with MCAS is there is no alert. There is nothing in the flight deck that tells you that MCAS is malfunctioning,” Peter Lemme, a former Boeing engineer and author of the Satcom Guru blog, told Quartz after the Ethiopian crash. “See, if there’d been an MCAS light they would have have had to train for it. The minute you put an indication in there, you have to tell the pilot what to do if it goes off.”
In the absence of such an “MCAS light,” the disagree alert would have been the closest thing to a warning the system was about to misfire—that is, if pilots had been told about MCAS in the first place.
Update: The story was updated with a comment from the American Airlines pilots’ union.