Boeing Did Not Fix MAX AOA Warning Issue Found in 2017

 Aviation Daily

WASHINGTON—New questions are being raised over the development and oversight of the Boeing 737 MAX after revelations the manufacturer knew about a mis-configured angle of attack disagree annunciator alert message on the aircraft in 2017 but did not fix it or tell operators about the problem until after last October’s crash of a 737 MAX 8—the first of two to strike the model in five months.

Boeing on May 5 clarified that within “several months” after MAX deliveries began in May 2017, it discovered that most of its 737 MAXs were being delivered without angle-of-attack (AOA) disagree alert message being activated as intended. It determined the issue was not a safety risk, however, and planned to address it as part of routine flight control software updates. The revelation adds more context to why the amber AOA Disagree alert messages, meant to tell pilots of a discrepancy between the aircraft’s two AOA sensors, have only been active on MAX aircraft equipped with a package of options.

“The Boeing design requirements for the 737 MAX included the AOA disagree alert as a standard, standalone feature, in keeping with Boeing’s fundamental design philosophy of retaining commonality with the 737NG,” Boeing said. “In 2017, within several months after beginning 737 MAX deliveries, engineers at Boeing identified that the 737 MAX display system software did not correctly meet the AOA disagree alert requirements. The software delivered to Boeing linked the AOA disagree alert to the AOA indicator, which is an optional feature on the MAX and the NG. Accordingly, the software activated the AOA disagree alert only if an airline opted for the AOA indicator.”

Boeing’s statement does not discuss whether the software was developed to its specifications, or whether the vendor introduced the error. Boeing’s statement does not name the vendor, but it is Collins Aerospace. Collins referred all questions to Boeing.

After it discovered the issue, Boeing said it followed its “standard process for determining the appropriate resolution of such issues,” including a review with “multiple company subject-matter experts.” The review “determined that the absence of the AOA disagree alert did not adversely impact airplane safety or operation,” Boeing said. “Accordingly, the review concluded, the existing functionality was acceptable until the alert and the indicator could be delinked in the next planned display system software update.”

Boeing’s senior management was not involved in the review, and neither Boeing’s senior leadership nor FAA were made aware of the issue until after the Oct. 29, 2018, crash of Lion Air Flight 610.

The AOA sensors provide key data to the MAX’s maneuvering characteristics augmentation system (MCAS) flight control law that is the focus of two fatal 737-8 accidents—Lion Air flight 610 and the Mar 10 crash of Ethiopian Airlines flight 302—in which all 346 people were killed and that have left the MAX fleet grounded.

In each accident, faulty data sent by one AOA sensor told the aircraft’s flight control computer that its nose was too high, causing MCAS to command horizontal stabilizer nose down trim. Preliminary reports on each accident suggest the pilots were not able to diagnose the failure quickly enough.

The original MCAS is programmed to command nose down trim if the AOA data shows the angle of attack is too high. Pilots can counter it in two ways: with electric trim input or via the manual trim wheel. Electric trim input resets MCAS, meaning faulty AOA data would trigger it again after a 5 sec. delay. In both accident sequences, the pilots countered with electric trim, setting up the MCAS’s cyclical activation.

Boeing’s safety analysis determined that crews would diagnose an unwanted MCAS activation as stabilizer runaway, and would follow the appropriate checklist, which includes de-powering the stabilizer trim motors by turning off the trim cutout switches, leaving the manual trim wheels as the only elevator trim inputs. The Ethiopian crew toggled off the cutout switches, but could not manually trim the aircraft at the relatively high indicated airspeed, so they turned on the trim cutout switches, which set the stage for MCAS to re-engage.

Neither Lion Air nor Ethiopian Airlines had the optional AOA disagree indicator package. The accident sequences would have triggered AOA disagree alerts, adding it to several that activated, including a stick-shaker stall warning.

Following the Lion Air accident, Boeing convened a “safety review board” (SRB) to revisit whether the AOA Disagree issue was a safety risk. “That SRB confirmed Boeing’s prior conclusion that it did not,” Boeing said. “Boeing shared this conclusion and the supporting SRB analysis with the FAA.”

Addressing reporters following a Boeing shareholder meeting Apr. 29, Boeing CEO Dennis Muilenburg downplayed the significance of the AOA Disagree alert’s role in delivering key information to pilots. “It’s not something that drives pilot action,” he said. “It’s not something that we designed in as a primary flight display in the flight deck of a commercial airplane. What pilots care about are things like altitude, airspeed, heading, pitch and roll. That’s what they fly. Those indicators are in the flight deck today. Airspeed and altitude in particular are the relevant items around these two [accidents].”

Even if the absence of the AOA Disagree lights is not linked to either accident, the issue adds more questions to the MAX’s development, and how much airlines knew about changes from the 737NG. MCAS was not on the NG, and most pilots didn’t know it existed until after the Lion Air accident.

Since just after the Lion Air accident, Boeing has described the AOA Disagree as an available option on the MAX, which was accurate. It was not until Apr. 29 that it explained the AOA Disagree’s status as an option was a mistake—it was supposed to be standard, as it is on the NG. Six days later, it acknowledged that it has known about this problem since mid-2017.

Boeing is updating MCAS, using both AOA sensors to prevent the system from acting on a single faulty sensor. The changes also will limit MCAS’s authority, in part by removing its ability to reset itself and potentially fire again based on faulty AOA data when the crew provides electric stabilizer trim input to counter it.

In addition, Boeing will make both the AOA disagree alerts and AOA indicator standard on all MAXs, including offering free modifications for aircraft already delivered.

Note: This story has been updated from the original version published May 5. It includes additional details and clarifications on MCAS’s operation and the AOA Disagree alert’s intended function.