Boeing Company did not tell U.S. regulators for more than a year that it inadvertently made an alarm alerting pilots to a mismatch of flight data optional on the 737 MAX, instead of standard as on earlier 737s, but insisted on Sunday the missing display represented no safety risk.
The U.S. planemaker has been trying for weeks to dispel suggestions that it made airlines pay for safety features after it emerged that an alert designed to show discrepancies in Angle of Attack readings from two sensors was optional on the 737 MAX.
Erroneous data from a sensor responsible for measuring the angle at which the wing slices through the air – known as the Angle of Attack – is suspected of triggering a flawed piece of software that pushed the plane downward in two recent crashes.
In a statement, Boeing said it only discovered once deliveries of the 737 MAX had begun in 2017 that the so-called AOA Disagree alert was optional instead of standard as it had intended, but added that was not critical safety data.
A Federal Aviation Administration official told Reuters on Sunday that Boeing waited 13 months before informing the agency in November 2018.
By becoming optional, the alert had been treated in the same way as a separate indicator showing raw AOA data, which is seldom used by commercial pilots and had been an add-on for years.
“Neither the angle of attack indicator nor the AOA Disagree alert are necessary for the safe operation of the airplane,” Boeing said.
“They provide supplemental information only, and have never been considered safety features on commercial jet transport airplanes.”
Boeing said a Safety Review Board convened after a fatal Lion Air crash in Indonesia last October corroborated its prior conclusion that the alert was not necessary for the safe operation of commercial aircraft and could safely be tackled in a future system update.
The FAA backed that assessment but criticized Boeing for being slow to disclose the problem.
Boeing briefed the FAA on the display issue in November, after the Lion Air accident, and a special panel deemed it to be “low risk,” an FAA spokesman said.
“However, Boeing’s timely or earlier communication with the operators would have helped to reduce or eliminate possible confusion,” he added.
Boeing attributed the error to software delivered to the company from an outside source, but did not give details.
Sunday’s statement marked the first time since the two fatal accidents that Boeing explicitly acknowledged doing something inadvertently in the development of the 737 MAX, albeit on an issue that it contends has no impact on safety.
Boeing has said the feeding of erroneous Angle of Attack data to a system called MCAS that pushed the planes lower was a common link in two wider chains of events leading to both crashes, but has stopped short of admitting error on that front.
The angle of attack measures the angle between the air flow and the wing and helps determine whether the plane is able to fly correctly. If the angle becomes too steep, the flow of air over the wing is disturbed, throwing the plane into an aerodynamic stall. That means it starts to fall instead of fly.
Although the angle itself is key for onboard systems, the industry has debated for years whether such data should be included in already crowded cockpit displays because it is directly related to airspeed, which pilots already scrutinize.
Some analysts and academics say having the AOA Disagree alert installed would have helped Lion Air maintenance crew diagnose a problem on the penultimate flight of the 737 MAX jet that crashed in October, killing all 189 on board.
The 737 MAX was grounded worldwide over safety concerns following the Ethiopian crash in March, killing 157 people.
When the jet returns to service, all new aircraft will have a working AOA Disagree alert as a standard feature and a no-charge optional indicator showing the underlying data, Boeing said. That restores the situation found on the displays of previous 737NG models since around the middle of last decade.
Airlines with grounded 737 MAX jets will be able to activate the AOA Disagree function directly.
Boeing is also developing a software upgrade and training changes to the MCAS system that must be approved by global regulators before the jets can fly again.
Boeing has yet to formally submit the upgrades to the FAA for approval but could do as early as this week once it completes a special test flight.
Federal prosecutors, the Transportation Department inspector general’s office and a blue-ribbon panel are also looking into the 737 MAX’s certification.
A U.S. House of Representatives panel will hold a hearing on the plane’s status with the FAA’s acting chief, Dan Elwell, and National Transportation Safety Board Chairman Robert Sumwalt on May 15.
Reporting by Tracy Rucinski in Chicago and David Shepardson in Wasington; Additional reporting by Tim Hepher in Paris; Writing by Tracy Rucinski, Tim Hepher; Editing by Bill Berkrot and Peter Cooney
Boeing Statement on AOA Disagree Alert
On every airplane delivered to our customers, including the MAX, all flight data and information needed to safely operate the aircraft is provided in the flight deck on the primary flight deck displays. This information is provided full-time in the pilots’ primary field of view, and it always has been.
Air speed, attitude, altitude, vertical speed, heading and engine power settings are the primary parameters the flight crews use to safely operate the airplane in normal flight. Stick shaker and the pitch limit indicator are the primary features used for the operation of the airplane at elevated angles of attack. All recommended pilot actions, checklists, and training are based upon these primary indicators. Neither the angle of attack indicator nor the AOA Disagree alert are necessary for the safe operation of the airplane. They provide supplemental information only, and have never been considered safety features on commercial jet transport airplanes.
The Boeing design requirements for the 737 MAX included the AOA Disagree alert as a standard, standalone feature, in keeping with Boeing’s fundamental design philosophy of retaining commonality with the 737NG. In 2017, within several months after beginning 737 MAX deliveries, engineers at Boeing identified that the 737 MAX display system software did not correctly meet the AOA Disagree alert requirements. The software delivered to Boeing linked the AOA Disagree alert to the AOA indicator, which is an optional feature on the MAX and the NG. Accordingly, the software activated the AOA Disagree alert only if an airline opted for the AOA indicator.
When the discrepancy between the requirements and the software was identified, Boeing followed its standard process for determining the appropriate resolution of such issues. That review, which involved multiple company subject matter experts, determined that the absence of the AOA Disagree alert did not adversely impact airplane safety or operation. Accordingly, the review concluded, the existing functionality was acceptable until the alert and the indicator could be delinked in the next planned display system software update. Senior company leadership was not involved in the review and first became aware of this issue in the aftermath of the Lion Air accident.
Approximately a week after the Lion Air accident, on November 6, 2018, Boeing issued an Operations Manual Bulletin (OMB), which was followed a day later by the FAA’s issuance of an Airworthiness Directive (AD). In identifying the AOA Disagree alert as one among a number of indications that could result from erroneous AOA, both the OMB and the AD described the AOA Disagree alert feature as available only if the AOA indicator option is installed.
Boeing discussed the status of the AOA Disagree alert with the FAA in the wake of the Lion Air accident. At that time, Boeing informed the FAA that Boeing engineers had identified the software issue in 2017 and had determined per Boeing’s standard process that the issue did not adversely impact airplane safety or operation. In December 2018, Boeing convened a Safety Review Board (SRB) to consider again whether the absence of the AOA Disagree alert from certain 737 MAX flight displays presented a safety issue. That SRB confirmed Boeing’s prior conclusion that it did not. Boeing shared this conclusion and the supporting SRB analysis with the FAA.
Boeing is issuing a display system software update, to implement the AOA Disagree alert as a standard, standalone feature before the MAX returns to service. When the MAX returns to service, all MAX production aircraft will have an activated and operable AOA Disagree alert and an optional angle of attack indicator. All customers with previously delivered MAX airplanes will have the ability to activate the AOA Disagree alert.