[Here’s what you need to know about the deadly Ethiopian Airlines and Lion Air crashes, and what Boeing has been doing since.] Regulators around the world grounded the Max this month, and airlines are not expected to use them soon. On Friday, Southwest Airlines said it planned its flight schedule through May without its 34 Max jets. Boeing said it could not comment on the black box findings until investigators released their official report, per international aviation agreements. Rosemount Aerospace, a subsidiary of the industrial giant United Technologies based in Burnsville, Minn., made the sensor. A United Technologies spokeswoman did not immediately respond to requests for comment. Angle-of-attack sensors are highly reliable and have been used on passenger jets for years, but like any aircraft component, they can fail. Given that, former Boeing and Rosemount engineers said it was surprising that Boeing would allow a single sensor to activate a crucial system that pushes the aircraft toward the ground. The sensors, which are effectively wind vanes on the jet’s nose, have malfunctioned in the past, for a variety of reasons, including bird strikes, according to the former engineers. They have also been broken by jetways that attach to the plane for passengers to board and exit the plane. The sensors can also malfunction if water pools around them and then freezes when the plane reaches a certain altitude, the engineers said. The sensors have built-in heaters to prevent freezing at such high altitudes, but they sometimes do not work quickly enough or can fail outright. “Generally speaking, aviation components are highly reliable,” said Mel McIntyre, a retired Boeing engineer who worked with such sensors for years. “But everything can fail. Nothing is invincible.” Mr. McIntyre declined to comment further on any specifics of the 737 Max.<doc-sep>Last week, Boeing 737 MAX aircraft were grounded all over the world following two highly-publicized crashes, one an Ethiopian Airlines flight on March 10 that killed all 157 people aboard, and an earlier Lion Air crash from late October that killed all 189 passengers and crew. An in-depth story from The Seattle Times suggests that both crashes may be the result of a single faulty sensor, and compromised FAA safety oversight procedures. Advertisement The sensor in question is an Angle of Attack (AoA) sensor, a small, wing-like mechanism that sprouts from the lower front side of the plane and mechanically detects the angle between the wing and the airflow rushing past the airplane. The reason this is important is that if that angle is too high, the plane is in danger of stalling, which is not the same as when you get off the clutch too fast in your car, but rather is an aeronautical term describing the condition of the wings losing lift due to the angle of attack—the angle the wings are encountering the airflow—being too high. In this situation, the sensor triggers the Maneuvering Characteristics Augmentation System (MCAS), which, according to the aviation-focused website The Air Current: The Maneuvering Characteristics Augmentation System (MCAS) was designed to address this, according to Boeing engineers and pilots briefed on the system, now at the center of the inquiry into the crash of Lion Air 610, a brand new Boeing 737 Max 8. MCAS is “without pilot input” and “commands nose down stabilizer to enhance pitch characteristics during step turns with elevated load factors and during flaps up flight at airspeeds approaching stall.” “It’s sole function is to trim the stabilizer nose down,” according to the system’s description to pilots, who were learning about it for the first time this week. So, the way the system corrects an angle that it feels is too high and may result in a stall is by adjusting the rear-mounted horizontal stabilizer to lift the tail of the plane, which will pitch the nose down, reducing the angle. Mark Nowlin of the Seattle Times made this helpful infographic: Advertisement Both crashes displayed characteristics of a pilot attempting to get the plane’s nose back up as it was repeatedly forced down, presumably by a malfunctioning MCAS system. Even though there are two AoA sensors on the plane, Boeing only decided to use one of them for input to the MCAS system, which appears to go against practices that suggest that systems whose failure can lead to a “hazardous failure mode” should have redundant systems. Advertisement From the Seattle Times report: “But when the consequences are assessed to be more severe, with a “hazardous failure” requirement demanding a more stringent probability of one in 10 million, then a system typically must have at least two separate input channels in case one goes wrong. Boeing’s System Safety Analysis assessment that the MCAS failure would be “hazardous” troubles former flight controls engineer Lemme because the system is triggered by the reading from a single angle-of-attack sensor. “A hazardous failure mode depending on a single sensor, I don’t think passes muster,” said Lemme.” Advertisement Another issue was that the MCAS system was originally reported to the FAA as being capable of moving the rear horizontal stabilizer in increments a maximum of 0.6 degrees. This was done in order to keep the changes to the plane’s flight more controllable. The system as delivered on the 737 MAX aircraft, though, was able to to move the stabilizer in 2.5 degree increments, over four times what was reported to the FAA. This means that the MCAS system essentially had “full authority” to move the rear stabilizer, meaning that just a few pushes from the system could move the stabilizer to its maximum limits, forcing the most possible downward force on the plane. Advertisement This limit could be reached with just two cycles of the MCAS system without corrections and could be enough to put the plane into the “maximum nose-down effect.” Faulty information from the sensor forced the MCAS system to attempt to pitch the plane downwards, and the larger angles made those pitch-down maneuvers much more dramatic. Advertisement Pilots would have no information that the AoA sensor was sending false data, and every time they corrected the plane, the system would reset, get false data again, and attempt to pitch the plane down again, even though the rear stabilizer had already been moved. Black box recordings from the Lion Air flight show this cycle repeated 21 times, with the captain eventually attempting to pull the plane’s nose back up with force before the plane dived into the sea. Advertisement The report characterizes the safety analysis from Boeing like this: Understated the power of the new flight control system, which was designed to swivel the horizontal tail to push the nose of the plane down to avert a stall. When the planes later entered service, MCAS was capable of moving the tail more than four times farther than was stated in the initial safety analysis document. Failed to account for how the system could reset itself each time a pilot responded, thereby missing the potential impact of the system repeatedly pushing the airplane’s nose downward. Assessed a failure of the system as one level below “catastrophic.” But even that “hazardous” danger level should have precluded activation of the system based on input from a single sensor — and yet that’s how it was designed. Advertisement So, how did this happen? How did these faulty sensors get past the FAA’s safety checks? The Seattle Times story describes an FAA with limited time and resources farming out safety procedures to Boeing themselves. This delegation of safety analyses to aircraft manufacturers has been going on for some time. Some of the reason for the delegation of safety analyses to Boeing had to do with pressure from the development of Airbus’ competing A320neo. According to the Seattle Times, “But several FAA technical experts said in interviews that as certification proceeded, managers prodded them to speed the process. Development of the MAX was lagging nine months behind the rival Airbus A320neo. Time was of the essence for Boeing.” Advertisement Boeing also neglected to give 737 pilots extra training on the new system, because MCAS was only likely to come into play in such extreme flight situations. Not requiring new training was a big selling point for airlines looking to upgrade older 737s, since they wouldn’t need to retrain their pilots. The investigation is still ongoing, so neither Boeing or the FAA are able to comment on it directly, but the information so far suggests a situation where inadequate testing and rushed practices led to some real disasters.<doc-sep>The crashed Lion Air 737 MAX and the Ethiopian Airlines 737 MAX aircraft had more in common than aircraft design and the apparently malfunctioning flight system that led to their demises. Both of the planes lacked optional safety features that would have alerted the pilots to problems with their angle of attack (AOA) sensors—the input suspected of causing the Maneuvering Characteristics Augmentation System (MCAS) software to put both aircraft into a fatal dive. The New York Times reports that both vehicles lacked an "AOA disagree" light—a warning light that indicates when the aircraft's two AOA sensors provide different readings—and an angle of attack indicator. Since the MCAS system relied only on one of the aircraft's AOA sensors, the disagree light and AOA indicator would have given the flight crew visible evidence of a sensor failure and prompted them to disable the MCAS. But both of these features were sold by Boeing as expensive add-ons. And many discount and smaller airlines declined to purchase them, as they were not required by regulators. Further Reading Boeing downplayed 737 MAX software risks, self-certified much of plane’s safety According to the Times, a "source familiar with the changes" said that the AOA disagree light will be added to the digital flight displays as part of an update to MCAS software. That update is expected to be deployed by no later than the end of April. The AOA indicator on the digital display will remain an add-on option. Advertisement All about angles The 737 MAX MCAS is a significant change from the avionics of previous Boeing 737s and is required because of the MAX aircrafts' much larger engines and the resultant change in handling. The MCAS includes a feature that determines when the aircraft is pointed upward relative to the flow of air across its surface at an angle that could lead to the loss of sufficient lift to keep the airplane flying—what's known as a stall. To prevent a stall, MCAS (like other anti-stall systems on commercial aircraft) adjusts the aircraft's tail stabilizers to push the nose of the aircraft down, boosting its airspeed. The AOA sensor is what MCAS relies upon to determine whether the aircraft is close to reaching that stall condition. But even though the 737 MAX has multiple AOA sensors for redundancy, MCAS relied on only one of them at a time for input. That's now being changed in the software update. Boeing has been taking other measures to correct its own stall. According to a Daily Beast report, Boeing's lobbyists made $827,000 in political contributions in February. The donations, which were reflected in a recently filed Federal Election Commission report, were the most that Boeing has ever donated in a single month to political campaigns. As Ars reported last week, the Department of Justice and Department of Transportation are now conducting an investigation into Boeing's original safety certification process. Engineers who worked at Boeing reported that the company's analysis of the safety impact of the MCAS system misled Federal Aviation Administration officials about the actual risk associated with the system, and Boeing oversaw most of the aircraft's safety certification itself.<doc-sep>
Indonesian investigators have linked the Lion Air plane that crashed in October to a Florida repair shop, Bloomberg reported Wednesday. The facility, owned by XTRA Aerospace, did maintenance on the Boeing 737 Max before the fatal crash, documents prepared for the country's parliament show. The report does not link the repair shop to the Ethiopian Airlines' jet, the second such plane to crash. The first of two Boeing 737 Max planes to crash since October has been linked to a Florida maintenance shop, according to investigation documents obtained by Bloomberg. Investigators in Indonesia, where Lion Air Flight JT610 originated shortly before it plunged into the Java Sea, are looking into an XTRA Aerospace facility in Miramar, Florida, which had previously worked on the plane’s angle-of-attack (AOA) sensor before the crash. That’s according to a briefing prepared for the country’s parliament, Bloomberg reported. The angle of attack sensor has come under scrutiny in both the Lion Air investigation as well as that of Ethiopian Airlines Flight ET302 five months later. In tandem with the Maneuvering Characteristics Augmentation System or MCAS, the sensors lie at the heart of the investigations into the two similar crashes. Originally designed to push the plane’s nose down if the AOA sensor detected a potential aerodynamic stall, the MCAS is suspected to have been erroneously activated in both crashes. Bloomberg's report does not say if the Florida shop worked on the Ethiopian Airlines jet which crashed in March. Boeing said this week it expects a software fix for the grounded plane, one of its best-selling of all time, to come in a matter of weeks. Also on Wednesday, unnamed sources familiar with the investigation told The Wall Street Journal that the pilots on the doomed flight initially responded to the plane pushing its nose down by turning off the automated anti-stall system that is widely thought to have been behind the crash. When that didn't work, the Journal reports, the pilots turned the system back on and tried other steps to control the plane. Pilots turned a manual wheel that controls the parts of the plane's tail that the MCAS system controls, sources told the WSJ, but they then turned electronic power back on. They then used electric switches to try and raise the plane's nose, but that also reactivated MCAS, continuing to push the plane's nose downwards. These details are based on the black box flight recorders from the flight, the sources said. In the United States, Boeing is facing multiple investigations from government authorities, including the Senate Committee on Commerce, Science, and Transportation, which said Tuesday that multiple whistleblowers from the Federal Aviation Administration had come forward alleging that safety inspectors for new planes lacked proper training. More on the investigation into Boeing’s 737 Max: