Question: “Should the AOA disagree light be a required feature?”
FAA acting chief Daniel Elwell: “No. It is just a maintenance alert. The AOA disagree light is only a service advisory. The AOA disagree light would not have changed the outcome of either accident. “
His statement seems hard to understand given that a defective AOA sensor was clearly involved in at least one and likely both of the 737 Max crashes. While there are two AOA sensors on all Boeing 737 Max planes (and have been ever since the first test flights in the spring of 2016), only one of these sensors is actively connected to MCAS – the sensor on the pilot side of the plane. Here is what the AOA sensors looks like on a 737 Max:
Here is a close up view of one of these sensors:
The AOA sensor is a small wing that can rotate and read the difference between the reference angle of the planes forward motion and the angle of the wind which is assumed to be the same as wind angle at the wing.
It should be noted that the Airbus A320 uses three AOA sensors – two similar to the Boeing AOA indicators but made by a more reliable manufacturer – and one under the tail of the plane. Some reports have indicated that Boeing cannot add a third angle of attack sensor under the tail of the plane do to design problems. But I was unable to find a clear explanation of what those design problems were.
However, the chief benefit of the Airbus A320 is not the three AOA sensors or the fact that they are using a better AOA sensor supplier with a better track record. The benefit of the A320 Neo is that the engine was properly placed on the plane to avoid excessive nose lift. The lack of excessive nose lift (a better balanced plane) means that the Airbus A320 Neo is much less likely to need the AOA sensors in the first place – no matter how many there are of them.
But returning to the question we are considering in this section, we need to ask why Boeing deliberately chose to use one sensor instead of two sensors and why Boeing chose to make the Sensor Difference Light in the cockpit of the 737 Max an optional feature?
The answer appears to be that Boeing concluded that the additional light would confuse pilots more than it would help them. An alternate explanation is that Boeing was simply trying to hide MCAS from the FAA, from pilots and from airline carriers.
Giving Boeing the benefit of the doubt, let’s review why using the readings from two AOA sensors instead of one might confuse pilots and increase the chances of a crash.
First, the proper response to a difference in AOA sensor readings is to turn off MCAS and not use it at all. As we explain in a later section, test engineers in 2016 clearly believed that an aggressive MCAS was needed to prevent a stall. Therefore, they viewed the risk of turning off MCAS as being greater than the danger from an inaccurate AOA sensor.
Second, if the pilot is in a whiteout, it would be very difficult for an inexperienced pilot to tell which sensor was right and which one was wrong.
Third, some circumstances such as icing and strong winds can affect both sensors and cause both of them to have erroneous readings.
We do not know what was going through the minds of the Boeing engineers went they decided that one sensor was safer than two sensors in 2016. But what we can know is that these Boeing engineers were not idiots. They instead were clearly very concerned about the danger that using two sensors would increase the odds of pilots turning off MCAS and then getting into a stall.
Due to the bad press Boeing has gotten from the two nose dive crashes, they have reversed course. They will now use two sensors instead of one (although the details of how these two sensors will be used has not yet been released). Nor has Boeing ever released the complete analysis their engineers must have conducted when they first decided that one sensor was safer than two sensors.
But we cannot assume that two sensors will be any safer than one sensor. They should reduce the odds of a Boeing 737 Max crashing from an extreme nose dive. But as we show later, they will also increase the chances of a Boeing 737 Max crashing from a Nose Up Stall.
It gets worse: over the last five years, 50 flights on US commercial airplanes experienced AoA sensor issues, compared to an estimated 76.8 million flights in US airspace in the same time frame. That is six times above the maximum rate set by the FAA for “hazardous” systems. This elevated risk of failure is why few commercial airliners make flight-critical decisions based solely on AoA sensor inputs.
The FAA reports include 19 reported cases of sensor trouble on Boeing aircraft, such as an American Airlines flight in 2018 that declared a mid flight emergency when the plane’s stall-warning system went off, despite normal airspeed. The Boeing 737-800 landed safely. Maintenance crews replaced three parts, including the angle-of-attack sensor, according to the FAA database.
In 2017, an American Airlines-operated Boeing 767 headed to Zurich declared an emergency and returned to New York. Another angle-of-attack sensor was replaced. And an American Airlines 767 was forced to return to Miami in 2014 after a mid flight emergency because of a faulty angle-of-attack sensor.
Adding another sensor is ignoring the real problem – just as changing MCAS from 2.5 degrees to 1.5 degrees (or whatever) is ignoring the real problem. What is needed is not more faulty sensors or a different MCAS setting. Rather we need planes that are designed to be stable so that AOA sensors are activated less often. This means insisting that planes are aerodynamically sound with the engines in the right place in relationship not only to the center of gravity but also in relationship to the wings of the airplane.