Boeing’s Crashes Expose Reliance on Sensors Vulnerable to Damage

The crashes of two Boeing Co. 737 Max jets in five months have focused attention on a little-known device that malfunctioned, starting a chain reaction that sent the planes into deadly dives.

Pilots have for decades relied on the weather-vane-like “angle of attack” sensors to warn them when they near a dangerous aerodynamic stall. But investigators are probing Boeing’s decision to enable the sensors on the Max model to go beyond warning pilots and automatically force the plane’s nose down.

A review of public databases by Bloomberg News reveals the potential hazards of relying on the devices, which are mounted on the fuselage near the plane’s nose and are vulnerable to damage. There are at least 140 instances since the early 1990s of sensors on U.S. planes being damaged by jetways and other equipment on the ground or hitting birds in flight.

In at least 25 cases in the U.S., Canada and Europe, the damage triggered cockpit alerts or emergencies.

On April 1, 2012, a United Airlines 767-300 was taking off from San Francisco when it struck a flock of western sandpipers, according to a Federal Aviation Administration database. The birds damaged the left sensor, scrambling the speed readings and auto throttle. The plane returned to the airport.

A Republic Airlines Inc. flight was struck by a tundra swan as it neared arrival into Newark, New Jersey, on Dec. 5, 2016, according to the FAA. It damaged the angle-of-attack sensor and other equipment on the Embraer SA EMB-170, rendering unreliable airspeed and altitude readings on the regional jet. It landed safely.

Before the 737 Max crashes, the most recent accident involving the sensors occurred when an Airbus SE A320 on a 2008 demonstration flight went down off the coast of France killing all seven people aboard. Moisture inside two of the plane’s three angle-of-attack vanes froze, confusing the aircraft’s automation system, according to France’s Office of Investigations and Analysis. The report also faulted the pilots for multiple errors.

Examining such previous episodes is all the more important because of Boeing’s decision to use a single sensor as the trigger for the anti-stall mechanism on the Max known as MCAS, or Maneuvering Characteristics Augmentation System.

“With that many pilot reports and with the unknowns that we’re dealing with in these two accidents, that’s an important area to be investigated,” said James Hall, the former chairman of the U.S. National Transportation Safety Board.

The FAA was aware of previous angle-of-attack failures and considers such incidents when it evaluates aircraft designs for certification, the agency said in a statement.

“As part of the FAA’s oversight of the continuous operational safety of our nation’s aviation safety system, the agency continues to monitor, gather and evaluate all available information and data regarding the performance of aircraft and related components,” the agency said.

The 737 Max, Boeing’s best-selling plane, has been grounded worldwide since last month. The Chicago-based aircraft maker is redesigning the software so MCAS won’t react to a single sensor reading and can be more easily overcome by the pilot, among other things.

Related: Six Minutes to Disaster: Ethiopian Pilots Battled Boeing Max

The company didn’t respond to questions about how it took such incidents into account while designing MCAS. The company believed the sensors were highly reliable and that pilots could handle the MCAS in an emergency so Boeing built less redundancy into it, it said in a statement.

“In designing flight control and other airplane systems, our industry follows a set of established and accepted assumptions and processes,” the company said. “The design and certification of the MCAS flight control law adhered to these processes and assumptions.”

In the Oct. 29 crash of a Lion Air 737 Max off the coast of Indonesia, a malfunctioning angle-of-attack sensor that had just been installed sent erroneous signals indicating the plane’s nose was pointed too high relative to the oncoming air. That prompted MCAS to push the nose down more than 20 times until pilots lost control and it plunged into the Java Sea, killing all 189 people aboard.

On March 10, the same safety system on a 737 Max operated by Ethiopian Airlines was activated after an angle-of-attack sensor on the jet failed suddenly at liftoff. After about six minutes in which MCAS pushed the nose down several times, the plane went into a steep dive and crashed at high speed with 157 passengers and crew.

In both accidents, there were steps pilots could have taken to avert a crash, but they failed to do so, according to preliminary reports. One possible reason was that the erroneous angle-of-attack readings triggered numerous alerts and warnings that may have have been distracting.

The stall warning set off a “stick shaker” in which the control column shakes violently and produces a loud noise to get the pilot’s attention. The pilots also began receiving erroneous airspeed and altitude readings, according to the preliminary crash reports.

“This is a breeding ground for confusion,” said John Cox, president of consulting company Safety Operating Systems who participated in dozens of airline accident investigation as a pilot union representative. “They are task saturated. When you get task saturated, your ability to problem solve drops by about fifty percent.”

The reason a single sensor failure can cause so many problems is its data feeds multiple systems on the plane, said Peter Lemme, a former Boeing engineer who worked on other aircraft models.

Overall, the sensors have high reliability and there are few examples of them causing crashes. The number of angle-of-attack failures in public databases are relatively small compared to the hundreds of millions of airline flights in recent decades. Nevertheless, they offer a window into how extensive an emergency such a failure can create.

“I don’t think it’s commonly known that there have been that many documented events involving a loss of AOA indicator in flight associated with stick shaker and air data anomalies,” said Jeffrey Guzzetti, the former director of the FAA’s Accident Investigation Division.

While investigators haven’t identified why the Ethiopian Airlines plane suddenly suffered a sensor failure just as it left the ground, that pattern, revealed in the flight recorders recovered from the wreckage, could be explained by a bird strike.

The FAA’s database of bird-plane encounters, as well as accident reports in the U.S. and other nations, contain dozens of such episodes.

On May 28, 2016, for example, a Cargolux Airlines International SA 747-400 was taking off in Calgary, Canada, when pilots heard a loud bang followed by a stall warning. After landing, mechanics found the right sensor was missing and saw evidence it had been hit by a bird, according to the Transportation Safety Board of Canada.

A NASA-operated repository of anonymous pilot reports, called the Aviation Safety Reporting System, contained similar instances in which sensors were damaged by birds, airport jetways or undetermined causes.

One March 2016 incident closely resembled the recent crashes, except that the plane, an earlier 737-800 model, wasn’t equipped with MCAS and the pilots maintained control.

As soon as the plane got airborne, the captain, seated on the left side, got the loud thumping noise and vibrating control column warning that the plane was about to stall, according to the NASA report. The captain’s airspeed and altitude displays disagreed with the copilot’s, indicating an error and setting off additional alerts. All of those symptoms occurred on the two recent Max crashes.

The pilots opted to continue onto their destination in spite of the multiple failures. Both the captain and the copilot said that they regretted continuing the flight and didn’t realize that they had violated their airline’s procedures by disabling the stall warning.

“A return, while considered, should have been accomplished,” said the captain.

Only after they landed did they realize that the captain’s angle-of-attack vane was bent for unknown reasons.