At Boeing, the Flap Over One Tiny Light Indicates Much Larger Flaws

Are Boeing planes really “pilot’s planes” anymore?

The aerospace giant has long enjoyed a reputation for building “pilot’s planes,” where nothing got between a pilot and their ability to fully control their aircraft. That’s why a failed cockpit warning light and a flawed avionics software program in their new 737-Max aircraft has received so much condemnation in recent days from aviation experts. It showed that Boeing was not only sloppy, but that they had quietly reneged on their long-running promise to keep pilots as the masters of the cockpit.

The media pounded Boeing mercilessly after the company admitted that it knew that there was yet another problem with the 737-Max: a malfunction with what’s called the AoA Disagree light going back as early as 2017. While Boeing notified the FAA about the fault, it failed to notify its airline customers of the problem until after the first 737-MAX jet, Lion Air Flight 610, crashed in October 2018.

This is important because the preliminary accident report in the Lion Air crash indicated that one of the two AoA sensors on the 737- MAX was not functioning correctly and was feeding bad data back to the plane. One of the systems that received this bad data was a newly installed flight assist program, the Maneuvering Characteristics Augmentation System, or MCAS. The program was designed to automatically pitch the nose of the plane down to prevent it from stalling, which occurs when the plane doesn’t receive enough lift to stay in the air.

The faulty data from the AoA sensor made the MCAS think the plane was in a stall. As such, the program started to pitch the plane’s nose down while it was ascending. The flight data recorder recovered from the Lion Air crash showed that the pilots tried 19 times to pull the plane’s nose back up, but MCAS kept pushing it back down. Eventually, the computer won, causing the plane to crash violently into the Java Sea, killing all 181 passengers and eight crew members onboard. Six months later, Ethiopian Airlines Flight 302 experienced a similar fate, forcing Boeing to ground all 737-MAX jets.

Software Failure

All things being equal, if one of the two outside AoA sensors were giving out false readings, then the AoA Disagree light should have illuminated in the cockpit, alerting pilots to a problem. Every 737 Max had one of these warning lights installed, as it was standard in previous models, so they may have been relying on it to illuminate when troubleshooting through issues.

But as we know now, the AoA Disagree light only worked on those planes that had also ordered something called an AoA Indicator gauge installed in their cockpits as well. This indicator is a tiny circular gauge that appears on the upper-right hand side of the 737-Max’s large electronic display screens.

In an interview with Boeing, the company disclosed that only around 20% of its 737-Max customers asked for the AoA gauge to be displayed on their instrument panel. Why so few? Well, it turns out that AoA is rarely used by commercial pilots.

“I have never flown a plane with an AoA indicator – and if I did, I wouldn’t even know where to look for it,” a commercial pilot, certified to fly the Boeing 737-NG family of planes, told Fortune under condition of anonymity, as their airline does not allow them to speak with the media. “Angle-of-Attack was important years back when jets – and flying, in general – were new. Today, very few pilots look at AoA because there are [CS1] dozens of other, more important indicators we use to keep the plane in the air.”

Optional Features

Southwest Airlines, United Airlines and WestJet all confirmed that they ordered their 737-Max jets without the AoA Indicator, meaning that their AoA Disagreement lights wouldn’t have illuminated if there was a problem. Lion Air and Ethiopian Airlines also ordered their planes without the AoA Indicator, as well.

After the Lion Air crash, Boeing informed Southwest of the problem but assured them that a patch was coming to their software package which should rectify the issue. Southwest decided to play it safe and had AoA Indicators installed on all of their 737-Max jets. Once the gauge was displayed, the AoA Disagree light worked as intended.

But even though it chose to address the issue of the faulty light immediately, Southwest acknowledged that their pilots would rely other, more critical, systems and alerts if they found themselves in a similar situation that brought down the Lion Air flight.

“From a Pilot’s perspective, the AOA Disagree lights are advisory, the proper handling of the stick shaker and unreliable airspeed event is the focus during these situations, as opposed to the illumination of a single advisory indicator light,” Brandy King, a spokesperson for Southwest, told Fortune. “We look forward to the FAA’s final guidance and will fully comply with any modifications and additional training requirements to strengthen the reliability of the 737 MAX.”

Too Much Information?

Sometimes too much information can be a bad thing. Several of the current pilots interviewed for this story admitted that it is easy to get desensitized in today’s modern aircraft, with all the bings, bongs and flashing lights coming from all directions.

“We did not install these features [the AoA Indicator] because our aircraft are already equipped with anti-stall indicators, which are proven and safe,” Frank Benenati, a spokesperson for United Airlines, told Fortune. “None of United’s airplanes have angle of attack on their primary flight display, as pilots are trained to use airspeed, pitch and power for the safe operation of aircraft.”

While the AoA Disagree light didn’t go off in the Lion Air crash, the flight data recorder did show that the captain’s stick shaker went off immediately after takeoff, indicating that the plane (thought) that it was in a stall. This is one of the few alerts that cannot be overlooked by the flight crew as it loudly shakes the captain’s control column – as seen in this video. Indeed, once the stick shaker went off, the Lion Air crew immediately sprang into action to address the stall, according to the preliminary accident report.

Not The Smoking Gun

That brings us back to the million-dollar question – if the AoA Disagreement light actually worked properly while Lion Air was ascending, would the pilots have done anything differently that might have saved the aircraft? All the experts Fortune spoke with collectively and rather emphatically say “no.”

“Sure, this was an engineering screw up, but it didn’t cause either plane, Lion Air or Ethiopian, to crash,” Douglas Moss, a pilot and instructor at The University of Southern California’s Viterbi Aviation Safety and Security Program, told Fortune. “In fact, if they did have a working light and it did come on, that probably would have been more confusing to the pilots because that would have indicated an AoA problem when that wasn’t the problem at all.”

But while a functioning AoA Disagree light wouldn’t have helped the pilots of Lion Air Flight 610 or Ethiopian Airlines Flight 302 avoid a crash, the fact that Boeing let a commercial passenger aircraft roll off their assembly line with a known defect, even as seemingly benign as this one, puts into question the company’s once stellar safety standards.

Being the “pilot’s plane,” Boeing’s commitment to safety always began in the cockpit, with pilots being able to maintain full operational control of their aircraft at all times. This started with furnishing pilots with all the information they needed to make the right flight decision, every time. It is why Boeing originally designed their planes to have multiple backup sensors for all critical flight data systems, like airspeed and angle-of-attack. It is also why they put those “disagree lights” in the cockpit, to basically let pilots know that there may be an issue with the data and to adjust their decision making accordingly.

By failing to immediate fix the AoA Disagree light, Boeing was sending a message that they knew best when it concerned safety. This is important because it begins to explain why Boeing felt it was then okay to introduce the ill-fated MCAS system into the 737-MAX. The program made critical operational decisions automatically, sidelining pilots. While the computer program was supposedly designed to make the plane safer and easier to handle, by totally removing pilot input, it actually wound up making the plane far less safe to fly.

In this case, it seems, a tiny indicator light illuminates something much, much larger.