Not just the 737: Angle-of-attack sensors have had problems

By Todd C. Frankel / The Washington Post

WASHINGTON — In 2014, Lufthansa flight 1829 took off from Bilbao, Spain, and was ascending normally when the plane’s nose unexpectedly dropped. The plane — an Airbus A321 with 109 passengers on board — began to fall. The co-pilot tried to raise the nose with his controls. The plane pointed down even further. He tried again. Nothing, according to a report by German investigators.

As the Lufthansa plane fell from 31,000 feet, the captain pulled back on his stick as hard as he could. The nose finally responded. But he struggled to hold the plane level.

A call to a ground crew determined that the plane’s angle-of-attack sensors — which detect whether the wings have enough lift to keep flying — must have been malfunctioning, causing the Airbus’s anti-stall software to force the plane’s nose down. The pilots turned off the problematic unit and continued the flight. Aviation authorities in Europe and the United States eventually ordered the replacement of angle-of-attack sensors on many Airbus models.

Today, aviation experts say, the angle-of-attack sensor on Boeing jets will get fresh scrutiny after two Boeing 737 MAX airplanes crashed, in Ethiopia last week and in Indonesia in October.

Crash investigators have raised concerns about the role of the sensor — a device used on virtually every commercial flight — in the October crash of Lion Air flight 610. There are concerns it may have sent the wrong signals to new software on the flight that automatically dips the plane’s nose to prevent a stall.

It is not clear whether the angle-of-attack sensor played a role in the crash of Ethiopian Airlines flight 302. Boeing CEO Dennis Muilenburg said Sunday that his company is finalizing software updates and pilot training protocols to address problems that have emerged “in response to erroneous sensor inputs.” He did not specify which sensors.

Muilenberg’s comments followed a statement by Ethiopia’s transportation secretary earlier Sunday that the plane’s black boxes showed “clear similarities” between the Indonesian and Ethiopian crashes. Aviation authorities worldwide grounded the Boeing 737 MAX last week out of concern about the plane’s safety.

In interviews late last week, aviation experts said there was no reason for broad alarm about the sensors. But six experts said that the risks posed by a faulty angle-of-attack sensor are amplified by the increasing role of cockpit automation. It is an example of how the same technology that makes aircraft safer — automated software — can be undone by a seemingly small problem.

“The sensor going out is serious,” said Clint Balog, a test pilot and associate professor at Embry-Riddle Aeronautical University. “But it can be made critical by software.”

Most commercial pilots today know how to respond to a malfunctioning sensor, said Shem Malmquist, a Boeing 777 captain and a visiting professor at the Florida Institute of Technology.

But potential complications arise with how software interprets what the sensor tells it.

“When you introduce computer controls, you start to get interactions that are hard to anticipate,” Malmquist said.

Angle-of-attack sensors have been flagged as having problems more than 50 times on U.S. commercial airplanes over the past five years, although no accidents have occurred over millions of miles flown, according to reports made to the Federal Aviation Administration’s Service Difficulty Reporting database. That makes it a relatively unusual problem, aviation experts said — but also one with magnified importance because of its prominent role in flight software.

“It is notable,” said David Soucie, a former FAA maintenance safety inspector.

The sensor is especially helpful for nighttime flying, Soucie said, but its loss alone should not create problems that pilots are unable to handle.

The FAA reports include 19 reported cases of sensor trouble on Boeing aircraft, such as an American Airlines flight last year that declared a midflight emergency when the plane’s stall-warning system went off, despite normal airspeed. The Boeing 737-800 landed safely. Maintenance crews replaced three parts, including the angle-of-attack sensor, according to the FAA database.

In 2017, an American Airlines-operated Boeing 767 headed to Zurich declared an emergency and returned to New York. Another angle-of-attack sensor was replaced. And an American Airlines 767 was forced to return to Miami in 2014 after a midflight emergency because of a faulty angle-of-attack sensor.

A Boeing spokesman declined to comment for this report. The FAA did not respond to a request for comment.

The angle-of-attack sensors on the fatal Lion Air flight were made by Minnesota-based Rosemount Aerospace, according to a photograph of the part that was shown by Indonesian officials to reporters after the recovery of the wreckage. It is a model commonly used on commercial aircraft.

A spokeswoman for Rosemount’s parent company, United Technologies, declined to comment.

The angle-of-attack sensor indirectly measures the amount of lift generated by the wings. The name refers to the angle between the wing and oncoming air. Its main purpose is to warn pilots when the plane could aerodynamically stall from too little lift, leading to a loss of control.

Many of the sensors include a small vane attached to the outside of a commercial aircraft. Most planes have two or three vanes as part of a redundant system. But they are not complicated machines. The Wright brothers used a version on their first flight.

Placing too much trust in the sensors can cause trouble. One of the most serious crashes tied to angle-of-attack sensors occurred in 2008, when XL Airways Germany Flight 888T hit the Mediterranean Sea, killing seven people. French authorities blamed water-soaked angle-of-attack sensors on the Airbus 320, saying they generated inaccurate readings and set up a chain of events that resulted in a stall.

According to investigators, the downed airplane’s sensors were made by Rosemount, the same company that made the sensors on the Lion Air crash. At the time, Rosemount was also called Goodrich, the company that owned the aerospace manufacturer at the time.

In the Lion Air crash, pilots struggled for control with the 737 MAX’s automated flight controls — the Maneuvering Characteristics Augmentation System, or MCAS. Faulty readings from the angle-of-attack sensors may have led the MCAS to believe the aircraft was in danger of stalling just as it was taking off from Indonesia, according to the preliminary report by Indonesian investigators. Gaining speed by diving can prevent a stall — assuming a plane is high enough to safely dive and return to level flight.

After the crash, the FAA issued an emergency airworthiness directive in November for 737 MAX 8 and 9 models that warned a mistakenly high reading from one angle-of-attack sensor “could cause the flight crew to have difficulty controlling the airplane.”

Less is known about the Ethiopian Airlines crash. But it involves the same type of aircraft and crashed at a similar point in its flight path as the Lion Air plane, according to investigators.

Both planes were equipped with MCAS, which uses angle-of-attack sensors to determine whether a plane is nearing an aerodynamic stall.

Airbus equips many of its commercial jets with its own anti-stall software that relies on an automated process.

During the Lufthansa flight in 2014, faulty information from the angle-of-attack sensors triggered the software, pushing the plane’s nose down, according to German aviation investigators. The program thought the plane was nearing a stall. The captain was eventually able to override the automated system, and the pilots, after talking with a maintenance crew, identified the likely problem and continued the flight to Munich.

Investigators later found that two of the angle-of-attack sensors were blocked, probably by ice, and generated improper readings.

European authorities and the FAA issued airworthiness directives over several years aimed at addressing sensor problems on Airbuses.

Airbus A320 planes with certain sensors made by two companies — United Technologies, parent company of Rosemount, which makes Boeing sensors; and Sextant/Thomson — “appear to have a greater susceptibility to adverse environmental conditions” than sensors made by a third company, the FAA said.

One important difference between the Lufthansa incident and the two 737 MAX crashes, aviation experts said, was where they occurred.

The Lufthansa plane was soaring at 31,000 feet when it launched into a steep dive. It dropped 4,000 feet in less than a minute before the pilots wrestled back control.

If the sensor problem had hit soon after departure, as investigators suspect it did with the Lion Air crash, that incident could have ended in disaster.