We Are All John Glenn

Previous reporting from The Wall Street Journal (Nov. 13, 2018) stated “Boeing Co. withheld information about potential hazards associated with a new flight-control feature suspected of playing a role in last month’s fatal Lion Air jet crash, according to safety experts involved in the investigation, as well as midlevel FAA officials and airline pilots. The automated stall-prevention system on Boeing 737 Max 8 and Max 9 models—intended to help cockpit crews avoid mistakenly raising a plane’s nose dangerously high—under unusual conditions can push it down unexpectedly and so strongly that flight crews can’t pull it back up. Such a scenario, Boeing told airlines in a worldwide safety bulletin roughly a week after the accident, can result in a steep dive or crash—even if pilots are manually flying the jetliner and don’t expect flight-control computers to kick in.” Amazingly, that was in November, months before the second crash, an Ethiopian Airlines flight in March.

This month, the news got worse. On May 6, NPR reported, “In a statement Sunday (May 5), Boeing said its engineers discovered a problem with a key safety indicator within months of Boeing delivering the first 737 Max planes to airlines. The indicator, called an angle of attack disagree alert, is designed to warn pilots if the plane’s sensors are transmitting contradictory data about the direction of the plane’s nose.

“Boeing intended for the indicator to be standard on the 737 Max, in keeping with the features available on previous generations of 737s. But its engineers discovered that the sensor worked only with a separate, optional safety feature.”

The short story seems to be that a module known as an angle-of-attack (AOA) sensor sends data to a 737 Max software system. If the sensor reads an imminent stall, the software pushes the plane’s nose down with greater force than a pilot can manually overcome. When the sensor fails, the software goes rogue, acts as if the plane is stalling, and pushes the nose down aggressively.

The part of the story that astonished me is news that the AOA sensor is a single piece of equipment rather than part of a redundant system. As I’ve written here in the past, so-called “high reliability” Class 3 electronics are seriously flawed and the reliability of Class 3 systems is generally no better (and, sometimes, worse) than for consumer electronics. There’s tremendous reliance on cosmetic results rather than making things right the first time. Redundancy is the reason planes don’t fall out of the sky with great frequency. Critical systems aren’t standalone; they have backup circuitry.

Knowing what I know about the fundamental lack of reliability associated with Class 3 electronics, I have never had any concerns about flight safety because of the backup systems. But now we learn that what is clearly a critically important piece of equipment didn’t have a backup. (More accurately, there is a backup system that reports disagreement between the AOA sensor and other sensors that perform similar functions. Except, it turns out, Boeing didn’t install that backup sensor in most 737 Max 8’s because of additional cost.)

If redundancy is being bypassed to keep costs down, we could be in big trouble. After all, we’re all John Glenn.

Editor’s note: Jim Smith began work in electronics assembly in 1965 and founded Electronics Manufacturing Sciences in 1981 to teach soldering as a unified science. Thousands of engineers, technicians and managers worldwide have attended his "Science of Soldering" classes. Jim’s articles have appeared in more than 100 publications worldwide. His "Unconventional Wisdom" column appeared monthly in ASSEMBLY Magazine for more than 10 years and he remains a regular contributor to the magazine. For more information, visit www.emsciences.com.