AOA Anomalies on Successive B737-800 Flights

AOA Anomalies on Successive Transavia Boeing 737-800 Flights (F-GZHO)

Transavia France Boeing 737-800 F-GZHO suffered Angle of Attack (AOA) anomalies and alerts during take off from Norwich, UK on 7 February 2018 and then on 8 February 2018 after take off from Paris Orly, France. The French Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (the BEA) explain in their safety investigation report, issued on 16 November 2020, that the first flight was a ferry flight after a base maintenance C-Check at KLM UK Engineering with just 3 persons on board and then the second a revenue flight with 180 persons on board.

Transavia France Boeing 737-800 F-GZHO Taking Off from Paris Orly on 25th August 2016 (Credit: Habib M’henni / Wikimedia Commons CC BY 4.0)

Aircraft Systems Context

BEA explain that:

IAS DISAGREE, AOA DISAGREE and ALT DISAGREE messages are generated by the DEU [Display Electronics Units] 1 and 2 based on the data provided by the two ADIRUs [Air Data Inertial Reference Units]. These messages are displayed in amber on the PFD without an audio warning.

The conditions for the activation…are the following:

The IAS DISAGREE message is displayed on the two PFDs when there is a difference of more than 5 kt for at least 5 seconds between the left and right indicated airspeed values.

The AOA DISAGREE message is displayed on the two PFDs when there is a difference of more than 10° for at least ten seconds between the angle of attack values measured by the left and right sensors.

The ALT DISAGREE message is displayed on the two PFDs when there is a difference of more than 200 ft for at least 5 seconds between the left and right altitude values.

The 737 is equipped with two AOA sensors installed on the forward fuselage…. The external part of the sensors consists of a heated vane which positions itself in the air flow bed.

The rotary movement of each sensor is transmitted to two electric resolvers, located in the body of the sensor, by means of internal gears. The resolvers transform the rotary movement into an electrical voltage value which is proportional to the angle of attack.

Within each sensor, resolver 1 sends its electrical data to the SMYDC [Stall Management Yaw Damper Computer] and resolver 2 to the ADIRU which generates the air and inertial data of the aeroplane. Resolvers 1 and 2 are mechanically linked by a gear. Thus, when the AOA sensor functions nominally, the angular positions of the two resolvers change at the same rate.

An angle of attack measurement error thus affects the indicated airspeed and altitude displayed on the PFD on the side of the erroneous measurement. …in addition to the indicated airspeed and altitude display errors, the various computers situated on the same side as a malfunctioning AOA sensor receive false input data. These dysfunctions may result in an increased work load for the crew along with difficulties in controlling the aeroplane.

During a C-check one…

…inspection required the two AOA sensors to be manually turned by 30°. The technicians who had carried out this operation had not noticed any anomaly.

Flight on 7 February 2018

The aircraft took off at 18:40 in night Visual Metrological Conditions (VMC). The captain was Pilot Flying (PF).

…at roughly the moment when the captain carried out the rotation, the IAS DISAGREE alert message appeared on both PFDs. The crew called out the appearance of the alert and quickly saw that the right PFD [Primary Flight Display] was giving erroneous speed indications while the left PFD and standby airspeed indicator were supplying identical information.

During the initial climb, the AOA DISAGREE and ALT DISAGREE alerts were also displayed on the PFDs. The captain decided to continue the flight as the speed information displayed on his PFD was correct. He also decided to postpone carrying out the checklists as the workload at this point of the flight was very high due to a large amount of traffic in the London TMA.

The crew observed during the climb that the altitude displayed on the right PFD was also erroneous and that the differences in speed and altitude between the two PFDs was increasing. At their cruising altitude of FL200, the first officer indicated that the difference was 2,000 ft and between 30 and 40 kt, the values on the right side being lower than those on the left side. The crew then carried out the AOA DISAGREE and ALT DISAGREE checklists followed by the IAS DISAGREE checklist which referred them to the Airspeed Unreliable procedure. Both pilots consulted this procedure but did not apply it as they had identified the erroneous indication and knew that the left PFD indication was correct. They nevertheless checked that the speed indication of the left PFD – which they considered correct – was consistent with the Flight with unreliable airspeed table.

They kept the autopilot (AP), the flight directors (FD) and the auto-throttle (A/T) engaged. Once the checklists had been carried out, the crew carried out a TACBDE assessment and decided to continue the flight to Paris-Orly.

TACBDE is a memory aid for: T = trajectoire (path), A = Action-menace (action-risk), C = Court terme (short term), B = Bilan (assessment), D = décision (decision), E = exécution (execution).

They did not transmit a PAN PAN message and they did not inform the ATC of their problem. During the descent, the captain contacted the Transavia maintenance department to report the problem encountered and request work by a maintenance technician. For the approach, the crew checked in the QRH [Quick Reference Handbook] for the thrust and pitch to be set. The pilots decided to increase the approach speed by 10 kt in order to have a sufficient indicated airspeed on both PFDs…

The aircraft landed safety and the captain recorded the alerts in the Technical Log.

Maintenance Fault-Finding After First Flight

A technician, employed by a subcontractor of the company of Transavia maintenance provider, attended to the aircraft during the night at Orly. He was only provided with the Technical Log information of three IAS DISAGREE, AOA DISAGREE and ALT DISAGREE alerts.

He tried to obtain more details about the event from the prime contractor maintenance company but the latter was unable to give him further information. He therefore complied with the AMM procedures concerning the inspection of AOA sensors, Pitot probes and static pressure ports and the stall warning and did not observe anything abnormal.

He added that the AOA sensor moved freely. He explained that he did not consult the procedures in the Fault Isolation Manual (FIM) corresponding to each alert but that the actions that he carried out ultimately corresponded to what was required by the FIM. [However,] FIM procedure for the AOA DISAGREE alert requires the SMYDC to be tested in order to check whether it has recorded a failure and that he had not thought to do this. The technician explained that an AOA sensor failure is usually accompanied by an Autoslat Fail alert and that this alert was not reported by the crew. He thought that the AOA sensor might have iced which could explain why he had not detected any problem. The aeroplane was therefore returned to service for the flight of the following day.

Flight on 8 February 2018

The next day, another crew had to fly from Paris-Orly airport to Marrakesh airport (Morocco), the take-off being scheduled for 06:35. It was an instruction flight to train a pilot for the position of captain. He was going to be PF for this flight while the captain, in the right seat, was going to act as first officer for the purpose of the training and would be PM [Pilot Monitoring].

The prior Tech Log entries had not particularly drawn the crew’s attention. For various unrelated reasons, departure was delayed. The aircraft took off at 08:25, again in VMC. It was at the point when an 80 knot call out should be made by the PM, that the crew identified a 10 knot difference between the PFDs.

An IAS DISAGREE alert message appeared between 90 and 95 kt according to the instructor. The latter took the controls, terminated the instruction situation, continued the take-off run and carried out the rotation. He set a pitch of 15° and thrust was at the assumed temperature. Shortly after, the AOA DISAGREE and ALT DISAGREE alerts appeared in succession. The instructor then observed that his PFD displayed values which were 20 kt and 400 ft below the left PFD and the standby instrument values. He told the pilot in training that the indications were erroneous on his side and asked him to continue the flight. The latter, PF again, engaged the AP.

The aeroplane was stabilized at FL90. The crew then complied with the memory items corresponding to Airspeed Unreliable: they disconnected, in succession, the A/T, AP and FDs and set a pitch of 4° and 75 % thrust. The PM then made a PAN PAN emergency call and asked for a radar vector to return to Orly. He asked the PF to continue managing the path while he carried out the checklists associated with the different alerts. The crew then carried out a TACBDE assessment. The left AP and FDs were re-engaged. The aeroplane made an overweight landing at Orly after a flight time of 40 minutes.

Maintenance Fault-Finding After Second Flight

The maintenance team which inspected the aeroplane after this flight observed that the AOA sensor on the right side was abnormally resistant to being turned and there were unusual clicking noises. The SMYDC test carried out…at the end of the second flight, revealed error messages concerning an AOA sensor anomaly requiring its replacement.

QAR Analysis

Transavia provided the BEA with all the flight data recorded by the aeroplane’s maintenance recorder (QAR [Quick Accees Recorder]) since March 2015. The analysis of this flight data brought to light that the dysfunction of the right AOA sensor gradually evolved over time with the values changing in increasingly longer steps compared to the left AOA sensor where the changes are a lot more dynamic. The following figures show the evolution of the AOA sensor dysfunction between 2015 and 2018 based on the recordings of the values provided by the left and right AOA sensors. The start of this dysfunction can be detected in the QAR data as early as March 2015, just a few weeks after the aeroplane had been delivered to Transavia.

The dysfunction then becomes significantly more marked and is visible up to the last flight before the maintenance work in Norwich (see Figure 6).

There is then a clear change in the behaviour of the angle of attack values recorded during the flights of 7 and 8 February and the dysfunction is less visible (see Figure 7).

The activation of the AOA DISAGREE alert cannot be checked using the QAR data of the occurrence flight: the AOA DISAGREE alert is generated by comparing the values measured by resolver 2 of each sensor whereas the recorded angle of attack value may come from resolver 1, depending on the SMYDC selection logic. It is therefore probable that the difference between the resolver 2s before 7 February was not sufficient to activate an alert and that this difference increased during the flight of 7 February although the difference between the resolver 1s had decreased.

Examination of the Faulty AOA Sensor

The sensor, manufactured in 2014, had not been disassembled since its delivery. Internal damage was discovered when it was disassembled by investigators.

The gears between the two resolvers were damaged and at ambient temperature, the shaft of resolver 2 was blocked in rotation and was slightly deformed. At operating temperature, reached after the vane heater test, the two resolvers gave indications which differed from each other by around 100°.

Resolver 2 was sent to the manufacturer of the AOA sensor, Collins Aerospace, who coordinated an examination with its subcontractor, MOOG, the resolver supplier. The examination of the resolver blocked in rotation found the presence of a viscous and tacky substance, between its stator and rotor, which prevented the relative movement of these two parts.

This substance was primarily epoxy resin but contaminated with one or more other substances. An epoxy resin, Tetra Hydro Furfuryl Alcohol (THFA) is used during manufacture, but only in a process step and physical location where the resolver component itself is not present. Collins Aerospace and MOOG stated were not aware of any other previous cases of contamination.

Collins Aerospace implemented additional material handling procedures and affixed warning notices on all the equipment using THFA to minimize the risks of THFA accidentally coming into contact with…resolvers.

Collins Aerospace considered that the damage to the gears and the deformation by torsion of the resolver 2 shaft was probably the result of abnormal loads experienced since 2015 due to the blocking caused by the contamination. The difference observed between the values supplied by the two resolvers could be due, according to Collins Aerospace, to a momentary disengagement of the gears linking the resolvers.

Application of the Airspeed Unreliable Procedure

In the case of an IAS DISAGREE alert, the Boeing 737-800 flight manual refers the crew to the Airspeed Unreliable procedure, an excerpt of which is given below.

The procedure asks the crew to disengage all the automatic systems when the flaps are extended, to set a pitch attitude of 10° and a thrust of 80 % of N1. These first four items of the procedure are memory items which must be complied with immediately, as soon as the abnormal situation is identified. The disengagement of the AP, A/T and FDs is stipulated to prevent these systems from supplying orders or erroneous indications if the values supplied by an ADIRU are erroneous, as can be the case when an AOA sensor is faulty.

In the two incidents, the pilots did not immediately carry out the memory items. In both cases, they first tried to identify the side which was supplying the erroneous information and initially used this assessment to continue the flight with the automatic systems engaged. They did not set the recommended pitch attitude and thrust parameters.

They indicated that they knew the applicable procedure well but that during take-off, the selected thrust and the pitch attitude of around 15° allowed the aeroplane to climb safely. They did not think it was opportune to reduce the pitch attitude and thrust in a critical flight phase such as the initial climb. They added that during simulator exercises with respect to the Airspeed Unreliable procedure, certain company instructors recommended to pilots to keep the pitch attitude of 15° and the take-off thrust in initial climb. When preparing the Airspeed Unreliable procedure, Boeing made the choice of minimizing the number of memory items and did not retain the possibility of keeping a higher pitch attitude for take-off. Boeing indicated that the pitch and thrust values of 10° and 80 % of N1 ensure safe take-off and that the captain must always assess the situation and remains at liberty to determine the most appropriate measures to ensure flight safety.

Decision to Continue Take-off

The Boeing 737-800 flight manual specifies four circumstances, between 80 kt and V1, where the take-off should be rejected:

BEA comment that:

The crews had little time to assess the capability of the aeroplane to continue the flight. They did not consider it opportune to reject the take-off. The favourable weather conditions during both take-offs probably contributed to this decision. The identification of the erroneous indications and the use of the automatic systems linked to the functional sensor allowed the flight to be continued in the first case and a safe turn around in the second case.

BEA Conclusions – Contributing Factors

The contamination of resolver 2 of the right AOA sensor by a solvent which led to a failure of the resolver and erroneous speed and altitude indications, followed by the AOA, IAS and ALT DISAGREE alerts. The investigation was not able to determine the cause of this contamination which seems to be an isolated case nor the reason why this defect, present since the installation of the sensor on the aeroplane, led to the activation of the alerts during a post maintenance flight. However, it is possible that the handling of the sensor during maintenance exacerbated the dysfunction without the technicians realising this.
The technician working on the aeroplane between the two flights not using the FIM. Its use would have ensured that a more complete check was carried out, the failure would have probably been detected and the sensor replaced.

BEA Safety Lessons

The take-off is a dynamic phase during which the crew may not have the resources to identify all the possible consequences of a failure of the speed indicator. Given the importance of the speed indications to continue the flight, a doubt as to this parameter should incite the crew to envisage rejecting the take-off when this is still possible.

A failure of the speed indicator can affect numerous systems situated on the side of the faulty sensor, such as the autopilot, auto-throttle, flight directors or stall protection. The deactivation of the automatic systems required by the memory items of the Airspeed Unreliable procedure aims to prevent the use of the automatic systems on the side affected by the dysfunction and must be carried out by the crew before any analysis.

Finally, transmitting a PAN PAN message in order to notify a technical issue allows the ATC to take precautionary measures if necessary. It can often help reduce the crew’s workload.

Safety Resources

Past Aerossurance articles that might interest you:

We have discussed human factors and error management more generally here:

Professor James Reason’s 12 Principles of Error Management
Back to the Future: Error Management
Also see our review of The Field Guide to Understanding Human Error by Sidney Dekker presented to the Royal Aeronautical Society (RAeS): The Field Guide to Understanding Human Error – A Review

A public inquiry chaired by Anthony Hidden QC investigated 1988 Clapham Junction rail accident. In the report of the investigation, known as the Hidden report, he commented:

There is almost no human action or decision that cannot be made to look flawed and less sensible in the misleading light of hindsight. It is essential that the critic should keep himself constantly aware of that fact.

Aerossurance has extensive air safety, operations, SAR, airworthiness, human factors, aviation regulation and safety analysis experience. For practical aviation advice you can trust, contact us at: enquiries@aerossurance.com