For most fixed-wing aircraft, accurate angle-of-attack information is utterly essential for safe flight, due primarily to the risk of stalling the aircraft if the AoA of one or both of its wings becomes excessively high (an additional concern which arises at very high speeds is the possibility of causing an over-g, potentially resulting in structural failure);1 as a result, all airplanes have some form of attack-angle sensor (typically a mechanical vane which aligns itself with the ambient airstream2) which feeds AoA data to the airplane's other systems (usually via the airplane's air-data computers).
Unfortunately, the indispensability of accurate attack-angle data means that, if the AoA data fed to other aircraft systems is not accurate, very bad things happen. This has caused numerous accidents:
- TW843 (L-1011-1, 30 July 1992) - The aircraft's right-hand angle-of-attack sensor, a known temperamental component, failed completely during the beginning of pre-takeoff taxi at JFK, freezing in a position corresponding to an AoA of 26.1° (an angle of attack which is physically impossible for an L-1011 to assume when all of its wheels are on the ground) throughout the aircraft's taxi and takeoff.4,5 This resulted in a false stall warning sounding as soon as the aircraft lifted off,6 leading to a very-high-speed rejected takeoff, excessively-hard touchdown, and runway excursion; structural damage incurred during touchdown resulted in a fire which destroyed the aircraft (although all 292 occupants survived).
- QF72 (A330-300, 7 October 2008) - During cruise over the eastern Indian Ocean, one of the aircraft’s three ADIRUs suffered a glitch which corrupted (to a greater or lesser extent) all of the parametric data computed and passed on by same; although this affected measurement and computation of many different aircraft parameters, the important part, for the purposes of this discussion, was that the AoA values transmitted by the malfunctioning ADIRU were contaminated by intermittent (but frequent) spikes to 50.625° (as well as, later on, some spikes to 5.625° or 16.875°), which caused the aircraft’s flight-envelope-protection systems to trigger two large nose-down elevator movements about two-and-two-thirds minutes apart (each time momentarily locking out the pilot’s compensatory nose-up control inputs) in response to a nonexistent stall condition, resulting in numerous severe injuries among the passengers and cabin crew (although all 315 occupants survived).
- JT043 / JT610 (737-8, 28-29 October 2018) - During turnaround maintenance at Denpasar on the first day, the aircraft's left-hand AoA sensor was removed due to recurrent malfunctions and replaced with one that had been in storage since being refurbished a year previously. The replacement sensor proved to have been improperly calibrated during refurbishment, causing it to read 21° higher than the aircraft's actual attack angle; the bad data from the sensor caused the aircraft's stickshaker to activate almost immediately after liftoff on the subsequent flight to Jakarta (it remained on for the remainder of the flight), and, more seriously, interacted with a poorly-designed modification of the aircraft's autotrim system in such a way as to cause the aircraft's horizontal stabiliser to run away in the nose-down direction, resulting in serious control difficulties until the flightcrew were able to stop the trim runaway by disabling the autotrim system. Maintenance personnel at Jakarta were unable to find a problem with the aircraft on the ground following the flight, and it was released again for flight the following day. As the miscalibrated AoA vane was not repaired or replaced, the problems from the previous day repeated themselves; the stickshaker activated as the aircraft rotated for takeoff (and once again remained active throughout the flight), and the stabiliser trim began to run away in the nose-down direction as soon as the aircraft's flaps were retracted.7 Unlike what happened the previous day, the flightcrew either forgot or were unable to disconnect the autotrim system before the extreme out-of-trim situation resulted in a loss of control and the aircraft crashed into the Java Sea with the deaths of all 189 on board.
Many of these accidents could have been prevented if some form of sanity checking (a test to detect and screen out nonsensical incoming data) were run on the angle-of-attack data before releasing it to other systems:
- An AoA vane that becomes stuck in a fixed position on the ground could be easily detected during takeoff by analysing the data provided by the sensor as soon as the aircraft's airspeed becomes high enough to allow the sensor vanes to operate, and marking as failed any sensor which reports an attack angle that it is not physically possible to assume when the aircraft is on the ground and unrotated.
- A sensor reading consistently high or low could be found out by calculating the z-axis load factor the reported angle of attack would create given the aircraft's current IAS, weight, and configuration, and rejecting the data from any sensor that has reported an AoA that is too excessively high or low to produce the observed Gz.
- A sensor that is starting to wander away from accuracy would be detected similarly, as its reported AoA would change over time in a manner inconsistent with the changes in the aircraft's airspeed, load factor, weight, and configuration.
- A failure that results in the reported attack angle changing unphysically rapidly (for instance, going from +2° to +50° and back to +2° in the space of two seconds8), which could conceivably be produced by certain types of sensor failures,9 but would more likely indicate a problem slightly further downstream, involving the improper processing and conversion of valid sensor data (such as from an ADIRU failure), would be particularly easy to detect, allowing the offending piece of equipment to be rapidly marked as failed and thrown offline.
So why isn't an airplane's raw angle-of-attack data sanity-checked before letting other aircraft systems run wild with it?
1: This does not necessarily require that the aircraft's attack angle be constantly displayed to the pilots; it is often sufficient simply to have the aircraft's systems monitor its AoA, and take action (such as activating the stickshaker) if it becomes excessive.
2: These sensors are typically mounted on the forward fuselage, even though mounting them on the wings - which are, typically, the part of the aircraft that generates most of its lift, and, thus, the part of the aircraft whose angle of attack is actually relevant - would provide more accurate data (because the local airflow - and, thus, local attack angle - over the forward fuselage is generally different from that over the wings; thus, AoA readings from nose-mounted sensors need to be corrected in order to calculate the wings' AoA).3
3: The magnitude and direction of the difference depends, among other things, on the aircraft's airspeed; thus, the process of calculating the wings' attack angle from that of the nose requires valid airspeed data, which can create problems of its own if the aircraft's systems do not actually have access to valid airspeed data.
4: The L-1011 uses an unusual, and ridiculously-complicated, type of AoA sensor, which, rather than a simple mechanical vane, uses
magic a hollow tube, pierced with two rows of perforations, which interfaces with a nearby differential-pressure sensor.
5: The data provided by any type of attack-angle sensor will necessarily be meaningless at low airspeeds (such as during taxi and the early portion of takeoff) due to the very low dynamic pressure imposed on the sensors at these low speeds; however, properly-functioning AoA sensors will provide valid data at high airspeeds, even on the ground.
6: Due to the abovementioned unreliability of AoA-sensor data at low speeds, combined with the physical impossibility of stalling an aircraft which is sitting on the ground, the L-1011's stall-warning system is inhibited when the aircraft's air/ground switch is in "ground" mode.
7: The particular subsegment of the 737 MAX (737-7/-8/-9/-10)'s autotrim system which caused the nose-down trim runaways is only active when the flaps are fully retracted.
8: This is not to say that attack angles of this magnitude cannot be experienced in a typical airplane; an airplane's AoA can easily approach 90° in a prolonged stall (especially one that degrades into a flat spin). However, no airplane larger than a fighter jet - and especially without thrust vectoring - is capable of pitching up by over 45° in the space of a single second; the rotational inertia of a large, enlongated, heavy fuselage is simply much too great for such a rapid, drastic maneouvre to be physically possible.
9: For instance, the L-1011's aforementioned mess of an attack-angle sensor system includes a motor which rotates the external sensor tube to null out the sensor's internal pressure differential, and reads out the local angle of attack by measuring the angle through which the sensor tube is rotated by the internal motor; a short circuit could easily cause the motor to keep running until it hit its mechanical stops in one direction or the other, driving the sensor tube to a very high positive or negative angle, and thereby causing the sensor to report a falsely-high AoA (and possibly one not even in the right direction, at that).