Software Fix Will Address Most Recent MAX Issue
Aug 1, 2019 Sean Broderick | Aviation Week & Space Technology
The latest Boeing 737 MAX flight control computer system anomaly that the FAA has ordered fixed is addressable through software changes and presents less risk on older 737s, Aviation Week has confirmed.
The failure scenario involved forcing a flight control computer (FCC) processor command to the horizontal stabilizer nose-down after detecting specific flight profile conditions, a source with knowledge of the issue says. It also bypassed the control column inputs, meaning pulling back on the column, or yoke, does not interrupt the stabilizer movement. Finally, the fault was to happen while the autopilot was engaged during cruise. The anomaly has never occurred during flight operations, but the FAA wanted to see what would happen if different combinations of faulty data fooled the FCC.
FAA pilots tested the scenario in mid-June—one of about 30 scenarios trialed during the session—in Boeing’s 737 engineering simulator, or e-cab. They were able to recover using the runaway stabilizer emergency procedure, the source said. There was no hardware failure, and the aircraft’s systems reacted exactly as they are designed to do.
But at least one pilot determined that the time needed to identify the failure as a runaway stabilizer was too long, and the FAA ordered Boeing to address the issue. Boeing’s solution, the source says, is a software modification that monitors the FCC’s output. If the combination of erroneous data is detected, the second FCC and autopilot take over, eliminating the chance of stabilizer runaway.
Details of the issue, many of which have not been previously reported, underscore the FAA’s heightened focus on eliminating risk as it scrutinizes the MAX’s design and evaluates when the aircraft will be safe to fly again. The FAA grounded the MAX on March 13, three days after the crash of Ethiopian Airlines Flight 302 (ET302), the second fatal MAX crash in five months. Other agencies, seeing similarities between the two accident flight profiles, began grounding the aircraft within a day of ET302, and the entire 380-aircraft fleet remains parked.
Investigators soon made a definitive link between ET302’s accident sequence and the October 2018 crash of Lion Air Flight 610 (JT610). In both cases, errant angle-of-attack (AOA) data being fed to the MAX’s Maneuvering Characteristics Augmentation System (MCAS) flight control law triggered nose-down stabilizer inputs as the aircraft were climbing shortly after takeoff. Both flight crews struggled to counter the system, which continued to operate, responding to the errant data. Both accident sequences ended in final dives that killed all onboard the aircraft.
The MCAS is an extension of the 737 Next Generation (NG) speed-trim system (STS), which adjusts the stabilizer to ensure pitch is maintained as speed increases. The MCAS activates when the aircraft’s speed approaches threshold AOA, or stick-shaker, stall-warning activation, for the aircraft’s configuration and flight profile. It was added to the MAX to enhance pitch stability with slats and flaps retracted at very light weights and full aft center of gravity. The MCAS ensures the MAX, which features larger-diameter engines that generate more lift than those on its NG predecessor, handles like the NG, helping the two models earn a common type rating and minimizing differences training.
Details from both ongoing accident probes, plus internal analysis, led Boeing and the FAA to determine that the MCAS needed changes. Boeing completed its software modifications in May and is awaiting word from the FAA on new training requirements that must be developed for MAX pilots.
The JT610 and ET302 accident sequences prompted the FAA to reexamine its approval of the MAX, including system safety evaluations. Prior to Boeing’s changes, the MCAS relied on a single source of AOA data. In each accident, issues with the AOA sensors meant the data stream was communicating an impossibly high AOA value to the FCC. Instead of ignoring the anomalous data—another change incorporated into the new MCAS logic—the system responded with nose-down stabilizer actions when they were not needed. Boeing and the FAA assumed such a failure would be both remotely possible and, if it did occur, quickly recognized by pilots as runaway stabilizer. Both MAX accident sequences show they were wrong.
As part of its MAX reevaluation, the FAA examined other anomalies considered remote and flagged the latest issue. Like the MCAS failure scenario, it would only be triggered by faulty data and require pilots to quickly identify runaway stabilizer.
“We identified a very remote failure case. Knowing what we know [following the accidents], we really needed to go back and see, if this occurs, can flight crews recover?” Ali Bahrami, FAA associate administrator for aviation safety, told U.S. lawmakers during a July 31 hearing. “Our test pilots [decided] that the level of proficiency that is required to recover from this event was exceptional. That’s why the software changes are being incorporated.”
The scenario is not linked to the MCAS system. While it can occur on the NG, modifications to that fleet are not as pressing and may not be required at all.
Pilots on the NG can counter any uncommanded stabilizer input by moving the yoke. On the MAX, Boeing bypasses this function—often called the column cut-out switch—when the MCAS is active, because it concluded that countering the MCAS by pulling back on the yoke could negate the system’s purpose. Because the column cut-out switch function is on the MAX, Boeing incorporated it into the latest round of worst-case failure scenarios trialed by the FAA’s pilots.
Boeing says it expects to deliver its package of MAX updates—including the completed MCAS changes, additional software modification and related training packages—to the FAA “in the September time frame.” The agency is expected to take several weeks to review the package before deciding whether to lift its grounding. It also will address all return-to-service recommendations made by its Technical Advisory Board, a group of FAA and outside engineers tasked with reviewing the MCAS update, related system safety assessment, and training.
“To be clear, the FAA will lift the 737 MAX grounding order only when it is safe to do so,” FAA Administrator Dan Elwell wrote in a July 30 letter to Congress. “While the FAA hopes to achieve nearly simultaneous approval from the major civil aviation authorities around the world, ultimately the U.S. and each country that grounded the 737 MAX will make its own determination based on its local requirements and processes.”
Elwell added that the FAA is “offering assistance to any and all countries to support their return-to-service decisions” and is “working with our colleagues from the European Union, Canada, and Brazil [the three other entities with agencies that oversee major aircraft manufacturing programs] to address their concerns.”
With the MCAS work done, Boeing’s main outstanding issues are the FCC software update to address the latest anomaly, certification flights to verify the package works as designed, and—perhaps most importantly—new training.
The FAA continues to acknowledge that pilots transitioning from the NG to the MAX were not given enough information on differences between the two aircraft. The MCAS system, designed to operate in the background, was not included in the original manuals or differences training. This has changed.
Some emergency procedures are also being revised, and new scenarios will likely be added to 737 recurrent simulator training, based in part on preliminary information gleaned from the two MAX accident probes.
“We recognized that some actions the [JT610 and ET302] flight crews took were inconsistent with what we assumed would be the correct reaction,” Bahrami says.