To ensure that an erroneous signal from a failed single AOA sensor does not prevent continued safe flight and landing, and specifically that it does not generate erroneous MCAS activation, the FAA proposes to require installation of updated FCC software with revised flight control laws 10 associated with MCAS. These revised flight control laws would use inputs from both AOA sensors to activate MCAS. This is in contrast to the original MCAS design, which relied on data from only one sensor at a time, and allowed repeated MCAS activation as a result of input from a single AOA sensor.
The updated FCC software would also compare the inputs from the two sensors to detect a failed AOA sensor. If the difference between the AOA sensor inputs is above a calculated threshold, 11 the FCC would disable the speed trim system (STS), including its MCAS function, for the remainder of that flight, and provide a corresponding indication of such deactivation on the flight deck.
To ensure that MCAS will not command repeated movements of the horizontal stabilizer, the revised flight control laws would permit only one activation of MCAS per sensed high AOA event. A subsequent activation of MCAS would be possible only after the airplane returns to a low AOA state, below the threshold that would cause MCAS activation.
The updated FCC software would also limit12 the magnitude of any MCAS command to move the horizontal stabilizer, such that the final horizontal stabilizer position (after the MCAS command) would preserve the flightcrew’s ability to control the airplane pitch by using only the control column. The original design allowed MCAS commands to be made without consideration of the horizontal stabilizer position – before or after the MCAS command.
An undesired MCAS activation could prompt the flightcrew to perform a nonnormal procedure. To ensure that after any foreseeable failure of the stabilizer system, safe flight is not dependent on the timeliness of the flightcrew performing a non-normal procedure, the FAA proposes multiple changes.
First, as previously discussed, the flight control laws would be changed to instead use inputs from two AOA sensors for MCAS activation, so that there would not be an undesired MCAS activation due to a single AOA sensor failure that could lead a flightcrew to perform a non-normal procedure.
Second, in the event that MCAS is activated as intended (i.e., during a high AOA event), the updated flight control laws software would limit the number of MCAS activations to one per high AOA event, and limit the magnitude of any single activation so that the flightcrew could maintain pitch control without needing to perform a nonnormal procedure.
The FAA also proposes requiring an additional software update that would alert the flightcrew to a disagreement between the two AOA sensors. This disagreement indicates certain AOA sensor failures or a significant calibration issue. The updated MDS software would implement an AOA DISAGREE alert on all 737 MAX airplanes. Some 737 MAX airplanes were delivered without this alert feature, by error. While the lack of an AOA DISAGREE alert is not an unsafe condition itself, the FAA is proposing to mandate this software update to restore compliance with 14 CFR 25.1301 and because the flightcrew procedures mandated by this AD now rely on this alert to guide flightcrew action. As a result of the changes proposed in this AD, differences between the two AOA sensors greater than a certain threshold13 would cause an AOA DISAGREE alert on the primary flight displays (PFDs).
...
...
As part of the FAA’s review of these design changes, the agency reviewed the entirety of the 737 MAX horizontal stabilizer control system. This review revealed that the physical separation of the horizontal stabilizer trim arm wiring and the horizontal stabilizer trim control wiring does not meet the criteria specified in 14 CFR 25.1707. This design standard was promulgated in 2007 and therefore is part of the certification basis of the 737 MAX but not of previous Boeing Model 737 airplanes. Certain wiring installations must have enough physical separation so that a wiring failure cannot create a hazard. Since design changes must comply with FAA regulations, the FAA proposes to require changes to the wiring installation to meet the required physical separation between the horizontal stabilizer trim arm wiring and the horizontal stabilizer trim control wiring. The FAA proposes this action to bring the airplanes into regulatory compliance.
My question: can MAX be certified with:
a) a single MCAS input per AOA event
b) MCAS limited so that it would preserve the flightcrew’s ability to control the airplane pitch by using only the control column.
In essence, does MAX with these limitations still meet the certification criteria which required MCAS in the first place??