Updated software designed to prevent another crash similar to those that downed two Boeing 737 MAX 8s within five months is functioning as intended in test flights and is expected to be installed on the grounded MAX airplanes in coming weeks, Boeing officials say.
Boeing has worked to develop the software update for the MAX maneuvering characteristics augmentation system (MCAS) even as investigations continue into the two fatal MAX 8 crashes — of Lion Air Flight 610, which crashed into the Java Sea after takeoff from Jakarta, Indonesia, on Oct. 29, and of Ethiopian Airlines Flight 302, which crashed March 10 after takeoff from Addis Ababa, Ethiopia. Together, all 346 passengers and crew were killed.
Three days after the March 10 accident, the U.S. Federal Aviation Administration (FAA) grounded MAX 8 and MAX 9 airplanes, joining other civil aviation authorities in ordering the worldwide fleet of nearly 400 MAX aircraft out of the sky.
In both crashes, preliminary findings from accident investigators have focused on the MCAS, a new MAX feature that was designed to enhance the airplane’s pitch stability — “so that it feels and flies like other 737s,” Boeing says. The goal was to improve the airplane’s handling characteristics and to decrease its pitch-up tendency at elevated angles of attack, thus reducing the likelihood that the airplane might stall. MCAS does not control the airplane when it is in normal flight but rather when it enters “a non-normal part of the operating envelope,” Boeing says.
In both accidents, preliminary findings indicate that the MCAS activated in response to incorrect information regarding the airplane’s angle-of-attack (AOA), the difference between an airplane’s pitch angle and the oncoming wind.
In each case, preliminary information indicates that the flight profiles in the moments before the crash included what the Ethiopian Aircraft Accident Investigation Bureau called “repetitive un-commanded aircraft nose down conditions.” Also in each case, the flight crew was unable to pull the MAX 8’s nose back up.
The investigations of both accidents are continuing.
Boeing began work after the Lion Air crash to develop a software update for the MCAS that would “ensure accidents like these never happen again,” CEO Dennis Muilenburg said at a leadership forum in Dallas in mid-April, adding that the update would prevent erroneous angle-of-attack sensor readings from triggering the MCAS. Boeing posted a similar message from Muilenburg on its website earlier in April.
Those erroneous sensor readings occurred in both accidents, “as one link in a longer chain of events,” Muilenburg said. “We know we can break this chain link.”
He said that, as Boeing test pilots have conducted 96 flights lasting a total of about 159 flight hours with the updated software, it has functioned as intended. “They will conduct additional test and production flights in the coming weeks as we continue to demonstrate that we’ve identified and met all certification requirements,” he said.
On the ground, Boeing has conducted information sessions with regulators and airline officials in Seattle, the U.K., Singapore and China, and pilots and other representatives of about two-thirds of the 50 MAX operators worldwide have participated in simulator sessions in which the software update was employed.
MCAS Design
The MCAS was designed and certified “to enhance the pitch stability of the airplane,” Boeing said in a mid-April statement. The system is intended to activate in manual flight, when the flaps are retracted and the airplane is being flown at an elevated AOA.
The MCAS software update was designed to “provide additional layers of protection if the AOA sensors provide erroneous data,” Boeing said, noting that it has gone through hundreds of hours of analysis, laboratory testing, verification in a simulator and two test flights, one of which included an in-flight certification test with FAA representatives.
Those additional layers include a flight control system that will compare inputs from both pilots’ AOA sensors, and “if the sensors disagree by 5.5 degrees or more with the flaps retracted, MCAS will not activate,” Boeing said.
In addition, Boeing said that the updates will ensure that, if MCAS activates in non-normal conditions, “it will only provide one input for each elevated AOA event. There are no known or envisioned failure conditions where MCAS will provide multiple inputs.
“MCAS can never command more stabilizer input than can be counteracted by the flight crew pulling back on the column. The pilots will continue to always have the ability to override MCAS and manually control the airplane.”
Boeing said that it had created updated computer-based training — designed to give 737 type-rated pilots “an enhanced understanding of the 737 MAX Speed Trim System, including the MCAS function” — to go along with the updated software and that, after its approval, it would be made available to all 737 MAX pilots.
The FAA Flight Standardization Board said in mid-April, after a training-focused review of changes in the MCAS, that the MCAS was “operationally suitable” and that it should be included among several “special emphasis” areas that are stressed during pilots’ ground training. That ground training — during initial, upgrade, transition, differences and recurrent training — should address “system description, functionality, associated failure conditions and flight crew alerting,” the board said. The document made no recommendation for additional simulator training incorporating scenarios involving the MCAS, however.
The board’s draft statement, placed on the FAA website for public comment through the end of April, is one step in the agency’s review of MCAS changes prompted by preliminary findings in the accident investigations.
FAA Oversight
In the aftermath of the accidents, critics have challenged the FAA on several aspects of its oversight of Boeing operations, and some complained that the FAA might be too close to the aircraft manufacturer. In addition, government agencies and several committees of the U.S. Congress announced investigations of various aspects of the FAA’s actions.
Transportation Secretary Elaine Chao and members of several congressional committees asked the Department of Transportation’s Office of the Inspector General (OIG) in mid-March to conduct a formal review of the process by which the FAA certificated the MAX 8. The OIG later said that the review had begun.
“While FAA has maintained an excellent safety record, two recent accidents involving Boeing 737 MAX 8 aircraft have raised significant safety concerns,” the OIG’s office said, adding that its audit would focus not only on the FAA’s process for certifying the 737 MAX airplanes but also on FAA actions in response to the two accidents.
Chao also named a special committee to review FAA procedures for certification of new aircraft, including the 737 MAX. Among the committee members are Air Force Gen. (Ret.) Darren McDew, former head of the U.S. Transportation Command, and former Air Line Pilots Association, International President Lee Moak.
“Safety is the number one priority of the department, and this review by leading outside experts will help determine if improvements can be made to the FAA aircraft certification process,” Chao said.
Rep. Peter DeFazio, an Oregon Democrat and chairman of the U.S. House of Representatives Committee on Transportation and Infrastructure, said the independent special committee was necessary because of “the many serious questions surrounding the Boeing 737 MAX and the FAA’s certification process.” He added that it “has become abundantly clear that an independent body must be able to review every step of the process and restore public confidence — both in the U.S. and around the world — that all identified problems will be resolved well before the MAX is allowed to be restored to service.”
The committee also planned its own investigation, asking both the FAA and Boeing to provide it with records concerning the agency’s certification of MAX aircraft. The panel encouraged current or former employees of Boeing and the FAA “to share any information that would be of interest to the committee and its investigation into the FAA’s certification of the Boeing 737 MAX.”
DeFazio said that, among other things, the panel wants to determine the roles and responsibilities of both the FAA and Boeing during the certification process; how “safety-critical systems that did not exist on prior 737 models were tested, evaluated and assumed to be safe”; and why the aircraft was certified without a requirement for additional pilot training.
Acting FAA Administrator Daniel Elwell defended the agency’s oversight of the development and certification of the 737 MAX .
In testimony in March to the U.S. Senate Committee on Commerce, Science and Transportation, Elwell said that effective safety programs call for “the open and transparent exchange of information” among the FAA, manufacturers such as Boeing and aircraft operators.
“It takes collaboration, communication and common safety objectives to allow the FAA and the aviation community to come together, to identify system hazards and to implement safety solutions.”
Sen. Roger Wicker, the Mississippi Republican who chairs the Senate committee, said the panel planned a related investigation of the training and certification of FAA aviation safety inspectors who evaluated the 737 MAX 8. In a letter to the FAA in early April, Wicker expressed concern that some inspectors on the FAA’s 737 MAX Flight Standardization Board might not have been qualified for the job and that, if they were not, their evaluation of MCAS might have been inadequate.
Elwell said in response that all flight inspectors on the board were fully qualified.
Featured image: © Photonsk | Dreamstime
Lion Air: PK-REN | Wikimedia CC-BY-SA 2.0
Ethiopian Airlines: LLBG Spotter | Wikimedia CC-BY-SA 2.0
Elaine Chao: U.S. Department of Transportation
Peter DeFazio: U.S. Senate