The Federal Aviation Administration (FAA) has given Boeing preliminary approval for its proposed fixes for the troubled 737 MAX-along with an airworthiness directive that the plane maker must comply with if it wants its planes back in the air.
Updated Flight Control Software
The agency will require that Boeing install a software patch to the Maneuvering Characteristics Augmentation System (MCAS) that implements new safeguards. The patch significantly alters the reliability of data the MCAS receives, the parameters under which the system will activate, and how the MCAS performs once it’s been triggered.
The MCAS is an anti-stall measure intended to activate only when the plane is at low speed, under manual pilot control, climbing with the flaps up, and the system detects that the aircraft is angling too high and at risk of stalling.
However, on Ethiopian Airlines Flight 302 and Lion Air Flight 610, the MCAS software kicked in at the wrong time: when the aircraft were taking off under manual control. In these cases, the MCAS forced the planes downward because it assumed the aircraft were stalling-when in fact they were operating safely. All passengers and crew were lost on those tragic flights, and the global MAX fleet has been grounded since-for almost two years.
Under the FAA’s proposed changes, the MCAS would now be governed by new flight control software, and the software would use new rules that send commands to the aircraft’s flight control surfaces, such as flaps, based on input from sensors or pilot actions.
In the case of the two crashes, the MCAS received faulty information from an angle-of-attack (AOA) sensor that told the system the plane was stalling when it was not. The MCAS then overrode the system and overpowered the crew, pushing the planes’ noses down into fatal dives.
The new flight control software would contain the following four new measures to prevent such tragic occurrences from being repeated:
1) More Than One Angle-of-Attack Sensor
The FAA requires that the MCAS rely on at least two AOA sensors. Many commercial jets rely on multiple AOA sensors; but typically, a 737 MAX relies on only one. These sensors are vulnerable to damage and malfunction-from sources such as lightning, bird strikes, freezing and faulty installation.
In the case of the two downed planes, black box data indicated that the aircrafts’ lone AOA sensor sent erroneously high input to the flight control system. This led the software to conclude that the planes were stalling, and triggered the MCAS-which repeatedly commanded the horizontal stabilizer to push the planes’ noses down.
Going forward, the flight control software would pull data from both sensors, significantly reducing the risk of a damaged sensor sending the wrong signal to the MCAS.
2) MCAS Disabled on Severe AOA Disagreement
To further strengthen the system against faulty AOA sensor readings, the updated flight control software would also compare the inputs from the two sensors to identify when a sensor is malfunctioning.
If the difference between the readings of the two sensors is above a certain threshold, the speed trim system-which includes the MCAS-would become disabled for the remainder of the flight. That threshold would be based on “the magnitude of the disagreement and the rate of change of the AOA sensor position values,” according to the FAA.
In addition, Boeing would be required to add an “AOA disagree” indicator in the cockpit to inform the flight crew of a potential sensor malfunction or failure. This should be a welcome addition for pilots: among other criticisms, Boeing has also been called out for not making an AOA disagree indicator light standard in the cockpit-a vital piece of information for a crew that was relying on a sole AOA sensor.
That indicator would have been even more important considering that Boeing had removed reference to the MCAS in its 737 MAX training materials, so many pilots-most notably the ones flying the downed aircraft-were not even aware that the MCAS existed.
3) One MCAS Activation per AOA Incident
The MCAS on board the Ethiopian Airlines and Lion Air planes were reacting to faulty sensor readings-and triggered repeatedly, which was too much for the pilots to handle. It appears that the pilots were briefly able to wrestle back some control of the aircraft-only to be overpowered by the MCAS activating again.
The new software would limit the MCAS to trigger only once during a high AOA incident-eliminating the repeated activations that contributed to the two crashes. This would allow the MCAS to properly carry out its original function as an emergency anti-stall measure.
It also means that, should the MCAS be overridden by either a faulty sensor reading, or activate during a genuine stall situation, the pilots will be unable to rely on the system for any further stall scenarios for the rest of the flight-they’ll have to handle it by themselves. But given the extensive training of most pilots, this seems like an acceptable consequence.
4) Less Aggressive MCAS When Triggered
Finally, should the MCAS kick in during a flight, its power would be significantly limited so that it can’t overpower the pilots.
The new software would keep a comparatively short leash on the MCAS, permitting it to activate and send signals to the flaps-while allowing the flight crew to retain pitch control, using the control column to maintain level flight, climb and descend. No longer would the anti-stall system be able to grab control of the aircraft away from the pilots: it would instead defer to their commands.
… But Wait, There’s More
While the software is the main focus of the fixes, the FAA will require additional corrective measures. A revised flight manual-this one actually mentioning the MCAS-would be required for all 737 MAX operators to use. Each plane’s AOA sensors would need to be tested, and each aircraft would have to undergo an operational test flight before it can be brought back into service. And finally, the wiring for the jet’s horizontal stabilizers will need to be reconfigured to comply with FAA standards.
Lots on the Line
The crashes brought both Boeing and the FAA under intense global scrutiny and scathing criticism for their repeated oversights in designing, manufacturing and certifying the 737 MAX.
So a lot is riding on these proposed fixes: the airworthiness of one of the world’s most popular aircraft, Boeing’s reputation and bottom line, the legitimacy and authority of the FAA–and the confidence of travelers around the world. If the plane maker and the regulator don’t get this right, the consequences could be severe for both-and could cause more chaos in an aerospace market already reeling from the MAX’s grounding and the COVID-19 pandemic.
Boeing will have to make significant changes to its best-selling plane.
The FAA is accepting public comment on the proposed fixes for the MCAS until September 21, 2020. If recertification goes as anticipated, we could be seeing 737 MAXs take to the air again by Halloween … but global confidence in the MAX could take much, much longer to recover.