Gulfstream says it is the first aircraft manufacturer to validate aircraft software using a more-comprehensive method required by US regulators in response to two Boeing 737 Max crashes.
“We were the first ones to go through it,” Gulfstream president of customer support Derek Zimmerman says on 13 September.
He was referring to “model-based development” – a newly required process Gulfstream used to validate a software update for its G500 and G600 business jets.
Aircraft manufacturers have for several years said their development programmes face heightened Federal Aviation Administration oversight following the 737 Max events. Earlier this year, Gulfstream specifically attributed a G700 certification delay to the FAA’s increased software scrutiny.
But now the company has revealed more details about how the agency oversees and approves aircraft software following the tragic Max wrecks.
Zimmerman says Gulfstream needed to complete a comprehensive model-based review before the FAA would sign off on its new G500/G600 software update. The FAA approved the update on 12 September.
Generally, model-based evaluations involve more-thorough studies of how various systems perform when integrated together – how they behave as a whole.
That is in addition to system-level evaluations, much of which is done by component suppliers, which bring their products through certification.
“The model-based development really is a second level of verification on top of the level of verification that already happens,” Zimmerman says. “They added an additional level of testing over the top of everything that would have been done prior to the regulatory change.”
The FAA changed its software review following the “Boeing accidents”, Zimmerman notes. The change is aimed at ensuring certifications align with increasingly complex automated aircraft systems.
The FAA did not provide comment from FlightGlobal.
Investigators attributed the Max crashes largely to erroneous activation of a flight control system. In addition to requiring Boeing change the design, investigators recommended closer review by regulators and manufacturers of how various systems interact.
Gulfstream did not initially use model-based methods when developing the G500 or G600 because those models cleared certification ahead of the change.
But Gulfstream did need to follow model-based methods to validate its software update, which addresses a G500/G600 flight-control issue that caused two hard landings. Those types share a flight-control system.
The jets’ angle-of-attack “limiter” (a system intended to prevent stalls) wrongly activated in windy conditions prior to touchdown, the FAA said.
In response, the agency in May prohibited G500s and G600s from landing if wind gusts exceed 5kt (9km/h).
Gulfstream’s software fix addresses the issue, meaning updated jets will not be subject to the restrictions.
Zimmerman describes the fix as relatively simple but says the FAA required Gulfstream go back and subject the system to model-based evaluations.
“We had to demonstrate the entirety of the code,” he says. “Then, we had to demonstrate… nothing else changed in the underlying code.”
Gulfstream has been using model-based methods all along in developing the G700 and G800, which share the G500/G600 flight-control system, Zimmerman says.
Additional software validation is partly why Gulfstream, early this year, delayed those programmes by six months. It now anticipates the G700 will enter service by mid-2023, with the G800 following six to nine months later.
