The Federal Aviation Administration has provided more insight into how updated flight computers on Boeing’s 737 Max respond to angle-of-attack (AoA) indicator failures.
The updates, described in an 18 November airworthiness directive (AD), are central to the FAA’s decision, also on 18 November, to lift the Max’s grounding.
Broadly, the AD approves Boeing’s Max updates. Those include making the Max’s Maneuvering Characteristics Augmentation Systems (MCAS) receive data from two, not one, AoA sensor.
MCAS can now only fire once when the system senses a high AoA, and flight control computers now disable MCAS if the two AoAs disagree.
The changes address a core contributing factor to the crashes of Lion Air flight 610 in October 2018 and Ethiopian Airlines flight 302 in March 2019. Those accidents, both involving 737 Max 8s, killed 346 people.
The jets crashed after MCAS, responding to faulty AoA data from a single sensor, repeated applied nose-down stabiliser input.
The FAA’s 18 November AD digs deeper into types of AoA failures, segmenting them into two categories.
One includes AoA failures involving issues with the circuits that measure the “angular position of the AoA sensor”.
The Max’s computers do detect such circuitry failures, and prevent such faulty data from being used by MCAS and other systems, the AD says.
The other category includes AoA failures not involving circuits – such as failures resulting from physical damage to AoA vanes.
Such failures preceded both 737 Max crashes.
The FAA calls non-circuitry AoA failures “undetected” – the circuit measures the faulty readings, passing the bad data to the Max’s internal reference unit and flight control computer, which controls MCAS.
Boeing’s updates will ensure such non-circuity failures no longer activate MCAS, the FAA says.
That is because the computers will identify differences in data between the damaged and undamaged vanes. Upon detecting such differences, MCAS will be disabled, the AD says.
The order also explains how the system responds if both a Max’s AoA vanes suffer damage during the same flight.
If the vanes fail at different times, the first failure will cause MCAS to be disabled, meaning the second failure will not further impact the system, the AD says.
What if both vanes fail simultaneously and in the same way – meaning they both generate the same faulty readings?
In that case, MCAS could fire, but would not threaten safety, the FAA says.
“Even if such a simultaneous and symmetrical failure were to occur, MCAS would activate only once,” the AD says. “The FAA confirmed through testing and analysis during certification that a single activation of MCAS will not prevent continued safe flight and landing.”
MANUAL TRIM CONCERN
The FAA’s AD also addresses concern that the Max’s manual control wheel can be difficult to turn when subjected to extreme forces resulting from mis-trim.
The crash reports spurred that concern, indicating that the Ethiopian pilots struggled to turn the control wheel due to such forces.
The AD says the Ethiopian pilots likely struggled due to “significant horizontal stabiliser mis-trim combined with excessive speed”.
But Boeing’s redesign “limits the maximum mis-trim” and ensures pilots can override MCAS-induced pitch changes using their control columns, the FAA notes.
Still, the FAA “evaluated the manual trim system”, analysing forces required to turn the wheel in “maximum out-of-trim conditions”.
“The FAA determined that manual trim wheel forces meet FAA safety standards and do not require exceptional pilot skill or strength,” the AD says.
