Boeing has disclosed details of a software update to its 737 Max that the company says eliminates the chance erroneous data can cause onboard computers to place the aircraft into a dive.
The company has already developed the software and tested it inflight, and is now working to achieve certification of the changes from federal authorities, Boeing officials say in Renton on 27 March.
"This combination of things will eliminate the chance of erroneous data ever causing MCAS activation," says a Boeing official who declined to be identified.
The manoeuvring characteristics augmentation system (MCAS) played a role in at least one of two recent 737 Max 8 crashes — incidents that have shown similarities and that prompted a global 737 Max grounding.
Company officials frame the MCAS modifications as improvements to an already safe system, saying the updates do not represent any concession by Boeing that the 737 Max was unsafe to begin with.
Boeing's 737 production line at Renton on 27 March. The company has maintained production during the 737 Max grounding.
Jon Hemmerdinger
Boeing has put the upgraded MCAS system "through hundreds of hours of analysis, laboratory testing, verification in a simulator and two test flights, including an in-flight certification test with Federal Aviation Administration representatives on board as observers", the company says.
Boeing declines to speculate a timeline by which the changes might be certified, which would allow the grounding to be lifted.
Company officials described three notable MCAS tweaks.
First, the upgraded MCAS operates based on data from both of the 737 Max's two angle-of-attack (AOA) sensors. It will collect data from both sensors all the time, and compare inputs from both, Boeing says.
"If those inputs vary by more than 5.5°, the system will inhibit MCAS and the entire speed trim function for the remainder of the flight," a Boeing official says. "That first level of protection… will keep MCAS from ever firing in the case of a single angle-of-attack" error, he adds
The current system relies on only one sensor at a time, though it alternates between the left- and right-side sensors.
Second, the upgrade will allow MCAS to activate – meaning to drop the aircraft's nose – only once for each time it registers an unusually high angle of attack, Boeing says.
The system will then reset and will engage again only if the aircraft enters another "elevated angle of attack situation", the official says.
"However, if for some reason an angle-of-attack vain gets stuck in a high position, the system will detect the inconsistency between the two inputs and it would not operate a second time," adds the official. "There are no known or envisioned failure conditions where MCAS would provide multiple inputs."
Finally, the company has tweaked MCAS so that it cannot command nose-down stabiliser movement to a degree to which a pilot pulling back on the control column cannot overcome, the company says.
"The control column will always be able to override MCAS input with sufficient manoeuvring ability that the aircraft can still climb," the official says.
Boeing has also updated computer-based "differences" training for pilots transferring from flying the 737NG to the 737 Max.
The course, though not yet approved, "is designed to provide 737-type-rated pilots with an enhanced understanding of the 737 Max speed trim system, including the MCAS function, associated existing crew procedures and related software changes", Boeing says.
The MCAS updates follow the October 2018 crash of a Lion Air 737 Max and the March crash of an Ethiopian Airlines aircraft of the same type. The pilots of the Lion Air crash fought against MCAS, which repeatedly pushed the aircraft's nose down, possibly due to erroneous angle-of-attack data, according to investigators.
Boeing has insisted pilots can disable MCAS by following existing cockpit procedures.
Source: FlightGlobal.com
