Boeing Releases Software Update, Other Changes for Embattled 737 MAX 8
Boeing announced Wednesday that the company had completed work on the software fix for the Boeing 737 MAX 8 aircraft’s Maneuvering Characteristics Augmentation System (MCAS), the aircraft's autopilot system suspected of being linked to two recent crashes of the 737 MAX 8 in less than six months—crashes that led to the plane's nearly worldwide grounding.
Boeing Completes Update To Maneuvering Characteristics Augmentation System
Boeing announced that engineers had completed work on the software update the company will roll out to all 737 MAX 8 aircraft to correct deficiencies in the plane’s new MCAS autopilot which is suspected of being linked to the crashes of Lion Air flight 610 from Jakarta, Indonesia last October 28 and the crash of Ethiopian Airlines flight 302 from Addis Ababa on March 10.
In order to facilitate a necessary redesign of the engine placement on the wings of the 737 MAX 8, the aerodynamics of the plane changed from earlier models of the aircraft. This meant that pilots who were accustomed to safely operating the craft at certain Angles of Attack (AOA), the angle made by the intersecting lines representing the plane’s direction and the direction of the oncoming airflow, would be in danger of stalling if they tried those same AOAs on the 737 MAX 8.
The anti-stall function of the MCAS was designed so that if such an angle was created, the system would automatically engage a wingflap on the tail of the craft, lifting the rear of the plane up and returning to a “safe” AOA.
As revealed in a report last week by the Seattle Times, the MCAS anti-stall function relied on a single sensor to determine the AOA. If this sensor malfunctioned and fed the MCAS incorrect AOA data, then the anti-stall function would engage and attempt to achieve a safe AOA according to its calculations based on erroneous input.
According to a report in the New York Times this week, the automated system once engaged was only concerned with achieving a safe AOA according to the numbers it was being fed. While it perceived an unsafe AOA, the system would engage, lifting the tail up over a 10 second stretch, whereupon it would pause for five seconds, and then, if the data still indicated a stall risk, it would engage again, over and over, in a loop until the “safe” AOA was achieved, even if this sent the plane into a nose dive.
Investigators conducted tests this week using flight simulators to investigate the conditions just such an event created, and people involved in flight simulator tests told the New York Times that absent direct intervention by a pilot who knew how to shut off the system, it could take as few as three such 10-second increments of tail lift, carried out in about 40 seconds, to send the plane into an irrecoverable nosedive.
As the Seattle Times report explains, the 737 MAX 8 actually has a second AOA sensor that feeds into the MCAS. Inexplicably, the software simply wasn’t designed to read the data from both sensors. Had the software been written to take both available inputs from the sensors and compared them, it would immediately reveal that one of the sensors was malfunctioning. We know this to be the case because that is exactly one of the fixes Boeing announced today. If these two sensors disagree by more than 5.5 degrees, Boeing says, the MCAS system will not engage.
Also at issue was how a discrepancy in the sensor data measuring the AOA was reported by the system. There is already a procedure to trigger a warning system in the cockpit to alert the crew that there was a malfunction in the AOA sensor. This safety feature has been available to airlines since the plane hit the market; its just that until now, the feature was optional and cost extra money to purchase.
Now, Boeing said, this warning will be a standard safety feature of the aircraft.
Issue of Pilot Control, Training, and Education
Boeing also issued pilot guidance on the system after it appeared that the MCAS anti-stall system engaged more than 20 times as the co-pilot fought the autopilot in a tug of war to try to keep the plane from going into a dive.
No where in the safety documents that were reviewed in the Seattle Times report does Boeing address the possibility of multiple, sequential engagements of the MCAS anti-stall maneuver and preliminary data appears to show that both Lion Air and Ethiopian Airlines engaged in a similar tug of war with the controls to try to keep the plane out of a nosedive.
In fact, this similarity in the satellite data alone was enough for much of the world to ground the 737 MAX 8, even the US, who held out longer than most. As part of the latest fix, Boeing has announced that the MCAS system will not re-engage if the pilot counters the maneuver through the pilot's flight controls.
Reuters reported last week that the data from the Lion Air cockpit voice recorder captured the captain of the plane frantically searching through the plane's manual trying to find out what was cause the plane to lurch downward, never having been told by Boeing about the anti-stall system.
It isn’t even clear if the system was properly documented in the manual, as there is at least one anonymous pilot report to the Aviation Safety Reporting System that the nose-down behavior of the anti-stall system was inadequately described in the materials given to pilots.
Boeing has gone to great lengths to avoid requiring 737 MAX 8 pilots to receive special training and certification to fly the plane, wanting to market thier new aircraft as no different than the ones an airline had been flying for years, only better. Boeing appears to be conceding that point as well, announced that after the software update is approved by the FAA and has been installed on the 737 MAX 8 aircraft and airline flight simulators used for training, pilots will need to be specifically certified to fly this model 737 aircraft after 21-hours of instructor-led training and sufficient practice time in a flight simulator before ever seeing the cockpiit of a real 737 MAX 8.
Fixes May Already Have Been in the Works Prior to 2nd Crash
How many of these updates were for problems Boeing knew about before the Ethiopian Airlines crash is unclear, but according to reporting last month in the Wall Street Journal, Boeing had known about the troubling flight pattern in the Lion Air crash and had been negotiating with regulators about the scope of the necessary fix, including a software update to the MCAS system that they originally planned to introduce in January.
Ultimately, the paper reported, the update to the MCAS was pushed back to April as a consequence of the partial US Government shutdown in January, as well as the negotiations between Boeing and regulators over what systems would need to be fixed.
How much of this previously planned update has been ready to go and for how long is not known, but in the coming months and years, we'll have more detail on when these fixes were finished and whether they could have rolled out prior to the crash of Eathiopian Airlines flight 302. The Seattle Times alerted both the FAA and Boeing of the problems it had identified in Boeing's safety reports and sought comment on them days before the crash of Ethiopian Airlines flight 302, so the evidence is growing that both Boeing and the FAA were aware of these issues and but stuck to the original plan to release the fix in April.
We also know that Boeing had made it one of its primary goals for the design of the 737 MAX 8 aircraft that the new plane would not require pilots to have to get a different certification than the one they already had from an earlier 737 model. The company wanted to market the plane as one that earlier model 737 pilots already knew how to fly and that the they would only need an hour-long course on their iPad to be brought up to speed. This would make the 737 MAX 8 much more competitive with the rival Airbus A320neo.
Following the Lion Air flight 610 crash, if regulators made specific demands that certain systems be updated or altered, and if these updates that regulators were pushing for changed the system beyond what would have been covered by the certifications for previous 737 models, pilots would have to undergo training and certification to fly a 737 MAX 8, and Boeing would lose a major edge over a cometitor, and the consequences could have meant tens or possibly hundreds of billions of dollars.
The question for US Congressional Investigators and the several US District Attorney's offices in the US and overseas may ultimately boil down to what those negotiations in January that delayed the rollout of a fix were about. Specifically, what exactly was Boeing pushing for in those negotiations and whether those negotiations prevented the software update to the 737 MAX 8 from being installed before Ethiopian Airlines flight 302 took off from Addis Ababa on March 10.
If Boeing was trying to limit the scope of the proposed changes in order to avoid a fix that would require pilots to receive training and certification before flying the 737 MAX 8, as the fix that Boeing announced this week now does, then this may only be the beginning of Boeing's problems.
Boeing for its part has stressed that their agreeing to update their system is in no way an acknowledgement that these systems caused these crashes and Boeing has maintained throughout the past few weeks that the 737 MAX 8 is safe to fly. The investigations of both crashes is still under investigation and no official determination of what caused the crash has been made in either case.
Norman Wagner from the University of Delaware tells Interesting Engineering about the challenges of making extraterrestrial cement for off-space infrastructure.