The FAA issued an airworthiness directive for Boeing 737 MAX aircraft and proposed requiring key design changes before the aircraft returns to the service.
This proposed AD would require installing new flight control computer (FCC) software, revising the existing Airplane Flight Manual (AFM) to incorporate new and revised flight crew procedures, installing new MAX display system (MDS) software, changing the horizontal stabilizer trim wire routing installations, completing an angle of attack sensor system test, and performing an operational readiness flight. This proposed AD would also apply to a narrower set of airplanes than the superseded AD, and allow operation (dispatch) of an airplane with certain inoperative systems only if certain provisions are incorporated in the operator’s existing FAA-approved minimum equipment list (MEL). The FAA is proposing this AD to address the unsafe condition on these products.
Proposed Design Changes
The FAA proposes mandating the following changes to the 737 MAX type design, to address the various aspects of the unsafe condition.
To ensure that an erroneous signal from a failed single AOA sensor does not prevent continued safe flight and landing, and specifically that it does not generate erroneous MCAS activation, the FAA proposes to require installation of updated FCC software with revised flight control laws associated with MCAS. These revised flight control laws would use inputs from both AOA sensors to activate MCAS. This is in contrast to the original MCAS design, which relied on data from only one sensor at a time, and allowed repeated MCAS activation as a result of input from a single AOA sensor.
The updated FCC software would also compare the inputs from the two sensors to detect a failed AOA sensor. If the difference between the AOA sensor inputs is above a calculated threshold, the FCC would disable the speed trim system (STS), including its MCAS function, for the remainder of that flight, and provide a corresponding indication of such deactivation on the flight deck.
To ensure that MCAS will not command repeated movements of the horizontal stabilizer, the revised flight control laws would permit only one activation of MCAS per sensed high AOA event. A subsequent activation of MCAS would be possible only after the airplane returns to a low AOA state, below the threshold that would cause MCAS activation.
The updated FCC software would also limit the magnitude of any MCAS command to move the horizontal stabilizer, such that the final horizontal stabilizer position (after the MCAS command) would preserve the flightcrew’s ability to control the airplane pitch by using only the control column. The original design allowed MCAS commands to be made without consideration of the horizontal stabilizer position – before or after the MCAS command.
An undesired MCAS activation could prompt the flightcrew to perform a non- normal procedure. To ensure that after any foreseeable failure of the stabilizer system, safe flight is not dependent on the timeliness of the flightcrew performing a non-normal procedure, the FAA proposes multiple changes.
First, as previously discussed, the flight control laws would be changed to instead use inputs from two AOA sensors for MCAS activation, so that there would not be an undesired MCAS activation due to a single AOA sensor failure that could lead a flightcrew to perform a non-normal procedure.
Second, in the event that MCAS is activated as intended (i.e., during a high AOA event), the updated flight control laws software would limit the number of MCAS activations to one per high AOA event, and limit the magnitude of any single activation so that the flightcrew could maintain pitch control without needing to perform a non- normal procedure.
The FAA also proposes requiring an additional software update that would alert the flightcrew to a disagreement between the two AOA sensors. This disagreement indicates certain AOA sensor failures or a significant calibration issue. The updated MDS software would implement an AOA DISAGREE alert on all 737 MAX airplanes. Some 737 MAX airplanes were delivered without this alert feature, by error. While the lack of an AOA DISAGREE alert is not an unsafe condition itself, the FAA is proposing to mandate this software update to restore compliance with 14 CFR 25.1301 and because
the flightcrew procedures mandated by this AD now rely on this alert to guide flightcrew action. As a result of the changes proposed in this AD, differences between the two AOA sensors greater than a certain threshold would cause an AOA DISAGREE alert on the primary flight displays (PFDs).
Also, as a result of the installation of this revised MDS software, operators would be required to remove “INOP” markers, if present, from the electronic flight instrument system (EFIS) panel of the airplane, because the markers would no longer be necessary, due to other changes in the updated MDS software that are unrelated to this unsafe condition. These markers, labeled “INOP,” indicate that one of the positions on the dial that selects display settings is inoperative.
To facilitate the flight crew’s ability to recognize and respond to undesired horizontal stabilizer movement and the effects of a potential AOA sensor failure, the FAA proposes to mandate revising and adding certain operating procedures (checklists) of the AFM used by the flight crew for the 737 MAX. All transport category airplanes have non-normal checklists to aid the pilots in responding to airplane failures.
The following is a general description of the changes that would be made to these checklists, and the purpose of each change. The FAA will conduct an operational evaluation before finalizing these checklists. (See Flightcrew Training section in this preamble for further information.)
To reduce the workload on the flightcrew when they suspect that the airspeed indications are unreliable, the FAA proposes to revise the Airspeed Unreliable checklist of the AFM. This checklist would be revised to (1) add a step to allow the flightcrew to determine a reliable airspeed indication without the use of reference tables, (2) improve the procedure for go-arounds to allow for increased use of automation, (3) add a step to ensure that erroneous altitude information is not transmitted via the transponder to air traffic control (ATC), and (4) add erroneous AOA as a potential cause for unreliable airspeed conditions.
The Runaway Stabilizer checklist of the AFM is used when there is undesired movement of the airplane’s horizontal stabilizer. The FAA proposes revisions to the criteria for this checklist’s use, to include when uncommanded horizontal stabilizer movement occurs continuously or in a manner not appropriate for current flight conditions. The revised checklist would include an explicit recall item that instructs the flightcrew to use their thumb-actuated trim switch to reduce forces on the control column. The checklist would also include a recall item to use the control column and thrust levers to control the airplane’s pitch attitude and airspeed. Finally, the checklist would be
revised to add a reference item to manually trim the horizontal stabilizer for pitch control, and note that a two-pilot effort may be used to correct an out-of-trim condition.
The Stabilizer Trim Inoperative checklist of the AFM would be revised to better align with the other non-normal checklists, and modified to provide guidance for manually trimming the stabilizer for pitch control, noting that a two-pilot effort may be used and will not cause system damage.
As previously discussed, one of the design changes proposed by this NPRM is a flight control law that would render the STS and MCAS functions inoperative if the airplane’s AOA sensors disagree. To assist the flightcrew in properly responding to such an occurrence, a non-normal checklist, called the Speed Trim Fail checklist, would be added to the AFM. This checklist would be used when the STS and MCAS functions are inoperative, and inform the flightcrew to continue normal operation. It would also note that the STS will not provide horizontal stabilizer trim inputs when the airplane deviates from its trimmed airspeed.
The FAA proposes adding the Stabilizer Out of Trim checklist to the AFM. The Stabilizer Out of Trim checklist would be used when the autopilot does not set the horizontal stabilizer trim correctly. Under the current design, the STAB OUT OF TRIM light illuminates in flight to inform the flightcrew that the airplane’s autopilot is not setting the horizontal stabilizer trim correctly. Under the new design, as part of the aforementioned FCC software update, this light will now also illuminate on the ground, to inform the flightcrew of a partial failure of a flight control computer. If the airplane is on the ground, the checklist will instruct the flightcrew to not take off. The checklist provides additional information for the flightcrew to use if the airplane is in flight.
The FAA proposes to add an AOA Disagree checklist as a procedure to the AFM, because the FAA proposes that the AOA DISAGREE alert be available on the PFDs for all 737 MAX airplanes. Therefore, this proposed checklist would be used when there is an indication, such as an AOA DISAGREE alert, that the airplane’s left and right AOA vanes disagree. The checklist would inform the flightcrew to accomplish the Airspeed Unreliable checklist.
The FAA proposes to add the ALT Disagree checklist as a procedure to the AFM. This checklist is used when the captain’s and first officer’s altitude indicators disagree, generating an ALT DISAGREE alert on the airplane’s PFDs. This proposed checklist would provide procedures to the flightcrew that would initially be driven by whether there is also an IAS DISAGREE alert shown on the airplane’s PFDs. The checklist would also provide additional steps for the flightcrew to subsequently complete for the descent, approach, and landing phases of flight.
The final checklist that the FAA proposes to add to the AFM is a new IAS Disagree checklist. This checklist is used when captain’s and first officer’s airspeed indicators – their “indicated airspeed” or “IAS” – disagree. The checklist directs the flightcrew to accomplish the Airspeed Unreliable checklist.
Since this NPRM proposes to supersede AD 2018-23-51, the procedural information required by that AD would be outdated when the final rule is effective and therefore would be removed.
As part of the FAA’s review of these design changes, the agency reviewed the entirety of the 737 MAX horizontal stabilizer control system. This review revealed that the physical separation of the horizontal stabilizer trim arm wiring and the horizontal
stabilizer trim control wiring does not meet the criteria specified in 14 CFR 25.1707. This design standard was promulgated in 2007 and therefore is part of the certification basis of the 737 MAX but not of previous Boeing Model 737 airplanes. Certain wiring installations must have enough physical separation so that a wiring failure cannot create a hazard. Since design changes must comply with FAA regulations, the FAA proposes to require changes to the wiring installation to meet the required physical separation between the horizontal stabilizer trim arm wiring and the horizontal stabilizer trim control wiring. The FAA proposes this action to bring the airplanes into regulatory compliance.