Close sidebar

Boeing has made 96 flights testing 737 MAX software update: CEO

written by australianaviation.com.au | April 12, 2019
The first Boeing 737 MAX entering final assembly at Renton. (Boeing)
A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)

Boeing chief executive Dennis Muilenburg says the company has conducted 96 flights testing the software update to an anti-stall feature on the 737 MAX that has been linked to two fatal accidents in the past six months.

The software update to the Maneuvering Characteristics Augmentation System (MCAS) has been in development since a Lion Air 737 MAX 8 plunged into the Java Sea shortly after it took off from Jakarta in October 2018. All 188 people on board were killed.

In March 2019, an Ethiopian Airlines 737 MAX 8 with 157 passengers on board crashed minutes after it took off from Addis Ababa. There were no survivors.

Advertisement
Advertisement

Boeing has acknowledged the MCAS anti-stall feature was activated in response to erroneous angle of attack information in both the Ethiopian Airlines and Lion Air tragedies, following the publication of the preliminary report into the Ethiopian Airlines accident.

In late March, Boeing held a technical briefing with 200 aviation professionals, including regulators and airline customers of the 737 MAX, to explain the software update.

And since then, the company has also visited the China, Singapore and the United Kingdom for further meetings with pilots and regulators.

Muilenburg, who was on board a test flight in early April, said the software update has functioned “as designed”.

PROMOTED CONTENT

“Overall, our team has made 96 flights totaling a little over 159 hours of air time with the updated software,” Muilenburg said at the George W. Bush Presidential Center Forum on Leadership in Dallas on Thursday (US time), according to a transcript published on the Boeing website.

“They will conduct additional test and production flights in the coming weeks as we continue to demonstrate that we’ve identified and met all certification requirements.

“We look forward to completing near-term milestones on the path to final certification.”

Boeing chief executive Dennis Muilenburg on a 737 MAX 7 test flight for the MCAS software update. (Boeing)
Boeing chief executive Dennis Muilenburg on a 737 MAX 7 test flight for the MCAS software update. (Boeing)

Boeing has explained previously the software update added extra layers of protection from erroneous data out of the aircraft’s angle of attack (AOA) sensors.

This included having the flight control system compare inputs from both AOA sensors. If there was a significant disagreement – by 5.5 degrees or more with the flaps retracted – the MCAS would not activate and an indicator of the flight deck would alert the pilots, according to Boeing.

Further, Boeing said “MCAS can never command more stabilizer input than can be counteracted by the flight crew pulling back on the column”.

“The pilots will continue to always have the ability to override MCAS and manually control the airplane,” Boeing said on its website.

“These updates reduce the crew’s workload in non-normal flight situations and prevent erroneous data from causing MCAS activation.”

In terms of pilot training, Boeing said it had updated the computer-based training to accompany the software update.

A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)
A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)

The airframe has also paused deliveries and is reducing the production rate of the 737 program to 42 aircraft a month, from 52 aircraft a month previously. The lower production rate was due to occur in mid-April.

Muilenburg, who has been at Boeing more than 30 years, described the past few weeks as “the most heart-wrenching” of his career.

“Our values are at the very core of everything we do. Yet, we know we can always be better, and these recent accidents have intensified our commitment to continuous improvement as we design, build and support the safest airplanes in the sky,” Muilenburg said.


VIDEO: Boeing chief executive Dennis Muilenburg’s speech at the Forum on Leadership from the George W. Bush Presidential Center’s YouTube channel.

The May 2019 edition of Australian Aviation magazine will include a feature story on the Boeing 737 MAX.

6 Comments

  • MARK RICHARDSON

    says:

    The comments from the Boeing CEO sicken me , over 300 people have been killed , in a plane that has inherent design flaws. Boeing did not say the MAX should be grounded , in fact the reverse Boeing kept saying the plane was safe to fly .

  • Steve Marks

    says:

    A great teaching example of the normalization of deviance as written about by Diane Vaughn in a variety of contexts including the Challenger disaster. Insufficient consideration of the unknown unknowns and persistence of biased safety perception in the face of evidence to the contrary. The reality is it is not safe.

  • Bob Grimstead

    says:

    “The company’s 737 Max airplanes also have another software problem — one that is unrelated to the flight control software at issue in the two crashes, Boeing said.
    The company did not immediately respond to questions about what aspect of the plane is controlled by this software and when the problem was discovered. The Washington Post, citing two unnamed officials, said the software affects wing flaps and other flight control hardware and as such is classified as “critical to flight safety.”

  • Adrian P

    says:

    No mention of fixing one of the original problems, the failure of the angle of attack (AOA) sensors.
    (For example is the airflow around the nose of the aircraft in certain flight conditions impacting the sensor?)
    The other problem being the change of aerodynamic balance due to fitting fan-jet engines with a large diameter intake to an airframe designed to take turbojet engines with a smaller diameter intake.

  • Mike Millett

    says:

    I recently viewed a video interview of Eric (Winkle)Brown the famous British test pilot. He was asked what was the most disappointing aircraft he had flown. He named the Westland Whirlwind which looked a bit like a Mosquito but with a T tail. Beautiful aircraft, looked great and should have flown that way he said. But it was underpowered and really needed Rolls Royce Merlin’s however they would have been to heavy and upset the CG and made it impossible to fly without extensive redesign. Sounds a bit like the Max? Mike Millett AirflowNZ

  • Dave Hope

    says:

    What is depressing about this whole story is that the design principles of a safe aircraft anti-stall system have been known as far back as 1924, when the first such system, the Savage-Bramson anti-stall gear, provided a fully-adjustable angle-of-attack system with a fail-safe (fully manually-overridable) stick pusher. The Hawker Siddeley Trident airliner, which I worked on in the early 1970s, had a highly reliable stall detection and stick pusher system. It utilised three independent angle of attack sensors (which were themselves made highly reliable with a 10,000 hr MTBF). The designers and certification authorities recognised that this system must be made highly immune to failure. As such no single system failure could cause either a stick shake or push. Two ‘shaker level’ signals plus a further two ‘imminent stall’ level signals from the probes were required to initiate a stick push.

    That this was all built using analog technology, which is expensive to redesign, perhaps encouraged a discipline of ‘get it right at the outset’. The power of modern software, when used to implement and monitor such control functions, can lead to a false sense of security. It may even encourage a design culture of the tweak-as-we test, before arriving at a final and safe configuration. Overall it saddens me that the new generation of aircraft systems engineers have not learned from past experience in the industry. Even if the above-mentioned technology has been superseded in the 21st century, the basic principles of safe anti-stall system design have not. How Boeing allowed a single AOA sensor, prone to error, to drive a level of elevator authority exceeding that of the pilot beggars belief. It raises big questions about the whole system safety assessment process in that company and in the FAA.

Leave a Comment

Your email address will not be published. Required fields are marked *

Boeing has made 96 flights testing 737 MAX software update: CEO

written by australianaviation.com.au | April 12, 2019
The first Boeing 737 MAX entering final assembly at Renton. (Boeing)
A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)

Boeing chief executive Dennis Muilenburg says the company has conducted 96 flights testing the software update to an anti-stall feature on the 737 MAX that has been linked to two fatal accidents in the past six months.

The software update to the Maneuvering Characteristics Augmentation System (MCAS) has been in development since a Lion Air 737 MAX 8 plunged into the Java Sea shortly after it took off from Jakarta in October 2018. All 188 people on board were killed.

In March 2019, an Ethiopian Airlines 737 MAX 8 with 157 passengers on board crashed minutes after it took off from Addis Ababa. There were no survivors.

Advertisement
Advertisement

Boeing has acknowledged the MCAS anti-stall feature was activated in response to erroneous angle of attack information in both the Ethiopian Airlines and Lion Air tragedies, following the publication of the preliminary report into the Ethiopian Airlines accident.

In late March, Boeing held a technical briefing with 200 aviation professionals, including regulators and airline customers of the 737 MAX, to explain the software update.

And since then, the company has also visited the China, Singapore and the United Kingdom for further meetings with pilots and regulators.

Muilenburg, who was on board a test flight in early April, said the software update has functioned “as designed”.

PROMOTED CONTENT

“Overall, our team has made 96 flights totaling a little over 159 hours of air time with the updated software,” Muilenburg said at the George W. Bush Presidential Center Forum on Leadership in Dallas on Thursday (US time), according to a transcript published on the Boeing website.

“They will conduct additional test and production flights in the coming weeks as we continue to demonstrate that we’ve identified and met all certification requirements.

“We look forward to completing near-term milestones on the path to final certification.”

Boeing chief executive Dennis Muilenburg on a 737 MAX 7 test flight for the MCAS software update. (Boeing)
Boeing chief executive Dennis Muilenburg on a 737 MAX 7 test flight for the MCAS software update. (Boeing)

Boeing has explained previously the software update added extra layers of protection from erroneous data out of the aircraft’s angle of attack (AOA) sensors.

This included having the flight control system compare inputs from both AOA sensors. If there was a significant disagreement – by 5.5 degrees or more with the flaps retracted – the MCAS would not activate and an indicator of the flight deck would alert the pilots, according to Boeing.

Further, Boeing said “MCAS can never command more stabilizer input than can be counteracted by the flight crew pulling back on the column”.

“The pilots will continue to always have the ability to override MCAS and manually control the airplane,” Boeing said on its website.

“These updates reduce the crew’s workload in non-normal flight situations and prevent erroneous data from causing MCAS activation.”

In terms of pilot training, Boeing said it had updated the computer-based training to accompany the software update.

A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)
A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)

The airframe has also paused deliveries and is reducing the production rate of the 737 program to 42 aircraft a month, from 52 aircraft a month previously. The lower production rate was due to occur in mid-April.

Muilenburg, who has been at Boeing more than 30 years, described the past few weeks as “the most heart-wrenching” of his career.

“Our values are at the very core of everything we do. Yet, we know we can always be better, and these recent accidents have intensified our commitment to continuous improvement as we design, build and support the safest airplanes in the sky,” Muilenburg said.


VIDEO: Boeing chief executive Dennis Muilenburg’s speech at the Forum on Leadership from the George W. Bush Presidential Center’s YouTube channel.

The May 2019 edition of Australian Aviation magazine will include a feature story on the Boeing 737 MAX.

6 Comments

  • MARK RICHARDSON

    says:

    The comments from the Boeing CEO sicken me , over 300 people have been killed , in a plane that has inherent design flaws. Boeing did not say the MAX should be grounded , in fact the reverse Boeing kept saying the plane was safe to fly .

  • Steve Marks

    says:

    A great teaching example of the normalization of deviance as written about by Diane Vaughn in a variety of contexts including the Challenger disaster. Insufficient consideration of the unknown unknowns and persistence of biased safety perception in the face of evidence to the contrary. The reality is it is not safe.

  • Bob Grimstead

    says:

    “The company’s 737 Max airplanes also have another software problem — one that is unrelated to the flight control software at issue in the two crashes, Boeing said.
    The company did not immediately respond to questions about what aspect of the plane is controlled by this software and when the problem was discovered. The Washington Post, citing two unnamed officials, said the software affects wing flaps and other flight control hardware and as such is classified as “critical to flight safety.”

  • Adrian P

    says:

    No mention of fixing one of the original problems, the failure of the angle of attack (AOA) sensors.
    (For example is the airflow around the nose of the aircraft in certain flight conditions impacting the sensor?)
    The other problem being the change of aerodynamic balance due to fitting fan-jet engines with a large diameter intake to an airframe designed to take turbojet engines with a smaller diameter intake.

  • Mike Millett

    says:

    I recently viewed a video interview of Eric (Winkle)Brown the famous British test pilot. He was asked what was the most disappointing aircraft he had flown. He named the Westland Whirlwind which looked a bit like a Mosquito but with a T tail. Beautiful aircraft, looked great and should have flown that way he said. But it was underpowered and really needed Rolls Royce Merlin’s however they would have been to heavy and upset the CG and made it impossible to fly without extensive redesign. Sounds a bit like the Max? Mike Millett AirflowNZ

  • Dave Hope

    says:

    What is depressing about this whole story is that the design principles of a safe aircraft anti-stall system have been known as far back as 1924, when the first such system, the Savage-Bramson anti-stall gear, provided a fully-adjustable angle-of-attack system with a fail-safe (fully manually-overridable) stick pusher. The Hawker Siddeley Trident airliner, which I worked on in the early 1970s, had a highly reliable stall detection and stick pusher system. It utilised three independent angle of attack sensors (which were themselves made highly reliable with a 10,000 hr MTBF). The designers and certification authorities recognised that this system must be made highly immune to failure. As such no single system failure could cause either a stick shake or push. Two ‘shaker level’ signals plus a further two ‘imminent stall’ level signals from the probes were required to initiate a stick push.

    That this was all built using analog technology, which is expensive to redesign, perhaps encouraged a discipline of ‘get it right at the outset’. The power of modern software, when used to implement and monitor such control functions, can lead to a false sense of security. It may even encourage a design culture of the tweak-as-we test, before arriving at a final and safe configuration. Overall it saddens me that the new generation of aircraft systems engineers have not learned from past experience in the industry. Even if the above-mentioned technology has been superseded in the 21st century, the basic principles of safe anti-stall system design have not. How Boeing allowed a single AOA sensor, prone to error, to drive a level of elevator authority exceeding that of the pilot beggars belief. It raises big questions about the whole system safety assessment process in that company and in the FAA.

Leave a Comment

Your email address will not be published. Required fields are marked *

Boeing has made 96 flights testing 737 MAX software update: CEO

written by australianaviation.com.au | April 12, 2019
The first Boeing 737 MAX entering final assembly at Renton. (Boeing)
A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)

Boeing chief executive Dennis Muilenburg says the company has conducted 96 flights testing the software update to an anti-stall feature on the 737 MAX that has been linked to two fatal accidents in the past six months.

The software update to the Maneuvering Characteristics Augmentation System (MCAS) has been in development since a Lion Air 737 MAX 8 plunged into the Java Sea shortly after it took off from Jakarta in October 2018. All 188 people on board were killed.

In March 2019, an Ethiopian Airlines 737 MAX 8 with 157 passengers on board crashed minutes after it took off from Addis Ababa. There were no survivors.

Advertisement
Advertisement

Boeing has acknowledged the MCAS anti-stall feature was activated in response to erroneous angle of attack information in both the Ethiopian Airlines and Lion Air tragedies, following the publication of the preliminary report into the Ethiopian Airlines accident.

In late March, Boeing held a technical briefing with 200 aviation professionals, including regulators and airline customers of the 737 MAX, to explain the software update.

And since then, the company has also visited the China, Singapore and the United Kingdom for further meetings with pilots and regulators.

Muilenburg, who was on board a test flight in early April, said the software update has functioned “as designed”.

PROMOTED CONTENT

“Overall, our team has made 96 flights totaling a little over 159 hours of air time with the updated software,” Muilenburg said at the George W. Bush Presidential Center Forum on Leadership in Dallas on Thursday (US time), according to a transcript published on the Boeing website.

“They will conduct additional test and production flights in the coming weeks as we continue to demonstrate that we’ve identified and met all certification requirements.

“We look forward to completing near-term milestones on the path to final certification.”

Boeing chief executive Dennis Muilenburg on a 737 MAX 7 test flight for the MCAS software update. (Boeing)
Boeing chief executive Dennis Muilenburg on a 737 MAX 7 test flight for the MCAS software update. (Boeing)

Boeing has explained previously the software update added extra layers of protection from erroneous data out of the aircraft’s angle of attack (AOA) sensors.

This included having the flight control system compare inputs from both AOA sensors. If there was a significant disagreement – by 5.5 degrees or more with the flaps retracted – the MCAS would not activate and an indicator of the flight deck would alert the pilots, according to Boeing.

Further, Boeing said “MCAS can never command more stabilizer input than can be counteracted by the flight crew pulling back on the column”.

“The pilots will continue to always have the ability to override MCAS and manually control the airplane,” Boeing said on its website.

“These updates reduce the crew’s workload in non-normal flight situations and prevent erroneous data from causing MCAS activation.”

In terms of pilot training, Boeing said it had updated the computer-based training to accompany the software update.

A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)
A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)

The airframe has also paused deliveries and is reducing the production rate of the 737 program to 42 aircraft a month, from 52 aircraft a month previously. The lower production rate was due to occur in mid-April.

Muilenburg, who has been at Boeing more than 30 years, described the past few weeks as “the most heart-wrenching” of his career.

“Our values are at the very core of everything we do. Yet, we know we can always be better, and these recent accidents have intensified our commitment to continuous improvement as we design, build and support the safest airplanes in the sky,” Muilenburg said.


VIDEO: Boeing chief executive Dennis Muilenburg’s speech at the Forum on Leadership from the George W. Bush Presidential Center’s YouTube channel.

The May 2019 edition of Australian Aviation magazine will include a feature story on the Boeing 737 MAX.

6 Comments

  • MARK RICHARDSON

    says:

    The comments from the Boeing CEO sicken me , over 300 people have been killed , in a plane that has inherent design flaws. Boeing did not say the MAX should be grounded , in fact the reverse Boeing kept saying the plane was safe to fly .

  • Steve Marks

    says:

    A great teaching example of the normalization of deviance as written about by Diane Vaughn in a variety of contexts including the Challenger disaster. Insufficient consideration of the unknown unknowns and persistence of biased safety perception in the face of evidence to the contrary. The reality is it is not safe.

  • Bob Grimstead

    says:

    “The company’s 737 Max airplanes also have another software problem — one that is unrelated to the flight control software at issue in the two crashes, Boeing said.
    The company did not immediately respond to questions about what aspect of the plane is controlled by this software and when the problem was discovered. The Washington Post, citing two unnamed officials, said the software affects wing flaps and other flight control hardware and as such is classified as “critical to flight safety.”

  • Adrian P

    says:

    No mention of fixing one of the original problems, the failure of the angle of attack (AOA) sensors.
    (For example is the airflow around the nose of the aircraft in certain flight conditions impacting the sensor?)
    The other problem being the change of aerodynamic balance due to fitting fan-jet engines with a large diameter intake to an airframe designed to take turbojet engines with a smaller diameter intake.

  • Mike Millett

    says:

    I recently viewed a video interview of Eric (Winkle)Brown the famous British test pilot. He was asked what was the most disappointing aircraft he had flown. He named the Westland Whirlwind which looked a bit like a Mosquito but with a T tail. Beautiful aircraft, looked great and should have flown that way he said. But it was underpowered and really needed Rolls Royce Merlin’s however they would have been to heavy and upset the CG and made it impossible to fly without extensive redesign. Sounds a bit like the Max? Mike Millett AirflowNZ

  • Dave Hope

    says:

    What is depressing about this whole story is that the design principles of a safe aircraft anti-stall system have been known as far back as 1924, when the first such system, the Savage-Bramson anti-stall gear, provided a fully-adjustable angle-of-attack system with a fail-safe (fully manually-overridable) stick pusher. The Hawker Siddeley Trident airliner, which I worked on in the early 1970s, had a highly reliable stall detection and stick pusher system. It utilised three independent angle of attack sensors (which were themselves made highly reliable with a 10,000 hr MTBF). The designers and certification authorities recognised that this system must be made highly immune to failure. As such no single system failure could cause either a stick shake or push. Two ‘shaker level’ signals plus a further two ‘imminent stall’ level signals from the probes were required to initiate a stick push.

    That this was all built using analog technology, which is expensive to redesign, perhaps encouraged a discipline of ‘get it right at the outset’. The power of modern software, when used to implement and monitor such control functions, can lead to a false sense of security. It may even encourage a design culture of the tweak-as-we test, before arriving at a final and safe configuration. Overall it saddens me that the new generation of aircraft systems engineers have not learned from past experience in the industry. Even if the above-mentioned technology has been superseded in the 21st century, the basic principles of safe anti-stall system design have not. How Boeing allowed a single AOA sensor, prone to error, to drive a level of elevator authority exceeding that of the pilot beggars belief. It raises big questions about the whole system safety assessment process in that company and in the FAA.

Leave a Comment

Your email address will not be published. Required fields are marked *

Boeing has made 96 flights testing 737 MAX software update: CEO

written by australianaviation.com.au | April 12, 2019
The first Boeing 737 MAX entering final assembly at Renton. (Boeing)
A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)

Boeing chief executive Dennis Muilenburg says the company has conducted 96 flights testing the software update to an anti-stall feature on the 737 MAX that has been linked to two fatal accidents in the past six months.

The software update to the Maneuvering Characteristics Augmentation System (MCAS) has been in development since a Lion Air 737 MAX 8 plunged into the Java Sea shortly after it took off from Jakarta in October 2018. All 188 people on board were killed.

In March 2019, an Ethiopian Airlines 737 MAX 8 with 157 passengers on board crashed minutes after it took off from Addis Ababa. There were no survivors.

Advertisement
Advertisement

Boeing has acknowledged the MCAS anti-stall feature was activated in response to erroneous angle of attack information in both the Ethiopian Airlines and Lion Air tragedies, following the publication of the preliminary report into the Ethiopian Airlines accident.

In late March, Boeing held a technical briefing with 200 aviation professionals, including regulators and airline customers of the 737 MAX, to explain the software update.

And since then, the company has also visited the China, Singapore and the United Kingdom for further meetings with pilots and regulators.

Muilenburg, who was on board a test flight in early April, said the software update has functioned “as designed”.

PROMOTED CONTENT

“Overall, our team has made 96 flights totaling a little over 159 hours of air time with the updated software,” Muilenburg said at the George W. Bush Presidential Center Forum on Leadership in Dallas on Thursday (US time), according to a transcript published on the Boeing website.

“They will conduct additional test and production flights in the coming weeks as we continue to demonstrate that we’ve identified and met all certification requirements.

“We look forward to completing near-term milestones on the path to final certification.”

Boeing chief executive Dennis Muilenburg on a 737 MAX 7 test flight for the MCAS software update. (Boeing)
Boeing chief executive Dennis Muilenburg on a 737 MAX 7 test flight for the MCAS software update. (Boeing)

Boeing has explained previously the software update added extra layers of protection from erroneous data out of the aircraft’s angle of attack (AOA) sensors.

This included having the flight control system compare inputs from both AOA sensors. If there was a significant disagreement – by 5.5 degrees or more with the flaps retracted – the MCAS would not activate and an indicator of the flight deck would alert the pilots, according to Boeing.

Further, Boeing said “MCAS can never command more stabilizer input than can be counteracted by the flight crew pulling back on the column”.

“The pilots will continue to always have the ability to override MCAS and manually control the airplane,” Boeing said on its website.

“These updates reduce the crew’s workload in non-normal flight situations and prevent erroneous data from causing MCAS activation.”

In terms of pilot training, Boeing said it had updated the computer-based training to accompany the software update.

A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)
A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)

The airframe has also paused deliveries and is reducing the production rate of the 737 program to 42 aircraft a month, from 52 aircraft a month previously. The lower production rate was due to occur in mid-April.

Muilenburg, who has been at Boeing more than 30 years, described the past few weeks as “the most heart-wrenching” of his career.

“Our values are at the very core of everything we do. Yet, we know we can always be better, and these recent accidents have intensified our commitment to continuous improvement as we design, build and support the safest airplanes in the sky,” Muilenburg said.


VIDEO: Boeing chief executive Dennis Muilenburg’s speech at the Forum on Leadership from the George W. Bush Presidential Center’s YouTube channel.

The May 2019 edition of Australian Aviation magazine will include a feature story on the Boeing 737 MAX.

6 Comments

  • MARK RICHARDSON

    says:

    The comments from the Boeing CEO sicken me , over 300 people have been killed , in a plane that has inherent design flaws. Boeing did not say the MAX should be grounded , in fact the reverse Boeing kept saying the plane was safe to fly .

  • Steve Marks

    says:

    A great teaching example of the normalization of deviance as written about by Diane Vaughn in a variety of contexts including the Challenger disaster. Insufficient consideration of the unknown unknowns and persistence of biased safety perception in the face of evidence to the contrary. The reality is it is not safe.

  • Bob Grimstead

    says:

    “The company’s 737 Max airplanes also have another software problem — one that is unrelated to the flight control software at issue in the two crashes, Boeing said.
    The company did not immediately respond to questions about what aspect of the plane is controlled by this software and when the problem was discovered. The Washington Post, citing two unnamed officials, said the software affects wing flaps and other flight control hardware and as such is classified as “critical to flight safety.”

  • Adrian P

    says:

    No mention of fixing one of the original problems, the failure of the angle of attack (AOA) sensors.
    (For example is the airflow around the nose of the aircraft in certain flight conditions impacting the sensor?)
    The other problem being the change of aerodynamic balance due to fitting fan-jet engines with a large diameter intake to an airframe designed to take turbojet engines with a smaller diameter intake.

  • Mike Millett

    says:

    I recently viewed a video interview of Eric (Winkle)Brown the famous British test pilot. He was asked what was the most disappointing aircraft he had flown. He named the Westland Whirlwind which looked a bit like a Mosquito but with a T tail. Beautiful aircraft, looked great and should have flown that way he said. But it was underpowered and really needed Rolls Royce Merlin’s however they would have been to heavy and upset the CG and made it impossible to fly without extensive redesign. Sounds a bit like the Max? Mike Millett AirflowNZ

  • Dave Hope

    says:

    What is depressing about this whole story is that the design principles of a safe aircraft anti-stall system have been known as far back as 1924, when the first such system, the Savage-Bramson anti-stall gear, provided a fully-adjustable angle-of-attack system with a fail-safe (fully manually-overridable) stick pusher. The Hawker Siddeley Trident airliner, which I worked on in the early 1970s, had a highly reliable stall detection and stick pusher system. It utilised three independent angle of attack sensors (which were themselves made highly reliable with a 10,000 hr MTBF). The designers and certification authorities recognised that this system must be made highly immune to failure. As such no single system failure could cause either a stick shake or push. Two ‘shaker level’ signals plus a further two ‘imminent stall’ level signals from the probes were required to initiate a stick push.

    That this was all built using analog technology, which is expensive to redesign, perhaps encouraged a discipline of ‘get it right at the outset’. The power of modern software, when used to implement and monitor such control functions, can lead to a false sense of security. It may even encourage a design culture of the tweak-as-we test, before arriving at a final and safe configuration. Overall it saddens me that the new generation of aircraft systems engineers have not learned from past experience in the industry. Even if the above-mentioned technology has been superseded in the 21st century, the basic principles of safe anti-stall system design have not. How Boeing allowed a single AOA sensor, prone to error, to drive a level of elevator authority exceeding that of the pilot beggars belief. It raises big questions about the whole system safety assessment process in that company and in the FAA.

Leave a Comment

Your email address will not be published. Required fields are marked *

Boeing has made 96 flights testing 737 MAX software update: CEO

written by australianaviation.com.au | April 12, 2019
The first Boeing 737 MAX entering final assembly at Renton. (Boeing)
A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)

Boeing chief executive Dennis Muilenburg says the company has conducted 96 flights testing the software update to an anti-stall feature on the 737 MAX that has been linked to two fatal accidents in the past six months.

The software update to the Maneuvering Characteristics Augmentation System (MCAS) has been in development since a Lion Air 737 MAX 8 plunged into the Java Sea shortly after it took off from Jakarta in October 2018. All 188 people on board were killed.

In March 2019, an Ethiopian Airlines 737 MAX 8 with 157 passengers on board crashed minutes after it took off from Addis Ababa. There were no survivors.

Advertisement
Advertisement

Boeing has acknowledged the MCAS anti-stall feature was activated in response to erroneous angle of attack information in both the Ethiopian Airlines and Lion Air tragedies, following the publication of the preliminary report into the Ethiopian Airlines accident.

In late March, Boeing held a technical briefing with 200 aviation professionals, including regulators and airline customers of the 737 MAX, to explain the software update.

And since then, the company has also visited the China, Singapore and the United Kingdom for further meetings with pilots and regulators.

Muilenburg, who was on board a test flight in early April, said the software update has functioned “as designed”.

PROMOTED CONTENT

“Overall, our team has made 96 flights totaling a little over 159 hours of air time with the updated software,” Muilenburg said at the George W. Bush Presidential Center Forum on Leadership in Dallas on Thursday (US time), according to a transcript published on the Boeing website.

“They will conduct additional test and production flights in the coming weeks as we continue to demonstrate that we’ve identified and met all certification requirements.

“We look forward to completing near-term milestones on the path to final certification.”

Boeing chief executive Dennis Muilenburg on a 737 MAX 7 test flight for the MCAS software update. (Boeing)
Boeing chief executive Dennis Muilenburg on a 737 MAX 7 test flight for the MCAS software update. (Boeing)

Boeing has explained previously the software update added extra layers of protection from erroneous data out of the aircraft’s angle of attack (AOA) sensors.

This included having the flight control system compare inputs from both AOA sensors. If there was a significant disagreement – by 5.5 degrees or more with the flaps retracted – the MCAS would not activate and an indicator of the flight deck would alert the pilots, according to Boeing.

Further, Boeing said “MCAS can never command more stabilizer input than can be counteracted by the flight crew pulling back on the column”.

“The pilots will continue to always have the ability to override MCAS and manually control the airplane,” Boeing said on its website.

“These updates reduce the crew’s workload in non-normal flight situations and prevent erroneous data from causing MCAS activation.”

In terms of pilot training, Boeing said it had updated the computer-based training to accompany the software update.

A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)
A 2015 file image of a Boeing 737 MAX on the final assembly line. (Boeing)

The airframe has also paused deliveries and is reducing the production rate of the 737 program to 42 aircraft a month, from 52 aircraft a month previously. The lower production rate was due to occur in mid-April.

Muilenburg, who has been at Boeing more than 30 years, described the past few weeks as “the most heart-wrenching” of his career.

“Our values are at the very core of everything we do. Yet, we know we can always be better, and these recent accidents have intensified our commitment to continuous improvement as we design, build and support the safest airplanes in the sky,” Muilenburg said.


VIDEO: Boeing chief executive Dennis Muilenburg’s speech at the Forum on Leadership from the George W. Bush Presidential Center’s YouTube channel.

The May 2019 edition of Australian Aviation magazine will include a feature story on the Boeing 737 MAX.

6 Comments

  • MARK RICHARDSON

    says:

    The comments from the Boeing CEO sicken me , over 300 people have been killed , in a plane that has inherent design flaws. Boeing did not say the MAX should be grounded , in fact the reverse Boeing kept saying the plane was safe to fly .

  • Steve Marks

    says:

    A great teaching example of the normalization of deviance as written about by Diane Vaughn in a variety of contexts including the Challenger disaster. Insufficient consideration of the unknown unknowns and persistence of biased safety perception in the face of evidence to the contrary. The reality is it is not safe.

  • Bob Grimstead

    says:

    “The company’s 737 Max airplanes also have another software problem — one that is unrelated to the flight control software at issue in the two crashes, Boeing said.
    The company did not immediately respond to questions about what aspect of the plane is controlled by this software and when the problem was discovered. The Washington Post, citing two unnamed officials, said the software affects wing flaps and other flight control hardware and as such is classified as “critical to flight safety.”

  • Adrian P

    says:

    No mention of fixing one of the original problems, the failure of the angle of attack (AOA) sensors.
    (For example is the airflow around the nose of the aircraft in certain flight conditions impacting the sensor?)
    The other problem being the change of aerodynamic balance due to fitting fan-jet engines with a large diameter intake to an airframe designed to take turbojet engines with a smaller diameter intake.

  • Mike Millett

    says:

    I recently viewed a video interview of Eric (Winkle)Brown the famous British test pilot. He was asked what was the most disappointing aircraft he had flown. He named the Westland Whirlwind which looked a bit like a Mosquito but with a T tail. Beautiful aircraft, looked great and should have flown that way he said. But it was underpowered and really needed Rolls Royce Merlin’s however they would have been to heavy and upset the CG and made it impossible to fly without extensive redesign. Sounds a bit like the Max? Mike Millett AirflowNZ

  • Dave Hope

    says:

    What is depressing about this whole story is that the design principles of a safe aircraft anti-stall system have been known as far back as 1924, when the first such system, the Savage-Bramson anti-stall gear, provided a fully-adjustable angle-of-attack system with a fail-safe (fully manually-overridable) stick pusher. The Hawker Siddeley Trident airliner, which I worked on in the early 1970s, had a highly reliable stall detection and stick pusher system. It utilised three independent angle of attack sensors (which were themselves made highly reliable with a 10,000 hr MTBF). The designers and certification authorities recognised that this system must be made highly immune to failure. As such no single system failure could cause either a stick shake or push. Two ‘shaker level’ signals plus a further two ‘imminent stall’ level signals from the probes were required to initiate a stick push.

    That this was all built using analog technology, which is expensive to redesign, perhaps encouraged a discipline of ‘get it right at the outset’. The power of modern software, when used to implement and monitor such control functions, can lead to a false sense of security. It may even encourage a design culture of the tweak-as-we test, before arriving at a final and safe configuration. Overall it saddens me that the new generation of aircraft systems engineers have not learned from past experience in the industry. Even if the above-mentioned technology has been superseded in the 21st century, the basic principles of safe anti-stall system design have not. How Boeing allowed a single AOA sensor, prone to error, to drive a level of elevator authority exceeding that of the pilot beggars belief. It raises big questions about the whole system safety assessment process in that company and in the FAA.

Leave a Comment

Your email address will not be published. Required fields are marked *

Each day, our subscribers are more informed with the right information.

SIGN UP to the Australian Aviation magazine for high-quality news and features for just $99.95 per year