As US government test pilots ran through dozens of flight scenarios on the Boeing Co 737 Max in recent weeks, a potential failure got their attention.
The plane’s flight computer tried to push the aircraft’s nose down repeatedly during a simulator run, prompted by a stream of erroneous flight data. The Federal Aviation Administration pilot concluded commercial pilots might not have time to react and avoid a tragedy in a real plane.
That flaw — the latest discovered on the family of jets involved in two fatal crashes since October triggered by a different failure that pushed their noses down — was revealed by FAA last month. It threw new uncertainty on the return to flight of the Chicago-based company’s best-selling model and sent its engineers scrambling for a fix.
Interviews with people familiar with the failure suggest it triggered multiple, aggressive movements to lower the plane’s nose, which alarmed the FAA pilots and other officials. However, the nose-down motion didn’t occur as a result of a computer hardware fault, according to one of the people, who asked not to be named because he wasn’t authorised to speak about the matter.
That would add credibility to Boeing’s assertions that it can fix the issue with a relatively simple software change.
“We are confident that is a software update, not a hardware update,” Boeing Chief Executive Officer Dennis Muilenburg said during an earnings call on Wednesday. “It’s an understood update and we’re in the middle of working our way through that.”
Muilenburg said the company expects it can complete a software patch by the end of September, while cautioning that the timeline remains uncertain. The FAA, which must sign off on any fix in the glaring spotlight of the 737 Max investigations, hasn’t set a deadline or agreed with Boeing’s assessment that software changes alone will suffice.
The agency has declined to comment on the situation beyond a statement it issued June 26 saying the flaw was discovered during the routine process to test the aircraft. “The FAA recently found a potential risk that Boeing must mitigate,” the agency said in its statement without describing the details.
Two people briefed on the flight test shared more details of the failure than were released when it was revealed.
In the fault, a wing at the tail of the Boeing jet known as the horizontal stabiliser was rotating in a way that lowered the nose, according to both people. That same scenario occurred during fatal accidents off the coast of Indonesia and in Ethiopia when a safety feature known as Maneuvering Characteristics Augmentation System activated during a malfunction.
However, the newly discovered problem wasn’t triggered by MCAS, said one of the people.
It was prompted instead by multiple erroneous data streams in a flight computer that occurred simultaneously, the person said. It was simulated in tests even though it has never been documented to have occurred during flight, the people said. Anticipating every possible outcome of even the most unlikely failures is part of how safety assessments are conducted during certification.
The failure scenario was known previously and had been assessed in a safety analysis when the plane was certified before entering service in 2017. At that time, Boeing concluded that pilots could overcome the nose-down movement by performing a procedure to shut off the motor driving the stabiliser movement.
Projecting that pilots would mitigate a hazard from a malfunction is common on jetliners, but that was part of the reason that FAA approved MCAS initially, a now-controversial decision that is being reviewed by Congress and other outside panels. Even though it was possible for pilots in both fatal crashes to have counteracted MCAS, the crews were unable to do so.
When the newly discovered computer failure began trimming the nose down in the recent test, it was more difficult than expected for test pilots to counteract, according to the other person briefed on the tests, who also asked not to be identified.
The second person wasn’t able to confirm that faulty data streams triggered the nose-down movements.
One of the ways pilots are taught to respond to a so-called “trim runaway,” which is what the computer issue prompted, is to activate switches on the control column that move the horizontal stabiliser. Doing so can counteract the malfunction, even if only temporarily, so that pilots have more time to perform other emergency actions.
Using the trim switches to halt the horizontal stabiliser movement proved difficult, though test pilots were able to respond to the failure and maintain control. As a result, they concluded that a typical pilot might not be able to respond adequately, the people said.
Because the fault was triggered by specific streams of erroneous flight data, a new software patch can be devised that monitors the computer for that highly unusual condition and prevents movement of the stabiliser when it occurs, one of the people said.
The 737 Max family of aircraft has been grounded by the US since March 13 and has cost Boeing and airlines billions of dollars. Boeing announced July 18 that it was reducing revenue and pre-tax earnings by $5.6 billion in the second quarter of this year.
American Airlines Group Inc predicted Thursday that it would take a $400 million hit on profit this year due to the plane’s woes and Southwest Airlines Co said it wouldn’t add the 737 Max back to its schedule until early next year.
