TO: ALL PILOTS
FROM: XXXXXXX—SENIOR DIRECTOR COMPLIANCE, OPERATIONS, & PROCEDURES DATE: APRIL 23, 2019 AS OF 1530 CDT REVISION: 2
RE: BOEING MAX 8 FLEET SOFTWARE ENHANCEMENT
This Flight Ops Update will be updated as more information is available. Please take note of the revision number and date/time of publish.
Last week, Boeing representatives briefed an audience including Southwest Senior Leadership, Flight Ops, Tech Ops, Inflight, NOC, and our unions on what is known about the two Boeing 737 MAX accidents and the changes Boeing is implementing to facilitate the MAX return to service.
While Boeing disclaimed any intent to preempt the ongoing investigations in either accident, it appears to be that AOA inputs are at the center of the MCAS activation in both events. Without speculating about either accident, based on the available public information, the focus is on:
How the problem presented itself in each instance (stick shaker/Airspeed Unreliable); and
What non-normal checklist(s) (if any) were accomplished to mitigate the situation as presented.
Regardless, substantial Boeing software changes are underway, and the MAX will not fly in revenue service again until the software is re-configured and the FAA lifts its emergency order.
The new FCC 12.1.1 software is intended to make the MAX Speed Trim System more robust. Three layers of safety are added to the Speed Trim System:
1. MultiplesourcesofAOAinputrequiredtoactivateSpeedTrim(nottoexceeda5.5degree difference in AOA)
2. Function limited to one activation per high AOA event
3. MCAS authority is limited to ensure that the stabilizer does not overcome elevator authority
Simply said, Boeing is reacting to the Lion Air and Ethiopian tragedies by adding multiple, additional layers of protection, completing work that began immediately following the Lion Air crash.
With the new software loaded, if an AOA sensor either fails on the ground or is subject to damage immediately after takeoff, a stick shaker will activate, and the Crew will recognize the issue, confirm the indications, then recover. In this case, the Airspeed Unreliable Non-Normal Checklist would be applied. If the Crew continues to clean up the aircraft (one might argue against retracting flaps through a stick shaker, errant or not), item #1 would result in the illumination of the the SPEED TRIM FAIL light and the disabling of the Speed Trim System (to include MCAS). In the highly unlikely case that item #1 fails, item #2 would limit the MCAS to one activation per event, dampening the overall amount of nose down trim input by the system (unless the AOA indication returns to below the threshold level for activation, to include a new conservative mid-value function). And finally, if items #1 and #2 fail, item #3 would provide that anytime MCAS activates, the stabilizer trim will be limited such that enough elevator authority
remains to climb with a 1.2 g authority with manual control inputs.
Accordingly, please note that, with the new FCC 12.1.1 software, an AOA failure would present itself as a basic Airspeed Unreliable event (we trained these last year and have included four events in this year’s CQT). Because the new software provides an engineered mitigation for the error state that occurred in the Lion Air and Ethiopian accidents on multiple levels, the FAA Flight Standardization Board concluded that no device level training will be necessary before MAX return to service.
Boeing continues to coordinate with appropriate regulatory agencies and will provide the CBT (Distance Learning), FCOM updates, MMEL, Service Bulletin, and Training Topics for all operators when possible. An overarching RBF will outline the path forward to resumption of MAX operations once the new materials become available.
Thank you for your continued professionalism. Please refer policy questions to XXXXXXXXX and technical questions to XXXXXXXX.
Q: What are the three layers of protection added to the Speed Trim System via FCC Software 12.1.1?
A: The three layers of protection added to the Speed Trim System:
Multiple sources of AOA input required to activate Speed Trim (not to exceed a 5.5 degree
difference in AOA)
Function limited to one activation per high AOA event
MCAS authority is limited to ensure that the stabilizer does not overcome elevator authority
Q: What other changes to Flight Control Laws did Boeing make on the MAX and were they reviewed in this latest flight control review?
A: Yes, the following were also reviewed and no changes are considered warranted:
Landing Attitude Modifier
Maneuver Load Alleviation
Emergency Descent Spoilers
Elevator Jam Assist
Q. Why was MCAS included on the MAX in the first place?
A. A FAR Part 25 requirement exists for a steady increase in stick force with an increase in angle of attack (or G load). In one region of the flight test envelope, where a Pilot would have disregarded multiple policy and procedural steps, at an airspeed below BUFFET ALERT, AIRSPEED LOW, and stick shaker, there exists a regime where stick forces do not continue on a linear path as AOA increases. The deviation is detectable by test equipment, but not by most Pilots (it is in single digits of pounds of force). Thus, in an effort to be compliant with the certification standards, Boeing utilized Speed Trim (as it had in the past) to influence control column feel in a certain part of the flight regime. Boeing also emphatically reiterated that MCAS is NOT a “stall prevention system,” as referenced by almost every news outlet to date. MCAS is an element of the Speed Trim System designed to improve aircraft handling characteristics.
Q. Why did Boeing not discuss MCAS in the manuals?
A. According to Boeing, MCAS is a function of Speed Trim, and the only change was that it had to operate while the stick was pulled back past the aft column stab trim cutout switch thereby enabling the additional function (as designed) that would operate like Speed Trim. The Boeing team also relayed the same system architecture had been used on the NG, so its use on the MAX seemed appropriate. The AOA sensors used on the 737 are the same as those on the 757, 767, and 777 and are extremely reliable (75,000 hours mean time between failure). Therefore, the likelihood of a problem seemed very remote—and even if one manifested itself, a Pilot manually flying can always trim out any forces put in by the system.
Q. Who determined that it is okay to operate the aircraft without MCAS, if it was required as part of original type certification?
A. Though there has been no change to the requirements for type certification (thus the need for MCAS), flight tests with an -800, a MAX 8 with MCAS, and a MAX 8 without MCAS indicated no appreciable differences between the three test conditions; therefore, no device training is required. Boeing relayed that twelve conditions were performed in all three cases with the same Test Pilots from multiple regulatory agencies. If for some reason a MAX ends up with an inoperative Speed Trim System once in flight, the Crew can easily continue to operate the aircraft safely.
MAX 8 Re-entry into Service
Our joint XXXXXXXXX Team stands ready for direction from the FAA regarding the path forward. This path starts with a FAA-issued Airworthiness Directive (AD) for the MAX fleet that is anticipated to publish soon.
Once the AD publishes, the following actions must occur prior to MAX re-entry into service:
Release a FCC software update via Service Bulletin (SB) to all carriers.
Provide a Computer Based Training (CBT) module to all carriers.
Revise the Boeing Flight Crew Operations Manual (FCOM) guidance to reflect the new FCC
Update the MAX fleet with the new FCC software and ensure compliance with the Boeing-issued
SB. As we understand it, this software is focused on three areas: o Improving MCAS activation logic.
o Enhancing angle-of-attack (AOA) inputs to MCAS.
o Limiting MCAS stabilizer-command authority.
Obtain FAA approval for CBT and any necessary changes to Company manuals.
Publish required CBT Training for Pilot viewing.
Track CBT completion.
Update Company manuals to align with FCOM updates.
Publish a Training Topic aid via myMobile365.
Take such further action as is necessary to fully accomplish the FAA-issued AD.
The timeline to return the MAX 8 into service is dependent on the completion of the above mentioned tasks from all respective entities and the FAA lifting the Emergency Order issued on March 13. We will continue to update you as we move forward.
This evening, Boeing released this statement regarding a software enhancement for the MAX 8 fleet. While there has been no official implication of MCAS in the recent tragedy to date, the heightened awareness makes this fix even more relevant. We are in the process of evaluating exactly what this software update means for our operation, but Southwest fully supports measures that further strengthen the Safety and reliability of our aircraft.
We will update you as we learn more.