On Aug 3rd 2020 the FAA released Notice of Proposal for Rule Making (NPRM) 2019-NM-035-AD introducing four new requirements for the Boeing 737 MAX aircraft (compare also our letter to the FSB/FAA of Apr 25th 2019 mentioned in the ET-302 coverage, see Crash: Ethiopian B38M near Bishoftu on Mar 10th 2019, impacted terrain after departure).
The FAA states:
The data from the flight data recorders, as summarized in reports of the Ethiopian Airlines Flight 302 accident and the Lion Air Flight 610 accident, indicated that if a single erroneously high AOA sensor input is received by the flight control system, the maneuvering characteristics augmentation system (MCAS) can command repeated airplane nose-down trim of the horizontal stabilizer. This unsafe condition, if not addressed, could cause the flightcrew to have difficulty controlling the airplane, and lead to excessive airplane nose-down attitude, significant altitude loss, and impact with terrain.
To address the unsafe condition, the FAA proposes to require four design changes:
(1) installing updated flight control software (with new control laws) for the FCC operational program software (OPS),
(2) installing updated MDS display processing computer (DPC) software to generate an AOA disagree alert,
(3) revising certain AFM flightcrew operating procedures,
and (4) changing the routing of horizontal stabilizer trim wires.
The first design change is intended to prevent erroneous MCAS activation. The second design change alerts the pilots that the airplanes two AOA sensors are disagreeing by a certain amount indicating a potential AOA sensor failure. The third design change is intended to ensure that the flightcrew has the means to recognize an respond to erroneous stabilizer movement and the effects of a potential AOA sensor failure. The fourth design change is intended to restore compliance with the FAAs latest wire separation safety standards.
In addition to these four design changes, the FAA also proposes to require operators to conduct an AOA sensor system test and perform an operational readiness flight prior to returning each airplane to service. Finally, operators with an existing FAAapproved MEL would be required to incorporate more restrictive provisions to dispatch the airplane with certain inoperative equipment. The new master minimum equipment list (MMEL), approved by the FAA, was published on April 10, 2020, after undergoing a public notice and comment process.
The FAA further details the proposed modifications:
To ensure that an erroneous signal from a failed single AOA sensor does not prevent continued safe flight and landing, and specifically that it does not generate erroneous MCAS activation, the FAA proposes to require installation of updated FCC software with revised flight control laws associated with MCAS. These revised flight control laws would use inputs from both AOA sensors to activate MCAS. This is in contrast to the original MCAS design, which relied on data from only one sensor at a time, and allowed repeated MCAS activation as a result of input from a single AOA sensor.
The updated FCC software would also compare the inputs from the two sensors to detect a failed AOA sensor. If the difference between the AOA sensor inputs is above a calculated threshold, the FCC would disable the speed trim system (STS), including its MCAS function, for the remainder of that flight, and provide a corresponding indication of such deactivation on the flight deck.
To ensure that MCAS will not command repeated movements of the horizontal stabilizer, the revised flight control laws would permit only one activation of MCAS per sensed high AOA event. A subsequent activation of MCAS would be possible only after the airplane returns to a low AOA state, below the threshold that would cause MCAS activation.
The updated FCC software would also limit the magnitude of any MCAS command to move the horizontal stabilizer, such that the final horizontal stabilizer position (after the MCAS command) would preserve the flightcrews ability to control the airplane pitch by using only the control column. The original design allowed MCAS commands to be made without consideration of the horizontal stabilizer position before or after the MCAS command.
An undesired MCAS activation could prompt the flightcrew to perform a nonnormal procedure. To ensure that after any foreseeable failure of the stabilizer system, safe flight is not dependent on the timeliness of the flightcrew performing a non-normal procedure, the FAA proposes multiple changes.
First, as previously discussed, the flight control laws would be changed to instead use inputs from two AOA sensors for MCAS activation, so that there would not be an undesired MCAS activation due to a single AOA sensor failure that could lead a flightcrew to perform a non-normal procedure.
Second, in the event that MCAS is activated as intended (i.e., during a high AOA event), the updated flight control laws software would limit the number of MCAS activations to one per high AOA event, and limit the magnitude of any single activation so that the flightcrew could maintain pitch control without needing to perform a nonnormal procedure.
The FAA also proposes requiring an additional software update that would alert the flightcrew to a disagreement between the two AOA sensors. This disagreement indicates certain AOA sensor failures or a significant calibration issue. The updated MDS software would implement an AOA DISAGREE alert on all 737 MAX airplanes. Some 737 MAX airplanes were delivered without this alert feature, by error. While the lack of an AOA DISAGREE alert is not an unsafe condition itself, the FAA is proposing to mandate this software update to restore compliance with 14 CFR 25.1301 and because the flightcrew procedures mandated by this AD now rely on this alert to guide flightcrew action. As a result of the changes proposed in this AD, differences between the two AOA sensors greater than a certain threshold13 would cause an AOA DISAGREE alert on the primary flight displays (PFDs). Also, as a result of the installation of this revised MDS software, operators would be required to remove INOP markers, if present, from the electronic flight instrument system (EFIS) panel of the airplane, because the markers would no longer be necessary, due to other changes in the updated MDS software that are unrelated to this unsafe condition. These markers, labeled INOP, indicate that one of the positions on the dial that selects display settings is inoperative.
To facilitate the flightcrews ability to recognize and respond to undesired horizontal stabilizer movement and the effects of a potential AOA sensor failure, the FAA proposes to mandate revising and adding certain operating procedures (checklists) of the AFM14 used by the flightcrew for the 737 MAX. All transport category airplanes have non-normal checklists to aid the pilots in responding to airplane failures.
In addition the FAA proposes changes to a number of checklists as well as addition of a number of checklists in order to reduce the workload of the crew in case of system malfunctions.
Finally the FAA states: "Since this NPRM proposes to supersede AD 2018-23-51, the procedural information required by that AD would be outdated when the final rule is effective and therefore would be removed." and later also writes:
On March 13, 2019, the FAA issued an Emergency Order of Prohibition, which prohibits the operation of Boeing Model 737-8 and 737-9 airplanes by U.S.-certificated operators or in U.S. territory.
The FAA plans to amend the Emergency Order of Prohibition in conjunction with adopting the final rule. The amended Emergency Order of Prohibition will address the actions that the Administrator deems appropriate to return the affected airplanes to service.