By Eric M. Johnson and David Shepardson
SEATTLE/WASHINGTON (Reuters) – Boeing Co said on Wednesday it had reprogrammed software on its 737 MAX passenger jet to prevent erroneous data from triggering an anti-stall system that is under mounting scrutiny following two deadly nose-down crashes in the past five months.
The planemaker said the anti-stall system, which is believed to have repeatedly forced the nose lower in at least one of the accidents, in Indonesia last October, would only do so one time after sensing a problem, giving pilots more control.
It will also be disabled if two airflow sensors that measure the “angle of attack,” or angle of the wing to the airflow, a fundamental parameter of flight, offer widely different readings, Boeing said. Reuters reported those details earlier this week.
“We are going to do everything that we can do to ensure that accidents like these never happen again,” Mike Sinnett, Vice President for Product Strategy and Future Airplane Development told reporters near Seattle on Wednesday.
The anti-stall system – known as MCAS, or Manoeuvring Characteristics Augmentation System – has been pinpointed by investigators as a possible cause in a fatal Lion Air crash in Indonesia and another fatal crash in Ethiopia on March 10.
Existing 737 pilots will also have extra computer-based training, following criticism that MCAS was not described in the aircraft manual. Boeing has previously said existing cockpit procedures would cover any example of runaway controls caused by MCAS.
The changes were drawn up in response to the Lion Air crash but are seen as crucial to regaining the trust of pilots, passengers and regulators after the Ethiopia crash prompted a worldwide grounding Boeing 737 MAX planes.
Ethiopian officials and some analysts have said the Ethiopian Airlines jet behaved in a similar pattern before crashing shortly after take-off from Addis Ababa, but that investigation is still at an early stage.
Boeing executive Sinnett told reporters the software had been through extensive testing, including flights with U.S. Federal Aviation Administration (FAA) regulators. However, he said he could provide no timeframe for when the 737 MAX jets would return to service, saying the new software upgrade and training protocols must be approved by the FAA and regulators around the world.
The software upgrade will also make it easier for pilots to counteract nose-down movements from MCAS by pulling back on the control column, Boeing said. The move follows reports that Lion Air pilots were overwhelmed by heavy movements ordered by MCAS.
The changes eliminate a single point of failure that existed in the original design by exposing MCAS to two blade-shaped sensors designed to measure the “angle of attack.”
Too great an angle can cause the plane to stall or lose lift. The previous version was only designed to examine one of the two sensors at a time, alternating between flights.
If the difference in the two measurements exceeds 5.5 degrees, then MCAS will stop working and pilots will be alerted to this by a warning message that will now be built into the cockpit display, whereas beforehand it was optional.
To allow the aircraft’s systems to compare the two sensors, Boeing confirmed earlier it would make the “Angle of Attack disagree” alert a standard feature on the 737 MAX, adding that it could be retrofitted on existing airplanes.
It also said it would not charge customers who choose another safety feature known as the AOA indicator option.
U.S. lawmakers on Wednesday questioned why Boeing had charged extra for some safety features and Senator Dianne Feinstein said she was considering legislation to bar the practice.
John Hamilton, chief engineer for 737 Max flight displays, said in a statement that “all primary flight information required to safely and efficiently operate the 737 MAX” was already included without the features that would now be offered.
He said the AOA indicator “provides supplementary information to the flight crew. The AOA disagree alert provides additional context for understanding the possible cause of airspeed and altitude differences between pilot displays.”
Reuters reported in November after the Lion Air disaster that some aviation experts believed the optional alert could have alerted engineers about mechanical faults, leading to an industry debate over whether the system should be mandatory.
(Reporting by Eric M. Johnson, David Shepardson and Tim Hepher, editing by Grant McCool)