Boeing 737 Max will return to flight after software updates, says EU's aviation regulator

It flew OK without MCAS – but not well enough to be certified as safe

The Boeing 737 Max was safe enough to fly without the controversial MCAS system but would not have met safety certification rules, the EU Aviation Safety Agency has said after confirming the airliner will return to European skies in January 2021.

Flights will resume once airline pilots have received extra training to the EU regulator's satisfaction, EASA added, having previously said it would not be following in the US Federal Aviation Administration's footsteps.

The EASA announcement is very similar to the US FAA's return to service for the Max but with a couple of extra pilot training requirements added.

Patrick Ky, chief of EASA, said in a statement: "EASA's review of the 737 MAX began with the MCAS but went far beyond. We took a decision early on to review the entire flight control system and gradually broadened our assessment to include all aspects of design which could influence how the flight controls operated. This led, for example, to a deeper study of the wiring installation, which resulted in a change that is now also mandated in the Proposed Airworthiness Directive."

MCAS stands for Manoeuvering Characteristics Augmentation System. It was a software system installed on the Max by Boeing to compensate for the Max having larger engines than its predecessors in the 737 family of airliners. Those larger engines changed the way the aeroplane responded to its controls, requiring a software system to keep it within certifiable limits.

Ky added: "We also pushed the aircraft to its limits during flight tests, assessed the behaviour of the aircraft in failure scenarios, and could confirm that the aircraft is stable and has no tendency to pitch-up even without the MCAS."

While this latter statement could be interpreted as meaning that MCAS was not required on the Max, EASA clarified to The Register that while the airliner was safe enough to fly without the software system operating, it would not have met certification standards for passenger flights without MCAS.

"In the case of the MAX: the MCAS is necessary to meet the safety regulation and obtain the necessary safety margins. However, when it is lost (failed and inoperative), an averagely skilled and trained crew is still able to safely fly and land the airplane," said a spokeswoman.

An aviation safety source, who is not from EASA, the UK Civil Aviation Authority or Boeing, and has extensive practical experience in aerodynamics and regulation, told The Register that MCAS was installed to meet the requirements of US certification law; specifically 14 CFR 25.173. This states: "The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots."

Our source explained that reading this together with 14 CFR 25.203(a) produces the requirement that all US-certified airliners must meet: broadly, the forces on the pilot's control yoke must progressively become heavier as the controls are deflected towards their limits, much like when turning a car's steering wheel towards full lock. The Max, he said, did not meet this requirement without MCAS.

MCAS would intervene if the Max was nearing a stall, with the nose up in a high angle-of-attack situation. It would input nose-down trim automatically, both helping prevent the aircraft from actually stalling (which is when it's not going fast enough to keep flying) and making the forces on the pilot's manually operated control yoke heavier.

The system was, however, reliant on inputs from a single angle-of-attack sensor. When that single sensor failed on two separate aircraft at low altitude - along with system and other failsafes - both crashed, costing 346 lives.

Maxes returning to airline service must have flight control software updates installed as well as display system updates that show a critical warning caption to pilots titled AOA DISAGREE. This alerts them that the two angle-of-attack sensors are no longer giving roughly similar readings, meaning MCAS could falsely activate and produce undesired control inputs.

Pilot checklists are also being updated specifically to include what to do if MCAS falsely activates, and pilots are also being trained on the software system's existence and functionality. Previously they were kept in the dark about it by Boeing, which hoped regulators wouldn't spot it and ask whether the airliner needed a separate (and expensive) certification for existing 737 pilots to fly it. ®