The Washington PostDemocracy Dies in Darkness

All eyes are watching as Boeing prepares software update months after Indonesia plane crash

People work on the flight deck of a Boeing 737 MAX 8 airplane in Renton, Wash. The model has been grounded for weeks after deadly crashes. (Ted S. Warren/AP)

More than five months after a brand-new Boeing 737 MAX 8 commercial jet went down in Indonesia, the manufacturer is still working on a software fix for the plane’s flight-control systems.

The fix and its related pilot training are seen as important steps toward convincing regulators worldwide that the 737 MAX 8 and 9, which have been grounded for more than two weeks, are safe to fly.

A Federal Aviation Administration spokesman said Monday that the agency expects to receive the final package of software and training updates for review “over the coming weeks," reflecting a delay from its initial timeline. Boeing had initially planned to submit the fix for FAA review last week.

“Time is needed for additional work by Boeing as the result of an ongoing review of the 737 Max Flight Control System to ensure that Boeing has identified and appropriately addressed all pertinent issues,” Lynn Lunsford, an FAA spokesman, said Monday in a statement. “Upon receipt, the FAA will subject Boeing’s completed submission to a rigorous safety review. The FAA will not approve the software for installation until the agency is satisfied with the submission.”

Boeing’s vice president of communications emphasized that the company is proceeding carefully to ensure regulators are satisfied.

“We continue to work with the FAA and other regulators on the software update and related training package,” Gordon Johndroe said Monday. “We’re committed to getting it right and will provide updates on timing soon.”

The software changes are meant to account for a new flight-control system that is thought to have played a role in two deadly crashes involving 737 MAX 8 aircrafts that left 346 people dead in Indonesia and Ethiopia.

The FAA grounded the planes on March 14, saying authorities needed to investigate “the possibility of a shared cause” between the two crashes. Although authorities are yet to formally assign blame for either crash, investigators have already concluded that the anti-stalling feature, known as MCAS, was activated in the final minutes of the Ethiopian flight.

Black box data shows anti-stalling feature was engaged in Ethiopia crash

Boeing started working on the software fix several months ago and has been testing it in updated jets. Last week in Renton, Wash., Boeing executives unveiled a version of the new flight-control system, designed to prevent MCAS from overreacting, and new visual alerts to make pilots aware of potentially dangerous situations.

They tried to sell a skeptical community of pilots, regulators and airline representatives on the idea that the new software would allay their concerns related to the MCAS system — even as they emphasized that the causes of the two crashes had not yet been firmly established.

“The rigor and thoroughness of the design and testing that went into the MAX gives us complete confidence that the changes we are making will address these accidents, and we look forward to working with all of our 737 MAX customers as they implement this from reentry into service, through pilot training and through the life-cycle of the airplane,” Boeing 737 project engineer Mike Sinnett told reporters last week.

The update would limit how quickly the stall-suppression system could tip down the nose of the plane, giving pilots more time to respond if MCAS is activated. It would alert pilots when the plane’s external sensors show different readings.

Boeing, initially defensive, now 'humbled' by 737 MAX crisis

A Boeing executive speaking on the condition of anonymity said last week that the training component of that update had been “provisionally approved” by regulators. The software component should take only about an hour to implement on individual airplanes, the person said, and can be deployed within a day after the FAA signs off on it.

“We went through a process of developing the software, deploying it, testing it and going back to our requirements ... it took this amount of time to get it right,” a Boeing official speaking on the condition of anonymity told reporters at a briefing Wednesday in Renton, Wash. “We didn’t rush it, because rushing it is the wrong thing to do in a situation like this.”

Even when Boeing completes the software fix, regulators still may not be satisfied. Some may worry that the changes could cause other unintended consequences, experts said.

With the new flight-control software, MCAS would disengage if there is a major discrepancy in the sensor data the system relies upon to tell if the plane is nearing a stall, the company has said.

“Right now, we know what we are worried about,” said R. John Hansman, a professor of aeronautics at the Massachusetts Institute of Technology. “One of the challenges though is, when you start messing around with software, you have to make sure you haven’t created some other problem or failure.”

At tense meeting with Boeing executives, pilots fumed about being left in the dark on plane software

Two former Boeing engineers who worked on automatic flight-control systems for Boeing told The Washington Post that the changes would probably require Boeing to prove that the plane could be handled safely without MCAS, including at landing.

“What if you’re landing without MCAS?” asked one engineer, who spoke on the condition of anonymity because his job still requires him to interact with Boeing. “Would you have to increase your speed a few knots for safety? Would anything change in an aborted landing procedure?”

Peter Lemme, a former Boeing engineer who helped designed flight-control systems for the 757 and 767, said he was glad that Boeing has said it would disengage the system if there is a discrepancy in sensor data. Unlike other models of newer Boeing jet liners that have three Angle-of-Attack sensors to gauge a stall, the 737 Max jets have only two.

“If one’s wrong, you can’t take the average of two, and you can’t use the good one, because the computer doesn’t know which one is right,” Lemme said.

Lemme said Boeing also seemed to have underestimated the hazard that the new flight-control system can cause when it is fed faulty data, saying the company is probably taking extra time to now ask, “what aren’t we thinking about?”

Hansman, the MIT professor, said he isn’t reading too much into a delay. “I think they want to get it right, and this now clearly is going to have so much scrutiny around the world.”