MAR 0 1 2019 RA-19-00256 Manager, AIR-860 BASOO Branch Department of Transportation Federal Aviation Administration 2200 S: 216 Street Des Moines, WA 98198-6547 Subject: Submittal of MCAS Development and Certification Overview Model: 737MAX FAA Project No.: RA Project No.: EASA Project No.: EASA Level: Response Requested: None - Informational Only Expedited Flow: No Reference: FAA/Boeing meeting on December 17. 2018. MCAS Development and Certi?cation Overview Special Instructions: Please forward to This letter is to submit: Updated presentation material from the Reference meeting This letter is being sent for: Information only BOEING PROPRIETARY TBC - 130073 RA-19-00256 Page 2 Please contact this office or the following individuals if you have further questions: Certification Engineer Program Manager: The information being forwarded to the FAA by or with this correspondence, which is being submitted voluntarily and in confidence to the FAA. is for reference only and is considered proprietary to The Boeing Company and/or its suppliers. is not customarily released to the public and has ongoing commercial value to Boeing The data provided should be returned to Boeing immediately following use by the FAA. including any copies thereof which the FAA may be required to make in the course of its review Boeing does not authorize the FAA to retain any portion of the materials being supplied Sincerely ngineering GWO Enclosure MCAS Development and Certification Overview -. Name 1l?Encl MC Title A 1 FAA Program i FAA i if 4F JTFAA FAA BOEING PROPRIETARY TBC T8. - 130074 Enclosure to RA-19-00256 Page 1 of 43 MCAS Development and Certi?cation Overview No license is requ'l'ed for the dissemination of the commercial information contained herein to foreign persons other than those from or in the terrorist supporthg countries identi?ed in the United States Export Administration Regulations (EAR) (15 CFR 730-774). It is the responsibility of the individual in control of this data to abide by U.S. export laws. ECCN 96991. Copyright 2018 Boeing. All rights reserved. BOEING PROPRIETARY 1 BOEING PROPRIETARY 130075 Enclosure to RA-19-00256 Page 2 of 43 Compliance Review Summary 737 MAX MCAS Control Law - All certification deliverables (Cert Plans, ICA Documents, in support of MCAS control law certification are compliant. . Review of all Boeing internal analysis in support of MAX development and certi?cation deliverables were completed per process and are compliant. 0 Assessment of Compliance Identified Several Areas for Improvement - Opportunities to Enhance Records of Decisions - Inconsistencies in Documentation - Aerodynamics Stability Control completed further evaluation of the Functional Hazard Assessment for loss of MCAS control law function in a corner condition of the normal ?ight envelope. - Confirmation via Flight Test that loss of MCAS rated as minor Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 2 BOEING PROPRIETARY 130076 Enclosure to RA-19-00256 Page 3 of 43 Agenda Development and Certification Timeline . MCAS Control Law Design Overview - System Level Hazard and Safety Assessments . Flight Controls Certification Deliverables - Airplane Level Hazard, Safety, and Single Multiple Fault Assessments . Instructions for Continued Ain/vorthiness (ICA) . Flight Crew Training and Documents - Maintenance Training and Documents MCAS Compliance Assessment Summary - Disagree Flight Deck Indication Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 3 BOEING PROPRIETARY 130077 Enclosure to RA-19-00256 Page 4 of 43 Agenda - Development and Certification Timeline Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 4 BOEING PROPRIETARY 130078 RA-19-00256 Page 5 of 43 Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY BOEING PROPRIETARY Enclosure to RA-19-00256 Page 6 of 43 Agenda 0 System Design Overview Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 6 BOEING PROPRIETARY 130080 Enclosure to RA-19-00256 Page 7 of 43 System Design Overview Summary Maneuvering Characteristics Augmentation System (MCAS) Description: . MCAS is a pitch augmentation ?ight control law implemented on the 737 MAX that commands nose down stabilizer to enhance pitch characteristics with flaps up during elevated angles of attack. - MCAS is activated without pilot input and only operates when the autopilot is disengaged. . MCAS control law becomes active and applies automatic nose down stabilizer in increments based on a table schedule as a function of AOA and Mach . The maximum command amount at any point in the table schedule is limited to 2.5 degrees . Stabilizer is commanded at a rate of 0.27 degrees per second (same rate as ?aps down speed trim) . Maximum magnitude of stabilizer command is lower at high Mach number and greater at low Mach number (for the same AOA above the activation threshold) . AfterAOA falls below the hysteresis threshold (0.5 degrees below the activation angle), MCAS commands nose up stabilizer to return the airplane to the trim state that existed before it entered the MCAS activation region - MCAS stabilizer operation can be stopped and reversed by a pilot using the electric thumb switches and commanding stabilizer trim in the nose up direction . If elevated AOA conditions persist and increase, MCAS commands additional incremental stabilizer in accordance with the table schedule referenced above Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 7 BOEING PROPRIETARY 130081 Enclosure to RA-19-00256 Page 8 of 43 System Design Overview MCAS vs. Speed Trim: Pilot Inputs and Effect on MCAS and Speed Trim Effect of Column Cutout - Does not inhibit MCAS commands - Inhibits Speed Trim commands Effect of Electric Stabilizer Trim thumb switch input) - Overrides both MCAS and Speed Trim commands Effect of Stabilizer Cutout switches - Inhibit both MCAS and Speed Trim commands Effect of Manual Trim trim wheel) - Overrides both MCAS and Speed Trim commands Effect of Trim Override switches - Overrides column cutout switches only Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 8 BOEING PROPRIETARY 130082 Enclosure to RA-19-00256 Page 9 of 43 Agenda - System Level Hazard and Safety Assessments Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 9 BOEING PROPRIETARY 130083 Enclosure to RA-19-00256 Page 10 of 43 MCAS System Level FHA Summary . Development of FHAs for MCAS control law was consistent with process and assumptions used on all Boeing models. . Loss of MCAS control law function assessed as Minor in the Normal Flight Envelope and Major in the Operational Flight Envelope. - All FHAs involving unintended MCAS activation were assessed as Major in the Normal Flight Envelope and Hazardous in the Operational Flight Envelope. . Consistent with FAA regulations and Boeing process MCAS FHA events were not evaluated in the SSA as they were assessed as Major. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 10 BOEING PROPRIETARY 130084 Enclosure to RA-19-00256 Page 11 of 43 Fundamental Assumptions Utilized in Functional Hazard Assessments - Fundamental assumptions used in ?ight control FHAs across all Boeing models. Consistent with 25.671, 25.672 and AC 25-7C for compliance evaluation for 25.143. - Uncommanded system inputs that are readily recognizable and can be counteracted by overriding the failure by movement of the ?ight controls in the normal sense by the ?ight crew do not require specific procedures. - Action to counter the failure shall not require exceptional piloting skill or strength . The pilot will take immediate action to reduce or eliminate increase control forces by re-trimming or changing configuration or flight conditions - Trained flight crew memory procedures shall be followed to address and eliminate or mitigate the failure - FHA evaluation for MCAS and Stab Trim was consistent with the above fundamental assumptions and resulted in the following. - Unintended stabilizer trim inputs are readily recognized by movement of the stab trim wheel, flight path change or increased column forces. . Aircraft can be returned to steady level flight using available column (elevator) or stabilizer trim. . Continuous unintended nose down stabilizer trim inputs would be recognized as a Stab Trim or Stab Runaway failure and procedure for Stab Runaway would be followed. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY I 11 BOEING PROPRIETARY 130085 Enclosure to RA-19-00256 Page 12 of 43 System Level Functional Hazard Assessment (FHA) MCAS Certification Approach - Determination of functional hazard categories Major, Hazardous, Catastrophic) was by Boeing pilot assessment performed in the simulator and aligned with Advisory Circular AC 25-7C. - Single MCAS unintended activations were inserted via the Stabilizer Trim System in the Simulator to asses impact to handle qualities and associated ?ight crew actions. -Accumulation or combination of failures leading to unintended MCAS activation were not simulated nor their combined flight deck effects. Upon each design iteration of MCAS, the functional hazard categories were re-assessed. The assessments were validated following each iteration. - When assessing unintended MCAS activation, the function was allowed to perform to its authority and beyond before pilot action was taken to recover . Failures were able to be countered by using elevator alone. - Stabilizer trim available to of?oad column forces. . Stabilizer cutouts were available but not required to counter failures. - Based on this evaluation, unintended MCAS activation was assessed as Major in the Normal ?ight envelope. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY I 12 BOEING PROPRIETARY 130086 Enclosure to RA-19-00256 Page 13 of 43 System Level Functional Hazard Assessment (FHA) MCAS FHAs Four failure conditions were evaluated per our FHA process in the Normal flight envelope and in Operational ?ight envelope and then assessed the effect for each failure condition in both of those envelopes. Conditions assessed: . Loss of MCAS function . Unintended MCAS activation to the control law table limit (accounted for erroneous All four conditions determined to meet hazard assessment/ probability requirements. Erroneous Angle of Attack was accounted for within unintended MCAS activation to control law table limit. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 13 BOEING PROPRIETARY 130087 Enclosure to RA-19-00256 Page 14 of 43 System Level Functional Hazard Assessment (FHA) Erroneous Inputs to MCAS Control Law . Erroneous inputs to MCAS control law could result in loss of MCAS function or unintended MCAS activation. Unintended MCAS activation due to erroneous input would still be subject to the control law table limits encoded in the MCAS software (2.5 deg maximum incremental stabilizer movement) Unintended MCAS activation has previously been shown to be: . Major in normal flight envelope. - Failure can be countered by using elevator alone. . Stabilizer trim available to of?oad column forces. . Stabilizer cutouts available but not required to counter failure. . Hazardous in the operational ?ight envelope. . The probability of being outside the normal flight envelope is 10-3 (refAC 25-7C). Therefore, a condition that meets the integrity requirements for a Major within the normal flight envelope also meets the Hazardous integrity requirements for the operational ?ight envelope. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 14 BOEING PROPRIETARY 130088 Enclosure to RA-19-00256 Page 15 of 43 Flight Envelope De?nitions Vs?a" VTOA VMO VFC V0 5 Speed -1g 09 0.89 1.39 1.69 2.59 NZ a stall as tick shaker AOA Deterrent Initial Initial Deterrent Buffet (Routine Turns 4? A 104 10-? 1 Probability 1 10-3 10-; Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 15 BOEING PROPRIETARY 130089 Enclosure to RA-19-00256 Page 16 of 43 Agenda . Flight Controls Certification Deliverables Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 16 BOEING PROPRIETARY 130090 Enclosure to RA-19-00256 Page 17 of 43 MCAS Flight Controls Certification Summary . ?737 Enhanced Digital Flight Control System, Autothrottle, and Yaw Damper Safety Analysis? showed compliance for? . ?737 Stabilizer Trim Control System Safety Analysis? showed compliance for - Flight test conducted concurrent with Aero ?ight testing to demonstrate MCAS control law function and effects of loss of function during Control System Malfunctions Testing. . During MAX development FCC and MCAS Control Law identi?ed as Development Assurance compliant system following ARP 4754. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 17 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 18 of 43 MCAS Certification CP 13474 ?737-8 Amended Type Certificate Flight Controls ?Auto?ight - Deliverable 8: ?737 Enhanced Digital Fliiht Control System, Autothrottle, and Yaw Damper Safety Analisis? for Existing catastrophic fault trees modified to account for the MCAS failure contributions to the top event . No warning required as a failure of the function did not pose an unsafe condition. In addition, counteraction of failures of the function did not require exceptional pilot skill or strength and is accomplished by movement of the flight controls in the normal sense. . Detected failures in MCAS are annunciated by the illumination of the existing SPEED TRIM (caution) light repurposes existing speed trim structure Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 18 BOEING PROPRIETARY 130092 Enclosure to RA-19-00256 Page 19 of 43 MCAS Certification CP 13471 ?737-8 Amended Type Certificate Flight Controls Primary, Elevator and Stabilizer Control? . Deliverable 9: ?737 Stabilizer Trim Control System Safety Analysis? for AR ecommen pprova - Existing catastrophic fault trees modified to account for the MCAS engage discrete failures contributing to loss of the control column cutout function - Identification of the established functional hazards in normal and operational flight envelope 6-4.2 FHA Results l?unctionul llzizzud Ame-?merit findings for the 737 MAX Stabilizer Ir1m('ontrol System are presented in Table below. Prohnhilites are given for both a 1.9 hour standard ?ight length ease as well as for 9.0 hour maximum duration Ii'l'( mission. Note the two different ?ight phases designated for MCAS related hazards ?Normal Flight Fm'elope? and ?Operating Flight anelope", Operating ?ight envelope for the MCAS function refers to a wind-up turn. Effect . . . Flight Contributing alculaterl Probability FT). Event Hazard Phase Stainilanl ETOPS Reference HIglIt 50?"9 (1.9 rm (9.0 anartloiix Lo? ot'inz-un electric down him Go mound None (36- 1. p. 1. prior to piloted go around. but after - - SILXBOA lltils? spring on thin] chzumel Hazardous system Landing None (lo-2. p. .1. motion lnit - - 001 very high flight crew workload for sate lunchtiu Hazardous MCAS function All None 06-2. 1). 8. operation ti ?Pel'?tmg' I I High! Fm :lopel Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 19 BOEING PROPRIETARY 130093 Enclosure to RA-19-00256 Page 20 of 43 Flight Test CP 13471 ?737-8 Amended Type Certificate Flight Controls Primary, Elevator and Stabilizer Control? - Deliverable 15: CFTP C1.39.AAC ?737-8 Primary Flight Control System? Recommend Approval for 1St Rev . Test Report Deliverable 17 Approval Test report points to conditions flown concurrently with C1 .21.AAL ?737-8 Maneuvering Characteristics? (reference CP 13669) Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 20 BOEING PROPRIETARY 130094 Enclosure to RA-19-00256 Page 21 of 43 Flight Test CP 13669 ?737-8 Amended Type Certificate ?Aerodynamics Performance, Stability and Control? - Deliverable 40: CFTP C1 .14.ADD ?737-8 Stall Characteristics? Recommend Approval - Demonstrate compliant stall characteristics. - Test Report Deliverable 42 Approval Deliverable 34: CFTP C1.21.AAL ?737-8 Maneuvering Characteristics? Recommend Approval for 1St Rev turns. Demonstrate compliant maneuvering column force characteristics during up - Test Report Deliverable 36 -AR Approval - Deliverable 7: CFTP C1 .33.AAD ?737-8 Control System Malfunctions? -AR Recommend Approval for 1St Rev . ?Demonstration of loss of MCAS function . Test Report Deliverable 9 Approval Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 21 BOEING PROPRIETARY 130095 Enclosure to RA-19-00256 Page 22 of 43 Agenda - Airplane Level Hazard, Safety, and Single Multiple Fault Assessments Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 22 BOEING PROPRIETARY 130096 Enclosure to RA-19-00256 Page 23 of 43 Airplane Level Hazard, Safety, and Single Multiple Failure Assessments Summary - For the MAX development Single and Multiple Failure analysis was completed and followed . Per BPI- MCAS was not evaluated individually as a new/novel on the MAX as 9 control law had been previously implemented on 767 GTTA. - ?Erroneous AOA, one source? was identi?ed and not analyzed as part of assessment per Engineering judgment. - During case selection per Engineering judgment the worst case multiple failure of ?Erroneous Air Data? and ?Erroneous or Air Data? replaced ?Erroneous AOA, one source? failure scenario. - analysis completed prior to the design change to MCAS control law during flight test. Reevaluation of design change not required per . While the version of MCAS included in the analysis was not re?ective of the certi?ed configuration; current assessment is that the final report would have included the same crew action that is already considered in the analysis. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 23 BOEING PROPRIETARY 130097 Enclosure to RA-19-00256 Page 24 of 43 Airplane Level Safety Assessments (ASA) Single and Multiple Failure Accomplishment Summary D910AO10 0 Completed by Systems Engineering with input from Safety and Functional Areas Developed per ?Conducting Single and Multiple Failure Analyses? Step 1 Team identi?es cases based on prior models, changes in airplane/architecture. Cases accepted/rejected in this step. Rationale for rejection reviewed. Step 2 ?Ana ysis performed. Data includes failure effects and cascading effects. Step 3 Teams determine if failure hazard classi?cation is appropriate for case. Step 4 Resolve actions in Al database. Step 5 E-CAB testing. Step 6 Document results. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 24 BOEING PROPRIETARY 130098 Enclosure to RA-19-00256 Page 25 of 43 Airplane Level Safety Assessments (ASA) Single and Multiple Failure Accomplishment Summary D910A010 -AVN-16: Loss of one AOA followed by an erroneous AOA 4.19.2 Analysis Summary . Baseline Configuration: 737-7. -8, and -9 MAX - Deemed potentially catastrophic Sangria? Eight Pfifje and Conditions? I ht before crew recognition of issue . dammit: 0 Operational conditions: IFR . cataStrophiC rating consistent With 0 Significant flight phase and conditions for follow-on effects: No Displays and Air Data system safety assessments and AC 25-11A Diversion by Procedure: No 0 Diversion Expected by Pilot: Not called out by procedure, but ?ight crew likely .Acceptability Rationale based on me? A Crew train ing, appropriate ig ht Grew . .. [Failure Case Cumulative Required Probability action and the probability of failure ?We Ca? Hazard category (B being extremely remote. Catastrophic 12-9oriess Acceptability Rationale: 0 Results in a misleading single source air data situation for primary displays. Potentially catastrophic before flight crew recognition of issue. Crew training supports recognition and appropriate flight crew action. 0 Failure event probability is beyond extremely improbable Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 25 BOEING PROPRIETARY 130099 Enclosure to RA-19-00256 Page 26 of 43 Agenda - Instructions for Continued Airworthiness (ICA) Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 26 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 27 of 43 Instructions for Continued Airworthiness (ICA) ICA Documents - For the MAX development pro ram all ICA documents required for certi?cation were roduced to com with 9 re ease process owrng omp lance or ns ructions for Continued AinNorthiness . Aircraft Maintenance Manual Integrated Fault Isolation Manual did not require inclusion of information specific to MCAS as they include all pertinent information required to diagnose MCAS control law input failures in the material that addresses Stab Trim control law input failures. . MCAS not included in Systems Description Section . Wiring Diagram Manual properly captures the airplane wiring changes for the Stabilizer Column Cutout due to incorporation of the MCAS control law. . Relay implemented in Stabilizer Column Cutout system to incorporate MCAS is monitored by the FCC and no periodic maintenance is required. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 27 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 28 of 43 Instructions for Continued Airworthiness (ICA) ICA Documents . Airworthiness Limitations Certification Maintenance Requirements (ALCMR) . Enhanced Zonal Analysis Procedure (EZAP) . Aircraft Maintenance Manual (AMM) Con?guration, Maintenance and Procedures (CMP) - Fault Isolation Manual (FIM) . Damage Tolerance Rating (DTR) - Maintenance Review Board (MRB) . Non Destructive Testing (NDTG) . Structural Repair Manual (SRM) . Standard Wiring Practices Manual (SWPM) Task Cards (TC) data not in AMM - Weight and Balance Manual (WBM) *Denotes item reviewed for inclusion of MCAS . Wiring Diagram Manual (WDM) Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 28 BOEING PROPRIETARY 130102 Enclosure to RA-19-00256 Page 29 of 43 Agenda 0 Flight Crew Training and Documents Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 29 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 30 of 43 Flight Crew Training Manuals Summary . Pilot Qualification process for the MAX followed AC 120-538 and Issue Paper O-1. . Final approved FSB Report and Other Differences Requirements (ODR) Tables for the MAX did not include MCAS control law. . Flight Crew Operations Manual (FCOM) does not include a specific systems description of MCAS control law. . Boeing and specifically discussed inclusion of MCAS in ODR table and system description in FCOM. FAA concurred with Boeing recommendation that inclusion of MCAS in the ODR table and FCOM was not necessary. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 30 BOEING PROPRIETARY 130104 Enclosure to RA-19-00256 Page 31 of 43 Training and FCOM Pilot Quali?cation Plan Process A Joint Boeing, FAA, FAA, EASA TCCA Approval (FSB OEB) EASA and TCCA process . Gated process Validation Tests) in compliance with EASA Operational Suitability Data Develop Training (OSD) requirements NG to MAX Differences MDR, ODR Tables Comparison Process Pilot Qualification Plan (PQP) Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 31 BOEING PROPRIETARY 130105 Enclosure to RA-19-00256 Page 32 of 43 Agenda . Maintenance Training and Documents Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 32 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 33 of 43 Maintenance Training and Documents Summary . As part of ATA Chapter system description the MCAS control law is referenced including the control law schematic. HORIZONTAL STADILIZEF: CONTROL ., EUNCT ONAL DESCRIPTION ELECTRIC TRIM l'r-I ng .?tt?rrp?r-t npe?mtlon thr' amhtl Net 'r Spr'f?t'l "to t?m thr- Ft?t?r: rnlu'nn sAi'rJr mom? amt-rm lx?emrr?r- i' r. 11:13:an tip the low sport 7' Is 3 un 75 ?n"t?ond \?t?htntcnao'-'= Vt tn Fl flanspeed rs 2? un ?5 per setor?c Stabilizer Tr n? Cut :?tut Fraitr" lf here Ii a stab rzer runmtay cow-1 tron the lots ?1316' the TF. 5' Irrur\ to Z'w 0LT LUT WDIILXI, Tut.- rcr'rucs want STAB TQIH 3 w. and these clumn (i u'out Sluict?c-S and (Z clumn I'tpu'. The cutout 5w ?cl?m?s are I?t 'l'tr: column CllIOl? switch minute There are two modules. :aptain an: F. Wher the n?tc-ves tne elratait'r tUIlIttItI v'ut ml the tlu- cutout smith-r?; up!? l'im ll .1 (WNW-11 oppos?w Ir) tl'e rrxwer'te'r' I?m- w? sw'rrnm 'nc nmrn?or opt-'37: 'rtr r7rr In 'n-r some direcicn as the column movement I The pri-?r' 1w". TRIM morn'lz? in do Inpass 0' r.mr Harmer. rt 'nr: have rt?rnl Liarreum Character st t. fthr?errtatrott The maneuterng ecgmertatron - JIICWS the Ila-t Move rr 2? t: high angles of .111th speed; Tits requres it": SIJDII get to mm: the tn .mrrn ?w In? I: 'rr mm-nr tor nost- up pitch Thu MTAP. on operator. r-xtrr-rnr- ripe-rt 1 LF cons 'rons tnn?. are oxsroe tn:- r-orrml operatmq envelope 5: a; Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 33 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 34 of 43 Agenda - Assessment Summary Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 34 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 35 of 43 Assessment Summary - Opportunities to Enhance Records of Decisions - MCAS Control Law Removal from Differences Training Table (ODR) and FCOM - Boeing and discussed and agreed on removal of MCAS control law during MAX development and certification. 0 Supporting rationale discussed between Boeing and FAA and accepted by FAA, but not formally documented in meeting minutes. . Reviewed FCOM and released MAX FSB Report do not reference MCAS. - No process violation or non-compliance . Engineering Pilot Assessment of Repeated Unintended MCAS Control Law Activation - Engineering and Test pilots discussed scenario of repeated unintended MCAS activation during MAX development and deemed no worse than single unintended MCAS activation. - Discussion and supporting rationale documented in pilot meeting summary email on June 22, 2016 and not documented in formal certification artifacts - No process violation or non-compliance Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 35 BOEING PROPRIETARY 130109 Enclosure to RA-19-00256 Page 36 of 43 Assessment Summary - Inconsistencies . MCAS Systems Descriptions in Maintenance Training Material and Not Included in ICA Documents . Maintenance Training material developed and released prior to ICA documents provide description of pre-?ight test MCAS control law. . No process violation or non-compliance . FCOM Acronyms Section Referencing MCAS Artifact left behind from earlier drafts of the FCOM prior to removal of MCAS from FCOM and FAA acceptance. - No process violation or non-compliance - EDFCS SSA Data Document D241A018-13 - Data Document is a repository for SSA supporting data and is not a certification deliverable nor referenced in SSA Compliance Documents D241A018-Supplemental non-certification data documentation updates not yet formally published to include the MAX. . EDFCS SSA D241A018-12 document used appropriate data in support of compliance for the MAX. . No process violation or non-compliance Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 36 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 37 of 43 Assessment Summary . Inconsistencies . D251A018-6, ?737 Stabilizer Trim Control System Safety Analysis? Compliance Document . Description of functional failure in the Fault Hazard Assessment table referenced preliminary MCAS control law authority limits and was not updated to reflect certi?ed design. . Identification of the probability for the Hazardous condition of unintended MCAS activation referenced the incorrect gate within the Fault Tree Analysis for Stabilizer Runway. - Compliant probabilistic assessment in Fault Tree Analysis maintained with revision. . D910A010, ?Single and Multiple Failure Accomplishment Summary? . ?Erroneous AOA, one source? was identified and not analyzed as part of assessment. Similar to previous derivative development programs like 747-8 - Supporting rationale provided was, ?Covered by Erroneous Air Data, Erroneous or RAir Data covers single probe loss case?. . Rationale should have pointed to ?Loss of one AOA followed by Erroneous which was a part of the assessment during MAX development. Condition was not evaluated in the simulator but deemed acceptable as failure was found to be extremely improbable. analysis completed prior to the design change to MCAS control law during ?ight test and not reevaluated. Current reassessment is consistent with previous analysis which is supported by crew action in acceptability rationale. . No process violation or non-compliance Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 37 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 38 of 43 Compliance Review Summary 737 MAX MCAS Control Law - Review of all certi?cation deliverables (Cert Plans, ICA Documents, in support of MCAS control law certi?cation are compliant. . Review of all Boeing internal analysis in support of MAX development and certi?cation deliverables were completed per process and are compliant. 0 Assessment of Compliance Identified Several Areas for Improvement - Opportunities to Enhance Records of Decisions - Inconsistencies in Documentation - Aerodynamics Stability Control completed further evaluation of the Functional Hazard Assessment for loss of MCAS control law function in a corner condition of the normal ?ight envelope. - Confirmation via Flight Test that loss of MCAS rated as minor Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 38 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 39 of 43 Agenda . Disagree Flight Deck Indication Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 39 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 40 of 43 and Optional Angle of Attack Flight Deck Indication Design Overview DME mt: - Optional Angle of Attack Indication . Implemented in BP99 for 737NG - first delivered December 1999. . Requirements carried over for 737 MAX. . disagree - Implemented in BP06 for 737NG - first delivered July 2006. - Annunciation was a customer request to assist maintenance troubleshooting. . Displayed on PFDs when the left and right AOA disagree 10+ degrees for 10 continuous seconds. . AOA DISAGREE alert does not require any pilot action. . There are other ?ight deck effects that - AOA data received from the ADIRUs via A429. F?"?ts Shou'd underStand that may '?d'Cate the presence of erroneous AOA data, . If the data from the ADIRUs are unavailable or invalid, including the ALT DISAGREE and IAS the annunciation will not be displayed. DISAGREE alerts. . Requirements carried over for 737 MAX. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 40 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 41 of 43 737 MAX Flight Deck Indication COSP 2018-2116 MDS PR693 DISAGREE Annunciation? discovered in October 2017 AOA DISAGREE is not displayed unless the optional AOA indicator is displayed. Determined to be requirements not implemented correctly by supplier in display system software. Testing of previous black label software on versions did not discover this issue. PR Review Process concluded to resolve the PR with MDS BP2 which is part of MAX-1O ATC (EIS 30 2020). Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 41 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 42 of 43 737 MAX Flight Deck Indication COSP 2018-2116 Summary Rationale Determined to be Not a Safety Issue (Dec 6, 2018) . IAS DISAGREE and ALT DISAGREE may be displayed with an AOA DISAGREE. AOA DISAGREE is supplementary information with no additional crew action. - All appropriate crew action is contained in the IAS DISAGREE and ALT DISAGREE QRH procedures. . The IAS DISAGREE and ALT DISAGREE annunciations are displayed independent of the AOA DISAGREE annunciation. - AOA DISAGREE, IAS DISAGREE, and ALT DISAGREE are observed faults and have corresponding IFIM Tasks. Task 34-10-00-810-801 SPEED DISAGREE Shows on PFD - (Captains?s) Fault Isolation Task 34-10-00-810-802 SPEED DISAGREE Shows on PFD - (First Officer?s) - Fault Isolation Task 34-20-00-810-801 ALT DISAGREE Shows on PFD - (Captains?s) - Fault Isolation Task 34-20-00-810-802 ALT DISAGREE Shows on PFD (First Of?cer?s) - Fault Isolation Task 34-20-00-810-803 AOA DISAGREE Shows on PFD (Captains?s) Fault Isolation Task 34-20-00-810-804 AOA DISAGREE Shows on PFD (First Of?cer?s) Fault Isolation The first step in all tasks is to look in OMF Existing Faults, 34 Air Data Inertial Reference System for related maintenance messages. Copyright 2018 Boeing. All rights reserved. EXPORT CONTROLLED: ECCN 9E991 BOEING PROPRIETARY 42 BOEING PROPRIETARY Enclosure to RA-19-00256 Page 43 of 43 BOEING PROPRIETARY