Back to home page737 MAX FCC Enhancements

Home > MAX > 737 MAX FCC Enhancements

Contents

Illustrated technical information covering Vol 2 Over 800 multi-choice systems questions Close up photos of internal and external components Illustrated history and description of all variants of 737 Databases and reports of all the major 737 accidents & incidents History and Development of the Boeing 737 - MAX General flightdeck views of each generation of 737's Technical presentations of 737 systems by Chris Brady Detailed tech specs of every series of 737 A collection of my favourite photographs that I have taken of or from the 737 Press reports of orders and deliveries Details about 737 production methods A compilation of links to other sites with useful 737 content Study notes and technical information A compilation of links to major 737 news stories with a downloadable archive A quick concise overview of the pages on this site

spacer

During a review of MCAS software changes by the FAA in June 2019, a further problem with the FCC was discovered. The FAA crew were simulating a Runaway Stabiliser during tests in Boeing’s MAX engineering flight simulator, also known as e-cab.

The FAA said that it had identified a new risk that would need to be addressed before the MAX could be ungrounded. Under a scenario where a specific fault in the FCC could cause an uncommanded movement of the stabiliser.

The FAA determined that:

  1. Line pilots would need more time to correctly diagnose the failure and execute the appropriate checklist.
  2. A computer chip malfunction could lead to uncommanded stabilizer movement during the emergency procedure.

One problem was that a specific Flight Control Computer (FCC) chip was processing data too slowly. It was uncertain whether the chip needed to be upgraded or if a software update could increase speed enough. All models of the 737 have two FCCs but use only one per flight, flip-floping to the other FCC between flights.

Another problem can be caused by cosmic rays hitting circuitry and randomly changing binary code from 0 to 1 or vice versa, are addressed by FAA certification standards but their effects were tested by FAA pilots in relation to the function of the MCAS by flipping five of the binary switches. Although the perfect storm of simulated failures would be an extremely rare occurrence in the air, the FAA said it had to be addressed. “While it’s a theoretical failure mode that has never been known to occur, we cannot prove it can’t happen, So we have to account for it in the design.” Double teaming the flight control computers mitigates that risk because each computer is constantly checking the performance of the other. If either detects a problem, neither will move the flight controls and the aircraft will have to be flown manually.

The solution, incorporated into FCC P12.1.2, was dual processor monitors and a cross FCC monitor. The monitor compares the trim-up and trim-down command outputs from both FCCs with its own trim command calculation. If the outputs differ from the trim-command calculation in the local channel’s monitor for a cumulative one second, then the local channel will take control of STS. The A/P may disconnect and NO AUTOLAND will be available. The SPEED TRIM FAIL will illuminate on recall and STAB OUT OF TRIM light will illuminate when on ground and below 30 knots.

Cross-channel signals are added to ensure the Standby FCC is in MCAS operation any time the Operational FCC is in MCAS operation. The Standby FCC performs a reasonableness check on the Operational FCC signal to activate MCAS to ensure the activation difference is not due to a postulated FCC failure - eg cosmic rays etc.

Dual Processor Monitor

The FCCs continuously monitor each other’s stabilizer trim commands, and in the event an erroneous command is detected, stabilizer trim commands, autopilot trim commands, and CWS trim commands are stopped and inhibited for the remainder of the flight for that FCC.

Stabilizer Cross-FCC Trim Monitor

The Cross-FCC Trim Monitor protects against erroneous stabilizer trim commands.

Autopilot Elevator Monitor

The Autopilot Elevator Monitor protects against erroneous elevator commands that can result in erroneous autopilot stabilizer trim commands.

For more details on the FCC watch this video presentation:

See more details about the book

All of the information, photographs & schematics from this website and much more is now available in a 374 page printed book or in electronic format.

*** Updated 23 Nov 2020 ***

The 737 Tech Site on Facebook The 737 Tech Site on Twitter The 737 Tech Site on Instagram The 737 Tech Site on Instagram

MCAS / FCC Changes

Slide taken from MCAS presentation above

Footer block