Much has been written over the past several months about the reason(s) for the Boeing 737 Max crashes – and not just in aviation circles. The events garnered worldwide attention not only because of their commonality, the perceived culpability of the manufacture and implied pilot training deficiencies, but because aviation crashes remain the modern-day version of a train-wreck. Passengers are at the mercy of the man, the machine, Mother Nature and the 10 million manufacturing and design decisions that were made years and decades before they ever boarded the plane. And we can expect this to be our aviation paradigm until civilian, multi-passenger space travel usurps aviation as the most sensational venue for transportation disasters.
As you may imagine, those who pilot the 737 and its variants have been peppered with questions from inquiring minds that want to know. From family, friends, passengers, co-workers and other pilots we get questions such as, what do you think happened? Why didn’t they turn off the system? Would you feel safe flying the Max? The executive summary is this: Engineers created a “background” system using a marginally reliable, non-redundant probe/sensor; the crews didn’t recognize the failure mode; and yes, I would still fly the airplane. Here’s why.
Not the First Time
Systems and components that operate behind the scenes, oblivious to the crew are not new. The previous airliner that I flew, the MD-80, had two-engine related systems and one of them worked behind the curtain similar to the MCAS. They were the ART system and the ATR system – same letters but different systems to augment the motors during non-normal situations. We operators only discovered the existence of the Mad Dog’s second engine augmentation system through operational events that led us to query the manufacturer.
The Automatic Reserve Thrust system (ART) is an out-in-the-open, pilot-selectable/de-selectable system and uses the autothrottles to advance the remaining motor to a higher power setting after an engine failure. The system includes an annunciator that indicates activation to the crew. The Automatic Thrust Restoration system (ATR – the second, “hidden” system) uses the fuel controllers (causing no throttle movement) to add fuel when several unusual conditions are encountered simultaneously during takeoff. And this system provides no system activation notification. With this system, as with the MCAS, any assertion that the manufacturer intentionally hid information from customers and pilots regarding their operation for some nefarious reason is unlikely. While the MCAS system is new to this aircraft, flight control augmentation, visible to the operator or not, is nothing new.
Military and civilian aircraft designers have traditionally used imaginative, innovative and sometimes brilliant (Bell X-1, SR-71, SpaceShipOne) aerodynamic engineering in order to accomplish desired flight characteristics and capabilities. We have high-speed rudder limiters, flaps that “blow-up” when the limit speed is reached, a stick-pusher when AOA gets too high, slats that extend automatically at slow speed, even landing gear that extend on their own (Cherokee Arrow). We have anti-skid systems that override pilot aggressiveness, doors that won’t open inflight and multiple other systems that are “pilot-proof.” Almost all of the “below-the-surface” systems, however, alert the pilot when they are triggered.
When a new system is substantially similar to an existing system, or when failures in the new system display familiar failure modes or flight characteristics (and can be addressed with existing procedures), it’s not unusual for manufacturers to consider new designs, systems or components as relatively inconsequential to operating procedures and therefore, not provide a pilot-alerting function in the system-activation logic nor recommend additional pilot training. Until that is, the brilliant new innovation displays an unexpected failure mode or proves to be overly complicated for Yogi or the other, average bears.
Why’d They Do It?
Boeing needed to make design changes to the venerable 737 in order to increase airline margins and thereby make the plane more competitive. To achieve this objective, a more efficient engine was chosen that was larger, but the engines needed more ground clearance. In order to avoid major airframe changes, the larger engines had to be moved higher, partially by making the nose strut longer, and partially by moving the engines forward. But the more-forward engines created unacceptable handling characteristics at high AOA. The Maneuvering Characteristics Augmentation System (MCAS) was designed to resolve the issue by adding to and changing the already existing Elevator Feel Shift (EFS) system (which makes the Max “feel” like a good-old-fashioned 737).
Most biz-jets and airliners like the Max have two AOA sensors but the “off the shelf, from the factory” MCAS only talks to one of them. The MCAS uses a single, non-redundant AOA sensor input to trim nose down at high AOA – and the amount of nose down trim authority given to this autonomous, single-source system is very significant. Additionally, the single AOA sensor input may have a reliability issue. Boeing does offer the option for a second AOA input to the MCAS and an AOA disagree warning light for the system. Two power-shutoff switches on the center console (almost every turbine airplane, including the 737, has had these for a thousand years) are designed to disable the MCAS system either way, which will then allow a manual re-trim of the aircraft through a hand-crank trim wheel by the captain’s right knee and another at the FO’s left knee. Malfunctions in a system that operates silently in the background, like the MCAS, can be a challenge when they malfunction especially if the failure mode mimics a normal, day-to-day behavior of the system.
As the Trim Wheel Spins
The 737 has several modes of stabilizer trim, only one of which is the MCAS. The mode everyone is familiar with is activated by the switches on the yolk and we use it all of the time – and it spins the trim wheel. Another mode trims the aircraft when the autopilot is off. Called the Speed Trim System (STS), it’s designed to improve flight characteristics with a low gross weight, aft center of gravity and high thrust when the autopilot is not engaged (i.e. during takeoff). This system spins the trim wheel as well. Another mode is the autopilot-on mode, which trims in the same manner as we do when hand flying – and it also spins the trim wheel. And yet another mode is the now infamous MCAS which, yes indeed, spins the trim wheel.
My point is this: 737 pilots are accustomed to seeing and hearing the trim wheel spin. When we’re fast, slow, autopilot on, autopilot off, when we expect it to trim and when we don’t expect it to trim, the trim wheel spins. Is it possible that we are desensitized to trim wheel movement? Absolutely yes, at least potentially. May that be the cause of a delay in our response if the MCAS fails and runs away with our trim? Absolutely yes, at least for a few seconds. And how many seconds of trim wheel spinning does it take to make the nose really, really, really heavy? A couple of crews have found the answer to be less time than they imagined.
Required by AD 2018-23-51: In the event of uncommanded horizontal stabilizer trim movement (which I just told you happens routinely with the STS, MCAS, and the normal autopilot-on mode), combined with any of the following potential effects or indications resulting from an erroneous AOA input, the crew must execute the runaway stabilizer procedure in the operating manual:
- Continuous or intermittent stick shaker on the affected side only;
- Minimum speed bar (red and black) on the affected side only;
- Increasing nose down control forces;
- IAS DISAGREE light;
- ALT DISAGREE light;
- FEEL DIF PRESSURE light.
A Typical Runaway Stabilizer Trim Procedure:
Control column…Hold firmly
Autopilot (if engaged)…Disengage
Control pitch attitude with control column and main electric trim.
If runaway trim stops…End of procedure
If trim continues to run away:
Stab Trim Cutout switches (both)…Cutout
If the runaway continues:
Stabilizer trim wheel…Grasp and hold
Training guidelines for the Boeing 737 Max likely didn’t emphasize the new MCAS anti-stall program or provide a pilot-alerting function because it was believed that current protocols to deal with other stabilizer and trim failures covered MCAS failure modes. Why they didn’t have the MCAS listen to both AOA sensor inputs through a comparator, however, is perplexing. This being the case, it seems there are a few possibilities to explain the recent unrecoverable catastrophic failures.
One – pilots are not recognizing the failure mode or if they do, are not using the approved procedure that should remove power from the MCAS. Two – pilots recognized the failure mode but are executing the procedure improperly, too late or the procedure when applied didn’t work. Three – it’s not the MCAS system that is malfunctioning at all, and there exists an unknown and unrecognized failure mode in the Max flight control system yet to be discovered.
When the Ground Gets Bigger
Magazine article lead-times are long (it’s almost the end of March as I write this), and by the time you read this we will have some answers and a solution will be in place. Probably new software, additional AOA sensor input, system activation annunciation and additional aircrew training. Then we can all shake our heads in disappointment over pilot errors, engineering decisions, or the discovery of an unknown failure mode – or a combination of all of the above. However it unfolds, when any failure rears its head in the airplane, it will be, as it has always been, your training, experience, determination and judgement that will be working the problem. And the folks that made those 10 million engineering and design decisions regarding your airplane are not the ones that will be watching the ground get bigger as you demonstrate some of that pilot stuff.