It's not so much a "problem" as it is "physics". If the stabilizers are forcing the nose down, and the pilot pulls back on the stick (engaging the elevators) to pull the nose up, the forces exerted on the stabilizer are such that, in extreme cases, human force is insufficient to move the manual wheel.
This is extremely (EDIT: No longer) well documented by Boeing going back decades, and it presents solutions of either: 1) reengaging the electronic stabilizer trim and trimming electronically back to a point where the forces are manageable, then cutting electronic trim again, or 2) relaxing the stick, letting the nose go the way the stabilizers want it to, which slackens the force, and makes cranking the wheel manually doable. Great if you're stabilizers are trimmed severely nose down at a height of 40,000 feet; less great at a height of 1,000 feet. (EDITED TO ADD: Apparently this information & procedure was removed from Boeing's manuals after the 1980s, and pilots no longer train on it, as the issues that led to its necessity were thought solved. The MCAS apparently has reintroduced the need for them.).
This is compounded by a new change in the 737-MAX: in prior 737 series aircraft, there are two stab trim cutout switches: one to cut the autopilot's ability to command the stabilizer trim, the other to cut electronic power to the stabilizer trim adjustment entirely, so you could stop the autopilot from changing the trim but still retain electronic control and not need to worry about the manual crank forces. The two switches are MAIN ELEC and AUTO PILOT.
In the MAX, this changed, and it's now an all or nothing setup: you have to kill electronic power to kill autopilot commands to the stabilizer. The two switches are now PRI and B/U. Both must be cut out to stop any stabilizer runaway, including MCAS runaway.
This all seems to add up to Boeing's narrative of "The MCAS is safe, pilots just need to know to hit the stab trim cutout" being grossly insufficient. They must cut it at a moment where the stabilizer isn't grossly mistrimmed with respect to level flight, OR they may well need to re-engage it and race the MCAS to get into a close-to-proper trim setup prior to cutting out the stabtrim and assuming manual trim control.
All while keeping the plane in the air, reading the manual, and attempting not to lose composure knowing that the same thing has happened to another flight that lost all hands.
I'm trying very hard to look at this objectively, but this is an extremely bad look for Boeing.
> All while keeping the plane in the air, reading the manual, and attempting not to lose composure knowing that the same thing has happened to another flight that lost all hands.
Additionally an angle of attack (AOA) sensor failure also triggers an unreliable airspeed warning so the pilots no longer trust their airspeed sensors or their AOA sensors while trying to judge pitch and speed. If they go too fast the control forces overpower them, if they go too slow they are more likely to stall.
I don't think Boeing gamed out or tested in a simulator the human factors involved in an AOA failure at takeoff, particularly for pilots who - like the Lion Air pilots - are entirely ignorant of MCASes existence.
EDIT: Found it: https://www.reuters.com/article/us-ethiopia-airplane-simulat...
I would hope that Boeing internally had simulators for the MAX while they were testing it - along with a borrowed supply of pilots who were competent but had no inside information. Even if they didn't, a pencil and paper exercise might have been useful:
1. AOA sensor fails at takeoff (A), the pilots receive an unreliable airspeed warning and the stick shaker activates. The pilots now mistrust their sensors and want to keep their speed up and the nose down.
2. At about 1000 feet above ground the pilots level the aircraft, raise the flaps and start the unreliable airspeed checklist. MCAS starts trimming intermittently.
3. The pilot flying is having to pull further back on the stick and trim correctively while the crew work through their checklist. At this point the crew need to avoid any over-focus, task saturation or over-stimulus from the many warnings and indicators and ask themselves why the aircraft is trimming the way it is. They have a fairly narrow window of time in which to do this and then disable the trimming with the plane in a well trimmed state.
(A) That this happened twice in relatively quick succession might be due to a common problem. Even if such a problem is found and fixed the AOA vanes and pitot tubes are delicate sensors sticking out of the nose of the aircraft; the system should be robust to failures in these sensors.
Runaway stabilizer is a memory item, there should be no reading of the manual involved.
Unfortunately the design of MCAS defeated the checklist of this particular memory item when in lower flight altitudes - which goes back to the argument that the 737 MAX never should have been given the same type rating as the older models.
They went for option 1 in this case, with the MCAS kicking in 5 seconds later.
> This all seems to add up to Boeing's narrative of "The MCAS is safe, pilots just need to know to hit the stab trim cutout" being grossly insufficient.
Yeah, and even that is understating it in my opinion.
Yeah, they basically had to go with option 1. They were only 1,000 feet above the ground, the maneuvering room to let the nose dip, crank, dip, crank, etc until properly trimmed just wasn't there.
How did this scenario get missed during testing? You'd think they would do extra testing around the new changes.
Seems like systemic issues. Reportedly Boeing's submitted risk assessment of the MCAS was based on a single adjustment applied from it, not repeated cycles of application based on a failure of the AoA to recover to what it saw as "level".
The FSB noted the change to the cutout configuration as a difference, but didn't analyze how that could change anything during Autopilot or Speed Trim runaway situations. They didn't even make any note of the MCAS as a difference at all (possibly they were not informed of it?).
I suspect this all comes down to the fact that Boeing started with a conclusion -- The MAX series must not require new simulator time -- and that conclusion was the lens through which they analyzed (or didn't) everything else.
Am I reading the chart on page 27 wrong? Because it looks like they reached a maximum height of 7,000 feet. Also looks like they were continuing to slowly climb until they re-enabled electric trim.
EDIT TO ADD:
Page 12 also says:
>about 32 seconds before the end of the recording, at approximately 13,400 ft
Which is a bit under 6,000 feet higher than the airport.
But apparently the option 2 maneuver (relax pressure on stick, then crank) hasn't been covered in a Boeing 737 manual since the 200 series in the 1980s.
So even given the extra room, there was no documentation covering that possible recovery scenario.
Are there real scenarios where you want to have both control surfaces opposing each other so heavily? Are there real cases for having the trim trying to pitch the plane down while the pilot is trying to pitch up with the stabilizer?
Or should we limit the trim so it never actually opposes the pilots intentions? (Maybe set it to a neutral position and disengage auto function if this condition is detected?)
In yet another change in the MAX series, there used to be what was called an aft column cutout switch which did more or less what it sounds like: engage when the stick was pulled back, cutting out autopilot commands to the stabilizer, so that it never attempted to outmuscle the pilot's input commands to the elevator.
This was removed in the MAX. Possibly this was to meet certification requirements: if the MCAS was needed to push down on the nose to meet the requirement that "During the approach to the stall, the longitudinal control pull force should increase continuously as speed is reduced from the trimmed speed to the onset of stall warning." If the MAX tends to pitch nose up at a certain point, the MCAS is intended to create a counter force against the pilots commands as it approaches that, rather than have the pilot pulling back at some point suddenly buck the nose upwards, then the MCAS needs to be active when the pilot is pulling back on the stick.
But it does argue that a LOT more thought needed to go into MCAS failure modes if it was necessary for it not to be cut out when the pilot is operating elevators.
I think what's going on with the 737-MAX is the needed trim is way beyond what's needed to fly the plane.
I'm now wondering is the MACS is needed because the tendency to pitch up also exceeds the pilots control inputs which is why it had to be on the elevator and have that much authority. Meaning once the aircraft pitches up the pilot doesn't have enough authority to push the nose back down.
Or, alternatively, the pitch up happens so quickly and severely the risk of stall is too great above a certain AoA and the pilot won't have adequate time to respond.
If either is the case, it implies the aircraft is not safe to fly without MCAS operational, and possibly not at all.
737 is a common plane. If there were a systemic problem it would have been discovered long ago. (In fact I think several such problems were discovered and fixed long ago.) Look how quickly this new problem was discovered by the public, with both the manufacturer and primary regulator working to hide it.
That's the reason the MAX should have been a separate classification with specific hands-on training.
edited
Yes, and it will only activate during that edge case if the AoA inputs are accurate. But they weren't. And so MCAS activated when it shouldn't have, and did things that the pilots could not recover from because they were things MCAS should never have done in the first place. That's the problem.
Source? That's the first I've heard that it's only for edge cases.
[0] https://theaircurrent.com/aviation-safety/what-is-the-boeing...
Or flying into windshear changes the angle of attack on you.
It's only supposed to activate in a specific edge case (high angle of attack, manual flight, no flaps, low airspeed). That's been discussed plenty online (including previous threads here at HN).
But that assumes that the angle of attack sensors are accurate. If the AoA sensors are inaccurate, as they were on this flight (more specifically the left one), MCAS can activate when it's not supposed to. That's what happened here.
I wasn't talking about at what airspeeds a stall is possible. I was talking about at what airspeeds MCAS is designed to activate (assuming correct AoA sensor input).
>At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working.
"Manually" here could mean manual electric control. 8 seconds seems an awfully short time for the Captain to ask if trim is functional, FO to say no and ask to try manual, Captain to say Yes, and for the FO to try the wheel and conclude it's not working.