Stretched to the Max

You continue the climbout and retract the flaps on schedule. Once the flaps are cleaned up, the trim begins running nose down without your command. You trim against it using your yoke-mounted trim switch. But it does it again. And again. The out-of-trim condition gets so strong that you’re now using both hands on the yoke in an attempt to keep the nose level.

Meanwhile, your relatively inexperienced co-pilot is digging in the quick-reference manual for a checklist to run. But which one? Is he looking for a checklist that addresses the stick shaker running continuously since takeoff, or the trim that began running uncommanded? As up-and-down gyrations continue, you ask your first officer for help in holding the nose up. The gyrations continue until the airplane crashes.

This scenario is simply an educated guess as to what may have been going on in the cockpit of the recent Boeing 737 Max crashes in Ethiopia and Indonesia. These crashes have alarmed the world and brought the legacy 737 design to the forefront of discussion, and rightly so. After all, it is the most popular airliner in the world. Although changes and updates in the investigation occur weekly or even daily, what follows is an analysis of what was known by publication deadline in early May.

Airlines love the 737 because so many pilots and mechanics are trained on it. It saves airlines millions in training costs. But every time the airplane needs to be modernized, it becomes an engineering feat to hang more efficient—read larger—engines on an airplane geometrically limited by stubby main landing gear that almost meet in the middle when retracted.

With the introduction of economical geared turbofans several years ago, Airbus simply hung a pair on its Airbus 319/320/321 models, which sits much taller on its landing gear than the 737. Boeing engineers presumably rolled their eyes when tasked with yet another major redesign of the 737 to make room for the massive fans. The end result is the Max, which utilizes extended nose gear and engines slung forward and higher to achieve the necessary ground clearance.

Only after the Lion Air crash in October 2018 did pilots learn about MCAS, which many of us took as a form of systems-knowledge betrayal.
Mounting the engines this way destabilized the airplane and changed its maneuvering characteristics to the point that it threatened the ability of the FAA to grant a blanket type rating across all models of 737s—something airlines desire in order to lower training costs. In response, Boeing created the Maneuvering Characteristics Augmentation System (MCAS), a longitudinal stability enhancement system that automatically rolls in nose-down trim if the airplane is at a high angle of attack. For the first time, the cable-and-pulley 737 had some fly-by-wire elements in the form of MCAS and spoiler augmentation. In Max differences training at my airline, I learned about spoiler augmentation but MCAS wasn’t mentioned.

Only after the Lion Air crash in October 2018 did pilots learn about MCAS, which many of us took as a form of systems-knowledge betrayal. Would you want to know about a system that can directly affect pitch control? Um, yeah! Upon sensing a high AOA, MCAS automatically trims the massive horizontal stabilizer nose-down, which can easily overpower the comparatively small elevators that the pilots control with the yoke. Boeing’s reason for remaining mute about MCAS is because the remedy for a runaway MCAS is the same as runaway trim—cutting power to the stabilizer trim through switches mounted on the pedestal near the right trim wheel.

Many pilots faulted the Lion Air crew for not simply flipping those switches and killing the power to the electric stabilizer trim, and manually trimming the airplane with the trim wheels. On flights prior to the accident flight, crews did just that. Obviously, it wasn’t repaired. Then again, it’s hard to accurately write up a maintenance problem when you don’t know that the system exists.

But the Ethiopian Airlines Max crash in March revealed that even if runaway-trim procedures are followed, air loads on the tail could be so high that manual trimming is impossible. Holding the yoke back with elevator to counter the nose-down command of the stabilizer creates an immense amount of load on the tail that can paralyze the trim actuator jackscrew. It’s surmised that the pilots of the Ethiopian Max attempted to move the stabilizer manually to no avail—but in its severely out-of-trim condition, the trim wheel wouldn’t budge. Possibly out of frustration, the crew turned the stabilizer trim back on, allowing MCAS to reactivate and seal their fate.

The only remedy for this severely out-of-trim condition is a long-retired “roller-coaster” technique where pilots release elevator pressure to unload the tail in order to allow manual trimming. It’s likened to the technique of reeling in a fish: release the pressure on the yoke as you crank away on the trim. In the throes of battling an out-of-control airplane with stick shaker and multiple alerts blaring, it’s easy to see how pilots were unable to regain control, especially in light of the fact that the roller-coaster technique hasn’t appeared in any 737 manual since those of the 737-200 in the early 1980s. The takeaway is to not let the airplane get so far out of trim that you can’t undo it manually.

The Max disasters also bring up basic safety, design, and certification principles. For example, how is it that MCAS relies on just one AOA sensor? And who certified that? You don’t have to be an engineer to realize that a system that can completely take over pitch control of an airplane shouldn’t rely on a single source of information. At a minimum, two AOAs should be sourced and a comparator used, but that was optional equipment. Besides faulty AOA sensor issues that are implicated in both accidents, it’s conceivable that a simple bird strike could take out an AOA vane—a scenario that has recently been fingered as a possibility in the Ethiopian crash, according to some reports. Needless to say, the FAA and Boeing have lots of questions to answer. Information emerged that the FAA delegated some self-certification privileges to Boeing during Max development. A too-cozy relationship, perhaps?

Boeing is reengineering MCAS to no longer give it the ability to drive the trim more than a few times, and it will have limited travel. It will also source both AOAs and use a comparator system, which previously was optional. There will undoubtedly be awareness and recovery training for pilots. Following the first crash (Lion Air), all 737 pilots should have been aware that MCAS does not activate with flaps extended. Had the Ethiopian crew remembered this, it could have averted disaster.

With the left AOA vane faulty or missing, the captain’s stick shaker was continuously chattering. Why, then, would the pilots retract the flaps fully as if they were continuing the flight? With an obvious control system malfunction, it would seem prudent to consider turning back to the departure airport with flaps at the takeoff setting. Further, power was left at the takeoff setting, increasing airspeed to and beyond VMO, setting off yet another alarm (overspeed clacker) and putting yet higher loads on the tail. I fully admit to noting this from the comfort of my armchair rather than in an out-of-control airliner with a runaway trim and a new co-pilot.

While foreign airlines were quick to ground the Max, the United States lagged behind in grounding. Why? I’m sure national pride and hobbling a giant U.S. manufacturer had something to dowith it, but part of it was because many U.S. pilots, myself included, felt confident that we knew exactly what to do if MCAS attempted to wrest control of our airplane. As further evidence emerged from the accidents, however, it became clear that grounding the airplanes was the right thing to do.

Was the initial scoffing by U.S. pilots an example of pilot exceptionalism? Perhaps. I look at it more from the standpoint of training, knowledge, and confidence in my own seat-of-the-pants flying skill honed from decades of flying real airplanes as opposed to simulators. There have been many head-scratching accidents where perfectly good airplanes seemingly went out of control, rendering their pilots as out of touch with the airplane as the hundreds of doomed passengers they flew. Basic knowledge of pitch and power settings would have saved Air France Flight 447 after its pitot tubes froze up. Instead, the pilots pitched up to a completely unrealistic deck angle for the conditions, setting up a deep stall. Air Asia Flight 8501 similarly pitched up to an unsustainable deck angle, stalled, and crashed into the Java Sea. And then there’s Asiana Airlines Flight 214, which struck the seawall on a clear, calm day in San Francisco after the crew botched a visual approach.

Naturally, any of these accidents could have happened to U.S. pilots, but I think the chances of that are exponentially smaller because most U.S. airline pilots were trained primarily in airplanes, not simulators. The United States’ relatively healthy general aviation industry (as well as the military) trains pilots in actual airplanes, cementing the seat-of-the-pants feel that a simulator just can’t replicate. In most parts of the world, general aviation has been regulated out of the sky and pilots are forced to learn in simulators. More reputable airlines with larger budgets send their pilots abroad to train just for this reason.

In the end, one has to wonder if Boeing would be better off creating a clean-sheet narrow-body airplane incorporating modern standards such as engine-indicating and crew-alerting systems and enough height to hang larger engines. The 737-800 and -900 versions take off and land at very high speeds, making them prone to runway overruns and tail strikes because of fuselage stretches. The design has been reengineered so many times that it’s hardly recognizable, except for the nose section, which dates to the Boeing 707 from the 1950s. Some refer to the 737 as the first regional jet. But with some models carrying 200 people across continents, it’s apparent that the design limit has been stretched, perhaps too far.