"WASHINGTON—A simulator session flown by a U.S.-based Boeing 737 MAX crew that mimicked a key portion of the Ethiopian Airlines Flight 302 (ET302) accident sequence suggests that the Ethiopian crew faced a near-impossible task of getting their 737 MAX 8 back under control, and underscores the importance of pilots understanding severe runaway trim recovery procedures.
Details of the session, shared with Aviation Week, were flown voluntarily as part of routine, recurrent training. Its purpose: practice recovering from a scenario in which the aircraft was out of trim and wanting to descend while flying at a high rate of speed. This is what the ET302 crew faced when it toggled cutout switches to de-power the MAX’s automatic stabilizer trim motor, disabling the maneuvering characteristics augmentation system (MCAS) that was erroneously trimming the horizontal stabilizer nose-down.
In such a scenario, once the trim motor is de-powered, the pilots must use the hand-operated manual trim wheels to adjust the stabilizers. But they also must keep the aircraft from descending by pulling back on the control columns to deflect the elevator portions of the stabilizer upward. Aerodynamic forces from the nose-up elevator deflection make the entire stabilizer more difficult to move, and higher airspeed exacerbates the issue.
The U.S. crew tested this by setting up a 737-Next Generation simulator at 10,000 ft., 250 kt. and 2 deg. nose up stabilizer trim. This is slightly higher altitude but otherwise similar to what the ET302 crew faced as it de-powered the trim motors 3 min. into the 6 min. flight, and about 1 min. after the first uncommanded MCAS input. Leading up to the scenario, the Ethiopian crew used column-mounted manual electric trim to counter some of the MCAS inputs, but did not get the aircraft back to level trim, as the 737 manual instructs before de-powering the stabilizer trim motor. The crew also did not reduce their unusually high speed.
What the U.S. crew found was eye-opening. Keeping the aircraft level required significant aft-column pressure by the captain, and aerodynamic forces prevented the first officer from moving the trim wheel a full turn. They resorted to a little-known procedure to regain control.
The crew repeatedly executed a three-step process known as the roller coaster. First, let the aircraft’s nose drop, removing elevator nose-down force. Second, crank the trim wheel, inputting nose-up stabilizer, as the aircraft descends. Third, pull back on the yokes to raise the nose and slow the descent. The excessive descent rates during the first two steps meant the crew got as low as 2,000 ft. during the recovery.
The Ethiopian Ministry of Transport preliminary report on the Mar. 10 ET302 accident suggests the crew attempted to use manual trim after de-powering the stabilizer motors, but determined it “was not working,” the report said. A constant trust setting at 94% N1 meant ET302’s airspeed increased to the 737 MAX’s maximum (Vmo), 340 kt., soon after the stabilizer trim motors were cut off, and did not drop below that level for the remainder of the flight. The pilots, struggling to keep the aircraft from descending, also maintained steady to strong aft control-column inputs from the time MCAS first fired through the end of the flight.
The U.S. crew’s session and a video posted recently by YouTube’s Mentour Pilot that shows a similar scenario inside a simulator suggest that the resulting forces on ET302’s stabilizer would have made it nearly impossible to move by hand.
Neither the current 737 flight manual nor any MCAS-related guidance issued by Boeing in the wake of the October 2018 crash of Lion Air Flight 610 (JT610), when MCAS first came to light for most pilots, discuss the roller-coaster procedure for recovering from severe out-of-trim conditions. The 737 manual explains that “effort required to manually rotate the stabilizer trim wheels may be higher under certain flight conditions,” but does not provide details.
The pilot who shared the scenario said he learned the roller coaster procedure from excerpts of a 737-200 manual posted in an online pilot forum in the wake of the MAX accidents. It is not taught at his airline.
Boeing’s assumption was that erroneous stabilizer nose-down inputs by MCAS, such as those experienced by both the JT610 and ET302 crews, would be diagnosed as runaway stabilizer. The checklist to counter runaway stabilizer includes using the cutout switches to de-power the stabilizer trim motor. The ET302 crew followed this, but not until the aircraft was severely out of trim following the MCAS inputs triggered by faulty angle-of-attack (AOA) data that told the system the aircraft’s nose was too high.
Unable to move the stabilizer manually, the ET302 crew moved the cutout switches to power the stabilizer trim motors—something the runaway stabilizer checklist states should not be done. While this enabled their column-mounted electric trim input switches, it also re-activated MCAS, which again received the faulty AOA data and trimmed the stabilizer nose down, leading to a fatal dive.
The simulator session underscored the importance of reacting quickly to uncommanded stabilizer movements and avoiding a severe out-of-trim condition, one of the pilots involved said. “I don’t think the situation would be survivable at 350 kt. and below 5,000 ft,” this pilot noted.
The ET302 crew climbed through 5,000 ft. shortly after de-powering the trim motors, and got to about 8,000 ft.—the same amount of altitude the U.S. crew used up during the roller-coaster maneuvers—before the final dive. A second pilot not involved in the session but who reviewed the scenario’s details said it highlighted several training opportunities.
“This is the sort of simulator experience airline crews need to gain an understanding of how runaway trim can make the aircraft very difficult to control, and how important it is to rehearse use of manual trim inputs,” this pilot said.
While Boeing’s runaway stabilizer checklist does not specify it, the second pilot recommended a maximum thrust of 75% N1 and a 4 deg. nose-up pitch to keep airspeed under control.
Boeing is developing modifications to MCAS, as well as additional training. Simulator sessions are expected to be integrated into recurrent training, and may be required by some regulators, and opted for by some airlines, before pilots are cleared to fly MAXs again. The MAX fleet has been grounded since mid-March, a direct result of the two accidents."
I made the prediction a month ago and I’ll make it again. MCAS won’t ever fly again.
I think the plane will fly without MCAS with a new type rating, and where pilots specifically train on the stick feel during a power on stall.
They needed the 737 with new engines to fly like the old 737 in order to maintain the type rating and avoid training. Now that they obviously have lost that and require substantial training, I don’t see any reason to keep the system.
Some people think the plane is unflyable / inherently unstable without MCAS. I’ve only flown about 15 hours in my life, and a Cessna at that so I’m not qualified to offer an expert opinion.
But my intuition is that if that were true, if MCAS was not just a bandaid to maintain a type rating, but rather a safety critical system essential for flightworthiness, it would never have shipped in its current form in the first place. Or rather, the 737 MAX would not have been viable to begin with.
If it is the case that 737 MAX is not actually airworthy without a functioning MCAS then Boeing has fucked up an order of magnitude worse than even they appear to have at this point.
MCAS is not there because of maintaining pilot type rating.
The plane's airworthiness certificate depends on certain behavior while approaching stall and the new larger and more forward engines on the MAX changed the behavior of the machine in such way that would make it very difficult for the crew to bring the nose down at high angles of attack and high thrust.
The engines on the MAX are forward of the CoG, so they are pushing the nose up as you add thrust - exactly what you do not want when approach a stall. MCAS has been added to help with this - to help the crew push the nose down in such situation by using the stabilizer trim.
The older NG doesn't have this issue because the engines are both smaller and more to the back, so the pitch-up moment is smaller, even though it is still present. This is an inherent issue with underslung engines, all planes with engines mounted under and ahead of the CoG have this issue.
>If it is the case that 737 MAX is not actually airworthy without a functioning MCAS then Boeing has fucked up an order of magnitude worse than even they appear to have at this point.
That's BS. By that logic no Airbus or any fly-by-wire plane could ever be certified - they actually require the computer augmentations to fly. Even the 737 NG has a similar trim system that automatically trims the plane depending on speed, angle of attack and what not.
The engines on the MAX are forward of the CoG, so they are pushing the nose up as you add thrust - exactly what you do not want when approach a stall. MCAS has been added to help with this - to help the crew push the nose down in such situation by using the stabilizer trim.
The forward-backward position of the engines have nothing to do with their resultand pitch torque. What matters is that they are below the CG.
The engines being forward matters because it shifts the center of pressure forward, giving an inherent pitch-up tendency that becomes more pronounced at high angles of attack.
And like you say, all planes with underslung engines have this issue to some degree. Maybe the issue with the MAX is severe enough to cause certification problems but the stall recovery procedures for the NG apparently already call for reducing pitch angle before going to full power or you may not be able to get it down.
This is completely wrong. An Airbus is not made conformant with FAR 25 airworthiness standard by software protections. It conforms to all of FAR 25 requirements without any of the safeguards in place, whereby stick inputs are directly translated to control surfaces. The airworthiness standards are predicated on aerodynamics, not software abstraction of an otherwise unairworthy design.
The idea there are switches in the airplane I can use to make the airplane unairworthy is absurd. And it is equally absurd that the aircraft flight manual and an emergency airworthiness directive would so direct a pilot to make the plane less airworthy than it already is, let alone unairworthy, as a corrective action. It's just absurd. You're welcome to provide a citation, however.
I submit FAR 25. I've read the entire thing and there's nothing in there that permits software to paper over an otherwise unairthworthy aircraft design.
It doesn't make much difference, most of what you've said is accurate to the best of my knowledge, however the thrust can be as far forwards of the CoG as it likes, that doesn't increase the pitch up moment. Having them lower may increase that moment and them having more power too. But the main issue on the Max is airodynamic lift generated by the nacelles at high AoA.
The Boeing whistleblower in the recent 60 Minutes Australia exposé said that's exactly why it was designed. Not only was a new type rating unacceptable, engineers were not permitted to make any design changes which would require simulator training.
> That's BS. By that logic no Airbus or any fly-by-wire plane could ever be certified - they actually require the computer augmentations to fly.
I would imagine that, to be certified, the Airbus planes had to demonstrate that:
a) The computer augmentation was unlikely to fail,
b) when failed, the plane was still flyable enough, and
c) the pilots were trained to fly the plane when the augmentation failed. (I believe this is called “direct law”, and I would be utterly shocked if pilots are not trained to fly the plane in direct law mode.)
Fly by wire systems are classified as safety critical and require much more redundancy. The Boeing 777 has three flight control computers, four sets of low-level controllers, and a fault-tolerant air data sensor system.
Bad air data (airspeed, altitude, angle of attack) has been a big problem in the past. Each of those involves a sensor that sticks out through the skin, and can potentially be damaged or plugged. Remember Air France 447, where the airspeed sensors iced up. Those things need redundancy.
>The engines on the MAX are forward of the CoG, so they are pushing the nose up as you add thrust - exactly what you do not want when approach a stall. MCAS has been added to help with this - to help the crew push the nose down in such situation by using the stabilizer trim.
And the pilots canot push the nose down in such a situation by actuating the stabilizers?
I've never flown an airplane, but as far as I know, MCAS doesn't have unique access to controls that the pilot does not. (eg, it's different from ABS in a car where the driver does NOT have 4 individual brake levers).
It seems to me if the pilots are trained and certified on the Max, they'll do a better job flying it than a poorly designed system.
OTOH, the system is also fixable, but it is becoming a matter of trust.
>I think the plane will fly without MCAS with a new type rating, and where pilots specifically train on the stick feel during a power on stall.
Maybe. Keep in mind MCAS was a system put in place to mitigate a catastrophic risk. If you remove it, you no longer have that mitigation - meaning you either have to argue that increased training can be a substitute (I would be skeptical of that if I was a regulator) or come up with something else. It's a shitshow.
I think it all comes down to certifying bodies other than the FAA. FAA seems happy to go along with whatever Boeing wants (as evidenced by the 'self certification' efforts of the agency); it remains to be seen if the EU or another major market airspace will capitulate.
It is a critical system. Part of the problem is that AOA sensors and MCAS were never considered critical before the software changes made for the 737 MAX and uprating them to critical was overlooked (which would have forced a lot more testing of them).
There is no established requirement that says software can't be used to correct for pitch up on acceleration. The software just has to work properly.
> uprating them to critical was overlooked (which would have forced a lot more testing of them).
Was this "overlooking" accidental or designed specifically to ignore the forced testing? This is the question that might be hardest to answer, but would justify criminal charges for the deaths in my mind.
I’m not sure a type rating works that way. A Boeing 717 has the same type rating as a Douglas DC-9. The two aircraft have similar airframes and some common systems but are quite different as one was built decades later. What the FAA does in these cases is requires more training. A DC-9 rated pilot who has only flown DC-9s will not fly a B717 without several hours in a simulator. The MAX will certainly fly again. I suspect some form of a redesigned MCAS in addition to more training for pilots will be the end result. The airlines may have to spend some money training but they’ll still be left with B737 type rates pilots who can fly B737NG and B737MAX which is where the cost savings is derived.
Is there any indication that MCAS is a problem when it is provided with accurate AOA data? I don't think so, but I'm willing to be educated.
My understanding is that MCAS only goes haywire when it gets haywire sensor data--specifically, data that indicate an AOA that is much higher than reality.
So much depends on the investigations, which are currently in progress. But it seems possible that the technical solution could simply be: require 3 AOA sensors and require agreement between 2 out of 3 to activate MCAS. Of course, there are probably significant business and regulatory issues to consider/fix as well.
Yes, but there's also the problem of just how haywire it goes --- forcing the horizontal stabilizer in an unflyable position from which it can't be moved (the subject of this article).
I'm not sure how easy it is to just bolt a third AoA sensor onto an existing airframe. OTOH, the MCAS system could at least be redesigned to take BOTH AoA sensors into account.
> I think the plane will fly without MCAS with a new type rating
Without the 737 type rating, the value prop of the 737 MAX is lost. There would be no point in continuing the program (at least at anywhere near its current scale).
That's a red herring, the MCAS issue has nothing to do with the type rating. MCAS is not something the crew was even supposed to be aware of, even less trained on, so no effect on type rating at all there.
What it may cause problem with is the certification of the plane as such - MCAS was required to correct the behavior of the plane in high speeds/high thrust and high angle of attack situation where the new larger engines made it difficult to bring the nose down (and avoid stalling).
However, that's not something that cannot be fixed. Airbuses fly full of similar augmentation systems and there is no problem with them, so it is certainly doable.
Type ratings don't really work like that. 90% of the type rating is systems knowledge, emergency procedures etc. If a new type rating was needed there would be a conversion course from the existing type rating.
Unflyable or unstable isn't nearly the same thing as uncertifiable. People have flown a whole lot of time in uncertifiable aircraft (see the whole experimental aircraft sector) but transport category aircraft are supposed to exhibit as full proof as possible behaviour.
I bet you it flies again with MCAS. I'll also bet it flies with barely a few hours of conversion training and that there aren't any accidents directly related to the updated MCAS system.
This isn't true though, it seems perfectly possible to certificate transport-category airplanes with sketchy stall characteristics, since T-tail planes can end up in unrecoverable situations by blanketing the tail in a stall.
Twin-engine planes also are not required to be recoverable from an engine failure at speeds below Vmc.
I don't know what the certification requirements are, but it seems they rely on being able to guarantee that you never get below a certain speed since in multi-engine airplanes there's always a low power/high thrust regime that's potentially uncontrollable.
I am not very concerned with this particular problem anymore since it will get a satisfactory solution due to its publicity.
What I am worried about and think should get more focus is other potential issues and corners that has been cut by the Boeing management. I have note read a single thing that Boeing has handled well in this massive disaster. This lack of judgement, short term profit seeking & cover up mentality is what media should spend more time on. It feels to me that they used up a lot of their trust capital to be allowed to perform any type of self-certification
Psychopaths in leadership/management create problems in all economic systems. Don't blame capitalism. Evil people are evil. There are good people at Boeing but psychopaths have a natural ability to gain power in all kinds of social structures.
I doubt that in a non-capitalistic system the 737 MAX would not have had similar problems as in no system resources are infinite. Budgets, even in the most socialist country, are limited. The question is just WHO limits the budget: private enterprises (or their shareholders), co-ops or politicians.
I'm not sure about that. There is genuine value created by avoiding the need for a significant fraction of the world's airline pilots to use scarce and expensive simulators all at the same time, and Boeing's claim that they could pull it off would have been just as attractive under socialism. Too many people trusted that claim without verifying it, but wishful thinking is a pretty universal human trait, and I don't think that socialists are immune to it.
> The U.S. crew tested this by setting up a 737-Next Generation simulator at 10,000 ft., 250 kt. and 2 deg. nose up stabilizer trim. This is slightly higher altitude but otherwise similar to what the ET302 crew faced as it de-powered the trim motors 3 min. into the 6 min. flight, and about 1 min. after the first uncommanded MCAS input
That's not slightly higher, that's a lot higher. The graphs in the preliminary report [0] note that the flight starts at around 7,500 ft. since Addis Ababa Bole International Airport is 7,625 ft. above sea level [1]. Their radar altitude "about 1 min. after the first uncommanded MCAS input" was ~1,000 ft. The highest they got above ground was around 6,500 ft. around 5 mins 30 seconds into the flight.
> The excessive descent rates during the first two steps meant the crew got as low as 2,000 ft. during the recovery.
If you assume they meant they were 10,000 ft. above sea level in the first quote, then this quote means they'd be 5,625 ft. under ground at their lowest point.
So if you run into this problem at 7,500’ above ground level you might just be okay.
This is why having the ability to disable MCAS without disabling electric assisted trim is so important and such a big factor in this accident. Additionally its raised another possible accident scenario:
The runaway trim cutouts were put in place after electric trim in case the switch (or some other aspect of the electric trim) got stuck in an on position that would cause the trim to go to full deflection one direction or the other, hence runaway trim. And hence if you notice this happening you cutout the power to the electric trim completely.
But now we know you can’t manually trim the aircraft above certain speeds with some trim levels. Should there be an expectation you can? What if runaway trim happens and ran to full deflection before a pilot cut it out. That would be equivalent to the same conditions experienced in this accident - the pilots now needing to manually trim but being unable to.
So on top of needing separate cutouts for the MCAS and electric trim, should the manual trim not be investigated for installing some higher ratio gearing/pulleys to enable over coming the forces experienced here?
Perhaps the intent was to perform the test at the same air density, as many aerodynamic properties, including stalling speed (and also engine performance) depend on density.
Also, it is more useful to know how much height was needed to recover, than that there was not enough. The latter can easily be determined from the former.
Is anyone concerned that even in the face of re-training, that two aircraft could find themselves in this position within the first year of operations?
Let's say you were on one of these aircraft and the pilots were able to recover. How terrifying would that be? This is the designed behavior?
Besides retraining, it seems that there must be upper-body strength tests that 737 MAX pilots will have to pass to ensure that they will be able to manually trim the stabilizer.
Poe's law 'n all that -- are you serious? I mean, yes, I've seen the video, but presumably it won't be safe to require pilots to execute the manual trim, yeah? IMO either the design is unsafe and must change or there exists a way to safely fly without ever needing manual trim.
I'm serious. If the final backup system is to revert to mechanical cranks, pulleys, and cables to move the horizontal stabilizer, then the pilots have to be able to exert sufficient torque and power on the control wheels to do so.
The 777 and 787 are full fly by wire. The control system has all the sensor inputs, all the actuator outputs, and a model of how the aircraft is supposed to behave. If the aircraft isn't doing what's expected, the flight control system will fault and drop to a dumber control mode, giving the pilot more control rather than driving control surfaces to their limits trying to correct the wrong problem. Those systems are managing trim, like MCAS, plus a lot more.[1]
MCAS is dumb. It has few inputs and one output. It has no overall model of aircraft behavior. It just detects a bad angle of attack and cranks the trim to bring the nose down.
The 777 is supposed to handle like a 737. The cockpit controls are reasonably similar, although different enough that transition training is required. Unfortunately, there's no "small 777", a gap in Boeing's product line the 737 Max was supposed to fill. (Or small 757, 767, or 787 variants. How did they go half a century without a new sub-200 seat aircraft?)
Link to the forum post explaining how to execute the yo-yo manoeuvre, mentioned in the article. What is interesting was one pilot mentioned that the yo-yo procedure dates all the way back to the 707 for a runaway trim. The 737 was derived from the 707 and 727. The 707 was the first Jet Airliner.
The 707 is interesting as the UK air Registration Board refused to certify it in its original form. It had insufficient rudder authority in the case of certain engine-out scenarios because Boeing hadn't implemented full rudder boost, and the pilots therefore couldn't overcome yaw. That had killed two crews in training. In order to save the big BOAC order Boeing had to fit full boost and a tail strake, which they quietly adopted for all subsequent 707s
Then there was the 727 that had four fatal crashes within six months of entering service, which was put down to inadequate training. But it was later found that the high fatality rate was because Boeing had routed fuel lines along the belly, which severed in a hard landing and caused immediate fires. And they severed easily because bizarrely they were aluminium, in order to bring the weight within target...
A little pedantic, but: the 707 was one of the first jet airliners. Britain's de Havilland Comet beat it into service by six years, and the Soviet Union's Tupolev Tu-104 by two.
Readit News
Details of the session, shared with Aviation Week, were flown voluntarily as part of routine, recurrent training. Its purpose: practice recovering from a scenario in which the aircraft was out of trim and wanting to descend while flying at a high rate of speed. This is what the ET302 crew faced when it toggled cutout switches to de-power the MAX’s automatic stabilizer trim motor, disabling the maneuvering characteristics augmentation system (MCAS) that was erroneously trimming the horizontal stabilizer nose-down.
In such a scenario, once the trim motor is de-powered, the pilots must use the hand-operated manual trim wheels to adjust the stabilizers. But they also must keep the aircraft from descending by pulling back on the control columns to deflect the elevator portions of the stabilizer upward. Aerodynamic forces from the nose-up elevator deflection make the entire stabilizer more difficult to move, and higher airspeed exacerbates the issue.
The U.S. crew tested this by setting up a 737-Next Generation simulator at 10,000 ft., 250 kt. and 2 deg. nose up stabilizer trim. This is slightly higher altitude but otherwise similar to what the ET302 crew faced as it de-powered the trim motors 3 min. into the 6 min. flight, and about 1 min. after the first uncommanded MCAS input. Leading up to the scenario, the Ethiopian crew used column-mounted manual electric trim to counter some of the MCAS inputs, but did not get the aircraft back to level trim, as the 737 manual instructs before de-powering the stabilizer trim motor. The crew also did not reduce their unusually high speed.
What the U.S. crew found was eye-opening. Keeping the aircraft level required significant aft-column pressure by the captain, and aerodynamic forces prevented the first officer from moving the trim wheel a full turn. They resorted to a little-known procedure to regain control.
The crew repeatedly executed a three-step process known as the roller coaster. First, let the aircraft’s nose drop, removing elevator nose-down force. Second, crank the trim wheel, inputting nose-up stabilizer, as the aircraft descends. Third, pull back on the yokes to raise the nose and slow the descent. The excessive descent rates during the first two steps meant the crew got as low as 2,000 ft. during the recovery.
The Ethiopian Ministry of Transport preliminary report on the Mar. 10 ET302 accident suggests the crew attempted to use manual trim after de-powering the stabilizer motors, but determined it “was not working,” the report said. A constant trust setting at 94% N1 meant ET302’s airspeed increased to the 737 MAX’s maximum (Vmo), 340 kt., soon after the stabilizer trim motors were cut off, and did not drop below that level for the remainder of the flight. The pilots, struggling to keep the aircraft from descending, also maintained steady to strong aft control-column inputs from the time MCAS first fired through the end of the flight.
The U.S. crew’s session and a video posted recently by YouTube’s Mentour Pilot that shows a similar scenario inside a simulator suggest that the resulting forces on ET302’s stabilizer would have made it nearly impossible to move by hand.
Neither the current 737 flight manual nor any MCAS-related guidance issued by Boeing in the wake of the October 2018 crash of Lion Air Flight 610 (JT610), when MCAS first came to light for most pilots, discuss the roller-coaster procedure for recovering from severe out-of-trim conditions. The 737 manual explains that “effort required to manually rotate the stabilizer trim wheels may be higher under certain flight conditions,” but does not provide details.
The pilot who shared the scenario said he learned the roller coaster procedure from excerpts of a 737-200 manual posted in an online pilot forum in the wake of the MAX accidents. It is not taught at his airline.
Boeing’s assumption was that erroneous stabilizer nose-down inputs by MCAS, such as those experienced by both the JT610 and ET302 crews, would be diagnosed as runaway stabilizer. The checklist to counter runaway stabilizer includes using the cutout switches to de-power the stabilizer trim motor. The ET302 crew followed this, but not until the aircraft was severely out of trim following the MCAS inputs triggered by faulty angle-of-attack (AOA) data that told the system the aircraft’s nose was too high.
Unable to move the stabilizer manually, the ET302 crew moved the cutout switches to power the stabilizer trim motors—something the runaway stabilizer checklist states should not be done. While this enabled their column-mounted electric trim input switches, it also re-activated MCAS, which again received the faulty AOA data and trimmed the stabilizer nose down, leading to a fatal dive.
The simulator session underscored the importance of reacting quickly to uncommanded stabilizer movements and avoiding a severe out-of-trim condition, one of the pilots involved said. “I don’t think the situation would be survivable at 350 kt. and below 5,000 ft,” this pilot noted.
The ET302 crew climbed through 5,000 ft. shortly after de-powering the trim motors, and got to about 8,000 ft.—the same amount of altitude the U.S. crew used up during the roller-coaster maneuvers—before the final dive. A second pilot not involved in the session but who reviewed the scenario’s details said it highlighted several training opportunities.
“This is the sort of simulator experience airline crews need to gain an understanding of how runaway trim can make the aircraft very difficult to control, and how important it is to rehearse use of manual trim inputs,” this pilot said.
While Boeing’s runaway stabilizer checklist does not specify it, the second pilot recommended a maximum thrust of 75% N1 and a 4 deg. nose-up pitch to keep airspeed under control.
Boeing is developing modifications to MCAS, as well as additional training. Simulator sessions are expected to be integrated into recurrent training, and may be required by some regulators, and opted for by some airlines, before pilots are cleared to fly MAXs again. The MAX fleet has been grounded since mid-March, a direct result of the two accidents."
I think the plane will fly without MCAS with a new type rating, and where pilots specifically train on the stick feel during a power on stall.
They needed the 737 with new engines to fly like the old 737 in order to maintain the type rating and avoid training. Now that they obviously have lost that and require substantial training, I don’t see any reason to keep the system.
Some people think the plane is unflyable / inherently unstable without MCAS. I’ve only flown about 15 hours in my life, and a Cessna at that so I’m not qualified to offer an expert opinion.
But my intuition is that if that were true, if MCAS was not just a bandaid to maintain a type rating, but rather a safety critical system essential for flightworthiness, it would never have shipped in its current form in the first place. Or rather, the 737 MAX would not have been viable to begin with.
If it is the case that 737 MAX is not actually airworthy without a functioning MCAS then Boeing has fucked up an order of magnitude worse than even they appear to have at this point.
The plane's airworthiness certificate depends on certain behavior while approaching stall and the new larger and more forward engines on the MAX changed the behavior of the machine in such way that would make it very difficult for the crew to bring the nose down at high angles of attack and high thrust.
The engines on the MAX are forward of the CoG, so they are pushing the nose up as you add thrust - exactly what you do not want when approach a stall. MCAS has been added to help with this - to help the crew push the nose down in such situation by using the stabilizer trim.
The older NG doesn't have this issue because the engines are both smaller and more to the back, so the pitch-up moment is smaller, even though it is still present. This is an inherent issue with underslung engines, all planes with engines mounted under and ahead of the CoG have this issue.
>If it is the case that 737 MAX is not actually airworthy without a functioning MCAS then Boeing has fucked up an order of magnitude worse than even they appear to have at this point.
That's BS. By that logic no Airbus or any fly-by-wire plane could ever be certified - they actually require the computer augmentations to fly. Even the 737 NG has a similar trim system that automatically trims the plane depending on speed, angle of attack and what not.
The forward-backward position of the engines have nothing to do with their resultand pitch torque. What matters is that they are below the CG.
The engines being forward matters because it shifts the center of pressure forward, giving an inherent pitch-up tendency that becomes more pronounced at high angles of attack.
And like you say, all planes with underslung engines have this issue to some degree. Maybe the issue with the MAX is severe enough to cause certification problems but the stall recovery procedures for the NG apparently already call for reducing pitch angle before going to full power or you may not be able to get it down.
The idea there are switches in the airplane I can use to make the airplane unairworthy is absurd. And it is equally absurd that the aircraft flight manual and an emergency airworthiness directive would so direct a pilot to make the plane less airworthy than it already is, let alone unairworthy, as a corrective action. It's just absurd. You're welcome to provide a citation, however.
I submit FAR 25. I've read the entire thing and there's nothing in there that permits software to paper over an otherwise unairthworthy aircraft design.
It doesn't make much difference, most of what you've said is accurate to the best of my knowledge, however the thrust can be as far forwards of the CoG as it likes, that doesn't increase the pitch up moment. Having them lower may increase that moment and them having more power too. But the main issue on the Max is airodynamic lift generated by the nacelles at high AoA.
I would imagine that, to be certified, the Airbus planes had to demonstrate that:
a) The computer augmentation was unlikely to fail,
b) when failed, the plane was still flyable enough, and
c) the pilots were trained to fly the plane when the augmentation failed. (I believe this is called “direct law”, and I would be utterly shocked if pilots are not trained to fly the plane in direct law mode.)
Bad air data (airspeed, altitude, angle of attack) has been a big problem in the past. Each of those involves a sensor that sticks out through the skin, and can potentially be damaged or plugged. Remember Air France 447, where the airspeed sensors iced up. Those things need redundancy.
And the pilots canot push the nose down in such a situation by actuating the stabilizers?
I've never flown an airplane, but as far as I know, MCAS doesn't have unique access to controls that the pilot does not. (eg, it's different from ABS in a car where the driver does NOT have 4 individual brake levers).
It seems to me if the pilots are trained and certified on the Max, they'll do a better job flying it than a poorly designed system.
OTOH, the system is also fixable, but it is becoming a matter of trust.
Maybe. Keep in mind MCAS was a system put in place to mitigate a catastrophic risk. If you remove it, you no longer have that mitigation - meaning you either have to argue that increased training can be a substitute (I would be skeptical of that if I was a regulator) or come up with something else. It's a shitshow.
There is no established requirement that says software can't be used to correct for pitch up on acceleration. The software just has to work properly.
Was this "overlooking" accidental or designed specifically to ignore the forced testing? This is the question that might be hardest to answer, but would justify criminal charges for the deaths in my mind.
My understanding is that MCAS only goes haywire when it gets haywire sensor data--specifically, data that indicate an AOA that is much higher than reality.
So much depends on the investigations, which are currently in progress. But it seems possible that the technical solution could simply be: require 3 AOA sensors and require agreement between 2 out of 3 to activate MCAS. Of course, there are probably significant business and regulatory issues to consider/fix as well.
Unfortunately the way things are, my supposition is anything but certain
Deleted Comment
Without the 737 type rating, the value prop of the 737 MAX is lost. There would be no point in continuing the program (at least at anywhere near its current scale).
What it may cause problem with is the certification of the plane as such - MCAS was required to correct the behavior of the plane in high speeds/high thrust and high angle of attack situation where the new larger engines made it difficult to bring the nose down (and avoid stalling).
However, that's not something that cannot be fixed. Airbuses fly full of similar augmentation systems and there is no problem with them, so it is certainly doable.
I bet you it flies again with MCAS. I'll also bet it flies with barely a few hours of conversion training and that there aren't any accidents directly related to the updated MCAS system.
Twin-engine planes also are not required to be recoverable from an engine failure at speeds below Vmc.
I don't know what the certification requirements are, but it seems they rely on being able to guarantee that you never get below a certain speed since in multi-engine airplanes there's always a low power/high thrust regime that's potentially uncontrollable.
What I am worried about and think should get more focus is other potential issues and corners that has been cut by the Boeing management. I have note read a single thing that Boeing has handled well in this massive disaster. This lack of judgement, short term profit seeking & cover up mentality is what media should spend more time on. It feels to me that they used up a lot of their trust capital to be allowed to perform any type of self-certification
Boeing is not the only company that subscribes to that religion.
As are arbitrary cost-cutting goals: https://en.wikipedia.org/wiki/LOT_Polish_Airlines_Flight_7#C...
(I only know about these specific disasters due to reading about the Il-62 because it looks cool)
That's not slightly higher, that's a lot higher. The graphs in the preliminary report [0] note that the flight starts at around 7,500 ft. since Addis Ababa Bole International Airport is 7,625 ft. above sea level [1]. Their radar altitude "about 1 min. after the first uncommanded MCAS input" was ~1,000 ft. The highest they got above ground was around 6,500 ft. around 5 mins 30 seconds into the flight.
> The excessive descent rates during the first two steps meant the crew got as low as 2,000 ft. during the recovery.
If you assume they meant they were 10,000 ft. above sea level in the first quote, then this quote means they'd be 5,625 ft. under ground at their lowest point.
[0] http://www.ecaa.gov.et/documents/20435/0/Preliminary+Report+...
[1] https://en.wikipedia.org/wiki/Addis_Ababa_Bole_International...
edit: oops, refs.
This is why having the ability to disable MCAS without disabling electric assisted trim is so important and such a big factor in this accident. Additionally its raised another possible accident scenario:
The runaway trim cutouts were put in place after electric trim in case the switch (or some other aspect of the electric trim) got stuck in an on position that would cause the trim to go to full deflection one direction or the other, hence runaway trim. And hence if you notice this happening you cutout the power to the electric trim completely.
But now we know you can’t manually trim the aircraft above certain speeds with some trim levels. Should there be an expectation you can? What if runaway trim happens and ran to full deflection before a pilot cut it out. That would be equivalent to the same conditions experienced in this accident - the pilots now needing to manually trim but being unable to.
So on top of needing separate cutouts for the MCAS and electric trim, should the manual trim not be investigated for installing some higher ratio gearing/pulleys to enable over coming the forces experienced here?
Also, it is more useful to know how much height was needed to recover, than that there was not enough. The latter can easily be determined from the former.
Let's say you were on one of these aircraft and the pilots were able to recover. How terrifying would that be? This is the designed behavior?
Are such tests part of flight crew physicals?
MCAS is dumb. It has few inputs and one output. It has no overall model of aircraft behavior. It just detects a bad angle of attack and cranks the trim to bring the nose down.
The 777 is supposed to handle like a 737. The cockpit controls are reasonably similar, although different enough that transition training is required. Unfortunately, there's no "small 777", a gap in Boeing's product line the 737 Max was supposed to fill. (Or small 757, 767, or 787 variants. How did they go half a century without a new sub-200 seat aircraft?)
[1] https://www.linkedin.com/pulse/analysis-boeing-777-fly-by-wi...
Edited for links : referance to 737-200 Manuel https://www.pprune.org/tech-log/619326-boeing-advice-aerodyn...
https://www.pprune.org/tech-log/619326-boeing-advice-aerodyn...
Then there was the 727 that had four fatal crashes within six months of entering service, which was put down to inadequate training. But it was later found that the high fatality rate was because Boeing had routed fuel lines along the belly, which severed in a hard landing and caused immediate fires. And they severed easily because bizarrely they were aluminium, in order to bring the weight within target...