In the aftermath of the crash in Indonesia of Lion Air Flight 610, pilots have been rightly concerned about what role a new and previously little-understood automated safety system might have played in the tragedy. The plane that crashed in late October was a brand-new Boeing 737 Max, and in preliminary reports, investigators pointed to failed sensors as a likely contributing cause of the crash. The pilots of the 737 seemed baffled by the behavior of the plane, which had experienced malfunctions on previous flights. In fact, airline mechanics had replaced sensor equipment the very day before the accident.
The outcome was horrific. After the pilots were unable to gain control of the jet after fighting for their lives for nearly the duration of the 11-minute flight, the jetliner crashed into the ocean from a clear blue sky. All 189 occupants perished in an accident that never should have happened.
Subscribe today to Plane & Pilot magazine for industry news, reviews and much more delivered straight to you!
The leading theory behind why failed sensors could wreak such havoc is perhaps even more frightening. Unlike older 737s, the Max is equipped with a system called maneuvering characteristics augmentation system (MCAS), which is a form of envelope protection. Envelope protection is automation designed to prevent pilots from maneuvering the plane outside the normal operating envelope. With MCAS, the system will prevent loss of control of various kinds, including heading off aerodynamic stalls before they happen, pushing the nose down. It sounds simple enough, right?
But with malfunctioning sensors, the MCAS in the accident plane may have been working with bad information, and instead of preventing an accident, critics of the system say, it might have precipitated one.
How so? This is how the theory goes. If the MCAS, getting data from compromised sensors, thought the plane was slow, it would have attempted to lower the nose to prevent a stall, a stall that it was not really entering. While doing this, the plane descended ever lower and built speed—it was already going plenty fast enough—while the pilots continually attempted to override the system. That system, experts say, would have reengaged after a short delay every time, repeatedly lowering the nose and building speed.
On previous models of 737, pulling back on the control column, the most natural of reactions, would interrupt what surely seemed to the pilots like a runaway trim situation. With MCAS, this response would do nothing. Instead, the pilots, in order to fly the plane normally, needed to pull the MCAS circuit breakers and then retrim the control surface by using the manual stabilizer trim wheels. All signs indicate that the pilots did not do that and had had no special training in what response to make in such a dire circumstance.
Boeing says that the new procedures—to pull the MCAS breakers and then hand trim—were not specifically called out on the 737 Max because they were already contained in the aircraft’s manuals and are consistent with previous techniques. I won’t go into the specifics of this issue, as it is outside the scope of this piece, which is intended for pilots of Part 23 GA planes.
But suffice it to say that the pilots of Lion Air 610 were put in a tough spot, trying to fly an airplane while troubleshooting complex sensor and automation issues they were surprised by and poorly equipped to understand, let alone troubleshoot in the heat of battle.
Lessons To Learn
For all pilots who fly or will fly planes with cockpit automation, the bottom line is this: Automation can kill, when it’s not saving your life, that is, so we need to know what the potential failure modes are on the airplanes we fly and how to overcome them…immediately.
Not many of us are ready to respond to such emergencies, as few of us have much training in using or managing flight control systems. Part of that is surely the fault of the system, and part of it is surely due to the rapid adoption of new, affordable and sophisticated digital avionics in light aircraft.
The FAA’s practical test standards guidance for the instrument rating does a surprisingly good job of addressing automation. Pilots taking a check ride are expected to understand and be able to use the autopilot to intercept courses and conduct missed approaches. It should be noted, however, that nothing requires the use of an autopilot during the flight test or even for the examiner to ask about autopilots if one is not installed. Less is expected of pilots taking the private pilot check ride. The standards publication uses the word “autopilot” just once, and even then it is mentioned in passing when discussing systems that the pilot applicant might be tested on. The standards do require the applicant to demonstrate the use of automation, if it is installed, and it directs the examiner to cover this subject in both the ground and flight test portions of the check ride.
And pilots, like me, who did check rides before the new, improved practical test standards came out are likely to be even less well prepared. I recently posted a non-scientific survey of pilots and asked them a single question: Would they be able to, without referencing a manual or reading placards, be able to very quickly disable the electric trim in their airplane? Around 30 percent of them said that they could not. Now, bear in mind that this is the type of question that lends itself to false “yes” responses or to people declining to take part in the survey if the answer is embarrassing, and no pilot likes to admit that they are in the dark over how to respond to an emergency situation. Still, around 30 percent of the respondents said that they did not know how to disable their electric trim system. And I’m guessing that at least a few of the pilots who responded “yes” were practicing wishful thinking, hoping they’d know what to do in a trim runway situation and therefore taking credit for knowing. My guess is that around half of non-commercial pilots could disconnect the electric trim in their plane quickly. That might be a charitable assessment, too. And understanding and being able to address a runway trim problem is only part of the picture.