The media uproar created by two fatal accidents in new Boeing 737 MAX airline jets makes me wonder if Boeing, or any transport jet maker, can continue to trust pilots to be a critical part of aircraft systems. Let me explain.
Because the new MAX version of the 737 has heavier engines and other changes, Boeing added a system that under certain conditions of airspeed, CG location and weight, automatically moves the pitch trim to modify stick force. The pilot who is hand flying feels this as though he is pulling on the yoke and would naturally reduce pull force to lower the nose and angle of attack (AOA).
In the non-aviation media, this system is being called everything from new, to radical, to untested. In reality, nearly all airplanes larger than a basic four-seat piston single use some sort of device to alter the forces a pilot feels while maneuvering the airplane.
Stick force—the load we pilots feel as we pull or push the airplane nose away from its stable trimmed airspeed—is critical for safety. If an airplane had no force feedback on the stick as the nose dropped, or worse, rose, it would be very difficult to fly. And almost impossible to fly for long periods, or in the clouds. That’s why maneuvering stick force is a strict certification requirement.
In light airplanes, the certification rules require that the stick force be positive. In other words, it must always take a pull force to slow the airplane from its stable airspeed no matter the location of the CG, the airspeed, or the configuration of the airplane.
In transport airplanes like the 737, the rules require a linear stick force gradient. And the rules also specify minimum stick forces in pounds of pull or push to maneuver the airplane away from its trimmed condition. Achieving positive stick force under all conditions is hard, but creating a linear force that builds steadily with each increment of airspeed change is really hard. And that’s what Boeing must do to certify its jets.
In general aviation airplanes, designers frequently put a spring in the elevator control cable system that pulls the elevator down. The spring pull is what we feel as positive stick force in addition to the natural air loads on the elevator. If the natural aerodynamic forces aren’t always positive, the spring delivers the certification requirement.
If you don’t believe me, sit in a Bonanza A36 or Cessna 210, or just about any other high-performance piston airplane, and pull the wheel back while sitting still on the ramp. That force you feel is mostly a spring, not the weight of the elevator, which, by the way, is statically balanced.
Often a spring isn’t enough to create positive stick force under all maneuvering conditions so designers add a bob weight to the pitch control system. The bob weight is a weight mounted somewhere in the pitch control circuit so that any G load acts on the weight pulling the control wheel forward. The higher the G load, the greater the force of the weight.
Most artificial pitch force feel devices are aimed at increasing nose-down stick force because that’s the most difficult to achieve when maneuvering. And pitching up is much more critical than down because the uncontrolled pitch up will eventually lead to a stall.
What the much ballyhooed system in the 737 MAX does is sense an increasing AOA when the pilot is hand flying the airplane. When the AOA reaches a point without enough stall margin, the system adds some nose-down pitch trim. That pitches the nose down and gives the pilot the stick force to know that he is pulling too close to the stall margin.
This concept of adding artificial feel using the pitch trim has been around for years. It has been used to add stick force at high speed cruise where Mach effects can alter stick force as well as at higher AOA where stall margins must be maintained.
What’s critical to the current, mostly uninformed discussion is that the 737 MAX system is not triply redundant. In other words, it can be expected to fail more frequently than one in a billion flights, which is the certification standard for flight critical systems and structures.
What Boeing is doing is using the age-old concept of using the human pilots as a critical element of the system. Before fly-by-wire (FBW) came along, nearly all critical systems in all sizes of airplanes counted on the pilot to be a crucial part of the system operation.
The certification concept for relying on the human involves identification of a failure, and a reaction time. The way it works is that the pilot must be able to recognize the failure, then take three seconds to analyze what is wrong, and then take corrective action before the airplane flies into a critical condition.
If you fly an airplane with an electric pitch trim system, you are flying under this certification concept. A pitch trim system running away can obviously fly the airplane into a dangerous condition, particularly when the autopilot is engaged which masks the trim runaway for some time.
The manufacturer seeking certification of the trim system and the FAA agree on what it will take to allow the pilot to identify a trim failure. It could be the airplane deviating from the desired flight path. Or a trim monitoring system with enough redundancy. Or, in years past, simply seeing the trim wheel moving on its own could have been enough.
Experimental test pilots introduce the trim failure, wait for the agreed identification condition, and then wait three more seconds before taking the prescribed recovery actions. In all airplanes I know of, the recovery is—including the 737 MAX—to shut off the system using buttons on the control wheel then a switch, or sometimes circuit breaker to make a positive disconnect.
Though the pitch system in the MAX is somewhat new, the pilot actions after a failure are exactly the same as would be for a runaway trim in any 737 built since the 1960s. As pilots we really don’t need to know why the trim is running away, but we must know, and practice, how to disable it.
The problem for Boeing, and maybe eventually all airplane designers, is that FBW avoids these issues. FBW removes the pilot as a critical part of the system and relies on multiple computers to handle failures.
Boeing is now faced with the difficult task of explaining to the media why pilots must know how to intervene after a system failure. And also to explain that airplanes have been built and certified this way for many decades. Pilots have been the last line of defense when things go wrong.
What makes that such a tall order is that FBW airplanes – which include all the recent Airbus fleet, and the 777 and 787 from Boeing – don’t rely on the pilots to handle flight control system failures. FBW uses at least a triple redundant computer control system to interpret the inputs of the cockpit controls by pilots into movement of the airplane flight controls, including the trim. If part of the FBW system fails, the computer identifies the faulty elements and flies on without the human pilots needing to know how to disable the failed system.
I know, I know, you’re yelling, “What about the Air France Airbus over the Atlantic?” It was determined that all three pitot tubes on the airplane froze robbing the FBW system, and the human pilots, of airspeed and other air data at night and in an area of thunderstorms. The pitot tubes were thought to have enough heat to prevent that, but those extreme conditions were outside the certification envelope. And certification theory also thought the engines on the Airbus Sully and Skiles were flying were far enough apart that large birds wouldn’t take out both. Was that one in a billion? Probably.
I have been fortunate enough to fly several FBW airplanes and I find the simplicity and excellent flying qualities, weight savings, and potential efficiency gain, to be an important advance. But, as a pilot, I also want to believe that being part of the redundant requirements for critical systems is still acceptable.
But airline accidents have become so rare I’m not sure what is still acceptable to the flying public. When Boeing says truthfully and accurately that pilots need only do what they have been trained to do for decades when a system fails, is that enough to satisfy the flying public and the media frenzy?
I’m not sure. But I am sure the future belongs to FBW and that saying pilots need more training and better skills is no longer enough. The flying public wants to get home safely no matter who is allowed to be at the controls.