Non-pilot acquaintances who know of my aviation background often ask about the Boeing 737 Max and its MCAS system. I do my best to explain what the MCAS system is designed to do, and how it works.
I tell them MCAS moves the pitch trim to add force to the controls under some conditions of airspeed, CG and other factors. I also explain that if MCAS runs amuck, as it possibly did in the two fatal accidents involving the 737 Max, the situation is no different than a trim runaway, a failure we pilots have always been trained to handle.
Many are amazed that the MCAS system doesn’t have multiple backup modes to detect failures and disable the system. I say that’s what the pilots are for. The pilots are the backup to the automated system in airplanes of the certification vintage of the 737.
When the pitch trim system runs away, the pilot has multiple methods of disabling it. The first line of defense is a button under the pilot’s thumb. There are also switches, and in most airplanes, a circuit breaker than can be pulled to totally depower the trim system.
This information doesn’t sit well with most non-pilots. It seems like too complicated a task for people to reliably perform every time.
What really blows away the non-pilot is when I explain how critical systems such as autopilots and pitch trim are certified. The rules are that test pilots must recognize the trim failure, for example, by some positive event such as seeing the trim wheel moving un-commanded, or sensing an unexpected force on the flight controls.
Once that positive identification is made, the test pilot must wait exactly three seconds before taking the proper action to disable to system. The FAA calls those three seconds “recognition time.” During the final stages of a landing approach, the recognition time is reduced to 1.5 seconds in the belief the pilot is paying closer attention during that critical phase of flight.
When non-pilots hear this information, their mouths drop open. They utter something like “that’s crazy. Three seconds! That’s just nuts.”
In my career of flying with so many test pilots, and writing about certification programs and standards, the three seconds sounded totally logical to me. Count them out in your head. Three seconds is lots of time to get the thumb of your flying hand on a button on the control wheel.
And this belief in the rationality of the recognition time was reinforced every year or more during simulator training. At least one pitch trim runaway is part of every initial or recurrent simulator training program. Sim instructors often send the trim off on a run during high workload periods such as when configuring for landing when the flaps and gear extension are changing the stick force. The more diabolical instructors will introduce a trim runaway during those brief periods of cruise flight in the sim when the autopilot is flying and your reading a checklist or studying the procedure for the next approach. Identifying a trim runaway in straight and level cruise with everything working fine can be the most difficult.
Even though the Level D sims jet pilots train in faithfully reproduce the behavior and flying qualities of the actual airplane, sim training is not the real world of flying. In the sim we are all primed at every moment for something to fail, because it usually does. Over the years I’ve learned to keep my right knee pushed against the trim wheel on airplanes that have a wheel, such as the Citation family, so I feel the trim runaway moving the wheel instantly. That works great in the sim, but in real life flying do I do that? Of course not. Nobody does.
And that’s the root of the myth of the perfect pilot. During training and checking, we all must meet a standard that is essentially perfect. In the case of a trim runway, we must demonstrate without fail that we do in fact recognize the failure during the three-second period, and react properly to recover.
In the past, the perfect pilot was essential for development and certification of airplanes. It has been either technically impossible, or too costly, to include enough monitors to automatically detect and handle the failure of critical systems such as pitch trim. The pilots were the backup, both as monitor, and then as a “system” to recover from the failure.
It turns out that pilots have been mostly perfect. Trim failures do happen, but in nearly all situations, the crew reacts correctly and the flight continues to a safe landing. Of course there have been fatal accidents caused by trim failures, and not just a few, but they are small in number compared to the total number of flights.
But at the jet level, flying has become so safe, that even a small number of accidents deemed acceptable even 25 years ago, is no longer tolerable. And electronic advances make it possible to include at least triple-redundant monitoring and sensing in critical flight control systems. Fly-by-wire (FBW) control systems—which all newer designed larger jets employ—use triple redundant computers and sensors to operate all flight controls, including trim. Pilots’ movement of the cockpit controls are the equivalent of moving the mouse on your desktop computer.
If you believe that the public has more confidence in a well-trained and experienced human pilot than in a FBW automated control system, try explaining the three-second recognition time. Once they understand that human pilots have three seconds to recognize pending disaster, and take the proper action to prevent a crash every time without fail, the public wants the multiple backups of FBW computers.
If you don’t believe me, read and listen to coverage of the 737 Max situation. The very idea that human pilots must be relied on to disable a malfunctioning critical flight control system stuns the media and, according to polls, the flying public. It doesn’t matter that the vast fleet of 737s—the most common jet airliner in the world—flies on with a pitch trim system that can run away, and that pilots must recognize and respond correctly to prevent a crash. That fact hasn’t been brought to public attention. The three-second recognition time is never mentioned, or even understood. If it was, the media and public would be as alarmed as they are about the MCAS system on the Max. They trust pilots, but unlike many of us who are pilots, the public knows there is no perfect pilot.