Can the autopilot (or stall avoidance system?) of the B737 MAX 8 be overridden by sheer force?

Question

A New York Times article from today about the Lion Air Flight 610 crash claims that in order to control the airplane the pilot

could have braced his feet on the dashboard and yanked the yoke, or control wheel, back with all his strength.

Thanks to T.J. Crowder's comment I realize there is not only the autopilot but also a (new?) stall avoidance system installed on this new line of B737s.

Is it true that either one can be overridden by a simple application of sufficient force to the yoke? If so:

• What is the respective underlying mechanism for the systems?
• What force would be necessary, respectively?
• Are both systems designed such that they can be overridden simply by applying an unusually strong force, or would that be just a violent and "unofficial" way to control the yoke despite the systems' best efforts?¹

I understand that the main flight controls of this recent incarnation of the Boeing 737, the MAX 8, are still hydraulic. Does that play a role in the "override by sheer force" possibility?

---

_{¹ A design which would allow a pilot to eventually control the plane just by applying excessive and unusual force (as opposed to perform a complicated series of button presses and/or touch screen actions to disable either system) would in my opinion make a lot of sense as a "panic mode".}

Answer 1

I'm not sure of the full story here, but if you pull the controls of a 737 while the autopilot is engaged the autopilot will trip and the pilots can fly the plane manually. This requires about 25 lbs of force.

There is also a button on the yoke where you can disengage the AP. So if the AP was controlling the plane and going into a violent descent the pilots should have been able to cancel it by pulling the yoke or pushing the button on the yoke or the mode control panel below the windshield.

And no, the controls being hydraulic doesn't play a role in the "override by sheer force" possibility.

Edit:

The autopilot servos are limited to 25 lb of force for single channel operation. Separate force sensors measure pilot column input and the autopilot will disconnect if the force applied by the pilot(s) exceeds 21 lbs.

Source

Answer 2

Most transport category aircraft, including B737, have the elevator, the main surface controlling pitch, attached to a horizontal stabilizer that is also movable. The elevator is controlled using the control column (yoke), while the stabilizer is moved using the trim wheels on the central console.

This arrangement means the command from the elevator is added to the command from the trim. So when the trim is all the way pitch down, the maximum pitch up command the elevator can provide before it hits its mechanical limit is severely limited.

Autopilot: Yes, but…

The autopilot moves the elevator instead of the pilot, and in B737 the yokes actually move as it does so. So the pilots can pull on the yokes to override it. As already mentioned in another answer, the autopilot is limited to force of 25 lbs, so even if it does not disconnect when the pilots apply 21 lbs as designed, they should be able to overpower it—and 25 lbs should not need one to brace too hard anyway.

However, the autopilot also actuates the trim occasionally to transfer the needed pitch command from the elevator to the stabilizer. This reduces drag a bit by eliminating the angle between the stabilizer and elevator, and it means the aircraft will continue to fly straight when the pilots disengage the autopilot.

But it also means the aircraft will be trimmed in whatever way the autopilot left it. If that means it is trimmed far in one way, the pilots ability to give the opposite command with the elevators alone is limited and they need to move the trim too.

MCAS: No

The Maneuvering Characteristics Augmentation System, however, works differently. It does not do anything at all with the elevators and simply adds nose-down trim. If it malfunctions, it will move the stabilizer all the way to the mechanical stop, and in this trim position, the elevator does not have enough authority to keep the nose up at slower speeds.

The yoke will hit mechanical stops at large, but still reasonable force (IIRC 40 or 50 lbs). All the hydraulic cylinders will be at their mechanical limits as well, so applying more force won't help. The elevator can't go any further. The only remedy is to turn off the electric trim—which is used by the MCAS, and by trim switches on the yoke—and adjust the trim using the trim wheels.

Answer 3

With typical hydraulic controls, the mechanical control cable circuit just operates control valves on the hydraulic actuators. The control valves normally only have fairly light centering springs that take only a few pounds of force to overcome. With no other devices in the control circuit, you could move the control column with your pinky finger.

Control feedback forces come from pitch feel devices in the control circuit that use internal spring packs (bungees) and/or roller cam devices to provide a variable resistive force. But the feel units won't drive the circuit, only provide resistance. Two devices can drive the elevator circuit in theory; the autopilot servo and the stick pusher (which is like an autopilot servo that only operates one way).

Autopilot and stick pusher servos have two clutches, a meshing teeth on/off clutch, and a friction slip override clutch. If the A/P servo runs away for some reason, and you can't trigger a disconnect electrically, it is possible to overpower the slip clutch in the servo, but it is like the stick is in not-quite-solidified concrete the whole time you are trying to move it. But you can move it.

The stick pusher servo is similar, but the stick pusher is designed to drive full nose down and release almost immediately.

In any case, if you had an elevator hard over like that and the electrical disconnects (there are usually several difference switches that can perform the disconnect function), the next action would be to operate the mechanical pitch disconnect to separate the left and right elevator circuits. You end up with one free elevator, which will give some control, at least enough to neutralize the overall input.

One possibility is the shock and surprise of the event, whatever it was, overwhelmed the crew and they didn't follow through on all the memory items for that kind of emergency. At this point, who knows.

Also remember that media stories on these kinds of incidents are almost always wildly inaccurate. Anyone who has worked in any kind of technical specialty and reads media reports related to their specialty knows that they are wrong most of the time.

Answer 4

Out of trim is no way to fly

The issue with the B737MAX as detailed in the Emergency Airworthiness Directive from Nov. 7, 2018 is not that the plane is applying a nose-down elevator input through the autopilot servos — this would be trivial for the pilots to overcome, even if the servos failed to declutch when the pilots pulled the yoke. The problem is that the aircraft may be applying a repetitive, nose-down pitch trim input to the stabilizer trim system (essentially, an autotrim command), and to quote our very own Capt. Casey Webster, "an out of trim transport category airplane can be a beast to fly".

In other words, an out-of-trim situation in a transport category aircraft can lead to quite high control forces, hence the reference you saw about the pilot bracing their feet on the instrument panel and pulling with all their might to overcome the grossly nose-down stabilizer trim. (Of course, you'd want the other pilot to cut out the trim motors while holding onto the trim wheel with a free hand to keep the trim situation from getting worse.)