14
$\begingroup$

A New York Times article from today about the Lion Air Flight 610 crash claims that in order to control the airplane the pilot

could have braced his feet on the dashboard and yanked the yoke, or control wheel, back with all his strength.

Thanks to T.J. Crowder's comment I realize there is not only the autopilot but also a (new?) stall avoidance system installed on this new line of B737s.

Is it true that either one can be overridden by a simple application of sufficient force to the yoke? If so:

  • What is the respective underlying mechanism for the systems?
  • What force would be necessary, respectively?
  • Are both systems designed such that they can be overridden simply by applying an unusually strong force, or would that be just a violent and "unofficial" way to control the yoke despite the systems' best efforts?1

I understand that the main flight controls of this recent incarnation of the Boeing 737, the MAX 8, are still hydraulic. Does that play a role in the "override by sheer force" possibility?


1 A design which would allow a pilot to eventually control the plane just by applying excessive and unusual force (as opposed to perform a complicated series of button presses and/or touch screen actions to disable either system) would in my opinion make a lot of sense as a "panic mode".

$\endgroup$
  • 7
    $\begingroup$ It's not clear from that article that it was the autopilot that the captain would have had to overcome. It's a "system" on the MAX 8 designed to kick in automatically to correct a stall. The speculation is that it got bad data and "corrected." I think we can safely assume that if the plane had been on autopilot and suddenly pitched nose-down, the pilot would have pulled back on the yoke with more than the force required to disengage the autopilot. Based on Boeing's guidance (kill power to tail stabilizers), the "system" isn't the autopilot, but smth else -- and apparently harder to overcome. $\endgroup$ – T.J. Crowder Nov 9 '18 at 15:16
  • 1
    $\begingroup$ @T.J.Crowder Oh, that is an interesting point. Thanks. $\endgroup$ – Peter A. Schneider Nov 9 '18 at 15:18
  • 4
    $\begingroup$ The system in question only applies when the autopilot is NOT engaged. $\endgroup$ – Ben Nov 9 '18 at 20:27
  • $\begingroup$ I asked a very similar question about the Airbus varient relating to the Hudson River incident $\endgroup$ – Cloud Mar 14 at 9:20
7
$\begingroup$

Most transport category aircraft, including B737, have the elevator, the main surface controlling pitch, attached to a horizontal stabilizer that is also movable. The elevator is controlled using the control column (yoke), while the stabilizer is moved using the trim wheels on the central console.

This arrangement means the command from the elevator is added to the command from the trim. So when the trim is all the way pitch down, the maximum pitch up command the elevator can provide before it hits its mechanical limit is severely limited.

Autopilot: Yes, but…

The autopilot moves the elevator instead of the pilot, and in B737 the yokes actually move as it does so. So the pilots can pull on the yokes to override it. As already mentioned in another answer, the autopilot is limited to force of 25 lbs, so even if it does not disconnect when the pilots apply 21 lbs as designed, they should be able to overpower it—and 25 lbs should not need one to brace too hard anyway.

However, the autopilot also actuates the trim occasionally to transfer the needed pitch command from the elevator to the stabilizer. This reduces drag a bit by eliminating the angle between the stabilizer and elevator, and it means the aircraft will continue to fly straight when the pilots disengage the autopilot.

But it also means the aircraft will be trimmed in whatever way the autopilot left it. If that means it is trimmed far in one way, the pilots ability to give the opposite command with the elevators alone is limited and they need to move the trim too.

MCAS: No

The Maneuvering Characteristics Augmentation System, however, works differently. It does not do anything at all with the elevators and simply adds nose-down trim. If it malfunctions, it will move the stabilizer all the way to the mechanical stop, and in this trim position, the elevator does not have enough authority to keep the nose up at slower speeds.

The yoke will hit mechanical stops at large, but still reasonable force (IIRC 40 or 50 lbs). All the hydraulic cylinders will be at their mechanical limits as well, so applying more force won't help. The elevator can't go any further. The only remedy is to turn off the electric trim—which is used by the MCAS, and by trim switches on the yoke—and adjust the trim using the trim wheels.

$\endgroup$
  • $\begingroup$ This is in line with what I have read in the meantime, and makes complete sense. It appears to contradict the Times article though ("with all his strength"). It's well possible that that statement was wrong because of an incomplete understanding of the technical situation at the time of its writing. Although 25 lbs (the weight of a large bucket of water) horizontal force are significant, and one may wish to push against something to sustain it, I'm not sure it qualifies as "with all strength". $\endgroup$ – Peter A. Schneider Feb 16 at 11:20
  • $\begingroup$ The relevant points here are that (1) the yoke force is not directly translating to hydraulic pressure but instead controls valves which have hard technical limits (all open, all closed); and (2) that the elevators also have a hard technical limit which is not sufficient to compensate for an all-out mis-trim of the horizontal stabilizers. Both make it impossible to compensate an all-out wrong trim through yoke forces. $\endgroup$ – Peter A. Schneider Feb 16 at 11:24
  • 1
    $\begingroup$ @PeterA.Schneider, indeed, this is not the first accident where inability compensate for incorrect trim with elevators was important contributing factor. Aeroflot flight 141 and XL Airways Germany flight 888T come to my mind. In the first, there is no official conclusion, but incorrect manipulation with trim is considered to be a likely cause, in the later the fact the aircraft was trimmed nose high (and autotrim went offline) from the slow flight made the stall recovery harder. $\endgroup$ – Jan Hudec Feb 16 at 11:50
  • $\begingroup$ "25 lbs should need one to brace too hard anyway." Did you mean "should NOT need"? $\endgroup$ – mike Mar 13 at 18:24
  • $\begingroup$ @mike, thanks, corrected. $\endgroup$ – Jan Hudec Mar 14 at 9:02
12
$\begingroup$

I'm not sure of the full story here, but if you pull the controls of a 737 while the autopilot is engaged the autopilot will trip and the pilots can fly the plane manually. This requires about 25 lbs of force.

There is also a button on the yoke where you can disengage the AP. So if the AP was controlling the plane and going into a violent descent the pilots should have been able to cancel it by pulling the yoke or pushing the button on the yoke or the mode control panel below the windshield.

And no, the controls being hydraulic doesn't play a role in the "override by sheer force" possibility.

Edit:

The autopilot servos are limited to 25 lb of force for single channel operation. Separate force sensors measure pilot column input and the autopilot will disconnect if the force applied by the pilot(s) exceeds 21 lbs.

Source

$\endgroup$
  • 2
    $\begingroup$ I'm not sure why they constructed the plane this way. But my guess is that the underlying cause is margin for error without disconnecting the AP. 21-25 lbs of force is not really that much especially not in an emergency, just give the yoke a solid "pull" and it'll be enough. Keep in mind it's force and not pressure $\endgroup$ – Douglas Pettersson Nov 9 '18 at 12:17
  • 3
    $\begingroup$ @curious_cat I would assume that it's a safety requirement that disengaging the autopilot requires a conscious act by the pilots. 21 lbs of force are probably high enough to not be exerted accidentally but still low enough to be produced ad hoc. (21 lbs seem to contradict the "feet on the dashboard" bit in the article. OK, maybe one needs a bit of pushing against the dashboard because it's a horizontal force.) $\endgroup$ – Peter A. Schneider Nov 9 '18 at 13:05
  • 1
    $\begingroup$ Just to give a reference point for how much strength it takes to overcome the autopilot, the spark plugs on my Cherokee take 30-35 foot-pounds of torque. It takes no effort on my part to tighten them. $\endgroup$ – JScarry Nov 9 '18 at 14:42
  • 1
    $\begingroup$ @curious_cat To avoid accidental a/p disconnect. Even with this requirement, there have still been a couple of crashes caused by inadvertently disconnecting the a/p by knocking against the yoke, so some aircraft don't let you disconnect the autopilot this way. $\endgroup$ – Dan Hulme Nov 10 '18 at 10:06
  • 3
    $\begingroup$ @curious_cat Aeroflot 593, Eastern 401. Opposite failure to disconnect would be China Airlines 140. $\endgroup$ – user71659 Nov 10 '18 at 18:56
6
$\begingroup$

With typical hydraulic controls, the mechanical control cable circuit just operates control valves on the hydraulic actuators. The control valves normally only have fairly light centering springs that take only a few pounds of force to overcome. With no other devices in the control circuit, you could move the control column with your pinky finger.

Control feedback forces come from pitch feel devices in the control circuit that use internal spring packs (bungees) and/or roller cam devices to provide a variable resistive force. But the feel units won't drive the circuit, only provide resistance. Two devices can drive the elevator circuit in theory; the autopilot servo and the stick pusher (which is like an autopilot servo that only operates one way).

Autopilot and stick pusher servos have two clutches, a meshing teeth on/off clutch, and a friction slip override clutch. If the A/P servo runs away for some reason, and you can't trigger a disconnect electrically, it is possible to overpower the slip clutch in the servo, but it is like the stick is in not-quite-solidified concrete the whole time you are trying to move it. But you can move it.

The stick pusher servo is similar, but the stick pusher is designed to drive full nose down and release almost immediately.

In any case, if you had an elevator hard over like that and the electrical disconnects (there are usually several difference switches that can perform the disconnect function), the next action would be to operate the mechanical pitch disconnect to separate the left and right elevator circuits. You end up with one free elevator, which will give some control, at least enough to neutralize the overall input.

One possibility is the shock and surprise of the event, whatever it was, overwhelmed the crew and they didn't follow through on all the memory items for that kind of emergency. At this point, who knows.

Also remember that media stories on these kinds of incidents are almost always wildly inaccurate. Anyone who has worked in any kind of technical specialty and reads media reports related to their specialty knows that they are wrong most of the time.

$\endgroup$
  • $\begingroup$ Thanks for the details. (Btw, I have more confidence in the NYT than in most others. They pay a lot of attention to factual correctness and do publish corrections. If you think the article is factually incorrect don't hesitate to send a correction; they surely appreciate it.) $\endgroup$ – Peter A. Schneider Nov 9 '18 at 13:49
  • 1
    $\begingroup$ Keep in mind that the both the Boeing OMB and the FAA EAD refer to the spurious aircraft inputs as pitch trim (stabilizer) inputs, not as pitch (elevator) inputs. $\endgroup$ – UnrecognizedFallingObject Nov 10 '18 at 1:56
6
$\begingroup$

Out of trim is no way to fly

The issue with the B737MAX as detailed in the Emergency Airworthiness Directive from Nov. 7, 2018 is not that the plane is applying a nose-down elevator input through the autopilot servos — this would be trivial for the pilots to overcome, even if the servos failed to declutch when the pilots pulled the yoke. The problem is that the aircraft may be applying a repetitive, nose-down pitch trim input to the stabilizer trim system (essentially, an autotrim command), and to quote our very own Capt. Casey Webster, "an out of trim transport category airplane can be a beast to fly".

In other words, an out-of-trim situation in a transport category aircraft can lead to quite high control forces, hence the reference you saw about the pilot bracing their feet on the instrument panel and pulling with all their might to overcome the grossly nose-down stabilizer trim. (Of course, you'd want the other pilot to cut out the trim motors while holding onto the trim wheel with a free hand to keep the trim situation from getting worse.)

$\endgroup$
  • 2
    $\begingroup$ Speculating about accidents that are under investigation is off-topic on this site. That's why the question has been updated to be about aircraft systems in general. Please edit your answer to match the question, or you can choose to delete it if you don't have anything to say about the question. $\endgroup$ – Dan Hulme Nov 10 '18 at 10:11
  • 2
    $\begingroup$ I edited the answer to remove the reference to JT610. This answer is valuable since it addresses and clarifies the core issue (thus improving my own muddled understanding). $\endgroup$ – Peter A. Schneider Nov 10 '18 at 12:00
  • 1
    $\begingroup$ It's worse, really. The stabilizer (trim) and elevator commands are additive, so nose-down trim reduces the maximum nose-up command that can be given. $\endgroup$ – Jan Hudec Feb 15 at 22:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.