I am thinking about the 737-MAX crashes. There is a similar question at Is it common for automated control systems to use non-redundant sensors? There was an article in yesterday's Seattle Times In key step for potential late-November ungrounding of Boeing’s 737 MAX, FAA details minimum pilot training which references Why Boeing’s emergency directions may have failed to save 737 MAX.

My thinking is that if the pilots are applying a force to a control which is near the limit of the strength of a human being, then the control system ought to recognize that the pilot is fighting with it. If the control system recognizes that the pilot is fighting with it, then it ought to assume that the pilot knows what he or she is doing, and let the pilot do what he or she wants to do. There might be an indication along the lines of "Are you sure you know what you are doing?".

I order to recognize that the pilot with fighting with the system, I propose adding a strain gauge to the controls. Normally, one should be able to fly the airplane with one hand. If a pilot is using two hands to fly and is using large forces to do so, the strain gauge will detect that (technically, the pilot is stressing the control by applying a force, and the strain gauge is measuring the deformation of the parts the pilot is forcing), and that will tell the automatic system to "let go" and do what the pilot wants to do.

Does this sound like a good idea? I am neither a pilot nor an aeronautical engineer. However, I once worked as a computer programmer in a test lab and I wrote software to test strain guages.

Thank you

  • 8
    $\begingroup$ Hi! Don't get this wrong, but this isn't really a new idea. Autopilot disengage on strong control movement is already a thing in design. It has caused at least one accident, too (but has possibly prevented some). $\endgroup$
    – Therac
    Oct 11, 2020 at 18:46
  • 1
    $\begingroup$ Does this answer your question? Can the autopilot (or stall avoidance system?) of the B737 MAX 8 be overridden by sheer force? $\endgroup$ Oct 11, 2020 at 19:18
  • 5
    $\begingroup$ Questions shouldn't be downvoted simply because they have been considered before. It was well though out, and well worded. $\endgroup$ Oct 11, 2020 at 19:51
  • 1
    $\begingroup$ As far as I know the B737 autopilot responds to light yoke inputs. If you push forward only slightly the autopilot remains engaged but autopilot trim orders for nose up trim are cut off. Similarly it works when you pull on the yoke slightly. (Or was it a different aircraft?) However this system can't be used because the B737Max is aerodynamically too unstable and MCAS was added to increase the column forces to make it feel more stable and to assist the pilot close to a stall. If the system would shut off when the pilot pulls up you can just not install the system and call it a day. $\endgroup$
    – Jan
    Oct 11, 2020 at 20:02
  • $\begingroup$ The question was downvoted because it does not accurately portray the problem with MCAS. MCAS is not an autopilot. It is an automated electric trim control. There were already procedures in place to deal with an electric trim that is not doing what you expect it to. You just turn it off. Both MCAS accidents would have been prevented if they just followed the established procedures that they should have been trained for. $\endgroup$ Oct 12, 2020 at 5:03

1 Answer 1


You actually bring up an interesting point.

The force gradients in the elevator system in a non FBW airplane are set by some form of bungee system, like springs, that you are pulling against. The hydraulics drive the control surfaces and there is no actual tactile feel, beyond what the feel force system imposes (think of fully hydraulic power steering in a big earth mover where there is no mechanical feedback to the steering wheel other than some form of spring centering unit).

The feel force is typically set to increase to about 50lbs at full travel, less at lower speeds and with flaps out, maybe 30lbs. So the "two hand pull" required to get full elevator is there by design. The force gradient is necessary to give the pilot a sense of how hard to pull and tries to approximate the forces on an airplane with mechanical controls.

You could easily design the feel force unit in the airplane to reduce the spring load to make the stick lighter for whatever purpose you want, and modern airplanes with the newer flight data recorders already have force sensors in the control linkage to provide data to the Flight Data Recorder, so the hardware is already there.

Problem is, the force gradient is needed to keep from overcontrolling, and either overstressing the airframe when above "maneuvering speed" or going into an accelerated stall when below it, from making large control inputs.

Where that kind of feature could be useful however, is during stab trim runaways, especially runaways to full nose down, and what happened in the MAX events, which was more or less similar to a ND stab runaway (the MAX's inadequate MCAS architecture got away with it by taking credit for the existing stab runaway procedure as a mitigation).

I've done those sorts of runaway scenarios in the simulator during recurrent training for the CRJs and the full nose down runaway leaves you wishing the feel force could be reduced as you have to continuously hold 20 or 30 or 40 pounds to keep the nose up. It's very unpleasant (in the RJ, the fix was to get the flaps out one way or another, which drastically reduced the required feel force thanks to the pitching moment of the flaps reducing trim speed, plus the feel force reduction that results from flap extension).

To implement what you suggest, you would have to have the feel force system set up to respond to an uncontrolled stab trim runaway by reducing the feel forces. I'm not aware of anyone who has done this, and certification would probably be quite difficult (there will be many many unintended consequences that have to be ironed out, such as how to get the system to decide what a legitimate runaway is in a reliable way, and then how to get around the basic feel force requirements in a temporary way). The certification hurdles are the likely reason this concept has never been done.

  • $\begingroup$ Failsafes within failsafes multiply modes of failure. Consider the drone that, when it loses its GPS signal, retreats to a hover at 100 ft. Guess what happens when it's powered up "safely indoors" in a shed with a steel roof. $\endgroup$ Oct 12, 2020 at 5:08
  • $\begingroup$ Off topic, but I once did the opposite to save a radio-control sailplane whose elevator servo had failed (diagnosed after landing). Fiddling with the flaps regained just enough pitch control to land smoothly. $\endgroup$ Oct 12, 2020 at 5:15

Not the answer you're looking for? Browse other questions tagged .