Stab Trim Runaway in PSX and 737 MAX

[torrence]

I was interested in the discussions in the media re recent 737 MAX incidents, probably associated with the automatic AOA limiter (MCAS, I think).  As I understand the Boeing directives after the Lion Air accident, they are saying that the correct response for stab trim runway is the same, regardless of the cause of the unscheduled trim motion, as on other older 737 versions (without MCAS) - using the Stab Trim Cutout switches. 

I assume this is similar to the 747 non-normal checklist for STAB TRIM UNSCHD.  My summary from 747 FCOM

1. Cutout switches to 'Cutout', autopilot disengage followed by 2. Cutout 2 to AUTO, check for correct stab movement, 3. If Yes, reengage Autopilot and normal operation, 4. If No, Cutout 2 to CUTOUT and repeat for Cutout Switch 3, 5. If normal stab movement not restored, proceed with both Cutouts in CUTOUT and no autopilot, prepare for landing with the note that "higher than normal control column force may be required to prevent unwanted pitch change". 

Leaving aside somewhat confusing terminology in the check list (e.g. the 'normal' positions of the cutout switches are 'AUTO', not 'CUTOUT'), this seem fairly straightforward if you have trained for it in the simulator etc. and in PSX this checklist seems to work for the two types of Stab trim runaway malfunctions under the Airframe tab - although I don't know exactly how Hardy causes these malfunctions (magic code).

What I wondering about though, if I've understood this correctly, is how the Checklist procedure addresses the root cause of the runaway trim in the MAX case - would the Cutoff switches simply take the MCAS out of the system?  In which case I'd assume the correct procedure would also include taking other steps - not necessary in the older 737 versions - to avoid getting into the stall region.   

Sorry if this sounds a bit confused, but I am ...

Cheers,
Torrence

[Jeroen Hoppenbrouwers]

Of course the 744 does not have MCAS stick pusher magic.

The Cutout switches do just that -- they kill the inputs to the hydraulic motors moving the stabilizer. It does not matter what system caused those inputs as far as I know. On the 744 the autopilot will trim out long-term column forces (autotrim) and the pilots can use the trim switches for manual trim. I don't think there is a specific switch to only cut out the autotrim but retaining the manual trim? You should disengage the autopilot if your do not want autotrim but keep manual trim, I think.

I think, but don't know, that on the 737 the system is similar. MCAS is just another input. You cannot just kill MCAS if you suspect it. The reasoning likely is that you have no real means to diagnose. You notice unscheduled stab trim (runaway) which is a direct, immediate threat to flight safety. Kill it! After that, just aviate and see how you can stay safe.

MCAS runaway due to AoA sensor malfunction is two or three steps away from the stabilizer, but still can be solved by the cutout switches. Of course it does not solve the AoA sensor problem, and therefore you still need to keep flying with all eyes and brain cells at max to get through it. But you get rid of one immediate threat.


Hoppie

[United744]

IMHO Boeing have simply added another failure path, and one that has big problems at that.

It wouldn't surprise me if in the future there is a AD requiring the MCAS system be disabled on all 737 MAX.

I see what they're trying to do, but they haven't thought the system through thoroughly enough.

How many AoA probes does the MCAS actually use? A compare between them all and auto-degrade or auto-fail on data mis-match seems to be completely missing from the system, and it seems it is just driving the stab based on the worst probe reading??

[Jeroen Hoppenbrouwers]

A 737 is a simple aircraft, compared to the bigger Boeings and most Airbusses. It's the same design as in 1967 with a few bells and whistles. Multilayer redundancy does not fit into this design and I am actually wondering why MCAS made it into it in the first place.

The radio altimeter had the same problem: Turkish 1951 went down because one of the R/A went berzerk while the other one happened not to be used by the flare logic. Should have been caught easily -- wasn't, crashed.

Somewhere the MCAS must have been thought to increase safety by catching a common pilot error. I wonder how common it is to stall a 737 with flaps up, i.e., when not maneuvering near the ground? It would not have saved 1951 either. But Mr. Boeing does not lightly add stuff to their cash cow. There must be reasoning behind it.


Hoppie

[torrence]

Recent NYT story indicates that the reasons behind the decision to include the MCAS are more complicated that just adding another gizmo.  The background includes Boeing desire to compete with upcoming Airbus designs for fuel efficient mid-models - which led to larger, more fuel efficient engines, which had to be mounted higher (for ground clearance) and more forward, which led to the potential for destabilization at low speeds, high bank angles etc. etc.
MCAS was introduced to prevent this while making the 'feel' of the MAX similar to the older models and avoiding the need for more extensive transition training for pilots etc. Complicated. 

NYT link:  https://www.nytimes.com/2019/02/03/world/asia/lion-air-plane-crash-pilots.html

Cheers,
Torrence

[torrence]

PSX Malfunctions/Airframe has two Stab trim runaway cases "no cutout" and "stoppable"

The stoppable case has Severe and Else sub-cases. 
In the Else case, the auto cutout works, and apparently takes care of the problem - you get EICAS messages but no control problems.

In the Severe case - following the checklist that I summarized above will solve the problem once you get on a working hydraulic system, and you can return to Autopilot if desired.

Not sure exactly how the "no cutout" pitch cases (up and down) work.

Cheers,
Torrence

[Hardy Heinlin]

The "stoppable" malfunction scenarios start when stab trim motion is commanded by the pilot or autopilot. If severe, it will only stop by manual cutout; else by manual cutout or autocutout.

The "non-stoppable" malfunction scenarios start immediately upon malfunction activation. If severe, it will move nose down, else nose up.


Cheers,

|-|ardy

[torrence]

Thanks, Hardy

I wasn't clear about the 'non stoppable' malfunction.  What I couldn't find was the appropriate checklist or info for how to handle it.  The couple of times I tried it, I think I just applied yoke force to counteract and stay level and the runaway stopped.  Is there a procedure in one of the QRH sources for this condition?

Cheers,
Torrence

[Hardy Heinlin]

I guess the only thing you can do is compensate the stab mistrim by extreme elevator deflection and by selecting a suitable airspeed and flap configuration.

This will probably never happen on a real 747, but I've seen this malfunction simulation on level-D 744 sims. As far as I recall, the aircraft is required to remain flyable by the elevators when the stab trim is fully deflected. With this malfunction you can demonstrate it :-)


Cheers,

|-|ardy

[Jeroen Hoppenbrouwers]

As far as I recall, the aircraft is required to remain flyable by the elevators when the stab trim is fully deflected.

I would love to believe this, safety-wise, but I fear the elevators must be so large to be able to counteract the whole stabilizer plane at extreme settings, that they would become unwieldy?


Hoppie

[Hardy Heinlin]

They are very large.

Unwieldy -- yes. But not totally inoperative.

[torrence]

They are very large.

Unwieldy -- yes. But not totally inoperative.

Question re the Stab trim runaway no cutout - Severe malfunction

I was actually surprised that in PSX this didn't actually create many difficulties.  When I tried this in cruise at FL360 with autopilot engaged, I got EICAS messages >AUTO PILOT, Stab trim unschd, > No Autoland.  and the noise down trim gradually went to 2.  But the Autopilot remained engaged and kept the aircraft level. No other effects that I could see immediately (i.e. Progress page predicts etc. didn't show any major changes).

When I disconnected Autopilot myself it was indeed hard to keep level with constant pressure on the yoke and autopilot could be re-engaged.

Status page after all of the above had two lines
STAB AUTO CUTOUT
STAB TRIM UNSCHD

Should this really be harder, or can the autopilot really handle extreme trim deflection without major problems?

[Hardy Heinlin]

Well, the autopilot is stronger than human muscles :-)

If there are two pilots on the deck, it may be a good idea to have both pilots pulling on the yoke, or at least hand the job over to the other pilot every minute or so.


Cheers,

|_|ardy


A thought for flight control designers: How about disconnecting the elevator feel force in such scenarios?

[John H Watson]

It would be interesting to see who would win between the pilot and the autopilot if there were not mechanisms to allow the pilot to override the autopilot. Some actuators have tiny pistons driving levers with the moment arm of a bicycle pedal crank. The pilots have yokes and control columns with better leverage. The autopilot aileron actuators can be overridden with just 12lbs (5.44Kg) of force at the yoke, but this is partly because of the override systems.
The major forces involved in controlling aircraft are further down the line and may involve several stages of force amplification.

The control system is only as strong as its weakest link. If extreme inputs are put into elevators, the elevators can buckle. I've seen bent sheet metal on an elevator of an aircraft where the pilots have used excessive force on the controls during a TCAS manoeuvre. Note that some control surfaces also have blown down mechanisms to help prevent damage by this kind of thing. Elevator feel may still be necessary.

[Jeroen Hoppenbrouwers]

Ok, next time I need to fly a 747, I will take this with me in the pilot's seat, just in case: