Pilots Have 40 Secs to Try to Save 737 MAX 8 if Autopilot Malfunctions

The ongoing crisis for Boeing over their 737 MAX 8 aircraft continues as a new report by the New York Times shows that pilots had less than 40 seconds to try to save the plane from a crash in flight simulation tests.

Test Flights in Simulator Reveals High Stakes Sequence of Events

In the ongoing investigation of the crash of Ethiopian Airlines flight 302 out of Addis Ababa, Ethiopia and Lion Air flight 610 out of Jakarta, Indonesia, investigators have been testing the automated flight software system that is suspected to have instigated the fatal series of events that led to the crash of the two Boeing 737 MAX 8s less than six months apart.

SEE ALSO: PARALLELS BETWEEN THE 737 MAX 8 AND THE DC-10 CRASHES OF THE LATE 1970S

During the simulations, using identical systems to what both 737 MAX 8s were using, investigators prompted a failure in a sensor on the nose of the simulated aircraft that would have triggered the automated system’s anti-stall function.

According to two unnamed sources for the New York Times report who were involved in the tests, the pilots in the simulators had less than 40 seconds to disengage the system in order to prevent a fatal crash. When the system engaged, it would do so for ten second, pushing the nose down. Then it would pause for five seconds before reengaging for another ten seconds, pushing the nose down even further. After a final five second pause, it would engage for a third time, pushing the nose of the plane far enough down that the plane would enter a nosedive too steep for any pilot to recover from.

The tests were based on what investigators know for certain about the crash of Lion Air flight 610 and according to the report, it was a surprise to the pilots involved. Even with the knowledge that the system was going to engage during the tests, they had not anticipated how powerful the automated response would be.

Pilot Training Deliberately Kept to a Minimum

Early on, Boeing made the decision was made to design the aircraft as much as they could to conform to earlier 737 models. This would give the aircraft manufacturer a head start in getting a new plane to the market to compete with Airbus' new A320neo aircraft and it would also be a major selling point for the plane that it was simply a better version of the older 737s.

Part of that effort was ensuring that the 737 MAX 8 received the same aircraft rating as previous 737 aircraft. That way, pilots who had already been certified to fly those earlier 737 models could have their existing certification extend to the 737 MAX 8 as well. There would be no need for airlines to spend money on training since, as Boeing would sell it, the pilots already knew how to fly the new plane.

“There is a limited window to solve this problem..."—John Cox, Aviation Consultant & Former 737 Pilot, New York Times

The problem is that the as part of the new automated system, the MCAS, the anti-stall function was entirely new to the 737 MAX 8 aircraft, a consequence of a modification to the placement of the engine on the wing that changed the aerodynamics of the plane, but improved efficiency. Pilots qualified to fly the earlier 737 models would have had no experience with this system. Designed to engage only if a pilot took so steep an angle that the plane would stall, it was considered simply an automatic failsafe, something a pilot would rarely, if ever, encounter. Boeing and regulators believed that pilots didn't even need to be told about this feature at all, and only sent out notices about the system after the Lion Air investigation started to suggest that this system might have played a role in the crash.

According to some reports by pilots, the extent of their training on the new 737 MAX 8 aircraft was a one hour online course using an iPad, with zero training done in an actual simulator. What's more, according to at least one anonymous pilot complaint submitted to the Aviation Safety Reporting System, the new anti-stall feature was also not fully explained in some flight manuals even after the notices went out after the Lion Air crash, prompting the pilot who filed the report to call the documentation of the MCAS anti-stall feature "inadequate and almost criminally insufficient".

Split Second Decisions, With Advanced Knowledge, Required to Save a Plane Caught in Anti-Stall Loop

This lack of pilot awareness of the system, its power, and the procedures for how to shut it off are some of the key points that investigators are looking into with the Lion Air and Ethiopian Airlines crashes.

According to a Reuters report last week, data recovered from the cockpit voice recorder for Lion Air 610 reportedly reveals that the flight’s captain can be heard frantically searching through the flight manual trying to figure out what was happening—not the right procedure for shutting it down, what was happening—while the other pilot fought against the automated system that repeatedly pushed the nose of the plane down, eventually ratcheting the plane into a nosedive towards the Java Sea.

To counteract this system, according to the New York Times report, the pilot at the controls would need to flip a switch at their thumb which would counter the nose-down movement of the plane. This isn’t a total fix, though, it only buys the pilot a few extra seconds added onto the 40 second window.

[see-also]

In order to fully shut down the MCAS function that was pushing the plane into a nosedive, the pilots would have to flip the switch at their thumb, then flip two more switches elsewhere that would shut down the power to the motor the MCAS used to push the nose down. Then, the pilot would then need to turn a crank to fix any remaining problems caused by the system before they would have control of the aircraft again.

Three different switches in a specific order followed turning a wheel with a crank—while fighting an autopilot system seemingly hellbent on sending the plane into a nosedive—in less than 40 seconds. In the simulation, knowing the procedure in advance and knowing that the MCAS system was going to be triggered so they would be primed to carry out the maneuver, the pilots were able to successfully shut the system down and land the plane safely.

“There is a limited window to solve this problem, and [the Lion Air flight 610] crew didn’t even know that this system existed,” John Cox, a former 737 pilot and currently an aviation consultant, told the New York Times.

The pilots also tested Boeing’s updated MCAS system, which they found to be less aggressive and easier to control. They landed safely in all the tests of the new software as well.

The new system forces MCAS to rely on two sensors on the nose of the aircraft, not just one as was the case prior to the update. Safety experts have questioned why Boeing would have such a critical system rely on a single sensor, when standard practice for a system whose failure even Boeing’s own analysis acknowledged could lead to loss of life, even though they appear to have understated the power and the implications of this system engaging during flight.