Edited to add it’s a training amendment

What people (including pilots) do under stress is resort to simple actions drilled in by training. That's why emergency procedure training is a major part of pilot training curriculum.

What goes away first under stress is capability for complex reasoning, which is what one would need to figure out what the heck is going on and take appropriate action. In this case an a/c doing uncommanded dive can be a result of three things: elevator controls malfuncion (unlikely in modern jets, the mechanisms for transmitting control forces from the yoke to the elevator are multiply redundant and well-understood to be critical), structural breakdown (empennage falling off would do that), or run-away elevator or stabilizer trim.

In most a/c the runaway trim can be only caused by malfunctioning auto-pilot (that's why APs have multiple redundant ways to disable them), so the pilots faced this situation react by trying to disable AP in all available ways and then immediately jumping to conclusion that there's something catastrophically wrong with elevator system or even airframe integrity. The thought that there could be yet another system which can do major trim adjustment doesn't even enter their consciousness.

Training (and/or being in a position where there's no immediate stress of wrangling misbehaving a/c) would help to get to the correct solution (disabling trim motor by pulling the circuit breaker).

That said, flying an a/c seriously out of trim is hard, and can cause an accident on its own (the fine pitch control is gone, and you can even be so far out of trim that you cannot do landing flare no matter how hard you pull up, which in heavy jets would result in structural breakdown when the plane slams into runway).

You could almost certainly disable just about anything by pulling the appropriate circuit breaker. You don't want to do that because the plane may be left in a state where you can't control it manually and you only have a few thousand feet of altitude to recover.

There are, in fact, two switches to turn off the electronic control of the horizontal stabilizer. The previous Lion Air crew used them after the pilot riding in the jumpseat went back and grabbed his copy of what I'd assume was the flight manual and had an ah-hah moment[1]. The flight 610 crew were pouring over something (quick reference handbook?) but didn't express any awareness of the stabilizer being trimmed[2].

Depending on how bad things got there are a few problems with this. First, electrically moving the stabilizer is much faster than moving it manually. MCAS can operate at two speeds, IIRC both are slower than the speed dictated by the buttons on the yoke (plus the buttons on the yoke will pause MCAS). But even MCAS will move the stabilizer much faster than a pilot could by cranking the manual wheels. I believe that moving the stabilizer from one extreme at the fastest speed to the other takes about a minute. You can find videos of the stabilizer mechanism on a 777 on youtube, it's just not something that's designed to move quickly.

The next problem is that if the stabilizer is pitched down sufficiently (perhaps by MCAS), your first instinct may be to pull back on the yoke (to move the elevator) to regain pitch. Well, once you've done that the aerodynamic forces may be such that you can't move the stabilizer into a nose up position until you let go of the yoke and let the plane pitch down further (Boeing references needing to unload the stabilizer in some documents). That's something you've gotta have cat-like reflexes for when you're already flying so low.

The really sad part is that the pilots could have disabled MCAS and retained electric control over the stabilizer by extending the flaps. But how are the pilots going to know this when Boeing refused to document anything?

0: http://avherald.com/h?article=419f2f9e

1: https://www.grid.id/read/04966850/deretan-kejanggalan-yang-d...

2: https://www.straitstimes.com/asia/se-asia/cockpit-voice-reco...

I can't help thinking things would be safer and the Ethiopian crash may not have happened if they just published all the info rather leaving this kind of thing to anonymous leaks to the press.

Remember, a few fatal crashes are worth it as long as it means higher corporate profits.

https://en.m.wikipedia.org/wiki/Air_France_Flight_447

A single data point is still a data point.

That doesn't tell us that it's reasonable to expect pilots in command under stress to always figure it out. And they have to figure it out 100% of the time to avoid statistically unacceptable crashes. So I don't agree that pilot training is an acceptable answer given what we know so far.

The pilots were stressed in part because they didn't know -- they had plenty of time to recognize the issue and take action had they known, but they didn't, so no amount of time would have helped them. We don't know if one more thing to know about would too much, but I rather doubt that.

https://www.flightglobal.com/news/articles/faa-order-tells-h...

https://www.youtube.com/watch?v=3pPRuFHR1co

The specifics of MCAS weren't out there because Boeing expected the pre-existing procedure to have been sufficient. That procedure wasn't sufficient, or the Lion and Ethiopian Air pilots were somehow not aware of it, or they forgot their training in a stressful situation.

To be clear: the planes should not have put these pilots into the situation they were in, but unless the recovery procedure doesn't work, these planes should not have crashed.

[One thing I've been wondering: somehow the pilots were able to bring the nose back up... it was only (apparently) after multiple nose downs that they eventually failed to recover the plane. What was going on there? It's as if they understood how to correct the stabilizer trim, but weren't aware of the cut-off switches.]

The MCAS activated several times, each time ratcheting the stabilizer down by 2.5 degrees. Every time the pilots tried to correct for it, it would engage again. That is what caused the characteristic up/down flight pattern.

There are a lot of details in this story: https://www.seattletimes.com/business/boeing-aerospace/faile...

What it seems like happened is MCAS ran the stabilizer to 2.5°, but the pilot didn't reset it back to 0, but just back enough he could counter with the elevator. So MCAS keeps cranking the stab each time a bit further nose down and the pilot keeps only partially countering MCAS, instead of running the stab fully back to 0.

The pilot was clearly aware stab trim had something to do with the situation because there were stab adjustments from the pilot. What I can't make sense of is the pilot only partially countering MCAS. I realize the Lion pilots didn't know about MCAS and so their mental model must have been flawed. I'm even more confused about the Ethiopian Air pilots who should have known about MCAS.

edit: also this - https://news.ycombinator.com/item?id=19442160

My understanding is that every time the MCAS activated, its effect was incremental. It could command only a limited deflection of the relevant control surface each time -- less than 1 degree? -- but the cumulative effect of multiple activations would eventually exceed the ability of the manual controls to override it.

Winner, winner, chicken dinner. The existing runaway stabilizer trim checklist does not fit the MCAS failure to a T. The procedure dictates that you stop if the trimming action stops when you counter it with the switches (MCAS pauses when you do this). Unfortunately when you're taught to only think inside the box, you'll go as far down that checklist as you need to and no further.

Beyond that, just after takeoff is one of the busiest part of the flight. In fact, if you look at the graphs you'll see that the stick shaker on the left side was going crazy almost immediately after takeoff (and before MCAS kicked in as a result of retracting the flaps). The pilots of flight 610 were able to reign in MCAS with the trim buttons and almost certainly continued to do so in order to focus on the other failures and their relevant checklists (stick shaker, unreliable airspeed, elevator feel system non-op).

[One thing I've been wondering: somehow the pilots were able to bring the nose back up... it was only (apparently) after multiple nose downs that they eventually failed to recover the plane. What was going on there? It's as if they understood how to correct the stabilizer trim, but weren't aware of the cut-off switches.]

Yep, to me, that looks an awful lot like some sort of hardware failure. Something to look for in the subsequent and final reports.

Both cause the stabilizer to tilt. Both cause the stabilizer wheels next to the pilot/co-pilot to turn. If the plane is pitching down, and you pull back the yoke and that still doesn't recover, don't you at some point check the stabilizer angle? If it's wrong, you use the stabilizer trim switch on the yoke under your thumb to correct it. Won't you see the stabilizer wheel turn when you do that? If you let go and the wheel immediately starts turning again the wrong way (pitching the plane down), doesn't that look like runaway stabilizer?

Also, how did the off-duty pilot figure it out if they are nothing alike?

BTW, when you write "runaway stabilizer feels nothing like MCAS" are you speaking from personal experience?

Pilots are trained well for runaway stabilizer, MCAS was essentially the same thing, but it didn't FEEL like the same thing, so a stressed pilot's mind may not immediately go to that solution/memory item.

Now things are starting to make sense.

Boeing claimed (and F.A.A agreed) that pilots didn't need training because they already had training for a memory procedure which would have solved the issue.

They both appear to have overlooked is the MCAS symptoms were sufficiently different to the runaway stabiliser scenarios pilots trained on, that pilots are having problems knowing which procedure to apply.

Besides obviously making the sensors used by MCAS truely redundant and limiting its extreme behavior of moving the trim up to the stops, a large part of fixing the MAX might be just having a big warning light for MCAS operating.

First he’s gonna be behind the throttle quadrant. The stabilizer wheels are roughly in the center of his vision, so he will notice them moving and when they start and stop. The pilots have them down near their thighs, so they’re not even necessarily in their peripheral vision. They will be less likely to notice every time they start and stop.

Second the jumpseat guy has no flight responsibilities. He can focus on thinking about what’s wrong without dealing with all of the other stuff you’re doing on departure. Radio calls, navigation, performance monitoring, configuration changes or being agitated by the stick shaker.

My assumption is that the jupmseat guy took a very generous interpretation of the checklist. But there may have been more panic about the trim on the earlier flight. If you compare trim inputs on flight 610 to the previous flight, the pilots on the earlier flight were making much shorter, more rapid inputs than the pilots on flight 610. The plane also pitched down far more dramatically than on flight 610.

The graphs for flight 610 seem to indicate that the pilots thought they had the trim situation under control (and they did right up until they didn't).

https://reports.aviation-safety.net/2018/20181029-0_B38M_PK-...

This was argued by Boeing to the FAA, who accepted the reasoning.

It should be noted that, if it had been determined the pre-existing procedure wasn't sufficient, then all pilots on the 737 Max would've had to undergo re-training. This would have been expensive, and probably hurt adoption of the new airframe.

What alternative did the airlines have though? The A320neo? Cause that would've required re-training too.

Probably Boeing should've pushed back against the airlines: we've made you a more fuel efficient 737, but it's going to require re-training.

Someone or someones may have thought: "MCAS is the only thing that requires retraining? Can't we fudge that?"

And the thing is, it still seems like MCAS is a reasonable solution, if poorly implemented.

Am I the only one hoping that in the end, the costs for Boeing will be more expensive than the global re-training would have been?

Later, it quotes claims that it "isn't in the documentation".

I would consider that published, official checklists are the most imminently critical form of documentation.