The crash of China Eastern Flight MU5735 on March 21, 2022, represents an aerodynamic anomaly that challenges standard failure mode assumptions. While initial reports focused on the dramatic vertical profile of the descent, National Transportation Safety Board (NTSB) data reveals a sequence of cockpit events—specifically the dual engine shutdown and manual control inputs—that transform the investigation from a mechanical failure search into a study of intentionality and human-machine interface. This analysis deconstructs the flight’s final minutes through three lenses: the kinetic energy state of the aircraft, the failure modes of the CFM56-7B engines, and the override logic of the Boeing 737-800 flight control systems.
Kinetic Energy Dissipation and the Vertical Profile
The descent from 29,100 feet to the impact site in the Guangxi mountains occurred in less than two minutes. To understand the severity of this profile, one must look at the energy state. A standard commercial descent occurs at a rate of 1,500 to 3,000 feet per minute (fpm). Flight MU5735 exceeded 30,000 fpm. This is not a "glide" or a "stall"; it is a powered or gravity-accelerated dive that suggests a deliberate nose-down pitch moment. Don't miss our recent article on this related article.
The Pitch Moment Variables
The Boeing 737-800 utilizes a redundant system of elevators and a moveable horizontal stabilizer to manage pitch. For an aircraft to transition from level cruise to a near-vertical dive, the following aerodynamic forces must be present:
- Sustained Negative G-Loading: The initial "pushover" requires significant elevator deflection.
- Stabilizer Trim Displacement: If the horizontal stabilizer was trimmed to a nose-down position, the aircraft would resist any attempt at recovery by the autopilot or manual pilot input.
- High-Speed Aerodynamic Compression: As the aircraft approached the speed of sound ($Mach 1$), the effectiveness of the control surfaces would change, likely leading to "Mach tuck," where the center of pressure moves aft, further deepening the dive.
The Dual Engine Shutdown Hypothesis
Data suggests that both CFM56-7B engines were shut down or at least transitioned to a zero-thrust state during the descent. In modern aviation, the simultaneous failure of two independent turbine engines is statistically negligible unless linked by a common factor. To read more about the background here, Al Jazeera provides an excellent summary.
Common Cause Failure Analysis
If the engines were not shut down manually, only three "common cause" factors could lead to a dual flameout:
- Fuel Exhaustion or Contamination: Disproven by the flight’s duration and the explosive nature of the impact, which indicated significant fuel reserves.
- Volcanic Ash or Severe Icing: Meteorological data for the Kunming-Guangzhou route on that day showed no such atmospheric hazards.
- Massive Bird Strike: Highly improbable at 29,000 feet, well above the standard migratory paths and operational altitudes of most avian species.
The absence of these factors leaves the "Fuel Control Switch" or the "Engine Start Levers" in the cockpit as the primary points of failure. By moving these levers to the "cutoff" position, a pilot can immediately starve the engines of fuel. The NTSB's focus on this detail suggests that the data retrieved from the Flight Data Recorder (FDR) shows the command for shutdown originated from within the cockpit, rather than as a result of external mechanical degradation.
Cockpit Control Logic and Manual Override
A critical component of the NTSB’s findings involves the "struggle" indicated by the flight path. The aircraft briefly leveled off around 7,000 to 8,000 feet before resuming its terminal dive. This momentary recovery is the most telling data point in the entire sequence.
The Conflict of Inputs
The 737-800 is a "manual-heavy" aircraft compared to its fly-by-wire counterparts from Airbus. While it has an autopilot, the pilots can override it by applying sufficient force to the control column. If two pilots provide conflicting inputs—one pushing the nose down and the other pulling up—the aircraft's response is a function of the net force applied to the elevator feel system.
The recovery at 7,000 feet indicates that, for a brief window, "up" elevator input was sufficient to counteract the "down" force or the stabilizer's position. The subsequent resumption of the dive implies that either the "up" input was abandoned or the "down" force was reapplied with greater mechanical advantage. This sequence effectively rules out a total loss of control surface connectivity (e.g., snapped cables), as a broken cable would not allow for a temporary recovery and a subsequent return to the failure state.
Structural Integrity Under Hyper-Velocity
The Boeing 737-800 is certified for a Maximum Operating Speed ($V_{mo}$) of 340 knots and a Maximum Operating Mach ($M_{mo}$) of 0.82. During the final seconds, MU5735 likely exceeded these limits significantly.
Component Shedding vs. Primary Failure
Witnesses reported seeing a piece of debris falling from the aircraft before impact. In a high-speed dive, the airframe is subjected to aeroelastic flutter and "buffeting."
- Winglets and Flap Track Fairings: These are typically the first components to depart the airframe under overspeed conditions.
- Horizontal Stabilizer Stress: The load on the tail section during a pull-up attempt at high Mach numbers can exceed the ultimate tensile strength of the attachment points.
The separation of a small component does not necessarily mean the aircraft "broke up in mid-air" due to a defect. Instead, it is a symptom of the aircraft being forced into a flight envelope it was never designed to survive.
Data Reconstruction and the Human Element
The NTSB’s involvement is governed by ICAO Annex 13, which focuses on safety rather than blame. However, when the data points toward "intentional input," the boundary between an "accident" and a "criminal act" blurs. The NTSB’s data suggests that the Flight Management Computer (FMC) did not command these maneuvers. There were no "uncommanded" movements.
The Silence of the CVR
The Cockpit Voice Recorder (CVR) is the final piece of the puzzle. If the CVR contains sounds of a struggle or ambient noise without verbal communication, it reinforces the theory of a localized cockpit event. The lack of an emergency "Mayday" call further narrows the scope. In a mechanical emergency—such as a rapid decompression or a cargo fire—the standard operating procedure is "Aviate, Navigate, Communicate." The total absence of "Communicate" while the aircraft is "Navigating" toward the ground at 30,000 fpm is statistically inconsistent with a mechanical failure.
The Strategic Shift in Global Aviation Safety
The implications of the MU5735 data require a reassessment of the "Two-Person Rule" and cockpit security protocols. Since the 9/11 attacks, cockpit doors have been reinforced to prevent external intrusion. However, this creates a "Fortress Effect," where the greatest threat to the aircraft can be the person behind the door.
The Limitations of Reinforcement
Hardened cockpit doors have successfully mitigated hijacking risks but have inadvertently facilitated "pilot-induced loss of life" events, such as Germanwings 9525 and potentially MU5735. The data suggests that current safety paradigms are skewed toward external threats, leaving a vulnerability in the internal psychological monitoring of flight crews.
Structural recommendations for the industry must now pivot. The focus is no longer just on the durability of the CFM56 engine or the redundancy of the 737's hydraulic lines. The focus is on the "Single Point of Failure" that remains in the cockpit: the human element. Future safety iterations will likely involve:
- Remote Override Capabilities: The technical possibility of ground-based pilots assuming control of a rogue aircraft, though this introduces new cybersecurity risks.
- Biometric Monitoring: Real-time physiological tracking of pilots to detect extreme stress or incapacitation.
- Unblockable Cockpit Surveillance: Continuous video and audio streaming to satellite servers to ensure data is never lost or tampered with.
The data from the NTSB does not point to a "broken airplane." It points to a broken system of human oversight. The Boeing 737-800 performed exactly as it was commanded to; the tragedy lies in the nature of those commands. The industry must now decide if the autonomy of the pilot is a relic of a pre-data era or a necessary safeguard that requires even more rigorous psychological vetting.
