Ethiopian B38M near Bishoftu on Mar 10th 2019, impacted terrain after departure

Last Update: January 24, 2023 / 19:12:28 GMT/Zulu time

Bookmark this article
Incident Facts

Date of incident
Mar 10, 2019

Classification
Crash

Airline
Ethiopian Airlines

Aircraft Registration
ET-AVJ

Aircraft Type
Boeing 737-800MAX

ICAO Type Designator
B38M

In a press conference on Dec 23rd 2022 Ethiopia's Transport Minister said, the final report is going to be released in the next few days and will confirm the findings already set in the preliminary report, in particular that MCAS triggered a nose down trim several times until the crew lost control. The final report has NOT yet been released (despite claims by media).

Both the websites of the Civil Aviation Authority of Ethiopia as well as of the accident investigation authority were offline.

On Dec 26th 2022 Ethiopia's AIB released their final report (which is contested by the NTSB on Dec 28th 2022, see below the summary of the final report) concluding the probable causes of the crash were:

Probable cause of the accident

Repetitive and uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA input, and its unrecoverable activation system which made the airplane dive with the rate of -33,000 ft/min close to the ground was the most probable cause of the accident.

Contributing Factors

- The MCAS design relied on a single AOA sensor, making it vulnerable to erroneous input from the sensor;

- During the design process, Boeing failed to consider the potential for uncommanded activation of MCAS, but assumed that pilots would recognize and address it through normaluse of the control column, manual electric trim, and the existing Runaway Stabilizer NNC. The OMB and Emergency AD issued after the Lion Air accident included additional guidance but did not have the intended effect of preventing another MCAS-related accident;

- While Boeing considered the possibility of uncommanded MCAS activation as part of its FHA, it did not evaluate all the potential alerts and indications that could accompany a failure leading to an uncommanded MCAS;

4. The MCAS contribution to cumulative AOA effects was not assessed;

5. The combined effect of alerts and indications that impacted pilot’s recognition and procedure prioritization were not evaluated by the Manufacturer;

6. Absence of AOA DISAGREE warning flag on the flight display panels (PFD);

- The B737 MAX Crew difference CBT training prepared by Boeing and delivered to Pilots did not cover the MCAS system;

- Failure by the manufacturer to design simulator training for pilots with regards to safety critical systems like MCAS with catastrophic consquences during undesired activation.

- The manufacturer failed to provide procedures regarding MCAS operation to the crew during training or in the FCOM;

- Failure by the manufacturer to address the safety critical questions raised by the airline which would have cleared out crew confusion and task prioritization;

The cockpit voice recorder transcript, now apparently complete starting page 94 of the report, suggests that the crew went to cut out the stabilizer trim at 05:40:37Z after the first officer suggests the stab trim cut out, the captain agreed, and the first officer reported the stab trim had been cut out. Subsequently click sounds are heard attempting to trim up, there is a sound similiar to the crew extending the trim handles at 05:41:09z, both crew with strain attempted to move the trim wheel but made remarks it was not working, the captain instructed to check the left alpha vane at 05:42:47z, the autopilot disconnected at 05:43:12z, in response to the autopilot disconnect wailer the captain says "No, no, leave it, leave it, it’s ok, it’s ok, let’s go up, let’s go up" and "Disconnect, let’s go back right heading", then the distress in the captain's voice increases screaming "PITCH UP!", the transcript ends at 05:43:39z.

The AIB analysed with respect to the crash scenario:

On this flight the captain was pilot flying (PF) and the first officer was the pilot monitoring (PM).Flight data recorder shows the left angle of attack (AOA) value became erroneous 10 seconds after rotation. This resulted in the onset of the stick shaker followed by a master caution light. At the same time the following happened on the captain’s primary flight display (left PFD):

As the IAS DISAGREE and ALT DISAGREE alerts were not recorded on the FDR no recording of crew conversation about the alerts, if they occurred as calculated by the manufacturer can also be attributed to the appearance of the master caution light which may have taken the crews attention to the glare shield and perhaps to the overhead panel momentarily in trying to identify what caused the master caution alert, and perhaps the alerts could have appeared at this time and by the time they turned their eyes to their respective PFD’s the messages may have been there already. It should be understood that an alert is easily recognizable when it corresponds to a change of state like appearance or disappearance, change of colour or is accompanied by aural alert.

With the onset of the stick shaker the captain initially responded by reducing the pitch which corresponds to one of the actions expected to be done by the pilot flying when a stick shaker triggers, as indicated in the approach to stall recovery manoeuvres stated in the quick reference hand book (QRH) 35non-normal manoeuvres section of the B737. This reduction in pitch did not stop the stick shaker and proximity to the ground or airplane handling quality which indicates the stick shaker to be erroneously activated probably led the captain to stop applying further nose down column input at a pitch angle of 7-80 above horizon. Approaching 400ft, the Captain called-out “command”attempted to engage the AP but it was not successful.At that time the FD pitch bars were out of view, this action, was not consistent with the procedure to be used with an ongoing stick shaker. As therewas no explicit discussion between the crew about using the autopilot, the investigation looked at two probable explanations for the above action.
1. He was trying to apply with the non-normal situations guideline found in the flight crew training manual (FCTM) which states “when a non- normal situation occurs, the Maximum use of auto flight system is recommended to reduce workload”.

Approaching 400ft, the Captain called-out “command” and attempted to engage the AP but it was not successful. At that time the FD pitch bars were out of view. As there was no explicit discussion between the crew about using the autopilot, the investigation looked at two probable explanations for the above action.

Further look at how training was conducted at the airline level for approach to stall recovery was conducted. Most approaches to stall training were given in accordance with the Boeing flight crew training manual FCTM guidelines. Per the manual all approaches to stall training were given with the autopilot engaged and the auto throttle disconnected to simulate an approach to stall condition and the pilot initiates recovery by disengaging the autopilot and following the steps in the approach to stall recovery procedure of the QRH. Additionally the investigation also observed that the FCTM doesn’t have a guideline on how to conduct an approach to stall training with the autopilot not engaged nor for a stall condition during departure.

Records at the airline show both pilots were trained in accordance with Boeing flight crew training guidelines. Thus, in all the training the pilot’s received for an approach to stall condition, the crew would start recovery by disengaging the autopilot at the onset of stick shaker and the auto throttle was already disengaged prior to the training maneuver per the FCTM guideline.

2. The crew understanding of the airworthiness directive and FCOM Bulletin that was released after the lion air accident.

A thorough study was conducted regarding the airworthiness directive and the FCOM bulletin released after the Lion Air accident. The back ground information from the FCOM bulletin that calls for attention to “an AOA failure condition that occurs during manual flight only” was assessed during the investigation and was found that it creates confusing to the reader as it appears that the AOA failure condition would only occur during manual flight only. But it was found that the AOA failure condition can occur regardless of the autopilot engagement status and that only activation of MCAS would be dependent on it.

There might be a chance that the pilot perceived the bulletin in the above discussed manner and believed the problem would disappear given he engages the autopilot, and the reason for his repetitive attempt to engage the autopilot. A second attempt was made six seconds later, above 500 ft at this time the left hand FD pitch bar was at -10°. The Captain’s reactions after the second engagement attemptper the CVR recording was “Yehe endet new” an Amharic expression meaning ("What's going on?") it was most likely an explanation asking oneself when unusual and unexpected multiple happenings occur. His verbal expression supports his expectation that the autopilot should have engaged. Shortly afterwards, the Captain requested the FO to contact the radar controller. At this time the Airplane was climbing through 800 ft radio altitude.

From take-off until the successful engagement of the autopilot on the third attempt, the airplane was kept in trim adequately by the Captain via the electrical trim command switches. The average force required on the control column was about 25% higher than previous take-offs recorded on the FDR activation of the Elevator Feel Shift system in response to the erroneous AOA values.

Passing 1000 ft/radio altitude, at the third attempt, the autopilot was successfully engaged. Just before the third AP engagement attempt, the pitch attitude was around 7°. The Captain’s FD bars had been approximately centered for two or three seconds, which might have prompted him to try to engage the AP once more. On the FO’s side, the FD pitch bar was 20°up.

The crew were faced with unprecedented change of events shortly after lift-off where the workload is high even on a normal take-off. This significantly increased the crew workload.

On several occasions, the captain asked the F/O to advise ATC of the inability to follow the planned departure due to flight control problem and to request runway heading and climb 14,000ft. It shows the captain has considered not resuming the normal flight and climb to the minimum safe altitude of 14,000ft around the airport to deal with the situation and decide on his next course of action. The heading mode was then selected on the mode control panel (MCP).

During the time when the autopilot remained engaged, the left stall management yaw damper computer (SMYD1) which was affected by inputs from a failed left AOA sensor calculated the left hand minimum operational airspeed erroneously above 340kt (VMO). At the start of the airspeed clacker (05:41:21) over speed warning triggered,and the captain called “SPEED” to which the F/O responded “SPEED”

Moreover, at that time, the auto throttle operation was affected by the erroneous left AOA sensor value so it remained in the Arm mode and failed to transition to N1 mode. Transition to the N1 mode would have reduced the take-off thrust to the climb thrust automatically. The auto throttle did not give a warning or a failure flag for the flight crew when its operation was affected by the failed AOA sensor value.

The first MCAS activation occurred within a second where the auto throttle was supposed to reduce from take-off thrust to climb trust. And in less than another second GPWS aural alert “DON’T SINK” sounded twice.

The activation of MCAS followed by GPWS aural alert with already ongoing stick shaker coupled with no failure flag or warning from the auto throttle as it failed to transition to climb thrust in an extremely high workload environment must have caused the auto throttle remaining in the ARM mode with take-off thrust set to remain unnoticed by the crew.The manufacturer revealed during the investigation that the flight management system responsible for calculating and sending thrust command was affected by the erroneous AOA inputs. There was no flight crew document (FCOM,AFM, QRH…) that states this could happen.

The erroneously calculated left hand minimum manoeuvring speed from the SMYD also gave the flight deck effects on the captain’s airspeed indication in terms of colour and manoeuvring band that the airplane was at a dangerously low airspeed. But the number in the airspeed indicator kept increasing as the airplane pitches down.

The pilot’s attention was already consumed with multiple alerts and managing the flight path at the same time. The effect of airspeed indication giving the pilot two different warnings, i.e. dangerously low airspeed indicated by stick shaker, minimum maneuvering band above current airspeed versus high airspeed indicated by the numbers in the speed tape was a point of concern. Although a pilot would normally look at both the maneuvering band and the number in the speed tape and compare the two for his actions, in this particular flight multiple events have occurred simultaneously which has an effect on the pilot’s cross checking. There is a high probability that the low speed feeling indicated by amber and red colour coupled with a stick shaker would weigh in the pilot’s judgment compared to the number indicated in the speed tape.

As a right turn was initiated after selected heading was changed to 197, the pitch decreased as a result of the combination of the nose-down command by the A/P and the right turn. This became visible on the vertical speed indicator which reached approximately -1 600 ft/mn. The red and black stripe band covered the speed tape entirely, which may have added confusion for the Captain. When the A/P disconnected, the Captain stopped turning and tried to stop the nose down movement by pulling on the column. The Captain applied an increasing force between 50 Lbs and 75 Lbs on the control column towards pitch up.

As the flaps reached the retracted position, MCAS activated for the first time and the stabilizer trim position decreased down from 4.6 to 2.1 units. Although the Captain was applying an increasing nose up force (between 100 and 125 Lbs), only a brief electric trim up input of 2 seconds was recorded, which was insufficient to trim out the MCAS inputs and to relieve the aerodynamic loads. The stabilizer remained at 2.1 units of trim. This short input may be explained by the fact that typical activation (pilot’s muscle memory) of the electric trim is usually around 2 to 3 seconds.

It was noted that MCAS trim is very fast; however the pilot’s inputs to re-trim to neutral were discontinued in the trim band range of 2.26 to 2.38 units ANU for some unknown reason and it was understood that the rapid onset and complexity of the emergency and its effect on the ET302 flight crew’s actions.

“Ensure that if MCAS is erroneously activated, the MCAS system preserves the flight crew’s ability, using basic piloting techniques, to control the airplane after the activation.” However when an erroneous AOA value (nose high) exists, MCAS continually activate airplane nose-down stabilizer trim with incremental commands (moves the stabilizer a fixed amount regardless of current position of the stabilizer) five seconds after each time the pilot tries to return to trimmed condition. Hence, MCAS denies trim authority and made it difficult to control the airplane from excessive nose dive and crashing.

The eCAB participants noted that attempting to duplicate the ET302 flight crew actions, the simulator crews felt it was instinctual to use as much electric trim as needed to reduce column forces in response to MCAS inputs, recognizing that a sustained input on the electric trim switch was longer than typical inputs that pilots are accustomed to making during routine operations. The force applied by the Captain on the control column during this phase only allowed keeping the airplane almost level (around 8,900 ft).

Five seconds after the pilot’s trim input, MCAS activated a second time. Three seconds later, the GPWS aural “DON’T SINK” was triggered and the message “Pull Up” appeared in red on both PFDs. The Captain called “ARGEW CUT” a combination of Amharic and English languages which implies “cut it”. Before the first officer responded to this, the captain prioritized and repeatedly said “Trim…trim with me”. The captain applied a 9 second electric trim-up input. This trim input fully counteracted the second MCAS input and stopped the GPWS warning even though it did not bring the aircraft to a neutral trim. It is because the activation of the MCAS made difficultto trim the airplane to the required level.

According to the runaway stabilizer procedure; once a pilot identifies a runaway condition that did not stop with autopilot disengagement or one that starts during manual flight, he should immediately put the stab-trim cut-out switches to cut-out position in order to avoid further mistrim. Further trimming and bringing the aircraft to neutral would then be accomplished by the use of a manual trim wheel. Simulator experience and procedural knowledge has probably built confidence in the pilots’ perspective in the application of the procedure and in maniplating the manual trim wheel. The FCOM’s bulletins which addresses the erroneous activation of MCAS with the runaway stabilizer non-normal checklist with a note regarding the option to bring the aircraft to neutral by using the electric trim before moving the stab trim cutout switches to cut-out does not concur with the procedural steps of the checklist nor the training that has been conducted. It would then be instinctual for the pilot to apply the procedure as was during the training for runaway stabilizer.In this connection, one of the questions raised by the Airline, addressed to Boeing after the Lion Air accident, could have given a better guidance to pilots but unfortunately, Boeing refrained from providing explanation or clarification.

In the meantime the FO recalled the captain’s command and requested confirmation “stab trim cut out?” to which the captain agreed. The FO then moved the stab trim cut-out switches to cut-out.

At this time, the stabilizer was at 2.3 units of trim and the Captain was pulling on the control column with a force of 80 Lbs. The altitude was 9 100ft, IAS 332 kt, pitch 2°5, and vertical speed + 350 ft/min.

During abnormal situations, flight crews are assumed to be capable of maintaining control of the flight path and performing a rapid diagnosis that will allow them to identify the correct response and actions to apply. However, a significantly unusual abnormal situation can lead to a total loss of understanding. The stick shaker here represented a major disruption in managing the situation and the rapid onset of multiple inconsistent cues and abnormalities. As a consequence, the effectiveness the crew’s CRM was seriously affected.

Five seconds after the end of the Captain’s electric trim-up inputs, a third automatic nose-down trim was triggered. There was no corresponding motion of the stabilizer since the stab trim cut-out switches were in cut-out position. At that moment, IAS was 327Kt, and on the F/O’s speed tape, the speed trend indicated that the Airplane was expected to reach VMO within the next 10s. Seven seconds after the stab trim cut-out switches were set to cut out, the captain asked the F/O to pull up with him. The force applied on his controls was around 100 Lbs. From that moment on, the pitch varied between + 7 ° and - 2 ° (corresponding to variations ranging from + 4,400 ft / min to - 2,500 ft / min). The values increased when both pilots pulled and decreased if only one pulled. The forces on the Captain’s control column varied between 90 and 110 lbs. The flight crew was struggling against the high column forces.

Passing through 9500 ft (about 1900 ft above ground), the captain asked the FO to advise ATC that they wished to maintain “one four thousand feet” because they were having flight control problems and the F/O complied. 14,000ft was the minimum safe altitude around the departure airport. At that moment, the speed was reaching VMO and the airplane was climbing. The ATC communication congestion along with the stick shaker may have confused the F/O from detecting the excessive air speed at a key point. It seems the Captain wished to keep the navigation simple (runway heading) and to reach 14, 000ft (MSA) as a priority.The Captain’s priority remained to control the airplane, which is in line with non-normal situations guideline in the B737 FCTM and the Ethiopian Airlines SOP regarding the prioritization of tasks in case of failure on board.

The speed exceeded VMO 340Kt (varying between 360 and 375Kt). The over speed warning triggered. The captain said « THE SPEED » at the start of the airspeed clacker (05:41:21.) to which the F/O responded ‘SPEED’ at 05:41:29. The uncontrollability of the airplane demanded extra ordinary physical and mental effort to be exerted by the crew. Repeatedly, the Captain asked the F/O to” pitch up with him”. The force on the Captain’s control was around 100lbs at that time sound of exhaustion and shortness of breath are heard on the CVR.

The captain requested the F/O to try the manual trim wheel. After 4 seconds of intense efforts identified on the CVR, the F/O told the Captain “it’s not working”. At this moment the stabilizer trim was at 2.3 units38 the IAS at 340 Kt.

FCTM indicates “Excessive airloads on the stabilizer may require effort by both pilots to correct the mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming. Accelerate or decelerate towards the in-trim speed while attempting to trim manually”. Forces needed to turn the trim wheel with such a mistrim and high speed are much higher than those expected to be encountered during training or in operation and likely would have required either a two-handed effort by one pilot, or a two-pilot effort.

The possibility of both pilots applying force on the manual trim wheel inorder to overcome the huge force that was required to turn the manual trim wheel was over ruled as it was found to be inconvenient as well as impractical due to the fact that the captain was holding the control column with a huge amount of force that required a two handed input to prevent the aircraft from diving. At different times during the event flight the captain was heard requesting assistance from his FO to pull with him as well.

The effect of airspeed on the manual trim wheel operation was also observed in a level D simulator as well as flight control test rig (FCTR). It was noted in both assessments that at a high speed of 340Kt and lower speed of 220Ktwhile the same amount of mistrim is present and the captain pulling on the control column in an attempt to replicate the event flight, the manual trim operation was found to be extremely difficult even through one complete turn. It was also noted thatabout 40 turns were required to bring the aircraft to a neutral trim position.

The significant amount of force required to turn the manual trim wheel was found to be the excessive airload on the stabilizer attributed to the force held on the control column to stop the aircraft from pitching nose down and dive rather than the airspeed maintained at that moment.

This finding is also supported by a statement on the FCTM and simulator observations. The FCTM indicates the aircraft will accelerate and decelerate while accomplishing this technique indicating speed not to be a factor, and simulator observation has revealed the force required turning the manual trim wheel both at a high speed of 340Kt and lower speed of 220Kt was significantly high.

The FCTM guideline on such excessive airloads is to relieve aerodynamically. Thus; inorder to relieve aerodynamically the pilot had to decrease the amount of force that was held on the control column. Whether relieving aerodynamically using the procedure commonly referred to as the “roller coaster method” was applicable to the event flight was addressed during the investigation. Prior to reaching the point where the flight crew tried to use the manual trim, the crew were already faced with significant aircraft pitching down caused by MCAS activation that has resulted in a GPWS terrain warning, and at the time the crew used the manual trim wheel the captain was holding the control column with a force of about 100Lbs. The FDR shows that at that moment the pitch varied between 70 and -20with a corresponding variation on vertical speed between +4400ft/min to -2500 ft/min. The values increased when both pilot pull and decreased when one pilot pulled.

The Captain repeatedly requested the F/O to pitch up with him “to go to 14 000”, the F/O complied.

The Captain asked the F/O to request from the ATC “a vector to return”, and the F/O complied. Hence, at that moment, it seems the captain decided to return back for landing. However, during the radio communications between the ATC and the F/O, the Captain advised the F/O, to stand-by and pitch up with him to 14, 000 ft.

During the radio communications with the ATC, the F/O’s action on the control column was released which increased forces on the Captain’s control column. The Captain then requested the F/O to check the Master Caution. Then, they both announced “left alpha vane”. The FDR data at that time is consistent with the crew pressing the Master Caution recall button to review the existing faults. This might indicate the captain probably wanted to reassess the faults and get to the root cause of the problem which started when they first had a master caution light right after lift-off. At this time the airplane was almost reaching the minimum safe altitude. After about 10 seconds the Captain’s then told the F/O that they should pitch up together and a straining sound of both pulling on the control column is recorded on the CVR. The captain then told the FO “PITCH IS NOT ENOUGH” & “PUT THEM UP”. A sound similar to stab trim cut-out switches being returned to normal was recorded on the CVR, thus the stab trim cut out switches were most likely turned back on at that moment. After a failed attempt to trim using the manual trim wheel as per the runaway stabilizer non-normal checklist and significant and unbearable amount of force on the control column for the duration they held and the captain’s last comment “pitch is not enough”, It most likely appears that the flight crew were trying to find other means to relieve the force. The airplane was at 13, 800 ft level; IAS was 367kt, pitch just below 1°, stabilizer at 2.3 units of trim, bank angle 21° right The crew was busy pulling on the controls with high muscular force trying to maintain airplane flight path control andreach 14, 000 ft, a target on which they remained focused. Trying to maintain flight path control was a very demanding task and represented here a high workload, physically and mentally, to the detriment of every other task. The over speed warning added another disruption and disturbance on board. The cockpit noise environment was unsettling and further impacted the flight crew’s concentration.

Immediately after the Stab trim cut-out switches being put back in normal position, the crew attempted another unsuccessful A/P engagement as the plane was approaching 14, 000ft. At the same time, the Captain applied two brief electric trim up inputs of 1 second each while pulling on the control with an average force of 100 Lbs. The force on the controls remained between 75 and 100 Lbs. Five seconds after the trim-up inputs, the fourth MCAS triggered. The plane started to descend. During the 9-second MCAS activation, the stabilizer decreased from 2.3 units to 1 unit of trim. The Captain repeatedly shouted to pitch up with FO. The forces were physically unmanageable by both flight crews.

The airplane hit the ground eighteen seconds after the end of the 4th MCAS.

With respect to the maintenance history the AIB analysed:

The airplane’s left Angle of Attack (AOA) Sensor failed immediately after takeoff sending faulty data to the flight control system. The erroneous data in turn triggered the Maneuvering Characteristics Augmentation System (MCAS) which repeatedly pitched the nose of the airplane down until the pilots lost control.

Intermittent flight control system abnormalities began well before the accident flight. Maintenance actions of relevance started occurring in December 2018 when the airplane was one month old and included several pilot write ups involving temporary fluctuations of vertical speed and altitude. There were also three reports of the airplane rolling during autopilot operation. Altitude and vertical speed indications on the PFD showed erratic and exaggerated indications. The airplane was only four months old at the time of its accident.

From the maintenance log book report the airplane also suffered intermittent electrical/electronic anomalies in addition to the flight control system malfunctions. For example, three days before the crash the Auxiliary Power Unit (APU) Fault Light illuminated, and the APU had a protective shutdown. The APU is a backup electrical and pneumatic power source. The new Honeywell manufactured APUs on the 737 MAX is praised for having a more reliable starting capability. The onboard maintenance function computer message also indicated the Start Converter Unit (SCU) showed the APU’s start system was inoperative. The SCU is located in the electrical and electronics (E/E) compartment. The Captain’s personal computer power outlet also had no power. The possibility of intermittent electrical/electronic system defects were an underlying issue.

From the above point of observation the AOA Sensor malfunction most likely occurred as the result of a power quality problem that resulted in the loss of power to the left AOA Sensor Heater. Evidence indicates the loss of power was likely due to a production related intermittent electrical/electronic failure involving the airplane’s Electrical Wiring Interconnection System (EWIS) 40and the AOA Sensor part. Boeing delivered the ET302 airplane to Ethiopian Airlines on Nov 15, 2018. Within a month of being placed into service, the airplane started experiencing a variety of intermittent electrical and electronic malfunctions.

According to the report, after the ET302 accident, Boeing informed the NTSB they had made an engineering design error in their initial AOA Sensor Hazard Analysis; Neither Boeing, the NTSB, nor the FAA informed Ethiopian authorities about this critical error that was communicated to the NTSB by Boeing four months earlier.

A miscalibrated sensor scenario for JT610 and a bird strike scenario for ET302 cannot explain the flight control system alerting, maintenance messages and electrical/electronic system faults that were occurring on these airplanes in the weeks and days before their accidents. These accidents were triggered by production quality defects that presented as intermittent system malfunctions. These types of defects are difficult to identify and troubleshoot. They frequently result in No Fault Found maintenance determinations.

MCAS and the lack of pilot training did not trigger these accidents; however it was the failure of the sensors due to the production quality defects. Simply put, if the intermittent defects did not cause the AOA Sensors to fail on these flights, MCAS would not have activated, and these two accidents would not have occurred. The MCAS would have remained as hidden threat until its true nature is exposed by some other valid or erroneous causes.

With respect to CRM the AIB analysed:

During the event flight the captain asked the first officer to request runway heading due to flight control problems. It is noted that the captain understood it would not be possible to fly the original clearance of standard instrument departure and make the navigation simple allowing more time for him to decide on the next course of action.

The captain also asked the first officer to request a stop climb at 14,000ft which is the minimum safe altitude around the departure airport. This was an indication that the captain understood it would not be possible to continue the normal climb profile and needed to level off at the lowest safe altitude in order to set things in order and decide on the next course of action.

After the second MCAS activation, the captain asked the first officer to trim with him and then put the stab trim cut-out switch to cut-out. The first officer confirmed with the captain and performed the procedure as per the AD and FCOM bulletin.

After a failed attempt to use the manual trim wheel and trim the airplane as per the runaway non-normal procedure and the training they have acquired, the captain decided to return back for landing and asked the first officer to get radar vectors for landing.

During the right turn for radar vectors, the captain who had been holding the aircraft with tremendous force for quite some time told the first officer “pitch is not enough”, “put them up”. The FDR and CVR data was concurrent with the stab trim cut-out switch being returned to normal position. Even if the decision to return the stab trims cut-out switches back to normal was not consistent with the AD nor the FCOM bulletin,it seems the captain understood that the force required on the control columns was beyond one he and his first officer could sustain for the remainder of the flight until a successful landing from the radar vectors.

Simulator observation and research during the investigation process has shown that an attempt to land with the miss trim level they have on the event flight where the stab trim switches were in cut-out position was unsuccessful.

With respect to the control forces the AIB analysed:

The Boeing constructed FCTR is designed to replicate the forces needed to move the trim wheel in a B737MAX at various mis-trim and airspeed combinations. A mis-trim of -1.5 units at airspeed of 340 KCAS (VMO) was the most difficult mis-trim/airspeed combination available in the FCTR. But during the accident flight, the mis-trim was -2.7 units at airspeed of 340 KCAS.

It was observed that the greater the mis-trim value, the greater the force required by the pilot on the control column to fly level flight and consequently the greater the force required rotating the manual trim wheel. The trim wheel must complete 15 revolutions to move the stabilizer by 1 unit (degree) of trim. Consequently, to resolve a mis-trim of -1.5°, the wheel would have to be rotated through 22.5 revolutions; but to resolve a mis-trim of -2.7° it would have to be rotated through 40.5 revolutions, i.e., 80% more. Initiating rotation and continuing for 40 revolutions on the accident flight would have been significantly more difficult than in the FCTR.

According to the cockpit voice recorder (CVR), the first officer indicated that he could not rotate the manual trim wheel. Moreover, Simulator and FCTR observations have revealed that the force required to operate the manual trim both at 340Kt and 220Kt was significantly high.

The force required to rotate the trim wheel depends on grip (overhand or underhand), seat (body) position in relation to the trim wheel, and the position of the handle on the wheel (which would change the direction of the force vector required to initiate or maintain rotation) could all affect how easy or difficult it was to move the manual trim wheel handle. Moreover, there was no mention of high forces that may be required to trim manually in either the QRH or the Boeing FCOM. Excessive air loads on the stabilizer may require effort by both pilots to correct the mis‐trim. In extreme cases it may be necessary to aerodynamically relieve the air loads to allow manual trimming.

Therefore, the force required to correct the mis-trim of -2.7 was out of the acceptable capability of the crew.

As part of the analysis the AIB stated: "The AD issued following the Lion Air crash indicates that if one executes the Runaway stabilizer NNC the problem could be handled. However, the information about flap position as part of the MCAS logic was omitted from the AD,MCAS operates only when the flap was fully up."

On Dec 28th 2022 the NTSB issued a press release and their comments submitted to the draft final report. In their press release the NTSB writes:

The NTSB took the unusual step of publishing the comments on its website after Ethiopia’s Aircraft Accident Investigation Bureau (EAIB) failed to include the NTSB’s comments in its final report on its investigation into the March 10, 2019, crash of Ethiopian Airlines flight 302, a Boeing 737-800 MAX.

...

The EAIB provided the NTSB with its first draft of the report last year. The NTSB reviewed the report and provided comments on several aspects of the accident the NTSB believed were insufficiently addressed in the draft report. The comments primarily were focused on areas related to human factors.

After the EAIB reviewed the comments, it provided the NTSB with a revised draft report for its review. The NTSB determined the revised report failed to sufficiently address its comments. As provided by the ICAO Annex 13 process, the NTSB provided the EAIB with more expansive and detailed comments.

Instead of incorporating the most recent and expanded comments into their report, or appending them as had been requested, the EAIB included a hyperlink in their final report to an earlier and now outdated version of the NTSB’s comments.

The NTSB also noted that the final report included significant changes from the last draft the EAIB provided the NTSB. As a result, the NTSB is in the process of carefully reviewing the EAIB final report to determine if there are any other comments that may be necessary.

In their 9 pages comments to the last draft final report the NTSB stated:

Overall, the US team concurs with the EAIB’s investigation of the MCAS and related systems and the roles that they played in the accident. However, many operational and human performance issues present in this accident were not fully developed as part of the EAIB investigation. These issues include flight crew performance, crew resource management (CRM), task management, and human-machine interface. It is important for the EAIB’s final report to provide a thorough discussion of these relevant issues so that all possible safety lessons can be learned.

With respect to the cause of the crash the NTSB commented:

We agree that the uncommanded nose-down inputs from the airplane’s MCAS system should be part of the probable cause for this accident. However, the draft probable cause indicates that the MCAS alone caused the airplane to be “unrecoverable,” and we believe that the probable cause also needs to acknowledge that appropriate crew management of the event, per the procedures that existed at the time, would have allowed the crew to recover the airplane even when faced with the uncommanded nose-down inputs.

We propose that the probable cause in the final report present the following causal factors to fully reflect the circumstances of this accident:

- uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA values and

- the flight crew’s inadequate use of manual electric trim and management of thrust to maintain airplane control.

In addition, we propose that the following contributing factors be included:

- the operator’s failure to ensure that its flight crews were prepared to properly respond to uncommanded stabilizer trim movement in the manner outlined in Boeing’s flight crew operating manual (FCOM) bulletin and the FAA’s emergency airworthiness directive (AD) (both issued 4 months before the accident) and

- the airplane’s impact with a foreign object, which damaged the AOA sensor and caused the erroneous AOA values.

The NTSB states with respect to airframe/system aspects:

The EAIB draft report states that the erroneous AOA data resulted from an AOA sensor failure yet omits key findings about the root cause of the AOA erroneous data: damage from impact with a foreign object/bird. Thus, the report misses the opportunity to address improvements for wildlife management at the flight’s departure location—Bole International Airport, Addis Ababa, Ethiopia.

- Cause of the AOA erroneous data: Collins Aerospace, the manufacturer of the airplane’s AOA sensor, was named as a technical advisor to the US team in April 2019 after the EAIB requested assistance investigating the most likely failure modes for the AOA sensor based on the accident data. Although the EAIB draft report acknowledges Collins’ factual report, the EAIB draft report does not acknowledge Collins’ fault tree analysis, which demonstrated that the recorded FDR data from the accident were not consistent with any internal failure of the AOA sensor; instead, those data were fully consistent with previous instances of partial AOA vane separation due to a bird strike.

...

- Bird activity at Addis Ababa airport: The EAIB draft report omits factual information, analysis, findings, contributing factors, and safety recommendations regarding bird hazards and the effectiveness of bird mitigations at Addis Ababa airport.

+ The EAIB draft report provides some details regarding a runway area search after the accident but inappropriately suggests that the lack of bird remains or AOA vane remnants indicates that the airplane was not impacted by a foreign object. The EAIB report fails to state that the search occurred 8 days after the accident and that the search did not include the area surrounding taxiway D, even though FDR data indicated that the airplane would have been positioned above the taxiway when the left AOA sensor data became erroneous.

+ On November 11, 2019, the EAIB published its final report regarding the November 26, 2018, engine failure event involving a Boeing 767-300, registration ET-AMG, caused by engine ingestion of a Steppe or Tawny eagle weighing 2.0 to 3.4 kilograms (4.4 to 7.5 pounds). The report stated that Steppe and Tawny eagles are common around Addis Ababa airport. The EAIB found that a bird strike hazard existed at the airport and made a recommendation in this area.

- The EAIB draft report includes multiple findings that question the functionality of the manual electric trim system but presents no facts to support these findings. In addition, the findings contradict the evidence from this investigation indicating that the system was functioning as intended.

+ Per the request of the EAIB, Boeing conducted a thorough assessment of potential trim system failures and provided the results to the EAIB in October 2019.

+ This assessment found that no trim system failure scenarios were consistent with the FDR data and that the behavior of the electric manual trim parameter recorded on the FDR was consistent with flight crew input.

- The EAIB draft report incorrectly states that design changes to the 737-8 MAX were not official and were not approved by the FAA.

+ Boeing’s changes to the MCAS design were official in March 2016 and were communicated to the FAA in July 2016, as described in the NTSB System Safety and Certification Specialist’s Report, section H, Certification of the MCAS Implementation and Function.

+ Boeing applied for and, in March 2017, was granted an amended type certificate for the 737-8 MAX. For further information, see the NTSB System Safety and Certification Specialist’s Report.

- The EAIB draft report incorrectly states that Boeing did not respond or failed to respond appropriately to Ethiopian Airlines’ request for more information about the MCAS after the Lion Air accident.

+ Boeing provided information to all 737 MAX operators in November 2018 (after the Lion Air accident but before the Ethiopian Airlines accident) to address uncommanded MCAS inputs. This information included operations manual bulletin (OMB)/FCOM bulletin ETH-12, FAA emergency AD 2018-23-51, a multi-operator message, dedicated meetings, and email messages.

+ Boeing’s response to Ethiopian Airlines’ request for more information about the MCAS, dated December 3, 2018, provided specific guidance about the OMB and checklist prioritization. In particular, the response indicated, “As is stated in the OMB, ‘If uncommanded stabilizer trim movement is experienced in conjunction with the erroneous AOA flight deck effects, the instructed course of action is to use the Stabilizer Cutout switches per the existing [runaway stabilizer] procedure.’”

With respect to human factors the NTSB commented:

- The EAIB draft report inappropriately states that the IAS (indicated airspeed) DISAGREE and ALT (altitude) DISAGREE messages were not displayed to the crew during the accident flight, and the EAIB used this incorrect assumption as a basis for its assessment of the crew’s performance.

+ Although the FDR was not programmed to record the presence or absence of the IAS DISAGREE and ALT DISAGREE messages, all conditions were met for the alerts to be presented to the crew. The systems logic (presented to the EAIB in September 2019) and flight simulations (conducted in December 2019) demonstrated the expected timing for the presentation of these alerts on the crew’s primary flight displays.

+ The EAIB report improperly states that, because the AOA DISAGREE message did not appear, the IAS DISAGREE and ALT DISAGREE messages also did not appear. As explained in detail in the report, a software discrepancy caused the AOA DISAGREE message not to appear, but the software discrepancy was unrelated to, and had no effect on, the display of the IAS DISAGREE and ALT DISAGREE messages.

+ Given that the conditions were met for the IAS DISAGREE and ALT DISAGREE messages to be annunciated to the crewmembers, their lack of conversation or action in response to the annunciations should be explored in the context of the flight deck environment, workload, crew experience, and training. The report’s assumption that those messages did not appear, which is contrary to Boeing’s description of the alerting system and the results of simulator testing during the investigation, severely limits the opportunity for recognizing and addressing potential crew training and experience improvements.

- The EAIB draft report states that no flight crew reference document explained that autothrottle thrust commands could be affected by erroneous AOA inputs.

+ Even if such a reference document did not exist, the flight crew should have been trained on 737-8 MAX non-normal procedures. Because crew response to in-flight anomalies is time critical, these in-flight reference documents are not intended to provide flight crews with an in-depth understanding of a system before responding to an anomaly. Rather, non-normal procedures are designed to provide flight crews with information to diagnose and respond to a system-related issue in a timely manner based on observable flight deck effects.

+ Non-normal procedures related to erroneous AOA inputs instruct the crew to disengage both the autopilot and autothrottle, thereby preventing the erroneous AOA inputs from affecting flight control and throttle movements. The observable flight deck effects associated with erroneous AOA inputs include the activation of the stickshaker and the annunciation of the IAS DISAGREE and ALT DISAGREE messages.

- The EAIB draft report incorrectly states (in several locations) that the MCAS made control of the airplane “impossible” but neglects to state that, if the crew had manually reduced thrust and appropriately used the manual electric trim, the airplane would have remained controllable despite uncommanded MCAS input.

+ The flight crew’s failure to reduce thrust manually and the excessive airspeed that resulted played a significant role in the accident sequence of events.

+ Upon either the activation of the stickshaker or the annunciation of the IAS DISAGREE message, the expected crew response is to turn off the autothrottle. The report could be strengthened if it discussed, from a human performance perspective, possible reasons why the flight crew did not respond as expected to the stickshaker and the IAS DISAGREE message.

+ Because the autothrottle remained engaged and responsive to the erroneous AOA inputs, the autothrottle did not transition to N1 mode and remained in the ARM mode with takeoff thrust. The expected crew response is to manually control thrust in this situation; however, the lack of manual control and the absence of flight crew conversation regarding the thrust settings indicate that the crew did not notice the autothrottle’s failure to transition to N1, even when the aural overspeed warning triggered as the airplane accelerated beyond about 340 knots. As airspeed increased, the required control forces increased on both the control column and the manual trim wheel.

+ Appropriately countering uncommanded nose-down inputs with manual electric trim nose-up inputs, as was expected per crew procedure described in the FCOM bulletin and the emergency AD, would have resulted in control column forces remaining in a controllable regime during the flight, including when the stabilizer trim cutout switches were in the CUTOUT position. (See section 2.4 below for further information about the crew moving the switches to the CUTOUT position.) The report could be strengthened if it evaluated, from a human performance perspective, the crew’s failure to apply manual electric trim nose-up inputs.

+ The draft report does not examine the flight crew’s understanding of the effect of airspeed on the control forces required to move the control column and trim wheel.

+ The draft report states that the FCOM did not include details on the higher trim forces required with airspeed. However, the FCOM states that “the effort required to manually rotate the stabilizer trim wheels may be higher under certain flight conditions.” Further, even though the FCOM did not include the effect of airspeed on the manual trim wheel forces, that information is specifically noted in the manufacturer’s flight crew training manual. For example, that manual states, “if manual stabilizer trim is necessary, ensure both stabilizer trim cutout switches are in CUTOUT prior to extending the manual trim wheel handles. Excessive air loads on the stabilizer may require effort by both pilots to correct the mistrim. In extreme cases it may be necessary to aerodynamically relieve the air loads to allow manual trimming. Accelerate or decelerate towards the in-trim speed while attempting to trim manually.”

+ Although the draft report mentioned the dates of the crew’s training on the “use of trim wheel,” the report does not address whether the training included airspeed effects on the trim wheel or the forces required to trim as airspeed increases.

+ The report misses an opportunity to evaluate the effectiveness of air carrier training related to the relationship between airspeed and manual trim control forces and make safety recommendations, as appropriate, to improve industry training.

+ The EAIB draft report incorrectly states (in several places) that the “Summary of FAA’s Review of Boeing 737MAX” document indicates that the MCAS denies pilot control and trim authority. However, this document states the opposite: “if MCAS is erroneously activated, the MCAS system preserves the flightcrew’s ability, using basic piloting techniques, to control the airplane after the activation.”

- The EAIB report inaccurately states that the crew performed actions “per the procedure.” Evidence shows that the crew did not appropriately perform non-normal procedures after receiving annunciations relating to unreliable airspeed, stall warning, and runaway stabilizer. The crew also did not respond as expected to the overspeed warning by disconnecting the autothrottle and reducing power.

+ Emergency AD 2018-23-51 and FCOM Bulletin ETH-12 instruct flight crews to conduct the runaway stabilizer checklist, which requires them to “control airplane pitch manually with control column and main electric trim,”

+ If the crew had conducted the procedure in the emergency AD and the FCOM bulletin, the crew would have used manual electric trim to reduce control forces. However, FDR data show minimal crew use of manual electric trim.

+ If the crewmembers had performed the memory items for the airspeed unreliable and/or runaway stabilizer checklists, they would have disengaged the autothrottle. A manual reduction of thrust would have further assisted in reducing control forces. However, FDR data show that the autothrottle remained engaged and that thrust remained at full power.

+ All these actions were expected per procedure and were to be conducted before moving the stabilizer trim cutout switches to the CUTOUT position.

+ Even after moving the stabilizer trim cutout switches to the CUTOUT position, the crew decided to return the switches to the NORMAL position, contrary to the FCOM bulletin and the emergency AD, which direct crews to ensure that the switches “stay in the CUTOUT position for the remainder of the flight.” The available evidence for this accident did not indicate why the crew performed this action. By not evaluating the human factors associated with this crew action, the report provides a limited understanding of the circumstances leading to the airplane’s nose-down pitch before impact.

- The EAIB draft report includes details and analysis of the OMB/FCOM bulletin and emergency AD information provided after the Lion Air accident but does not include details about the effectiveness of the operator’s dissemination of the bulletin or flight crew understanding of that information.

+ The bulletin and emergency AD provided information to ensure that flight crews were aware of the possibility for repeated nose-down trim commands after an erroneously high single AOA sensor input and had specific guidance for recognizing the event and responding appropriately.

+ Performance of the correct action depends on flight crews having access to, understanding, and applying the information presented in those documents.

+ The report states that the bulletin and emergency AD were disseminated to Ethiopian Airlines flight crews via the logipad system, but the report does not discuss the effectiveness of this dissemination method or opportunities to improve crew access to, and understanding of, the disseminated information, which could benefit other operators that use a similar system to provide flight crews with critical information.

- The EAIB draft report describes how CRM could have been affected by the flight deck environment but does not fully evaluate the CRM that occurred during the accident flight.

+ International Civil Aviation Organization investigative guidance states that a human performance investigation “should be as methodical and complete as any other traditional area of the investigation.”

+ The CRM aspects not discussed in the report include, but are not limited to, the following:

# Division of duties
# Operator CRM training
# Expected/as-trained CRM performance
# Flight deck communication
# First officer’s limited flight experience
# Potential authority gradient

On Jan 3rd 2023 the French BEA also released comments on the final report (click on Observations du BEA) stating:

The BEA notes that the contributing factors identified by the EAIB are only related to the MCAS system. The following contributing factors, that come out of the analysis of the event, should also be stated in the report:

Flight crew’s failure to apply, immediately after take-off and before the first MCAS activation, the Approach to Stall or Stall Recovery Maneuver and the Airspeed Unreliable Non-Normal Check-list;

Captain’s insistence on engaging the A/P, contrary to the Approach to Stall or Stall Recovery maneuver procedure;

Insufficient use of the electric trim to relieve the high control column forces after the MCAS nose down orders;

Captain’s lack of thrust reduction when the speed became excessive, which in combination with insufficient trim, caused an increase of the forces which became unmanageable on both the control column and the manual trim wheel.

The use of the Logipad system by the airline as the sole means to disseminate information on new systems and/or procedures, which doesn’t allow the evaluation the crews’ understanding and knowledge acquisition on new systems and procedures. This system was used to disseminate the information related to the MCAS system issued following the previous 737 Max accident and did not allow the airline to ensure that the crews had read and correctly understood this information.

On Jan 24th 2023 the NTSB released additional comments mainly re-iterating that the AoA sensor vane fractured due to foreign object impact (bird?) in the opinion of the NTSB.
Incident Facts

Date of incident
Mar 10, 2019

Classification
Crash

Airline
Ethiopian Airlines

Aircraft Registration
ET-AVJ

Aircraft Type
Boeing 737-800MAX

ICAO Type Designator
B38M

This article is published under license from Avherald.com. © of text by Avherald.com.
Article source

You can read 2 more free articles without a subscription.

Subscribe now and continue reading without any limits!

Subscribe now
Are you a subscriber? Login
Subscribe

Read unlimited articles and receive our daily update briefing. Gain better insights into what is happening in commercial aviation safety.

Compare our plans

Send tip

Support AeroInside by sending a small tip amount.

Send tip

Related articles

Newest articles

Subscribe today

Are you researching aviation incidents? Get access to AeroInside Insights, unlimited read access and receive the daily newsletter.

Pick your plan and subscribe

Partner

Blockaviation logo

A new way to document and demonstrate airworthiness compliance and aircraft value. Find out more.

ELITE Logo

ELITE Simulation Solutions is a leading global provider of Flight Simulation Training Devices, IFR training software as well as flight controls and related services. Find out more.

Blue Altitude Logo

Your regulation partner, specialists in aviation safety and compliance; providing training, auditing, and consultancy services. Find out more.

AeroInside Blog
Popular aircraft
Airbus A320
Boeing 737-800
Boeing 737-800 MAX
Popular airlines
American Airlines
United
Delta
Air Canada
Lufthansa
British Airways