UPDATE Jan 4 – The US National Transportation Safety Board (NTSB) disagrees with Ethiopia’s Aircraft Accident Investigation Bureau (EAIB) final report on the accident of Ethiopian Airlines flight ET302. The report, which was presented last week but published on the website only yesterday, fails to include important comments by the NTSB. It also differs significantly from the draft version that was provided earlier. That’s why the NTSB has taken the unusual step to publish its comments on its own website. The French BEA has also made critical comments about the final report. NTSB disagrees with final report on Ethiopian ET302.
The EAIB report extensively describes the events around the crash of Ethiopian flight ET302 on March 10, 2019, in which eight crew and 149 passengers perished when their Boeing MAX 8 crashed into the ground eight minutes after take-off from Addis Ababa Bole International Airport. The accident was the second fatal one involving a MAX 8 after a Lion Air aircraft crashed in October 2018.
Previous interim and final accident reports have attributed the crashes to a failure of the angle of attack system. This resulted in the instruction of a system unknown to the crew (the Maneuvering Characteristics Augmentation System, which consistently commanded the aircraft into a nose-down attitude that both crews were unable to overcome.
Further investigations by the NTSB, the FAA, the US House Committee, and Senate Committee uncovered that Boeing had tried to mask the existence of MCAS to prevent the MAX from having to be certified as a new airplane design. The lack of oversight by the FAA in relation to actions by Boeing to deceive FAA inspectors made it possible that the MAX 8 and 9 were certified with flawed systems. The type was only allowed to re-enter service in late 2020 after various modifications to the airplane, pilot training, and oversight were made. Boeing President and CEO Dennis Muilenburg was ousted in late 2019, while the FAA and other regulatory agencies across the world changed their oversight of Boeing programs. Boeing is still trying to recover from this period.
The accident
The final report confirms that flight ET302 was confronted with deviating angle of attack (AOA) readings from the left and right sensors. According to the Ethiopian investigators, this was caused by a failure of the lefthand AOA vane heating, most likely the result of an electric or electronic problem with the guide vane/sensor. Although a master caution alert was given shortly after take-off, the pilots weren’t warned by an AOA disagree alert. However, the Captain’s left stick shaker was activated and the autothrottle continued to disengage. The cockpit voice recorder initially includes very little conversation between the 29-year-old Captain and 25-year-old First Officer about what was happening, until the Captain says some one minute and twenty seconds into the flight: “We have a flight control problem.”
The erroneous AOA data affected various systems and began to trigger MCAS, a system that was designed to automatically trim the aircraft in case the pitch-up attitude would become too high. MCAS only works when the flaps are fully retracted. In this case, MCAS commanded the aircraft into a nose-down attitude four times during the short flight, which never reached higher than 9.100 feet.
The Captain and FO tried to counter the pitch-down attitude by using electric-trim input, pulling the steering column, or trim the wheel of the horizontal stabilizers, but the Flight Control Computer kept instructing MCAS to kick in and push the nose down. “The Captain repeatedly commanded loudly to pitch up, the forces were physically unmanageable by both flight crew members; due to this there were sounds of exhaustion and shortness of breath were heard in the CVR.”
The report says: “The crew was faced with unprecedented change of events shortly after lift-off which significantly increased crew workload. MCAS design on a single AOA inputs made it vulnerable to undesired activation. Its repetitive activation of nose down stabilizer trim made the aircraft uncontrollable.” In other words: the crew tried tirelessly to fight the pitch-down attitude but lost out to the system while the stick shaker, clackers, and warning lights caused mayhem in the cockpit.
The EAIB report adds: “MCAS and the lack of pilot training did not trigger the accident; however it was the failure of the sensors due to the production quality defects. If the intermittent defects did not cause the AOA Sensors to fail on the accident flight, MCAS would not have activated, and the accident would not have occurred. The MCAS would have remained as a hidden threat until its true nature is exposed by some other valid or erroneous causes. There was no information related to MCAS either in the Flight Crew Operating Manual provided by Boeing or in the Airplane Flight Manual. The error of omission is that Boeing failed to disclose early and attentively the existence of MCAS to the operators.”
Previous electronic faults
New information in the final report is that the MAX 8 that was involved in this accident had suffered numerous electric and electronic faults in the weeks before the crash. The aircraft, ET-AVJ, made its first flight on October 30, 2018, only. The report says: “Post-accident analysis reveals new Airplane experienced unexplained electrical and electronic faults within weeks of entering service, and in the weeks and days prior to their accidents. During the previous maintenance actions of relevance occurred in early December 2018 and involved several write-ups involving temporary fluctuations of vertical speed and altitude as well as a report of the Airplane rolling during autopilot operation. Prior to the accident flight, Altitude and vertical speed indication on the Primary Flight Display showed an erratic and exaggerated fluctuation indication; maintenance actions were performed and none were reported to have recurred; however, the erratic and intermittent nature of the fluctuations made it difficult to insure a permanent solution of these parameters.”
In its findings, the EIAB says: “The failure of originally installed and tested Boeing AOA Sensor parts associated with fatal plane crashes likely involving an open circuit, wire fatigue, evidence of multiple arcing events, unexplained electrical/electronic anomalies, and the loss of heater power. Boeing has never acknowledged the electrical malfunctions that occurred on both MAX airplanes in the months, weeks, and days leading up to their accidents before MCAS was activated on their fatal flights.”
Downplaying MCAS
The Ethiopian investigators go at length to explain that Boeing has concealed and downplayed the MCAS, and how its functionality changed over the years from being designed to function only during manual flight, with flaps up, and at an elevated AOA into a system that also worked at low Mach numbers. “In March 2016, Boeing determined that MCAS should be revised to improve wings-level, flaps up, low Mach stall characteristics and identification. The MCAS was revised such that depending on AOA, it would be capable of commanding incremental stabilizer to a Maximum of 2.5 degrees at low Mach decreasing to a maximum of 0.65 degrees at high Mach. (…) Uncommanded MCAS function was considered “Major“ instead of being categorized as “Catastrophic” during the fault hazard assessment (FHA) by Boeing.”
But Boeing “did not provide the operator with information and alerts related to MCAS to help them understand the system and know how to resolve potential issues. Boeing has never discussed this AOA Sensor electrical design error publicly, did not inform the EAIB about this error either. A loss of power can be a symptom of a EWIS failure, power quality issue and/or a defect inside the AOA Sensor.” The investigators think that the AOA Sensor malfunctioned likely as the result of power quality problem that resulted in the loss of power to the left AOA Sensor Heater.
Even after the Lion Air accident in October 2018, Boeing wasn’t open when the first reports about the role of MCAS emerged. “Post Lion Air accident and prior to ET-302 accident, Ethiopian Airlines training department communicated to Boeing requesting clarification on the MCAS design and the operational procedures of the FCOM bulletin regarding checklist prioritization and whether run-away stabilizer checklist was enough to handle the situation and the need to include airspeed unreliable checklist. In its reply, Boeing did not answer all asked questions made by Ethiopian airlines training department, indicating that it was related to an ongoing Lion Air accident investigation.”
Recommendations
The report makes a number of recommendations, of which some have already been addressed by regulators before the MAX was allowed to re-enter service. The first is that aircraft manufacturers consider the effects on the flight crew of multiple warning systems in the cockpit. The warnings obscured the problem and made it impossible for the crew to identify the exact problem in time. The second recommendation calls for sufficient time and adequate training with the revised MCAS system.
The third recommendation calls on Boeing to reconsider the design of MCAS in such a way that AOA data input from both sensors is received and analyzed by the FCC before sending any command to MCAS. The EAIB also recommends that Boeing, instead of a runaway stabilizer, provide MCAS description and advise how to mitigate MCAS during repetitive AND command.
NTSB comments
The NTSB says that the EAIB presented it with three draft versions since January 2021, the final one in March 2022, and requested its comments to be included in the final report. The US board says now that the Ethiopian Board has failed to do so.
In its December 27 statement, the NTSB writes: “We agree that the uncommanded nose-down inputs from the airplane’s MCAS system should be part of the probable cause for this accident. However, the draft probable cause indicates that the MCAS alone caused the airplane to be “unrecoverable,” and we believe that the probable cause also needs to acknowledge that appropriate crew management of the event, per the procedures that existed at the time, would have allowed the crew to recover the airplane even when faced with the uncommanded nose-down inputs.”
The NTSB proposed that the probable cause in the final report “would include the following causal factors to fully reflect the circumstances of this accident: 1) uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA values and 2) the flight crew’s inadequate use of manual electric trim and management of thrust to maintain airplane control.”
Later on, it adds that the final report fails to properly address how flight crew performance played a critical role in the accident sequence. “However, a discussion of the accident flight crew’s performance (including CRM) was not sufficiently developed in the EAIB draft report, which continues to focus heavily on system design issues.”
The National Transportation Safety Board remarks that “the EAIB draft report incorrectly states that design changes to the 737-8 MAX were not official and were not approved by the FAA.” The NTSB stresses that “Boeing’s changes to the MCAS design were official in March 2016 and were communicated to the FAA in July 2016, as described in the NTSB System Safety and Certification Specialist’s Report, section H, Certification of the MCAS Implementation and Function. Boeing applied for and, in March 2017, was granted an amended type certificate for the 737-8 MAX. For further information, see the NTSB System Safety and Certification Specialist’s Report.”
“The EAIB draft report incorrectly states (in several locations) that the MCAS made control of the airplane “impossible” but neglects to state that, if the crew had manually reduced thrust and appropriately used the manual electric trim, the airplane would have remained controllable despite uncommanded MCAS input.” And: “The EAIB report inaccurately states that the crew performed actions “per the procedure.” Evidence shows that the crew did not appropriately perform non-normal procedures after receiving annunciations relating to unreliable airspeed, stall warning, and runaway stabilizer. The crew also did not respond as expected to the overspeed warning by disconnecting the autothrottle and reducing power.”
Furthermore, the US agency says that the EAIB draft report “incorrectly states that Boeing did not respond or failed to respond appropriately to Ethiopian Airlines’ request for more information about the MCAS after the Lion Air accident.” According to the NTSB, “Boeing provided information to all 737 MAX operators in November 2018 (after the Lion Air accident but before the Ethiopian Airlines accident) to address uncommanded MCAS inputs. (…) Boeing’s response to Ethiopian Airlines’ request for more information about the MCAS, dated December 3, 2018, provided specific guidance about the OMB and checklist prioritization.”
The NTSB also states that the final report excludes findings about potential foreign object damage, specifically caused by birds at Addis Ababa Bole Airport. The report identifies that no remains of a bird were found on the runway from which ET302 took off, which could have been the cause of damage to the AOA sensor on the aircraft. Instead, it blames the failure of the AOA sensor on a power quality issue. But the NTSB says that Ethiopian investigators searched the runway only eight days after the accident and didn’t look at the area near a taxiway, which was the point at which erroneous AOA data was first observed. Analysis by Collins Aerospace concluded that these readings could very well have become erratic after the vane broke off following a bird strike. The report misses the opportunity to address wildlife management at the airport.
French BEA is also critical
The French accident agency BEA is also critical of the final report. In a media statement on January 3, BEA notes: “The BEA considers that the operational and crew performance aspects are insufficiently addressed in the EAIB final report, in particular with regard to the sequence of events that occurred before the activation of the 1st MCAS. Consequently, this prevents the reader from having a precise and complete understanding of the event. Shortcomings relating to the crew’s actions, particularly in the first phase of the flight, are not accompanied by a thorough analysis of the reasons for the behaviors observed, in relation to their training, their experience, and the company organization with regard to the training and knowledge acquisition principles.”
About the accident of ET302 itself, the BEA observes that when the stick shaker activated, the pilots didn’t follow the prescribed procedures for this kind of situation. While applying nose-down input, the Captain failed to disengage the Auto Throttle and tried to engage the Auto Pilot. The French agency remarks about this: “At a height of approximately 350 ft, the captain again tried to engage the A/P although the airline policy requests pilots to wait until they reach 500 ft AGL to engage the autopilot. This premature action, although not appropriate in stick shaker conditions, may be symptomatic of a state of stress that had been rapidly developing following the activation of the stick shaker and Master Caution immediately after take-off.”
“The BEA regrets that the parts of the CVR transcript which allow to show the difficulties encountered by the F/O have been removed from the extracts of the CVR transcript published in the report. It is regrettable that the report does not include a thorough analysis of the reasons for the behaviours observed, in relation with their training, their experience and the company organization with regard to the training and knowledge acquisition principles.”
“The BEA notes that the only probable cause retained in the EAIB report is related to the activation of the MCAS system. The BEA believes that the crew’s inadequate actions and the insufficient Cockpit Resource Management (CRM) played a role in the chain of events that led to the accident, in particular during the first phase of the flight, before the first MCAS activation.”
Active as a journalist since 1987, with a background in newspapers, magazines, and a regional news station, Richard has been covering commercial aviation on a freelance basis since late 2016.
Richard is contributing to AirInsight since December 2018. He also writes for Airliner World, Aviation News, Piloot & Vliegtuig, and Luchtvaartnieuws Magazine. Twitter: @rschuur_aero.
NTSB is covering for Boeing’s failure after the fact that the Lion air accident and the Ethiopian one are the same. The age of the pilots and the so-called bird’s damage is trying to shift blame after all proven to other fictional reasons. As we all know the U.S. government agencies are full of inexperienced racist bureaucrats.
This was a complex multifaceted accident. There was a ‘swiss cheese’ of causes. Yes MCAS was the key issue that led to them losing control but, for the sake of those killed, all lessons for potential improvement should be explored. I’m sure the U.S. government agencies are full of many types of people but branding them racist seems… well… racist? Boeing, in my view, however, have blood on their hands.
An air accident investigation should be unbiased. Accusing the US officials of racism is totally unfounded. One could say that the Ethiopian EAIB excluded crucial details/information from the final report. Because it wasn’t convenient?