US investigators have dissented over findings of an Ethiopian inquiry into the fatal Boeing 737 Max 8 crash outside Addis Ababa nearly four years ago, arguing that the conclusions focus on technical design issues and fail to take sufficient account of human factors and inadequate pilot responses to the loss of control.
The accident, involving Ethiopian Airlines flight ET302 in March 2019, was the second to involve a 737 Max in less than five months and led to a worldwide grounding of the type over concerns that failure of a single angle-of-attack (AoA) sensor could generate false air data and lead the horizontal stabiliser trimming system to push the aircraft into a rapid descent.
Ethiopia’s aircraft accident investigation bureau has concluded that the trimming system – the Maneuvering Characteristics Augmentation System (MCAS) – was responsible for the crash, echoing the Indonesian Lion Air 737 Max accident in October 2018.
It claims that a defective AoA sensor exposed the vulnerability of MCAS, which would have otherwise remained as a “hidden threat”.
The US National Transportation Safety Board (NTSB) fully concurs that the MCAS behaviour was part of the accident sequence.
But it disagrees that the AoA sensor was defective, arguing instead that a bird-strike on the instrument, causing its vane to break away, was more likely.
Crucially it also contests the inquiry’s suggestion that the aircraft was “unrecoverable” by the crew.
“We believe that the probable cause also needs to acknowledge that appropriate crew management of the event, per the procedures that existed at the time, would have allowed the crew to recover the airplane even when faced with the uncommanded nose-down inputs,” says the NTSB.
It has separately published its dissension over the draft report, after it was not attached to the final report issued in late December by the Ethiopian bureau.
The Ethiopian inquiry found that the aircraft’s throttle levers remained at take-off thrust, and the stick-shaker activated as the jet became airborne from Addis Ababa.
Its captain attempted to engage the autopilot, despite this being inconsistent with stick-shaker procedures, but the crew “did not discuss any issue” relating to the stick-shaker, it states. The autopilot activated at the third attempt.
According to the inquiry the false AoA sensor data led to incorrect calculation of a minimum operational airspeed – which exceeded the maximum operational airspeed of 340kt (630km/h) – and also prevented the flight-management computer from detecting a threshold altitude at which thrust would have automatically reduced.
As the aircraft climbed, the crew retracted the flaps, but shortly afterwards the autopilot disconnected. The combination of manual flight, retracted flaps, and the false AoA data triggered MCAS to adjust the horizontal stabiliser and lower the nose.
Although the crew attempted to counter this nose-down tendency with manual input, the continuing high-thrust acceleration meant the pilots had to apply excessive forces in response.
MCAS triggered for a second time, and the pilots responded by activating the trim cut-out switches – a correct response, advised after the Lion Air accident – which effectively prevented MCAS from adjusting the stabiliser when it triggered for a third time.
At this point the aircraft was travelling at 332kt, at 9,100ft altitude, and gradually climbing – but the crew was having to counter the out-of-trim stabiliser with substantial force.
The crew advised air traffic control of the flight-control difficulties, and aimed to reach the minimum safe altitude of 14,000ft in order to start diagnosing the problems.
But the “unbearable” manual forces needed to trim the aircraft and maintain the climb were too much for the pilots, and the captain called, “Put them up” – an apparent command to disconnect the trim cut-out switches which, critically, would also re-activate MCAS.
“It most likely appears that the flightcrew were trying to find other means to relieve the force,” says the inquiry, in an explanation for the decision. MCAS subsequently commanded a fourth nose-down shift in the stabiliser, pushing the aircraft into its final fatal dive.
None of the 157 passengers and crew aboard the 737 Max (ET-AVJ) survived the impact.
The inquiry says MCAS and a lack of pilot training “did not trigger” the accident, but that it was initiated by flawed data from the AoA sensor.
But the NTSB believes the analysis of the pilots’ performance is “not sufficiently developed” by the inquiry which, it adds, focuses “heavily” on system design issues instead.
“Absence of flightcrew performance information limits the opportunity to address broader and equally important safety issues,” it states, pointing out that evaluation of the crew’s actions “would not have been particularly difficult” given the amount of information available.
“Design mitigation must adequately account for expected human behaviour [in order] to be successful,” the NTSB adds, while demanding a “thorough understanding” of crew performance – not only for design purposes but also operational and training safety improvements.
The NTSB disputes a conclusion that airspeed and altitude ‘disagree’ messages were not presented to the crew, and says the inquiry should have explored the pilots’ “lack of conversation or action” in response to the messages.
According to the NTSB, the aircraft was not uncontrollable, but the inquiry neglects to state that a manual reduction of thrust and appropriate use of manual electric trim would have allowed the pilots to maintain control despite the uncommanded MCAS inputs.
“The flightcrew’s failure to reduce thrust manually and the excessive airspeed that resulted played a significant role in the accident sequence of events,” the NTSB insists.
It says the activation of the stick-shaker or the annunciation of an ‘airspeed disagree’ message should have prompted an “expected” crew response to disengage the autothrottle.
Instead the autothrottle remained active and responsive to the erroneous (AoA) data, and failed to order a thrust reduction. Despite an aural ‘overspeed’ warning as the aircraft accelerated towards 340kt, at high thrust, the NTSB says the crew did not notice the autothrottle’s unusual behaviour, or take action to manually control thrust, leaving the pilots to deal with excessive forces on the control column and manual trim-wheel.
Countering the uncommanded nose-down inputs with manual nose-up electric trim – as described in operating manual documentation – would have enabled control forces to remain in a “controllable regime”, it says.
It adds that the draft report “did not examine” the pilots’ understanding of the relationship between airspeed and necessary control forces, and says it “misses an opportunity” to evaluate the effectiveness of airline training on this matter.
Evidence from the inquiry, the NTSB states, shows the crew did not carry out appropriate non-normal procedures in response to annunciations relating to unreliable airspeed, stall warning and runaway stabiliser.
Flight-data recorder information shows only “minimal” use of manual electric trim, which would have reduced control forces, while performing memory items for unreliable airspeed or runaway stabiliser would have led the crew to disengage the autothrottle. Such actions should have been carried out before the crew activated the trim cut-out switches.
But even after activating the trim cut-out, says the NTSB, the crew subsequently disconnected the switches – a decision “contrary” to procedures that direct crews to ensure that the cut-out remained in place for the rest of the flight.
“Available evidence for this accident did not indicate why the crew performed this action,” it adds.
“By not evaluating the human factors associated with this crew action, the report provides a limited understanding of the circumstances leading to the airplane’s nose-down pitch before impact.”
The NTSB has received support from its French counterpart over its complaints regarding the report’s lack of focus on the actions of the flightcrew, an omission the BEA describes as “regrettable”.
The BEA investigation authority believes the 737 Max’s pilots experienced rapidly developing stress from a stick-shaker alert on take-off, even before they found themselves fighting against the MCAS.
It says the stick-shaker should have prompted the crew to apply stall-recovery procedures from memory – including applying nose-down input and disengaging the autopilot and autothrottle.
“Only the nose-down input was performed by the flightcrew,” the BEA states. “The autothrottle remained engaged and the pilot later insisted on engaging the autopilot.”
Engineering simulations, it says, show the pilots would have been presented with airspeed and altitude ‘disagree’ messages, and should have run a checklist for unreliable airspeed – which also requires autopilot and autothrottle disengagement, adopting a 10° nose-up pitch and a specific thrust setting.
But the captain did not disconnect the autothrottle and instead attempted to engage the autopilot, despite being below the autopilot height threshold set by the airline.
“This premature action, although not appropriate in stick-shaker conditions, may be symptomatic of a state of stress that had been rapidly developing following the activation of the [stick-shaker] immediately after take-off,” says the BEA.
It says the first officer – who had just 300h experience – appears to have been “overwhelmed” by events from the point at which the stick-shaker triggered.
The authority says parts of the cockpit-recorder transcript illustrating the first officer’s difficulties have not been included in the final report into the accident.
“Co-ordination and the communication between the captain and the first officer were insufficient,” says the BEA. “There was no discussion nor diagnosis with respect to the nature of the events on board. The situational awareness, problem-solving and decision making were therefore deeply impacted.”
The lack of thrust reduction meant the aircraft accelerated to excessive speeds and made manual control against aerodynamic forces extremely difficult when the false AoA data, combined with other logic conditions, led MCAS to issue uncommanded pitch-down inputs.
The BEA argues that crew-performance aspects of the accident – particularly those which emerged before the MCAS activation – are “insufficiently addressed” by the Ethiopian investigation.
It says the crew’s failure to apply checklists or reduce thrust, use of autopilot contrary to procedures, and inadequate use of electric trim to relieve high control forces should have had further explanation.
“Shortcomings relating to the crew’s actions, particularly in the first phase of the flight, is not accompanied by a thorough analysis of the reasons for the behaviours observed, in relation with their training [and] their experience,” says the BEA.
Probe rejects bird-strike theory for angle-of-attack sensor failure on crashed jet
One of the aspects of the Ethiopian Airlines Boeing 737 Max crash which had remained unclear during the investigation was the cause of the original angle-of-attack (AoA) sensor malfunction that initiated the accident sequence.
The sensor suddenly failed during the take-off run from Addis Ababa on 10 March 2019, transmitting flawed information to various aircraft systems including the Maneuvering Characteristics Augmentation System (MCAS) horizontal stabiliser trim function – which led the aircraft to enter a nose-down attitude and rapid descent from which its crew was unable to recover.
Ethiopia’s air accident investigation bureau believes the sensor was defective and malfunctioned “most likely” as a result of a “power quality problem”.
At the time of the malfunction, flight-data recorder information showed heater power to the left-hand sensor was lost.
“Evidence indicates the loss of power was likely due to a production-related intermittent electrical [or] electronic failure involving the airplane’s electrical wiring interconnection system,” the inquiry claims.
It points out that the aircraft had been experiencing various electronic glitches shortly after its delivery to Ethiopian Airlines in November 2018.
But the US National Transportation Safety Board (NTSB) argues that a bird-strike, which damaged the AoA vane, is a more plausible explanation for the sudden change in sensor data.
Readings from the left- and right-hand AoA sensors began to deviate sharply just as the aircraft lifted off. The left-hand figure fluctuated from 11.1° to 35.7° and then 74.5°, while the right-hand instrument remained largely constant at about 15°.
Ethiopian investigators, states the NTSB, omitted “key findings” about the sensor failure in their draft report into the accident.
Collins Aerospace manufactured the sensor and was appointed to the investigation team as a technical adviser to look into possible reasons for the malfunction, including manufacturing defects, component and heater faults, and structural failures.
The company conducted vibration, acceleration and flight-simulation testing, and modelled the sensor’s performance.
While the Ethiopian inquiry refers to Collins’ analysis, the NTSB says it “does not acknowledge” that the analysis of flight-data recorder information was “not consistent” with any internal failure of the sensor.
“Instead, those data were fully consistent with previous instances of partial [AoA] vane separation due to a bird-strike,” it adds.
The vane appears to have broken at the hub and separated from the sensor, causing the performance deviation evident 44s after the Ethiopian aircraft commenced its take-off roll.
Separation of the vane resulted in an open circuit for the vane heater and resulted in a fail annunciation about 6s later.
According to the analysis the aircraft was travelling at about 170kt (314km/h) at the time and a 0.23kg (0.5lb) bird impact would have been sufficient to break the vane away from the jet. Large birds, such as steppe and tawny eagles, are common around Addis Ababa airport.
“Windtunnel test data and the [AoA] dynamic performance model show that the failure mode involving separation of the vane at the hub is consistent with the large and near-instantaneous initial change in the left [AoA] value and the resulting [AoA] dynamics observed,” says the NTSB.
The Ethiopian inquiry states that an inspection of departure runway 07R, covering about a quarter of its 3,780m (12,400ft) length, did not locate any bird remains or debris from the vane.
But the NTSB states that the search took place eight days after the accident and did not include the area around taxiway D, where the erroneous left-hand AoA sensor readings began.
It adds that the lack of debris located during the inspection is not sufficient to rule out a foreign-object impact on the vane.
The NTSB says the inquiry “misses the opportunity” to address improvement of wildlife management at Addis Ababa.
But the Ethiopian investigators, while conceding that a bird-strike “may be” a cause, has leaned towards technical failure, insisting that a “wide range of power quality problems” can lead to erroneous AoA sensor output.