NTSB dismayed as 737 Max crash inquiry overlooks human factors

US investigators have dissented over findings of an Ethiopian inquiry into the fatal Boeing 737 Max 8 crash outside Addis Ababa nearly four years ago, arguing that the conclusions focus on technical design issues and fail to take sufficient account of human factors and inadequate pilot responses to the loss of control.

The accident, involving Ethiopian Airlines flight ET302 in March 2019, was the second to involve a 737 Max in less than five months and led to a worldwide grounding of the type over concerns that failure of a single angle-of-attack (AoA) sensor could generate false air data and lead the horizontal stabiliser trimming system to push the aircraft into a rapid descent.

Ethiopia’s aircraft accident investigation bureau has concluded that the trimming system – the Maneuvering Characteristics Augmentation System (MCAS) – was responsible for the crash, echoing the Indonesian Lion Air 737 Max accident in October 2018.

It claims that a defective AoA sensor exposed the vulnerability of MCAS, which would have otherwise remained as a “hidden threat”.

The US National Transportation Safety Board (NTSB) fully concurs that the MCAS behaviour was part of the accident sequence.

SENSOR DAMAGE

But it disagrees that the AoA sensor was defective, arguing instead that a bird-strike on the instrument, causing its vane to break away, was more likely.

Crucially it also contests the inquiry’s suggestion that the aircraft was “unrecoverable” by the crew.

“We believe that the probable cause also needs to acknowledge that appropriate crew management of the event, per the procedures that existed at the time, would have allowed the crew to recover the airplane even when faced with the uncommanded nose-down inputs,” says the NTSB.

It has separately published its dissension over the draft report, after it was not attached to the final report issued in late December by the Ethiopian bureau.

The Ethiopian inquiry found that the aircraft’s throttle levers remained at take-off thrust, and the stick-shaker activated as the jet became airborne from Addis Ababa.

Its captain attempted to engage the autopilot, despite this being inconsistent with stick-shaker procedures, but the crew “did not discuss any issue” relating to the stick-shaker, it states. The autopilot activated at the third attempt.

According to the inquiry the false AoA sensor data led to incorrect calculation of a minimum operational airspeed – which exceeded the maximum operational airspeed of 340kt (630km/h) – and also prevented the flight-management computer from detecting a threshold altitude at which thrust would have automatically reduced.

As the aircraft climbed, the crew retracted the flaps, but shortly afterwards the autopilot disconnected. The combination of manual flight, retracted flaps, and the false AoA data triggered MCAS to adjust the horizontal stabiliser and lower the nose.

Although the crew attempted to counter this nose-down tendency with manual input, the continuing high-thrust acceleration meant the pilots had to apply excessive forces in response.

MCAS triggered for a second time, and the pilots responded by activating the trim cut-out switches – a correct response, advised after the Lion Air accident – which effectively prevented MCAS from adjusting the stabiliser when it triggered for a third time.

SUBSTANTIAL FORCE

At this point the aircraft was travelling at 332kt, at 9,100ft altitude, and gradually climbing – but the crew was having to counter the out-of-trim stabiliser with substantial force.

The crew advised air traffic control of the flight-control difficulties, and aimed to reach the minimum safe altitude of 14,000ft in order to start diagnosing the problems.

But the “unbearable” manual forces needed to trim the aircraft and maintain the climb were too much for the pilots, and the captain called, “Put them up” – an apparent command to disconnect the trim cut-out switches which, critically, would also re-activate MCAS.

“It most likely appears that the flightcrew were trying to find other means to relieve the force,” says the inquiry, in an explanation for the decision. MCAS subsequently commanded a fourth nose-down shift in the stabiliser, pushing the aircraft into its final fatal dive.

None of the 157 passengers and crew aboard the 737 Max (ET-AVJ) survived the impact.

The inquiry says MCAS and a lack of pilot training “did not trigger” the accident, but that it was initiated by flawed data from the AoA sensor.

But the NTSB believes the analysis of the pilots’ performance is “not sufficiently developed” by the inquiry which, it adds, focuses “heavily” on system design issues instead.

“Absence of flightcrew performance information limits the opportunity to address broader and equally important safety issues,” it states, pointing out that evaluation of the crew’s actions “would not have been particularly difficult” given the amount of information available.

“Design mitigation must adequately account for expected human behaviour [in order] to be successful,” the NTSB adds, while demanding a “thorough understanding” of crew performance – not only for design purposes but also operational and training safety improvements.

The NTSB disputes a conclusion that airspeed and altitude ‘disagree’ messages were not presented to the crew, and says the inquiry should have explored the pilots’ “lack of conversation or action” in response to the messages.

THRUST REDUCTION

According to the NTSB, the aircraft was not uncontrollable, but the inquiry neglects to state that a manual reduction of thrust and appropriate use of manual electric trim would have allowed the pilots to maintain control despite the uncommanded MCAS inputs.

“The flightcrew’s failure to reduce thrust manually and the excessive airspeed that resulted played a significant role in the accident sequence of events,” the NTSB insists.

It says the activation of the stick-shaker or the annunciation of an ‘airspeed disagree’ message should have prompted an “expected” crew response to disengage the autothrottle.

Instead the autothrottle remained active and responsive to the erroneous (AoA) data, and failed to order a thrust reduction. Despite an aural ‘overspeed’ warning as the aircraft accelerated towards 340kt, at high thrust, the NTSB says the crew did not notice the autothrottle’s unusual behaviour, or take action to manually control thrust, leaving the pilots to deal with excessive forces on the control column and manual trim-wheel.

Countering the uncommanded nose-down inputs with manual nose-up electric trim – as described in operating manual documentation – would have enabled control forces to remain in a “controllable regime”, it says.

It adds that the draft report “did not examine” the pilots’ understanding of the relationship between airspeed and necessary control forces, and says it “misses an opportunity” to evaluate the effectiveness of airline training on this matter.

Evidence from the inquiry, the NTSB states, shows the crew did not carry out appropriate non-normal procedures in response to annunciations relating to unreliable airspeed, stall warning and runaway stabiliser.

Flight-data recorder information shows only “minimal” use of manual electric trim, which would have reduced control forces, while performing memory items for unreliable airspeed or runaway stabiliser would have led the crew to disengage the autothrottle. Such actions should have been carried out before the crew activated the trim cut-out switches.

SWITCHES DISCONNECTED

But even after activating the trim cut-out, says the NTSB, the crew subsequently disconnected the switches – a decision “contrary” to procedures that direct crews to ensure that the cut-out remained in place for the rest of the flight.

“Available evidence for this accident did not indicate why the crew performed this action,” it adds.

“By not evaluating the human factors associated with this crew action, the report provides a limited understanding of the circumstances leading to the airplane’s nose-down pitch before impact.”

The NTSB has received support from its French counterpart over its complaints regarding the report’s lack of focus on the actions of the flightcrew, an omission the BEA describes as “regrettable”.

The BEA investigation authority believes the 737 Max’s pilots experienced rapidly developing stress from a stick-shaker alert on take-off, even before they found themselves fighting against the MCAS.

It says the stick-shaker should have prompted the crew to apply stall-recovery procedures from memory – including applying nose-down input and disengaging the autopilot and autothrottle.

“Only the nose-down input was performed by the flightcrew,” the BEA states. “The autothrottle remained engaged and the pilot later insisted on engaging the autopilot.”

Engineering simulations, it says, show the pilots would have been presented with airspeed and altitude ‘disagree’ messages, and should have run a checklist for unreliable airspeed – which also requires autopilot and autothrottle disengagement, adopting a 10° nose-up pitch and a specific thrust setting.

But the captain did not disconnect the autothrottle and instead attempted to engage the autopilot, despite being below the autopilot height threshold set by the airline.

“This premature action, although not appropriate in stick-shaker conditions, may be symptomatic of a state of stress that had been rapidly developing following the activation of the [stick-shaker] immediately after take-off,” says the BEA.

It says the first officer – who had just 300h experience – appears to have been “overwhelmed” by events from the point at which the stick-shaker triggered.

The authority says parts of the cockpit-recorder transcript illustrating the first officer’s difficulties have not been included in the final report into the accident.

“Co-ordination and the communication between the captain and the first officer were insufficient,” says the BEA. “There was no discussion nor diagnosis with respect to the nature of the events on board. The situational awareness, problem-solving and decision making were therefore deeply impacted.”

AERODYNAMIC FORCES

The lack of thrust reduction meant the aircraft accelerated to excessive speeds and made manual control against aerodynamic forces extremely difficult when the false AoA data, combined with other logic conditions, led MCAS to issue uncommanded pitch-down inputs.

The BEA argues that crew-performance aspects of the accident – particularly those which emerged before the MCAS activation – are “insufficiently addressed” by the Ethiopian investigation.

It says the crew’s failure to apply checklists or reduce thrust, use of autopilot contrary to procedures, and inadequate use of electric trim to relieve high control forces should have had further explanation.

“Shortcomings relating to the crew’s actions, particularly in the first phase of the flight, is not accompanied by a thorough analysis of the reasons for the behaviours observed, in relation with their training [and] their experience,” says the BEA.