The BEA Weighs In: Ethiopian Airlines flight 302

24 Feb 23 10 Comments

In March 2019, the Ethiopian Aircraft Accident Investigation Bureau (EAIB) requested that the French Bureau d’enquêtes et d’Analyses (BEA) support their investigation into the crash of Ethiopian Airlines flight 302. Specifically, they asked the BEA to recover the data from the Flight Data Recorder and the Cockpit Voice Recorder recovered from the wreckage and offer their analysis of that data.

The “black boxes” were damaged on impact; however, the BEA recovered the full information from them, which they delivered to the EAIB along with an in-depth interpretation of the data. The BEA concluded that the crew performance was an important factor in causing the crash.

In January 2021, the Ethiopian team sent the initial draft of their report to BEA and the NTSB, representing the two participating states of France and the US, for comment. The BEA responded, reiterating that the performance of the crew needed to be included and analysed as a part of the report, as this was a significant contributing factor to the accident. The BEA also wrote a “contributory report” analysing the crew performance, making the reasons for their concern very clear. This contributory report broke down the flight into five phases.

The BEA received another draft of the Ethiopian report. The French agency noted with mounting concern that the crew actions were still not sufficiently considered in terms of their contribution to the accident. This second draft only included the crew performance for phases four and five of the flight, that is, in the final moments. The BEA wrote again to the EAIB, explaining that considering all of the crew actions would improve understanding of what the crew could have done differently. In that way, the aviation community could see exactly what actions the crew could have taken and identify opportunities to retain control of the aircraft and land safely.

The BEA submitted a five-page document to the Ethiopian investigators, specifying precisely which sections of the draft needed expanding, starting with the initial flight crew response to the emergency and their use of the autothrottle during the emergency.

The EAIB included more information about the pilot training in this second draft of the final report, details of which had not previously been available. The BEA noted, based on this new information, the crew had recently attended recurrent training which covered the failures that occurred in the first moments of the flight and, theoretically, the flight crew had been reminded of the procedures for dealing with those failures. However, the captain did not actually follow the correct procedures (or any procedures at all) and the first officer seemed completely unable to offer support. How was it that, when faced with the initial emergency, they were unable to rely on their training to know how to react?

The BEA concluded that these issues should be incorporated into the report, with a focus on the lack of Cockpit Resource Management as a contributing factor.

The BEA generally agreed with the probable cause and the contributory factors listed in the draft. They argued one point: the Ethiopian Board had included the lack of information about MCAS as a contributing factor.

To add a bit of context to this, Boeing’s handling of MCAS had been headline news for months in the aftermath of the Lion Air flight 610 crash. The aviation world was literally inundated with information about MCAS. I first wrote about the functions of the MCAS at the end of November 2018, four months before the Ethiopian crash, and my piece referenced Jon Ostrower’s earlier article in The Air Current: What is the Boeing 737 Max Maneuvering Characteristics Augmentation System? which published on the 13th of November, 2018. It seems incredible that in March 2019, two well-trained 737 MAX pilots were suffering from a lack of information about MCAS.

The draft report agreed that the accident flight crew had received all of the information from the airworthiness directives and bulletins released in the aftermath of the Lion Air 610 crash. Investigators had confirmed that the flight crew had attended a specific training explaining the characteristics of MCAS. Thus, the lack of information published by Boeing, while a critical factor in the first crash, had been rectified to a large extent by the time of the AOA failure in Ethiopian flight 302.

The flight crew did not understand the failure they were facing and were unable to react quickly to the crisis. From a standpoint of aviation safety, it is critical to consider how and why they were caught so unawares.

And yet, when the EAIB sent a third draft of the final report, again they disregarded the crew actions leading up to the MCAS activation. The conclusion still focused on the lack of MCAS training and documentation as a contributing cause, with only a cursory exploration of Ethiopian Airline’s dissemination of the MCAS procedures in the aftermath of the Lion Air crash.

This time, the BEA response was more forceful. They reminded the reader that the BEA had been an active participant of the investigation: analysing the aircraft systems, the operational aspects and the crew performance issues. They were speaking from a position of knowledge.

The BEA considers that the operational and crew performance aspects are insufficiently addressed in the EAIB final report, in particular with regard to the sequence of events that occurred before the activation of the 1st MCAS. Consequently this prevents the reader from having a precise and complete understanding of the event.

The BEA laid out a short but clear summary of the points that needed to be included for a comprehensive and balanced report, with the request that their response be appended to the Final Report. It is clear that by now, having seen the third draft, the BEA were no longer expecting their concerns to be dealt with.

The summary starts with the events that took place from take-off to the first MCAS activation.

The emergency started directly after take-off with the failure of the left Angle of Attack (AOA) sensor, which fed erroneous data into the system. The BEA concluded that the initiating event was a foreign object impact breaking the sensor vane, most likely a bird strike. The first symptom in the cockpit was that the master caution alert lit up and the captain-side stick shaker was activated.

A stick shaker consists of an electric motor and an unbalanced flywheel connected to the control column. An electrical current is sent when the Angle of Attack (AOA) reaches unsafe values, which causes the stick shaker to vibrate and shake the control column.

The stick shaker has been described as a poor man’s AOA indicator. If the Angle of Attack exceeds a safe value and the shaker activates, the control column begins to violently vibrate in an unmistakable message to the pilot that the aircraft is at risk of stalling.

The Boeing 737 MAX documentation and training is clear that the immediate response should be to hold the control column firmly, disengage the autopilot and the autothrottle, and then smoothly apply a nose-down input. This is a memory item: the pilot’s response should be instinctive to take control of the aircraft and pitch the nose down in order to increase the airspeed as a matter of urgency.

The captain did push the control column forward for the nose-down input but he did not disengage the autothrottle.

The autothrottle (A/T) is an automated system which controls the speed of the aircraft by controlling the engine thrust and power settings for a specific flight profile. There are two basic modes: Thrust Mode and Speed Mode. When ready for departure, the autothrottle is set to Thrust Mode and will generate a high thrust value for the take-off and then transition to the appropriate lower thrust value for the climb. The autothrottle reduces the flight crew’s workload. However, if the aircraft is at risk of stalling, manual control is prioritised. It’s critical that the autopilot and the autothrottle do not interfere with the recovery process.

There was no need for the captain to disengage the autopilot as it was not yet engaged.

Five seconds after the stick-shaker activation, both Pilot Flight Displays showed the IAS DISAGREE message and the ALT DISAGREE message. These messages mean the system has conflicting data for the Indicated Air Speed (IAS) and the Altitude (ALT). This was caused by the faulty AOA data on the captain’s side. The AOA data from the sensor on the right side of the aircraft was correct.

As the 737 MAX reached 350 feet above the ground, with the stick shaker still violently vibrating the control yoke, the captain tried to engage the autopilot. He also left the autothrottle engaged, which continued to operate at the 94% thrust set for the take-off.

The airline’s policy was that pilots should wait until they were 500 feet above ground level before engaging the autopilot. The BEA theorise that the captain’s early attempt to engage the autopilot may have been a stress reaction following the master caution and stick shaker issues after take-off.

Whichever way you look at it, it was the wrong thing to do.

The IAS DISAGREE message is a trigger to follow the Airspeed Unreliable Non-Normal Checklist. The first action on the checklist is to disengage the autopilot. The second is to disengage the autothrottle. Then the flight crew should ensure that the Flight Director switches are set to off and select a specific manual pitch attitude and power setting: in this case, with the flaps still extended, 10° and a power setting of 80% N1.

But neither pilot acknowledged the IAS and ALT DISAGREE messages or looked for the checklist. BEA analysis and simulator tests at Boeing both confirmed that the alerts appeared on both displays but somehow the pilots did not notice or disregarded the information.

Instead, the captain tried once more to get the autopilot to engage as they climbed through 500 feet. When it didn’t engage, he said “What’s going on?” There was no response from the first officer.

As they passed 1,000 feet, the captain attempted to engage the autopilot for the third time. This time, it works.

One of the crew set the Mode Control Panel to a speed of 238 knots. However, Mode Control Panel was not controlling the autopilot airspeed target. Instead, the autopilot was basing its target on the captain-side minimum operational speed.

Skewed by the faulty data, the minimum operational speed was calculated at an impossible airspeed, an airspeed higher than the maximum operating velocity of the aircraft (340 knots). In an attempt to accelerate to the apparently desired speed, the autopilot pitched the nose down. The stabiliser trim decreased to 4.6 units, helping to keep the nose-down attitude of the aircraft.

The 737 MAX began descending at a rate of 1,400 feet per minute. The pilots had only seconds to react.

Someone, presumably the captain, finally disengaged the autopilot. We don’t know who because there was no discussion in the cockpit. There was no mention of the stick shaker activation or the massive increase in speed beyond what had been set on the Mode Control Panel. And again, no one seemed to consider disengaging the autothrottle, which was still producing 94% take-off power.

Only the captain seemed to be reacting, and he did not follow the memory items or ask for any checklists. Instead, he attempted to engage the autopilot early and repeatedly. The first officer, as Pilot Monitoring, had no helpful information and showed no awareness of the DISAGREE messages on their panels. Neither seemed to know how to respond to the unexpected acceleration.

And more important than any of that: the crew never discussed what was happening. They never considered what actions they might take. They made no attempt at diagnostics or problem solving.

And all this was before the MCAS activated, as the flaps were still in the process of retracting.

The BEA concluded that the First Officer was overwhelmed by the events on board from the moment that the stick shaker was triggered.

However, the Ethiopian investigators did not consider the crew actions to be a factor in the accident and simply omitted the initial transcripts which documented the lack of Cockpit Resource Management in the beginning of the crisis.

This brings us to part two, when the MCAS activated.

The flaps had just reached the fully retracted position as they’d climbed away. This removed the inhibition on MCAS. Triggered by the faulty AOA data, the MCAS decreased the stabiliser trim from 4.6 units to 2.1 units. The captain fought to keep the nose up, applying between 100 and 125 pounds of force onto the control panel. There was a brief input on the electric trim, but at two seconds, it was not enough to counteract the MCAS inputs. The stabiliser remained at 2.1 units of trim.

The captain, through brute strength, managed to keep the aircraft almost level.

The MCAS activated again. This time, the captain did use the electric trim to relieve the load, applying trim-up for nine seconds. The MCAS was interrupted. However, the captain failed to apply any additional trim-up inputs: the stabliser remained at around 2.3 units of trim. Effectively, he’d cancelled out the second MCAS activation but not reset the trim to cancel out the other stabiliser inputs caused the aircraft pitched down to accelerate and the first MCAS activation had not been cancelled out. The captain was still fighting against the aircraft’s configuration.

At the same time, someone, probably the captain, moved the stab trim cut-out switches into the cut-out position. The STAB TRIM CUT OUT disconnects the electric trim tab system and, critically, disables the MCAS, which meant that it was no longer reacting to the faulty data by attempting to bring the nose down.

However, it also meant that they could no longer adjust the electric trim. The 737 MAX was at 9,100 feet, travelling at an indicated airspeed of 332 knots, with a pitch of 2.5°, climbing at 350 feet per minute. In order to continue the climb, the captain was pulling on the control column with 80 pounds of force.

The maximum operating velocity of the aircraft was 340 knots. But the indicated airspeed had continued to increase until it was flying between 350 and 375 knots, flying faster than the aircraft was designed to handle. The overspeed warning sounded in the cockpit. Both crew members expressed surprise: clearly, neither had been monitoring the indicated airspeed.

Now that they were aware that their airspeed was dangerously high, one of the two pilots might make a move to reduce the thrust. Neither did. The autothrottle remained engaged, still powering the aircraft at 94%, as if for take-off.

These actions are why the BEA has argued against the “simple” conclusion that the probable cause of the crash was the activation of the MCAS.

The crew’s actions and Cockpit Resource Management were clearly frighteningly incompetent before the MCAS had activated. Further, every single contributing factor was based on related to MCAS and Boeing’s failures. The causal factors in the drafts never mention the response to the crisis in the cockpit.

The BEA recommended that the crew’s “inadequate actions and insufficient CRM” be included in the probable cause. Further, they added five additional contributing factors to the crash.

  • Flight crew’s failure to apply, immediately after take-off and before the first MCAS activation, the Approach to Stall or Stall Recovery Maneuver and the Airspeed Unreliable Non-Normal Check-list;

  • Captain’s insistence on engaging the A/P, contrary to the Approach to Stall or Stall Recovery maneuver procedure;

  • Insufficient use of the electric trim to relieve the high control column forces after the MCAS nose down orders;

  • Captain’s lack of thrust reduction when the speed became excessive, which in combination with insufficient trim, caused an increase of the forces which became unmanageable on both the control column and the manual trim wheel.

  • The use of the Logipad system by the airline as the sole means to disseminate information on new systems and/or procedures, which doesn’t allow the evaluation [of] the crews’ understanding and knowledge acquisition on new systems and procedures. This system was used to disseminate the information related to the MCAS system issued following the previous 737 Max accident and did not allow the airline to ensure that the crews had read and correctly understood this information.

Ethiopian Airlines ET-AVJ photographed a month before the accident by LLBG Spotter

In December 2022, Ethiopian Airlines published the final report without including these changes or appending this document. The final report includes a link to the previous response by the BEA. In response, the BEA took the decision to follow the NTSB’s lead and publish their comments on their website to make their position perfectly clear.

You can read the full document from the BEA, as well as the press release where they explain why they have published it, on the BEA website alongside a copy of the EAIB final report.

Category: Accident Reports,


  • GREAT writeup, very interesting.
    It seems pretty obvious that their training was deficient. When you owe the IRS money they can go in with guns drawn and demand goods, money, records, anything they want. In a case like this I would send in a crew (unannounced) to interview all pilots and inspect all training records to see if any of them had received all of the training they should have gotten. If the airline or country balked, I would prevent their planes from landing at any airport outside that country. It seems ridiculous that they be allowed this kind of fast and loose management.

    However, the Ethiopian investigators did not consider the crew actions to be a factor in the accident and simply omitted the initial transcripts which documented the lack of Cockpit Resource Management in the beginning of the crisis.

    • Curiously I come to the opposite conclusion. The crew’s training was adequate. They just failed to follow that training.

      • if the training doesn’t enable you to do what you’ve been trained to do, how can it be adequate?

        If you train your dog to comr when you call, but he doesn’t, was his training “adequate”?

        • In the end,it doesn’t matter. If the investigation board glosses over the issues of training and competence, then none of it gets fixed.

        • Training can be wholly adequate but competence and human behaviour are key factors to consider. The inquiry was established partly to find out why they didn’t employ that training.

          As for your dog. Offer a bone. It’ll some come!

      • if competence is the issue, they shouldn’t have passed the training, but failed it, IF the training was adequate.

        In fact, the BEA makes this very point:

        The use of the Logipad system by the airline as the sole means to disseminate information on new systems and/or procedures, which doesn’t allow the evaluation the crews’ understanding and knowledge acquisition on new systems and procedures. This system was used to disseminate the information related to the MCAS system issued following the previous 737 Max accident and did not allow the airline to ensure that the crews had read and correctly understood this information.

        The competence of the crew wasn’t being checked, making the training inadequate.

  • The BEA comments paint a dire picture of a flight crew that was completely overwhelmed during thosd 5 minutes of flight:

    There were no crew exchanges on the CVR regarding the IAS DISAGREE or ALT DISAGREE messages, which supports the conclusion that the IAS DISAGREE and ALT DISAGREE messages were most probably not seen by the crew throughout the flight.

    At a height of approximately 350 ft, the captain again tried to engage the A/P although the airline policy requests pilots to wait until they reach 500 ft AGL to engage the autopilot. This premature action, although not appropriate in stick shaker conditions, may be symptomatic of a state of stress that had been rapidly developping following the activation of the stick shaker and Master Caution  immediately after take-off.

    During this phase, besides the destabilizing cockpit environment linked to the activation of the stick shaker and a Master Caution immediately after take-off, the coordination and the communication between the captain and the F/O were very limited and insufficient. There was no discussion nor diagnosis with respect to the nature of the events on board. The situational awareness, problem solving and decision making were therefore deeply impacted. The F/O’s lack of proactivity,  which comes out from the CVR transcripts, seems to show  that he was overwhelmed by the events on board from the moment the stick shaker triggered. His low flight experience (300 hours total) may have accounted for this situation.

    What’s scary is that the crew accelerating the aircraft into overspeed would’ve happened regardless of MCAS. MCAS changing the trim robbed them of the opportunity to recover from a situation they shouldn’t have been in. The problem-solving strategy by the PF was apparently, “I must’ve messed up somehow, let the autopilot save me”, and it seems symptomatic of his complete disorientation.

    I wonder which airlines incorporated an “AOA disagree” scenario into their simulator training after the Lion Air crash (or even before?). In hindsight, that’s what should’ve been performed by all crews flying the 737MAX, and maybe then that flight wouldn’t have crashed. A simulator is the proper place to be disoriented by that scenario, not a passenger flight 5 minutes from impact.

    • Lets remember neither LionAir or Ethiopian had the luxury of an AOA Disagree warning as it had been removed from the 737 basic standard package and included as an optional AOA display feature which most airlines hadn’t purchased. Most Max crews didn’t know it had been removed, and following the FAA SB many didn’t know their aircraft didn’t have the option.
      Its reinstatement should have been mandatory following Lion Air.

  • Eight months prior to LionAir the French BEA investigated two successive incidents of AOA failure on a Transavia 737-800 fitted as standard with AOA Disagree and neither of those crews followed the Airspeed Unreliable procedure.

    There are eerie similarities between these incidents and LionAir. Had the BEA reported promptly within 3 months and the industry addressed the glaring issue then perhaps both 737MAX crashes could have been avoided. The marked differences from SOP, by five different crews, 2 Transavia, 2 LionAir, 1 Ethiopian, suggests that something is completely awry with the whole industry.

    None of this excuses Boeing for the disastrous system design on board the 737MAX. Systems should assist pilots, not hide info from them, disregard settings, and plummet the aircraft to the ground. All crews screw up, over look obvious things in stressful situations; it the systems role to flag these errors and contain them, and not to blindly allow an aircraft to exceed VNE because the A/T was set to N1.
    The failure of a single AOA should have been trapped by the system, notified to the crew, and the system switched to alternate controls.

    Also of note, the FAA in 2013 (AD 2013-19-08) classified the erroneous activation of a 737 control column shaker during takeoff, as an unsafe condition which could result in runway overrun, failure to clear terrain or obstacles aftertakeoff, or reduced controllability of the airplane.
    Its a pity Boeing didn’t incorporate this advice into the 737Max design

  • Amendment to my comment:
    “and not to blindly allow an aircraft to exceed VNE because the crew failed to notice that the A/T (due to the AOA error) had failed to transition to N1 mode and remained in ARM with takeoff thrust.”

Post a comment:

Your email address will not be published. Required fields are marked *


This site uses Akismet to reduce spam. Learn how your comment data is processed.