What happened on Ethiopian flight 302: a breakdown of the preliminary report

5 Apr 19 43 Comments

Yesterday, the 4th of April, the Ethiopian Accident Investigation Bureau investigating the crash of Ethiopian Airlines flight 302 released the Preliminary Report (local version stored at bottom of this post).

Ethiopian Airlines flight 302, in the Boeing 737-8(MAX) registration number ET-AVJ, was a scheduled passenger flight from Addis Ababa to Nairobi. There were two flight crew, five cabin crew, one in-flight security officer and 149 passengers. The flight crashed shortly after take-off; the aircraft was destroyed and there were no survivors.

As per ICAO article 26 and 13, the state in which the accident occurred must hold an inquiry into the cause of the accident; in this case, the Ethiopian Accident Investigation Bureau is leading this investigation. Also participating are EASA, the Ethiopian CAA, and Ethiopian Airlines, as technical advisors; the NTSB, as the aircraft was designed and manufactured in the US; and the BEA, who have taken responsibility for reading the Flight Data Recorder and the Cockpit Voice Recorder.

Media relations are being dealt with by the Minister of Transport, which explains why the initial announcement was that “the flight crew repeated followed procedures recommended by Boeing” which made it sound, to me at least, like they followed one check list over and over in hopes of a different result — it’s clear from the report that this was not the case.

DFDR (left) and CVR (right) as discovered on the accident site

The new information is focused around what the FDR can tell us about the aircraft inputs. This is listed in detail with timestamps in the preliminary report and if you know avionics at all, I think it is worth a read. I’m going to just give a summary of the relevant points.

When the aircraft prepared to depart that morning, the Boeing 737’s configuration was as expected and during the take-off roll, both left and right AoA (angle of attack) values were normal and in sync. The captain was the Pilot Flying. There was no sign of anything amiss. The engine thrust was increased and stabilised at 94%; the engines remained at this power setting and the throttles did not move.

As the aircraft lifted off, the left AoA value decreased to 11.1° and then increased to 35.7° while the right AoA value remained steady at 14.94°. The left value jumped up to 74.5° in less than a second. The highest value of the right AoA was 15.3°. The captain’s stick shaker activated, which means that the control yoke began to vibrate rapidly to warn the pilot that the aircraft is at risk of stalling. At the same time, the captain’s instruments for airspeed, altitude and flight director pitch all showed lower values that the first officer’s instruments on the right side.

This is all connected to bad data, that is, the left AoA displayed value was quite clearly wrong and leading to a number of false indications. If this were the only issue, then the flight crew would quickly need to work out which set of instruments was correct and use them to get down to the ground as quickly as possible. Probably the clearest example of the effects of bad air data is Aeroperú 603 in 1996 although the cause was quite different.

Carrying on with Ethiopian 302, as the aircraft reached 50 feet above the ground, the flight director mode was changed to LNAV (Lateral Navigation), a flight guidance mode which uses GPS and beacons to follow a straight-forward route, without regard to altitude. In normal circumstances, the flight director would display the route to the next waypoint and once the autopilot was engaged, the aircraft would navigate to follow that route.

At the aircraft climbed to 200 feet, the FDR recorded that the Master Caution (effectively an automated flight engineer) changed state.

Boeing 737 Master Caution with ANTI-ICE warning displayed

It’s safe to assume that it lit up, as the first officer called out Master Caution Anti-Ice, which is a warning that icing has been detected or that the ice detection system has failed.

Four seconds later, the recorded left AoA heat parameter changed state, presumably turned on in order to melt any icing that may be building up there. It isn’t clear to me if this is a manual intervention or an automated one.

At 400 feet, the flight director mode was changed to VNAV SPEED, which means that the flight mode will include vertical guidance and speed when the autopilot is engaged, taking control of the climb to cruise altitude. This is all still perfectly normal. In 2010, Ethiopian Airlines procedure for use of autopilot in flight in the Flight Crew Operating Manual (FCOM) gave the minimum altitude for autopilot engagement as 400 feet above ground level. I do not have any information as to what the current FCOM says but there’s no reason why it should have changed.

The captain called out “command” to signal that he was engaging the autopilot. The autopilot warning sounded, which means that the autopilot had disengaged, presumably immediately upon being set. The captain called out “Command again” and the autopilot warning sounded again. At this point, the aircraft was at 630 feet above the ground.

The captain advised the first officer to contact radar (air traffic control), which the first officer did, reporting their departure route, current altitude and that they were climbing to flight level 320 (32,000 feet).

During this time, the pitch trim position responded to manual trim inputs. This is important because later, the manual trim appears not to have responded.

One of the flight crew selected 32,000 feet having engaged the Level Change mode and the selected airspeed was 238 knots. The captain requested flaps up and the first officer retracted the flaps. This is all normal departure procedure.

As they reached 1,000 feet above the ground, the captain’s side autopilot was successfully engaged and the pitch trim decreased slightly. Six seconds later, the aircraft showed small oscillations, lateral accelerations, rudder oscillations and slight heading changes. The captain asked the first officer to request ‘maintain runway heading’ — I take this to mean he is breaking off his navigation in order to focus on what is wrong with the aircraft.

The autopilot disconnected thirty-three seconds after having been engaged and the captain told the first officer again to request runway heading and that they were having flight control problems.

The FDR recorded an automatic aircraft nose-down and the pitch trim moved from 4.6 to 2.1 units; enough that the climb was stopped and the aircraft descended slightly. This is the first interference by the Maneuvering Characteristics Augmentation System (MCAS) which has been in the headlines. The MCAS was installed on the Boeing 737 MAX in order to improve the handling characteristics of the new model which had larger engines and higher capacity. If the Angle of Attack (AoA) gets too high, the MCAS will send a command to pitch the nose down gently, which supports the pilots in avoiding a stall. In the cases of both Lion Air flight 610 and Ethiopian flight 302, it became clear early on that both aircraft suffered from bad AoA data which resulted in unwanted pitch down commands from the MCAS.

The Ground Proximity Warning System (GPWS) alerted with DON’T SINK; a warning that the aircraft is close to the ground and not configured for a descent.

The first officer reported to ATC that they were unable to maintain their navigation and requested runway heading which was immediately approved.

The left and right flaps extended very slightly (0.019°) and remained in that position for the rest of the flight. To be honest, I’m not sure what this might mean, if anything.

The control column was pulled back (to pitch the aircraft up) and the aircraft resumed climbing while the Automatic aircraft nose up stabiliser motion was still in progress. As it stopped, one of the pilots used the electric trim to trim the aircraft nose up. The aircraft pitch remained the same while the control column is pulled back with increasing pressure.

Someone, presumably the captain, is attempting to get the aircraft back into the climb; this is what’s been described as the flight crew fighting against the MCAS.

Five seconds after the first automatic nose down stabiliser trim ended, there’s a second automatic trim command. The stabiliser moved down and reached 0.4 units. In the climb it had been at 4.6, so we can see the increasing trim down effect.

The Ground Proximity Warning System (GPWS) triggered three times with DON’T SINK announcements.

The captain asked the first officer to trim up with him and the manual electric trim was used to pitch the nose up. The trim stabiliser reversed and moved up, with the trim increasing to 2.3 units. The first officer called out “Stab trim cut-out”. This is the correct procedure to deal with the MCAS issue as released by Boeing after the Lion Air accident. He repeated the call and the captain agreed. The first officer then confirmed that he had used the STAB TRIM CUTOUT switches, that is, he had deactivated the stabiliser trim system.

Again, there was an automatic nose down command recorded by the FDR, however this time, the stabiliser trim did not respond, which implies that the stabiliser trim system had been correctly deactivated.

Excerpt from Boeing Flight Crew Bulletin released November 2018 in the aftermath of the Lion Air crash

The captain called out: “Pull up, pull up, pull up!” The first officer acknowledged. The captain then asked the first officer to tell ATC that they wanted to maintain current altitude and that they have a flight control problem, which the first officer did. Clearly, they are unable to maintain the climb.

Over the course of about two and a half minutes, stabiliser trim position gradually moved in a nose down direction from 2.3 units to 2.1 units. At the same time, both control columns were being pulled back. The left indicated airspeed (i.e. the captain’s side, which is the side with the bad AoA values) showed an increase in speed from 305 knots to 340 knots, which is the maximum operating speed. If this figure were correct, the aircraft increasing speed further would case structural loads beyond what is safe. The indicated airspeed on the right side shows an even higher indicated airspeed, topping out at 365 knots.

At the same time, the FDR recorded repeated attempts to pull back on the control columns.

The right overspeed clacker sounded, warning the flight crew that the aircraft has exceeded safe limits. It continued to sound until the end of the recording.

The selected altitude ws changed from 32,000 feet to 14,000 feet, their current altitude. Note that this is above sea level and not their height above the ground: Addis Ababa airport has an elevation of over 7,000 feet and they were flying over high ground.

The captain asked the first officer to pitch up with him (that is, pull back on the control column with him, which means that they are now applying brute force to try to pitch the nose back up), which was acknowledged. The left overspeed warning sounded.

The captain asked the first officer if the trim was functional. The first officer replied that the trim was not working and asked if he could try it manually. This implies that it was the electric trim, which is activated by a small switch on each control column, which was not responding.

The captain told him to try but then the first officer replied that it wasn’t working. There’s nothing on the FDR here, because no inputs were received, so it is impossible to prove that the first officer attempted to use the manual trim. However, it appears that having correctly disabled the automatic stabiliser trim, the flight crew lacked any means of controlling the trim at all.

ATC confirm their request to turn to the airport and instruct them to turn right for a heading of 260°. The selected heading was changed to 262°.

The first officer called out the Master Caution Anti-Ice, which has displayed again. Both pilots called out “Left alpha vane.” Alpha means angle of attack what they are referring to is the mechanical wind vane on the left side of the aircraft, that is, they have both understood at that moment that the left AoA sensor has an issue. But there was no time for trouble-shooting; the captain called for the first officer to pitch up with him and then said that it wasn’t enough.

This must have been a desperate moment. The FDR then showed two brief electric trim inputs for nose up. The stabiliser moved nose up from 2.1 units to 2.3 units. It wasn’t enough.

Worse, five seconds later, another nose down down automatic trim command occurred and the stabiliser trim moved in the nose down direction from 2.3 units to 1.0 units.

Had the flight crew turned the stabiliser trim back on and restored the control to the faulty MCAS? That’s what it looks like to me. This will be a key point to clarify in the final report.

The aircraft pitched nose down. The flight crew continued to pull the control columns back but the aircraft continued to pitch down, reaching 40° nose down. The stabiliser position varied between 1.1 and 0.8 units for the rest of the recording.

The left indicated airspeed reached 458 knots and the right reached 500 knots. And that is where the recording ended as the aircraft crashed into the ground.

Close view of the crater caused by the high energy impact before excavation

There’s more in the report, including detailed diagrams of the flight controls and entries in the tech log book which are possibly related, including reports of erratic airspeed and vertical speed indications. It’s only 33 pages so I recommend taking a look if you want more data:
Aircraft Accident Investigation Preliminary Report Ethiopian Airlines Group–B737-8 (MAX) Registered ET-AVJ–28 NM South Eastof Addis Ababa,Bole International Airport

NOTE 10 April 2019: The link has stopped working. I don’t know what’s going on with this but as usual, I kept a local version which you can download for further info.

Preliminary Report B737-800MAX (ET-AVJ)

ET302 Preliminary FDR data — see the report for full details

The initial findings are as follows:

  • The Aircraft possessed a valid certificate of airworthiness;
  • The crew obtained the license and qualifications to conduct the flight;
  • The takeoff roll appeared normal, including normal values of left and right angle-of-attack (AOA).
  • Shortly after liftoff, the value of the left angle of attack sensor deviated from the right one and reached 74.5 degrees while the right angle of attack sensor value was 15.3 degrees; then after; the stick shaker activated and remained active until near the end of the flight.
  • After autopilot engagement, there were small amplitude roll oscillations accompanied by lateral acceleration, rudder oscillations and slight heading changes; these oscillations also continued after the autopilot disengaged.
  • After the autopilot disengaged, the DFDR recorded an automatic aircraft nose down (AND) trim command four times without pilot’s input. As a result, three motions of the stabilizer trim were recorded.The FDR data also indicated that the crew utilized the electric manual trim to counter the automatic AND input.
  • The crew performed runaway stabilizer checklist and put the stab trim cutout switch to cutout position and confirmed that the manual trim operation was not working.
  • I look forward to seeing your comments on what is known so far.

    Category: Accident Reports,

    43 Comments

    • So it looks like the crew were unable to use manual trim (speculation on other forum is that this is due to the air speed, but I have no idea if that is true), so in an attempt to sort things out they reengaged the electronic trim, which allowed the MCAS (with limits resetting 5s after every pilot input) to tip the plane into the ground.

      Rereading the TBC19 bulletin sent after the Lion Air crash http://www.b737.org.uk/mcas.htm the suggestion that electronic trim should be used before the cutouts are used, makes me wonder if Boeing knew that manual trim might not be useable…

      • I wondered about the airspeed too; that might be key to this. Note that it looks like they reengaged the stabiliser trim, the electric trim was never disengaged and appears to have made two small inputs nose up about 30 seconds before the crash. But yes, you bring up a key point which is that five seconds later was the nose-down, so by reinstating the stabiliser trim and (finally?) getting a response from the electronic trim, MCAS reset and responded again to the incorrect AoA data.

        • I can’t figure out as why they couldn’t rotate manually (with the retractable handles) the stabilizer trim wheel after turning off the cutout switches. My experience is quite old flying 707’s, but I also had a good experience in electric and electronic aircraft maintenance and to me sounds impossible that the manual system had become stuck after disconnecting the cutout switches no matter the airplane airspeed. If you read the preliminary report of the Lion Air crash, it also mentions the previous flight, where they performed the runaway stabilizer flawlessly, even more, they decided to proceed to the scheduled destination with AP off and manual trim, and they did it with no problem.

          • ^Do you mean they completed the flight without working MCAS? I thought the MAX could not fly at all without MCAS.

    • I wonder what would have happened if they had not turned the stabilizers back on, and instead flown back to the airport with what they had.
      And how do you decide if you’re in one if those situations (this is not the first) where going back straightaway with what you have is the only situation?

      It looks like this report fully vindicates the decision to ground the fleet.

      • The investigation is going to have to address that, I think. It doesn’t surprise me that having lost electric and manual trim, the first officer may have hit the trim stabiliser switches in an attempt to gain control of the trim. From the data, it seems that they were still descending even with both of them pulling back on the control columns, as the captain complained it wasn’t enough and the speed was still increasing. So they may well have already been doomed from that point and the automatic nose down input simply made it happen faster. But there’s not enough information yet to tell.

        • The FDR shows the aircraft ascending, not descending, until the fatal final MCAS activation.
          I wonder what caused the air speed to be so high, that seems to have been intentional because of the stall warning? Or to generate more lift, as they were already too fast to engage the flaps? Would a slow speed with more flaps have generated more lift?

        • It’s highly unprobable that the stabilizer had been unable to move manually, and I mean by “manually” turning the stabilizer trim wheel retractable handles that all Boeing aircrafts have installed in the same position since the 707 dinosaur back in the 50’s …

      • I’d be interested in a pilots view on how easy/safe it would be to land with such a badly trimmed plane.

        From the flight data it looks like the level of nose down trim meant they were only able to keep the plane level(ish) with almost full pull back on the controls. This suggests once they start landing there would be almost zero chance of pulling up again. Maybe they felt that had to try to retrim to get more about ability to climb?

    • Reading the comments, it seems that Sylvia and the other entrants have a good handle on this sad story. I am impressed with their analytical efforts.
      Without further news, it does not seem that much more can be said about it. Obviously, the modern 737s do not have a manual trim. In the olden days, a large wheel on both sides of the pedestal could be moved (rotated) and change the trim tab setting. Using the electric trim would operate the same system, causing the wheel to spin forward or backward.
      As long as the stabiliser was not too far out of an acceptable setting, the aircraft would remain controllable.
      Insofar as the remaining flap setting is concerned: Assuming that there was a question about what speed the aircraft was flying at, the crew may have been deemed it safer to leave it. After all, there is that strange: “terrain don’t sink” from the GPWS. That normally alerts the crew, when they have just suffered an engine failure during or shortly after take-off that they are still very low, maybe at V2 and acclerating to Vfto (final take-off speed) which will enable them to clean up and continue (single engine!) climb to a safe altitude.
      The warning is usually heard only during simulator sessions. I remember a f/o in exasperation saying to the check pilot: “Why don’t think? I a thinking hard what to do!” It sounds very strange to me for this warning to come on 7000 feet above terrain.
      A low speed does not necessarily generate more lift; flaps are part of the equipment that MAINTAIN lift at low speed. Without them, the runways would need to be a lot longer. But yes, if the speed is low it may be a good idea to leave the flaps a notch extended. But in this case, the aircraft was getting too fast. Flaps genefally do have an effect on the pitch, but it seems a lot more was out of kilter than just the pitch trim.
      In my opinion, the crew have been unable to control the aircraft once the dive had started. By the sound of it, they were highly professional. They kept working as a team, the cockpit coordination never broke down. In spite of this terrible crash, it seems that the operating standards of that airline are high.
      Boeing just announced that they are reducing the number of 737s being produced. They cite a backlog with deliveries because the fleets are grounded everywhere. But I reckon that they may be putting a brave face on the real reason why: the type has .a fault that can cause a fatal crash. Orders have been cancelled and, unless the reason can be pinpointed with absolute certainty and modifications installed I doubt that the flying public will not want to fly in one.

    • I have a question – i believe the MCAS activates only after Flap retraction. So would a slower speed and flap extension removed the MCAS from the equation. The lower spedd would also have made the aerodymaic loads much lighter on the pilot flying without trim?

    • After reading the report I still don’t understand some things (I flew 707, so my experience with all these digital instruments is limited):
      1) did the pilots operated at any time the stabilizer trim wheel manually?, I mean with the retractable handles …
      2) why do they reconnect the electric trim cutout switches?, if the revised procedure says that they must not be reconnected for the remainder of the flight. Also I’m sure the original procedure must say the same: “do not reconnect the trim cutout switches”
      3) it also look that they never regain control of the engines power by disconnecting the autothrotle system (whatever it name is)
      4) did this aircraft have an stby basic instruments set (IAS, altitude and horizon) to discriminate faulty data among two main systems?, if so, why they couldn’t discriminate which side was giving wrong data?, to me, that’s basic. It also looks that the copilot didn’t really help during the whole process … I read somewhere that he’s got a few hundred flight hours experience …

      • From the Bloomberg article linked by Dannii:
        “During that time, the captain asked the copilot to try making adjustments — known as trimming — manually. “The first officer replied that it is not working,” according to the report. The two wheels that pilots turn by hand to trim would have been “very hard to move or impossible” at that speed, John Cox said.”

        • I’m afraid the copilot did not help sufficiently during the emergency. Do you know that the copilot had a total of 361 flight hours, and about 260 hrs among 737 and 737-Max?
          I have a lot of experience flying the old 707, but the 737 Max is still an airplane, and basic flying is essential and it’s difficult to understand as how a pilot with such experience can get on an airplane with almost 200 souls aboard. My guess is that the copilot didn’t actuate the manual trim wheel (I mean with the trim wheel handles) during the whole process. That’s maybe the reason he reconnected the trim cutout switches. Big chances are that also the training was insufficient for these pilots.

    • Pradeep,
      You obviously are of a similar generation. I did not fly 707, but I have been rated on the BAC 1-11 as well as bizjets like Citations, Lear 25 series and SN 601 Corvette.
      The ATR 42 and Fokker 50 had relatively modern electronics, but even so, in those days the FMS of the F50 was getting its information from VOR-DME, not GPS.
      So I am baffled by the effect a system like the MCAS can have on the contollability of an aircraft to the point where the crew loses ALL means of correcting the situation. This looks a bit similar to a runaway stabilizer that gets stuck in an extreme poistion.
      And why is there no apparent system that allowed the crew to totally override or disconnect the MCAS? It seems that the crew were on the correct path to identifying the problem but the MCAS appears to have taken total control and resisted efforts of the crew to stop the nosedive.
      Conflicting warnings sounded, but the crew nevertheless seemed to have identified which side of the cockpit had the reliable instruments.
      Both in the end were indicating a very serious overspeed situation.
      With all that automation, all over the world crews are obviously trained to deal with the all-knowing electronics. Is that at the expense of basic flying? Many years ago, perhaps in the ‘seventies, a B727 tried to get above a thunderstorm. They got themselves in the “coffin corner”, where there was only a small margin between MMO and Vstall.
      Turbulence caused the aircraft to stall, the pusher put it straight into a mach overspeed. The crew were unable to correct. They suffered reversal of the controls. Not even speed brakes could correct it. In a last, desperate effort the captain decided to lower the gear. They got out of it. After landing, an inspection revealed that the gear attachment had been moved back about an inch, the wing spar had been slightly deformed. There was no other damage found and Boeing allowed the spar to be strengthened at the place where it had been deformed and that 727 continued in service, albeit with the main wheels a very small bit further aft than normal. I heard this from a retired TWA captain who claimed that he had flown that particular 727.
      So I wonder what would have happened if the Ethiopian crew had just lowered the wheels. But still, my admiration for their porofessionalism.

      • “reversal of the controls”? I’ve heard of that as a myth from a movie about breaking the sound barrier, but never in actuality; details?

        It’s not clear that this plane was anywhere near the “coffin corner”; it just kept being nosed down by the runaway MCAS. (The Bloomberg report suggests that they had the choice of working with the MCAS or of operating the controls by muscle power alone; I can see some set of ground-bound engineers deciding against providing a way to cut out just the MCAS.) I don’t see that dropping the landing gear would have fixed this problem (would it reduce the airspeed enough to make manual control possible?), and wonder whether it would even have been possible at their IAS; aren’t there usually interlocks to prevent landing gear extension at high speed?

        • The big problem with creating drag at the underside of the plane is creating another nose-down moment, exacerbating the control problem. Throttling the engines down has the same effect.

    • Control reversal is a real phenomenon. In the days of mechanical linkages, it was possible to connect the pilot’s controls and the control surfaces incorrectly; although rare, it did happen, usually with catastrophic results.
      Control reversal can also occur on aircraft with fly-by-wire (electronic activation) on aircraft with thin flexible wings. Under certain conditions, the aileron does not roll the entire aircraft but instead acts like a trim tab, twisting the wing along its chord (leading edge to trailing edge dimension) so that the entire wing deforms to produce aerodynamic forces in opposition to the commanded movement. This was a particular problem–and not well understood– in the early days of jet flight, which is why it is associated with attempts to break the sound barrier after WWII.

    • According to the official report in page 13 (URL above) says that the First officer had a total experience of 361 flight hours, 207 in 737, 56 hours in 737-8. Numbers indicates that this pilot started as a 737 FO with just 98 hours flying small civilian airplanes. Is that possible?.
      I’m talking about the official report, not a media new … is that really possible?, if so, I wouldn’t be surprised if the pilot didn’t receive a good support during this emergency.

    • I have read many of the stories and comments on this site but this is my first time posting a comment. Thank you, Sylvia, for this interesting forum!

      This is truly a sad and scary situation with the 737 MAX. Two 100%-fatality crashes within such a short time is hard to fully comprehend. In this instance, supposing either of the disparate IAS numbers was remotely close to being accurate, this must have been terrifying toward the end, especially with the severe nose-down attitude. Here in the U.S., we had an Atlas Air cargo 767-300 crash in February, killing its two flight crew and the single jumpseater. That aircraft ended up in a high speed, severe nose-down upset also, but for theorecitally very different reasons, as the 767 has no MCAS.

      The above comments have some unique insight and even though this is a tragic situation, it is very interesting learning technical and historical events pertinent to this case.

      Am I correct in inferring that the “oscillations” are a result of either reactive movements or uncommanded inputs on the control surfaces? Was this some kind of aerodynamic result of overspeed? I remember similar oscillations being mentioned with the Lion air crash.

      As for the credibility of the First Officer, I am surprised at his low number of hours. However, unless there is obvious evidence in the FDR an CVR that he acted in error, I think that the bottom line for his performance in this emergency situation is going to be whether he acted according to his training and in conjunction with the Captain. Maybe this will not be fully made known to us, the general public, until later in the investigation. Perhaps a FO with a multiple thousands of hours would have had some bit of further understanding for the situation, but it seems like CRM did not blatantly break down.

    • I post this without comment as I don’t have any expertise, but this is one explanation put forward by Patrick Smith.
      “When the plane’s stabilizers are acting to push the nose down, and the control column is simultaneously pulled aft, a sort of aerodynamic lockout forms: airflow forces on the stabilizers effectively paralyze them, making them impossible to move manually.”

    • Why is it that neither pilot ever addressed the stick shaker activation? The report says that the shaker activated shortly after liftoff and remained on throughout most of the rest of the flight…wouldn’t that prompt a response from the crew? And since only one side was activated, would that not have been an indication that erroneous data was being received and that manual flight was necessary, in which case attempting to engage the autopilot (twice) would be an incorrect action?

      Also, regarding crew experience, I think they were both pretty green in terms of time in model. The PIC only had 103 hours TT in 737 MAX since completing differences training in July 2018 (an average of only 12 hours/month since training); it is not clear from the data provided how much of that time was as PIC and how much was as FO, nor is it clear how completion of the differences training was assessed (written test, oral exam, flight check, or just finishing the iPad program?). The FO of the accident flight only had 56 hours TT in 737 MAX, only 207 hours TT in 737’s (all of which was apparently accumulated in the last 90 days), only 361 hours TT EVER, and had completed his line training/check just 39 DAYS before the accident. Not exactly a deep bench in the cockpit that day. Ab initio training is a great concept, but it has to be done in such a way that trainees gain experience in a graduated fashion, mentored by senior pilots with significantly more experience.

      • Though your points are valid the crew’s possible lack of experience appears to have little or nothing to do with the probable cause of the crash. Their resource management, cooperation, clear and proper communication of responses, observations, and confirmations along with adherence with proper procedures and inputs would suggest both diligence and skill beyond their relative experience. When examining such a situation rich with thoroughly disseminated data simple comparison of their actions and interactions with best procedures and all possible actions which could have possibly been taken reveals relevance of crew experience beyond inevitable subjective opinion and bias created by review of documented time in type and total time. Simply there are a limited amount of controls and possible actions which could have been taken. Without a deeper understanding of the integration of pilot aids with manual controls and the relevant electromechanical abilities both in relation the circumstances and variables presented by this flight further understanding of actual causes isn’t possible. However the probable cause wasn’t a crew related and will be proven to be an inherent design issues(es) most likely to be related to; failure(s) of sensors, related cabling and connectors, or control unit(s) software interpretation of sensor data; control unit(s) software activation and application of pilot aids; inherent ability of electromechanical actuators upon flight surfaces; and inherent ability of manual control of flight surfaces and inherent ability of manual controls to overcome electromechanical ability of pilot aids, and finally required force required to operate manual controls with and without interference from pilot aids and within circumstances and variables presented by this flight. Unfortunately the probable cause(s) and required specific preventative modifications will likely encompass and require changes to all of the afformentioned systems.

        • Perhaps a personal example will make my point re experience a bit more understandable. As a pilot, I have about 400 hours total fixed wing time and hold single-engine, multi-engine, and instrument ratings as a private pilot (more time than the FO in the Ethiopian mishap). I also have about 75 hours of PF time in helicopters, primarily in JetRangers. My fixed wing time was accumulated in 27 different makes and models, including a few hours in 4-engine transport category aircraft, so I am truly a “jack of all trades, master of none” when it comes to flying. By contrast, in my professional life as an emergency physician, I have approximately 70,000 hours of actual patient care (including 5 years as a Navy flight surgeon) since graduation from medical school, plus 4 years of undergraduate education and 4 years of medical school training. So, would you rather have me in charge of taking care of your heart attack in my ER or flying you and your family in a highly automated aircraft with a potentially fatal flaw, the training on which was completely inadequate and incomplete?

          Further, the investigation into the Colgan Air mishap in Buffalo not that many years ago highlighted both the inexperience of the first officer and fatigue as contributing causes, as well as the captain’s improper attempt to recover from a stall. These findings led to regulatory changes that greatly increased the minimum number of flight hours required just to get hired as a first officer. Experience matters and training matters–this mishap proved it, but even some “safe” airlines apparently haven’t learned that lesson.

          Another more recent example of experience making the key difference between life and death is the MD-83 overrun accident in Michigan that the NTSB recently reported on. In that case, the PF was in the left seat and was undergoing differences training. However, he was an experienced pilot (more that 15,000 hours TT) and most of that experience was in various versions of the same basic airplane. When he tried to rotate the aircraft after V1 and nothing happened, he recognized the issue instantly (“…it ain’t flying!…”) and did the intuitively unthinkable: he executed a high-speed rejected takeoff after V1. The training captain was the PM in the right seat and also had a lot of experience, almost 8000 hours TT and most of that in type. What he also had was the discipline to accept and execute the play the PF called, even though it went against all instincts. The aircraft ran off the end of the runway, but since the airport had reconfigured the runway safe area to current standards (developed after other fatal mishaps), they rolled through relatively level and obstacle-free terrain, coming to a stop on their wheels and evacuating the airplane with no deaths and no serious injuries. They had never trained for this particular scenario (mostly because it had never happened before–the cause was a bent elevator hinge damaged overnight in high wind gusts because apparently the DC-9 and all its variants don’t have gust locks– but their experience and their shared mindset about should be happening, along with the training captain’s disciplined resistance to intervening with the PF’s call, saved all on board, and it was pretty much a full airplane. Experience and training matter.

          Full disclosure: so as not to seem arrogant or pompous when talking about medical experience, readers of this should know that an article published recently estimated that about 9% of all deaths in U.S. hospitals each year are due to errors of one sort or another. This amounts to almost 200,000 potentially preventable deaths each year. We in medicine have not yet even begun to effectively eliminate error from our practice. That said, there is not much that surprises me on any given shift in the ER, given my level of experience, but there is much that can surprise me in flight.

          Every mishap is due to a chain of events which come together to produce the disaster. I have no doubt that the cause of this mishap will turn out to be the same chain: bad design, inadequate testing, poor regulatory oversight, skimpy training and a failure to disclose and discuss the system producing a key difference between previous iterations of the 737 and the MAX, and the crew’s failure to adequately recognize and respond to the failure when it occurred. As to the last point, my guess is that their response was inadequate because they lacked the training and experience needed to rapidly diagnose the problem and overcome it.

      • “since only one side was activated” is hard to discern, because both sticks are linked and shake simultaneously. One of the issues with MCAS is that the equipment that clearly indicates deviation of the Angle of Attack sensors is optional and costs extra. One theory goes that if this equipment was mandatory, the Boeing 737max couldn’t have been grandfathered onto the 737 license.

    • So far all the analysis and comments seem to be centered on the MCAS, a software program installed on the MAX to assist in the event of an extremely nose up attitude. Boeing is currently working on the software to iron out any flaws it might have had previously.
      It has also been mentioned that the MAX tendency to pitch up – the reason MCAS was installed – when maximum power is applied to the engines is due to the engines’ high power output and where they are placed relative to the aircrafts center of gravity (CG). So clearly there is a stability problem as well which, as far as we know is not being currently addressed.
      Assuming that the software issue is sorted out and the MAX is back in operation. Imagine the following scenario:
      MCAS develops similar problems. Crew carry out correct procedures and the system is successfully disconnected.
      The pilots then fly a manual approach back to the airport. For some reason they are unable to land and have to initiate a go around. Full power is applied and the nose abruptly and dangerously pitches up. There is no MCAS protection because it is off line. The crew would find themselves with a dangerously unstable aircraft .
      It is not the software. It is the hardware.

    • This just keeps getting worse for Boeing :

      https://www.seattletimes.com/business/boeing-aerospace/boeing-altered-key-switches-in-737-max-cockpit-limiting-ability-to-shut-off-mcas/

      In short the article reports that the left switch used to deactivate the yolk thumb buttons and the right switch used to deactivate automated systems. But on the Max they changed it so they both cut out switches did the same thing (cut out all systems).

      It reports that if the cut outs operated as normal (in the same way as the NG) then it would have saved them all.

      This seems just too bad to be true. I hope this gets verified.

      • The design change for the cutout switches was thoroughly documented on April 6th by Marcel van den Berg (yes, he’s Dutch) at https://feitoffake.wordpress.com/2019/04/06/overview-of-many-failures-by-boeing-in-designing-the-boeing-737-max/ , see numbers 28 and 29 on his list.

        Numbers 26 and 27 cite the absence of “yoke jerk” on the 737max. Yoke jerk inhibits automatic trim control when the yoke is pulled back hard on previous 737 models, and would obviously have prevented the crash.

        And Marcel also linked this excellent article explaining why the airplane was impossible to be trimmed nose up manually while the yoke was pulled back: https://theaircurrent.com/aviation-safety/vestigal-design-issue-clouds-737-max-crash-investigations/

      • Using pure logic and a huge heap of scepticism here, then an obvious question must be : what else has Boeing done that lurks unseen and unknown amid its current fleet of jetliners? What this stab trim wiring situation does helpfully do, however, is put them firmly on the hook for blame; they were headed strongly towards trying to blame the software contractor. I think that this is very important now. In an act of extreme catharsis or even contrition, they might just have to come clean to save themselves.
        The back end of that 737 sure has claimed a few over the years. And that’s sad.

        • Yeah, I’m hoping Sylvia can grab my reply with the two links out of the spam folder, because I found out that this was well documented back in April by Marcel van den Berg on his blog.

          The older 737s also have “yoke jerk”, where pulling back hard on the yoke disables all automatic trim. It’s fairly hard to see why they dropped that one.

          • Oh! I’m so sorry about that — it actually bypassed moderation and went straight to spam, so I never saw it; I just found it now. I do apologise and I’m looking at how to dial that back without ending up with a million ads in the comments. Always feel free to mail me at [email protected] if you’ve let a comment and I haven’t approved it within 12 hours, I do try to check at least once a day!

    • Bought a 2019 Honda in December. By 1700 miles, I was left “stalled” in the middle of very heavy traffic, gently slowing down with zero throttle response. The “BRAKE – BRAKE – BRAKE flashing on the dash in concert with this fiasco. Why is this relevant? Because Honda bought and installed poor systems software and hardware, that thought the car turning starboard ahead of me, on a curving road, was an imminent impact. Of course, the Brake Mitigation didn’t come to this conclusion until that “suspect” vehicle was completely off the road and in a parking lot… Leaving me to cope with a zero power situation for half a dozen seconds, about to get rear ended. At least the current iteration of this trash has an obscure button to turn the hot mess off. Which has to be pushed every time on start-up to defeat it. I do so religiously.

      My personal opinion as a lay person – having no weight, of course: Boeing designed an unstable airplane, sidestepped regulations, implemented a half-baked stability fix, and seemingly has no real off switch so you can Just Fly The Damned Plane. Coupled with reports that they intentionally defeated other system cut-offs from prior versions, and also had a super-secret additional instrumentation package that the software designers And Some of Boeing’s Own Engineers had never heard of… Not marketed apparently because that would screw type certification… Well, one has to ask just how many extra coffee breaks were being enjoyed at the FAA, because this is all sheer insanity. Boeing is fortunate that both losses were 3d world. A couple of these back-to-back fiascos in L.A. or D.C. environs would have crushed them for many years.

      Lord, keep me out of a plane where the systems don’t really integrate.. where the stick is shaking, magic voices scream to pull up, and all the while a demon in the details plunges the craft beneath the earth, refusing to release control. As full disclosure, my brother is a commercial pilot, I am not, I only pilot a Honda Pilot. With as much of this junk turned off as I can. One can hardly imagine the final seconds in a craft saddled with exponentially worse nanny controls.

    • There’s an excellent video by “Mentour Pilot” (a serving line training captain) : https://www.youtube.com/watch?v=aoNOVlxJmow

      This one shows a flight sim enactment of what happens when the aero forces on the stabilizer under “runaway stabilizer” become so great that it is no longer possible to use physical force (human) to trim the nose back up. The aero forces increase exponentially with airspeed. In the video he details that Boeing actually had a procedure called “the roller coaster” to try to recover : basically release the column (elevator) to take some of the load of the stablizer in the hope the CPT & FO can both attempt to manually re-trim. Then pull back and repeat the procedure until fully back in trim.

    • Just recalled another total loss mishap where all on board (and 4 on the ground) died as a result of misunderstood automated “protection”: TAM 402 in 1996 in Brazil. Starboard thrust reverser on a Fokker 100 deployed on takeoff. There was no indicator on the flight deck to alert the crew, so they didn’t know what was happening other than the airplane was out of control. Automation pulled the power lever back on the starboard engine as intended to eliminate the asymmetric thrust, but the pilots had not been trained on the system, didn’t know it existed, and so pushed the power back up thinking they were dealing with an autothrottle malfunction. The first officer ultimately pushed the power lever forward and held it there so hard the cable connection broke, which allowed full power to be applied to the thrust reverser. The airplane rolled over and crashed. The investigation discovered the following: “In the subsequent investigation it was discovered that the flight crew had not been trained for such an occurrence as the aircraft’s manufacturer, Fokker, had judged the failure mode to be so remote a possibility that training for recovery was not necessary.[6]”

      Had the pilots been trained on this system, they could have easily controlled the aircraft much like an engine failure at takeoff, climbed out, and made a safe emergency landing. Instead, 99 people died. So, 23 years ago, this accident already proved that hidden automation in commercial aircraft, automation that is not known to the pilots and on which they have not trained, can and will prove fatal. And yet Boeing (and the FAA) went ahead and repeated exactly the same mistake with the MAX.

      • I’ve read that that’s actually one of the main differences to the Airbus auto pitch trim problems: these not only occur much less often, in all reported incidents (bar that one test flight), the crew knew to disable the system and fly the plane safely home. One less hole in the cheese matters.

    Leave a Reply to colintd

    Your email address will not be published. Required fields are marked *

    *
    *
    *

    This site uses Akismet to reduce spam. Learn how your comment data is processed.