What happened on Ethiopian flight 302: a breakdown of the preliminary report
Yesterday, the 4th of April, the Ethiopian Accident Investigation Bureau investigating the crash of Ethiopian Airlines flight 302 released the Preliminary Report (local version stored at bottom of this post).
Ethiopian Airlines flight 302, in the Boeing 737-8(MAX) registration number ET-AVJ, was a scheduled passenger flight from Addis Ababa to Nairobi. There were two flight crew, five cabin crew, one in-flight security officer and 149 passengers. The flight crashed shortly after take-off; the aircraft was destroyed and there were no survivors.
As per ICAO article 26 and 13, the state in which the accident occurred must hold an inquiry into the cause of the accident; in this case, the Ethiopian Accident Investigation Bureau is leading this investigation. Also participating are EASA, the Ethiopian CAA, and Ethiopian Airlines, as technical advisors; the NTSB, as the aircraft was designed and manufactured in the US; and the BEA, who have taken responsibility for reading the Flight Data Recorder and the Cockpit Voice Recorder.
Media relations are being dealt with by the Minister of Transport, which explains why the initial announcement was that “the flight crew repeated followed procedures recommended by Boeing” which made it sound, to me at least, like they followed one check list over and over in hopes of a different result — it’s clear from the report that this was not the case.
The new information is focused around what the FDR can tell us about the aircraft inputs. This is listed in detail with timestamps in the preliminary report and if you know avionics at all, I think it is worth a read. I’m going to just give a summary of the relevant points.
When the aircraft prepared to depart that morning, the Boeing 737’s configuration was as expected and during the take-off roll, both left and right AoA (angle of attack) values were normal and in sync. The captain was the Pilot Flying. There was no sign of anything amiss. The engine thrust was increased and stabilised at 94%; the engines remained at this power setting and the throttles did not move.
As the aircraft lifted off, the left AoA value decreased to 11.1° and then increased to 35.7° while the right AoA value remained steady at 14.94°. The left value jumped up to 74.5° in less than a second. The highest value of the right AoA was 15.3°. The captain’s stick shaker activated, which means that the control yoke began to vibrate rapidly to warn the pilot that the aircraft is at risk of stalling. At the same time, the captain’s instruments for airspeed, altitude and flight director pitch all showed lower values that the first officer’s instruments on the right side.
This is all connected to bad data, that is, the left AoA displayed value was quite clearly wrong and leading to a number of false indications. If this were the only issue, then the flight crew would quickly need to work out which set of instruments was correct and use them to get down to the ground as quickly as possible. Probably the clearest example of the effects of bad air data is Aeroperú 603 in 1996 although the cause was quite different.
Carrying on with Ethiopian 302, as the aircraft reached 50 feet above the ground, the flight director mode was changed to LNAV (Lateral Navigation), a flight guidance mode which uses GPS and beacons to follow a straight-forward route, without regard to altitude. In normal circumstances, the flight director would display the route to the next waypoint and once the autopilot was engaged, the aircraft would navigate to follow that route.
At the aircraft climbed to 200 feet, the FDR recorded that the Master Caution (effectively an automated flight engineer) changed state.
It’s safe to assume that it lit up, as the first officer called out Master Caution Anti-Ice, which is a warning that icing has been detected or that the ice detection system has failed.
Four seconds later, the recorded left AoA heat parameter changed state, presumably turned on in order to melt any icing that may be building up there. It isn’t clear to me if this is a manual intervention or an automated one.
At 400 feet, the flight director mode was changed to VNAV SPEED, which means that the flight mode will include vertical guidance and speed when the autopilot is engaged, taking control of the climb to cruise altitude. This is all still perfectly normal. In 2010, Ethiopian Airlines procedure for use of autopilot in flight in the Flight Crew Operating Manual (FCOM) gave the minimum altitude for autopilot engagement as 400 feet above ground level. I do not have any information as to what the current FCOM says but there’s no reason why it should have changed.
The captain called out “command” to signal that he was engaging the autopilot. The autopilot warning sounded, which means that the autopilot had disengaged, presumably immediately upon being set. The captain called out “Command again” and the autopilot warning sounded again. At this point, the aircraft was at 630 feet above the ground.
The captain advised the first officer to contact radar (air traffic control), which the first officer did, reporting their departure route, current altitude and that they were climbing to flight level 320 (32,000 feet).
During this time, the pitch trim position responded to manual trim inputs. This is important because later, the manual trim appears not to have responded.
One of the flight crew selected 32,000 feet having engaged the Level Change mode and the selected airspeed was 238 knots. The captain requested flaps up and the first officer retracted the flaps. This is all normal departure procedure.
As they reached 1,000 feet above the ground, the captain’s side autopilot was successfully engaged and the pitch trim decreased slightly. Six seconds later, the aircraft showed small oscillations, lateral accelerations, rudder oscillations and slight heading changes. The captain asked the first officer to request ‘maintain runway heading’ — I take this to mean he is breaking off his navigation in order to focus on what is wrong with the aircraft.
The autopilot disconnected thirty-three seconds after having been engaged and the captain told the first officer again to request runway heading and that they were having flight control problems.
The FDR recorded an automatic aircraft nose-down and the pitch trim moved from 4.6 to 2.1 units; enough that the climb was stopped and the aircraft descended slightly. This is the first interference by the Maneuvering Characteristics Augmentation System (MCAS) which has been in the headlines. The MCAS was installed on the Boeing 737 MAX in order to improve the handling characteristics of the new model which had larger engines and higher capacity. If the Angle of Attack (AoA) gets too high, the MCAS will send a command to pitch the nose down gently, which supports the pilots in avoiding a stall. In the cases of both Lion Air flight 610 and Ethiopian flight 302, it became clear early on that both aircraft suffered from bad AoA data which resulted in unwanted pitch down commands from the MCAS.
The Ground Proximity Warning System (GPWS) alerted with DON’T SINK; a warning that the aircraft is close to the ground and not configured for a descent.
The first officer reported to ATC that they were unable to maintain their navigation and requested runway heading which was immediately approved.
The left and right flaps extended very slightly (0.019°) and remained in that position for the rest of the flight. To be honest, I’m not sure what this might mean, if anything.
The control column was pulled back (to pitch the aircraft up) and the aircraft resumed climbing while the Automatic aircraft nose up stabiliser motion was still in progress. As it stopped, one of the pilots used the electric trim to trim the aircraft nose up. The aircraft pitch remained the same while the control column is pulled back with increasing pressure.
Someone, presumably the captain, is attempting to get the aircraft back into the climb; this is what’s been described as the flight crew fighting against the MCAS.
Five seconds after the first automatic nose down stabiliser trim ended, there’s a second automatic trim command. The stabiliser moved down and reached 0.4 units. In the climb it had been at 4.6, so we can see the increasing trim down effect.
The Ground Proximity Warning System (GPWS) triggered three times with DON’T SINK announcements.
The captain asked the first officer to trim up with him and the manual electric trim was used to pitch the nose up. The trim stabiliser reversed and moved up, with the trim increasing to 2.3 units. The first officer called out “Stab trim cut-out”. This is the correct procedure to deal with the MCAS issue as released by Boeing after the Lion Air accident. He repeated the call and the captain agreed. The first officer then confirmed that he had used the STAB TRIM CUTOUT switches, that is, he had deactivated the stabiliser trim system.
Again, there was an automatic nose down command recorded by the FDR, however this time, the stabiliser trim did not respond, which implies that the stabiliser trim system had been correctly deactivated.
The captain called out: “Pull up, pull up, pull up!” The first officer acknowledged. The captain then asked the first officer to tell ATC that they wanted to maintain current altitude and that they have a flight control problem, which the first officer did. Clearly, they are unable to maintain the climb.
Over the course of about two and a half minutes, stabiliser trim position gradually moved in a nose down direction from 2.3 units to 2.1 units. At the same time, both control columns were being pulled back. The left indicated airspeed (i.e. the captain’s side, which is the side with the bad AoA values) showed an increase in speed from 305 knots to 340 knots, which is the maximum operating speed. If this figure were correct, the aircraft increasing speed further would case structural loads beyond what is safe. The indicated airspeed on the right side shows an even higher indicated airspeed, topping out at 365 knots.
At the same time, the FDR recorded repeated attempts to pull back on the control columns.
The right overspeed clacker sounded, warning the flight crew that the aircraft has exceeded safe limits. It continued to sound until the end of the recording.
The selected altitude ws changed from 32,000 feet to 14,000 feet, their current altitude. Note that this is above sea level and not their height above the ground: Addis Ababa airport has an elevation of over 7,000 feet and they were flying over high ground.
The captain asked the first officer to pitch up with him (that is, pull back on the control column with him, which means that they are now applying brute force to try to pitch the nose back up), which was acknowledged. The left overspeed warning sounded.
The captain asked the first officer if the trim was functional. The first officer replied that the trim was not working and asked if he could try it manually. This implies that it was the electric trim, which is activated by a small switch on each control column, which was not responding.
The captain told him to try but then the first officer replied that it wasn’t working. There’s nothing on the FDR here, because no inputs were received, so it is impossible to prove that the first officer attempted to use the manual trim. However, it appears that having correctly disabled the automatic stabiliser trim, the flight crew lacked any means of controlling the trim at all.
ATC confirm their request to turn to the airport and instruct them to turn right for a heading of 260°. The selected heading was changed to 262°.
The first officer called out the Master Caution Anti-Ice, which has displayed again. Both pilots called out “Left alpha vane.” Alpha means angle of attack what they are referring to is the mechanical wind vane on the left side of the aircraft, that is, they have both understood at that moment that the left AoA sensor has an issue. But there was no time for trouble-shooting; the captain called for the first officer to pitch up with him and then said that it wasn’t enough.
This must have been a desperate moment. The FDR then showed two brief electric trim inputs for nose up. The stabiliser moved nose up from 2.1 units to 2.3 units. It wasn’t enough.
Worse, five seconds later, another nose down down automatic trim command occurred and the stabiliser trim moved in the nose down direction from 2.3 units to 1.0 units.
Had the flight crew turned the stabiliser trim back on and restored the control to the faulty MCAS? That’s what it looks like to me. This will be a key point to clarify in the final report.
The aircraft pitched nose down. The flight crew continued to pull the control columns back but the aircraft continued to pitch down, reaching 40° nose down. The stabiliser position varied between 1.1 and 0.8 units for the rest of the recording.
The left indicated airspeed reached 458 knots and the right reached 500 knots. And that is where the recording ended as the aircraft crashed into the ground.
There’s more in the report, including detailed diagrams of the flight controls and entries in the tech log book which are possibly related, including reports of erratic airspeed and vertical speed indications. It’s only 33 pages so I recommend taking a look if you want more data:
Aircraft Accident Investigation Preliminary Report Ethiopian Airlines Group–B737-8 (MAX) Registered ET-AVJ–28 NM South Eastof Addis Ababa,Bole International Airport
NOTE 10 April 2019: The link has stopped working. I don’t know what’s going on with this but as usual, I kept a local version which you can download for further info.
The initial findings are as follows:
The Aircraft possessed a valid certificate of airworthiness; The crew obtained the license and qualifications to conduct the flight; The takeoff roll appeared normal, including normal values of left and right angle-of-attack (AOA). Shortly after liftoff, the value of the left angle of attack sensor deviated from the right one and reached 74.5 degrees while the right angle of attack sensor value was 15.3 degrees; then after; the stick shaker activated and remained active until near the end of the flight. After autopilot engagement, there were small amplitude roll oscillations accompanied by lateral acceleration, rudder oscillations and slight heading changes; these oscillations also continued after the autopilot disengaged. After the autopilot disengaged, the DFDR recorded an automatic aircraft nose down (AND) trim command four times without pilot’s input. As a result, three motions of the stabilizer trim were recorded.The FDR data also indicated that the crew utilized the electric manual trim to counter the automatic AND input. The crew performed runaway stabilizer checklist and put the stab trim cutout switch to cutout position and confirmed that the manual trim operation was not working.
I look forward to seeing your comments on what is known so far.