Controversy Surrounds Final Report on Ethiopian flight 302
The final report on Ethiopian flight 302 was released by Ethiopian Accident Investigation Board (EAIB) on the 23rd of December 2022. I’d like to go over the full report in detail but first, let’s take a look at the controversy around the release. Specifically, I want to pay attention to what the report doesn’t say.
Ethiopian Airlines flight 302 crashed on the 10th of March 2019. It was quickly established that the crash had much in common with a crash a few months previous: Lion Air flight 610, which crashed after take off at Jakarta. Specifically, both crashes appeared to be related to Boeing’s MCAS, a newly added system that had only come to light in the aftermath of the Lion Air flight 610 crash. The loss of Ethiopian flight 302 led to the Boeing 737 MAX being grounded for 20 months while the accidents, the certifications and the relationship between Boeing and the FAA were all investigated.
The final report for Lion Air flight 610 was released in October 2019, a year after the accident. ICAO Annex 13 asks that a preliminary report be released within thirty days of the accident or incident, with a final report within twelve months. If this is not possible, then an interim statement should be released on each anniversary of the occurrence, with a statement as to the progress of the investigation and any safety recommendations suggested by the investigating body based on their analysis so far.
In this case, the crash investigation was led by the Ethiopian Accident Investigation Board (EAIB) with support from the National Transportation Safety Board (NTSB), representing the US as the state of the design and manufacture of the aircraft. Boeing and the American Federal Aviation Administration agreed to assist the NTSB in this regard. The flight data recorder and the cockpit voice recorder were given to the Bureau d’Enquêtes et d’Analyses (BEA), the French accident investigation agency, for analysis.
On the 19th of April 2019, the EAIB released a preliminary report. Then, an interim report was released on the 9th of March 2020, almost a year after the crash.
In January 2021, the EAIB sent a draft of their final report to the NTSB and the BEA for comment. Both agencies responded with concerns that MCAS was shown as the sole cause of the crash. Both agencies independently wrote to the EAIB listing additional items that they felt should be considered as contributing to the crash.
I should underscore here that neither agency was defending Boeing. In both letters, they agreed that MCAS was the causal factor.
In the analysis of the crash of Lion Air 610, there were several serious contributing factors, including maintenance procedures, crew training and a culture of “good enough” at the operator. If the Indonesian National Transport Safety Committee had concluded that the sole cause of the accident was the MCAS responding to the faulty air data, that would mean that many other issues critical to safe operations could be silently ignored.
The NTSB wished for the final report to consider the root cause of the erroneous data coming from the AOA sensor. Collins Aerospace, the manufacturer of the AOA sensor and acting as a technical advisor to the US team, had explored the most-likely failure modes for the sensor. The EAIB’s draft document acknowledged the Collins report but did not include the detail. The NTSB also wished for more consideration for operational and human factors.
Meanwhile, the BEA argued that their analysis of the data recorders showed significant failings related to Cockpit Resource Management (CRM) and even submitted an additional report analysing the crew performance based on the data.
The EAIB went back to work. The NTSB and the BEA received a second draft document. Their previous comments did not seem to have been taken into account. The report focused again exclusively on MCAS as the sole cause of the accident.
The BEA responded more forcefully this time, submitting a five-page analysis of the crew performance in the first phases of flight. This analysis also points out that, although the crew’s responses to the emergency in the final phases of the flight were described in the report, no analysis of their response had been incorporated into the conclusions. This time, the BEA asked directly for their submitted document to be appended to the Final Report in accordance with paragraph 6.3 of ICAO Annex 13.
The NTSB also responded in the same vein.
Overall, the US team concurs with the EAIB’s investigation of the MCAS and related systems and the roles that they played in the accident. However, many operational and human performance issues present in this accident were not fully developed as part of the EAIB investigation. These issues include flight crew performance, crew resource management (CRM), task management, and human-machine interface. It is important for the EAIB’s final report to provide a thorough discussion of these relevant issues so that all possible safety lessons can be learned.
The NTSB included a second, more detailed set of comments, with a nine-page document detailing the areas they felt needed addressing. The draft report, they said, described the erroneous AOA data but did not investigate why the AOA values were wrong. And most importantly, the NTSB commentary directly took issue with the EAIB conclusion that the MCAS alone caused the aircraft to be unrecoverable. The NTSB argued that the crew management of the event needed to be included as a causal factor. The NTSB also asked that this document be included in the report.
March 2021, the second anniversary of the crash, passed without an update.
On the 23rd of December 2022, nearly four years after the crash, the EAIB released the final report without further consideration of the supporting states. This report of 266 pages has a single probable cause:
Repetitive and uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA input, and its unrecoverable activation system which made the airplane dive with the rate of -33,000 ft/min close to the ground was the most probable cause of the accident.
Ten contributing factors were listed, all directly related to MCAS and Boeing.
In the appendices, the commentary from the supporting states is limited to two links to documents showing the initial comments by the NTSB and the BEA to the first draft that they received in January 2021.
The NTSB responded on the 27th with a press release, publicly releasing their comments as the investigative team had failed to take them into account and did not append the comments, as requested. Further, the press release said, the final report included significant changes which had not yet been reviewed. On the 13th of January, the NTSB released a second press release, this time highlighting the new information in the final report which had not been in any of the drafts. Some of the changes were directly in response to the NTSB comments on the previous draft. For example, this version of the report stated that the AOA sensor malfunction likely occurred to an unexplained electrical failure, without reference to the NTSB’s conclusion, based on the testing by Collins Aerospace, that the sensor failed after the AOA vane was struck by a foreign object, most likely a bird strike.
The BEA also issued a press release on the 3rd of January.
On December 23, 2022, the EAIB published the final report on its website without directly including the BEA’s comments in appendix. Instead, the EAIB report contains a link to a BEA document which does not contain the comments that the BEA had finally requested to be appended.
The BEA press release states that the EAIB also removed crew interactions from the transcript included in the final report. Specific examples from the Cockpit Voice Recorder which showed a worrying lack of CRM, including the failure of the first officer to support the captain, had been removed.
The full final report was posted to the BEA website as a pdf for reference.
In both instances, the agencies are not denying the EAIB’s accusation that MCAS and Boeing caused the accident, but that it is not the only factor that must be considered. As a sole cause, it is incomplete. As a result, the aviation world may be losing an opportunity to identify and address further safety concerns.
In the weeks to come, we’ll be looking at the NTSB and BEA commentary on the human performance and operational factors and whether there are legitimate safety concerns in these areas. This may sound like putting the cart before the horse, but by knowing what is missing, we’ll better be able to focus on the final report itself.
“Fly the plane!”
The people who taught me to fly, were flying before radios, autopilots or redundant systems. From my 1st flight, it was hammered into me to “Fly the plane”.
Today, we have Sims that fly just like the real plane. There is no excuse for a flight crew not to be up to the job. One can crash a simulator thousands of times without a single death, learning how to fly the plane through whatever conditions are thrown at you.
I agree that the MCAS was playing the fool, what does that have to do with the flight crew “Flying the plane”?
What did your instructor tell you to do if the plane became uncontrollable?
There are some scenarios judged to be so unlikely that they don’t get brought up even in anything-can-happen simulations or written up in manuals; I was just rereading the “Gimli Glider” entry in Wikipedia, which says that the manuals the pilots carried said nothing about what to do after losing both engines; it’s possible they never had it happen in a simulator run either. I wonder whether simulator options were expanded after the MCAS problems to include “The airplane turns into a bucking bronco.”
It’s certainly possible that there were CRM errors in this case and/or the Lion Air case. I’ve never practiced (let alone flown) a simulation that called for two qualified pilots, but I wouldn’t be surprised to hear that teaching CRM is a lot harder than teaching what to do mechanically in an emergency, because machines tend to be less unpredictable than people under stress. It’s possible that this case should point to CRM issues that Ethiopian Air pilots should be better trained in, but a simplistic “Fly the airplane, !@#$%^&*!!” won’t move closer to that goal.
The problem isn’t the MCAS failure with this flight. Sylvia and pretty much everybody else acknowledges MCAS was the main reason it all went badly. The problem is that by whitewashing the report, the EAIB is hiding issues that the MCAS failure revealed.
Good CRM probably wouldn’t have saved this flight, based on when the MCAS failure actually occurred — right after takeoff, no altitude, no airspeed, crew already distracted from takeoff procedures. But, by not acknowledging the problems revealed, it creates a situation where there might be a future incident involving a different failure where good CRM could prevent an incident from turning into a crash — but it won’t happen because they didn’t do anything remedial after this one.
Something that gets referred to very often in this blog and other places that look at failures is the idea of swiss cheese failure — you usually need all the holes to line up before the worst case scenario happens. By whitewashing the report, EAIB takes the politically easy way out, but guarantees another crew won’t be ready when something goes wrong.
I’m not arguing with that, only with the claim that “just fly[ing] the plane” would have gotten them out of the problem. The EAIB’s actions aren’t inexplicable — blaming outsiders (maybe even former oppressors?) is easier than blaming in-country processes — but I agree they missed a chance to address issues that could be fixed locally.
I’ve often noted the number of things that had to pile up to produce an accident (as opposed to an incident), but I’ve never heard it described as “swiss cheese failure”; I’ll have to remember that term.
That’s a great way of putting it.
Sylvia for some reason your Like button is not working. It worked fine last week. Today when I click on Like I get a message box from http://www.facebook.com/plugins/optin/etc. and Tap to go back to fearoflanding.com. I have a screenshot but I can’t see where I can attach it here.
Bronwen, can you try it now? I think I fixed it.
I think in any sort of post-failure analysis there’s a tendency to want to put all the blame on a single cause, particularly if it’s an external one. We’ve seen similar things in the US and UK where there often seems to be a rush to assume pilot error (you can sack that guy if he even survived, and all other pilots are great so keep buying those plane tickets) rather than bad maintenance (it’s bad because doing it right would have cost more). I don’t know the political pressures on the EAIB but it would certainly seem plausible that someone’s told them “don’t talk about crew training, we don’t have the budget to fix it, blame the foreign companies”.