NTSB Comments on the EAIB Report
The NTSB published their comments openly after claiming that they had not been appended to the final report.
They state that "We agree that the uncommanded nose-down inputs from the airplane’s MCAS system should be part of the probable cause for this accident. However, the draft probable cause indicates that the MCAS alone caused the airplane to be “unrecoverable,” and we believe that the probable cause also needs to acknowledge that appropriate crew management of the event, per the procedures that existed at the time, would have allowed the crew to recover the airplane even when faced with the uncommanded nose-down inputs."
We propose that the probable cause in the final report present the following causal factors to fully reflect the circumstances of this accident:
- uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA values and
- the flight crew’s inadequate use of manual electric trim and management of thrust to maintain airplane control.
In addition, we propose that the following contributing factors be included:
- the operator’s failure to ensure that its flight crews were prepared to properly respond to uncommanded stabilizer trim movement in the manner outlined in Boeing’s flight crew operating manual (FCOM) bulletin and the FAA’s emergency airworthiness directive (AD) (both issued 4 months before the accident) and
- the airplane’s impact with a foreign object, which damaged the AOA sensor and caused the erroneous AOA values.
On Jan 24, the NTSB issued further comments re-iterating that in their opinion, the AoA sensor vane fractured due to foreign object impact (ie a bird) and not as a result of a manufacturing defect.
https://www.ntsb.gov/investigations/Documents/Response%20to%20EAIB%20final%20report.pdf
NTSB chair Jennifer Homendy said in an interview on 24 Jan 2023 that Ethiopia's Aircraft Investigation Bureau (EAIB) had made errors in its report. "We feel what they did not do is really delve into the flight crew performance issues and whether they were adequately prepared," Homendy said. "We felt like it was not as comprehensive and robust as it could have been."
Final Report Executive Summary
On March 10, 2019, at 05:38 UTC, Ethiopian Airlines flight 302, Boeing 737-8(MAX), ET-AVJ, took off from Addis Ababa Bole International Airport bound to Nairobi, Kenya Jomo Kenyatta International Airport.
ET302 was being operated under the provisions of the Ethiopian Civil Aviation Regulations (ECARAS) as a scheduled international flight between Addis Ababa Bole International Airport (HAAB), Ethiopia and Jomo Kenyatta Int. (HKJK) Nairobi, Kenya. It departed Addis Ababa with 157 persons on board: 2 flight crew (a Captain and a First Officer), 5 cabin crew and one IFSO, 149 regular passengers.
At 05:36:12 the Airplane lined up on runway 07R at field elevation of 7,656 ft with flap setting of 5 degrees and a stabilizer trim setting of 5.6 units1. Both flight directors (F/D) were ON with LNAV and VNAV modes armed. At 05:37:17the F/O reported to Tower ready for takeoff andat 05:37:36ATC issued take off clearance to ET-302 and advised to contact radar on 119.7MHz.
The takeoff roll and lift-off was normal, including normal values of left and right angle-of-attack (AOA). During takeoff roll, the engines stabilized at about 94% N1. Shortly after liftoff, the left Angle of Attack sensor recorded value became erroneous and the left stick shaker activated and remained active until near the end of the recording. In addition, the airspeed and altitude values from the left air data system began deviating from the corresponding right side values. The left and right recorded AOA values began deviating. Left AOA decreased to 11.1° then increased to 35.7° while the right AOA indicated 14.94°. Then after, the left AOA valuereached 74.5° in ¾ seconds while the right AOA reached a Maximum value of 15.3°, the difference between LH and RH AOA was59°and near the end of the recording it was 490. At 05:39:30, the radar controller identified ET-302 and advised to climb FL 340 and when able to turn right direct to RUDOL. At 5:39:51, the selected heading increased from 072° to 197°.
After the flaps were fully retracted the stautomatic nose-down trim activated and engaged for 9 seconds positioning the stabilizer trim to 2.1 units. The pilot flying pulled to pitch up the Airplane with a force more than 90lbs. He then applied electric trim-up inputs. Five seconds after the end of these inputs a second automatic nose-down trim activated.
At 5:40:22, the second automatic nose-down trim activated. Following nose-down trim activationGPWS DON’T SINK sounded for 3 seconds and “PULL UP” also displayed on PFD for 3 seconds.At 05:40:43, approximately five seconds after the end of the crew manual electrical trim up inputs, a third automatic trim nose-down was recorded but with no associated movement of the stabilizer.
At 05:40:50, the captain told the F/O:“advise we would like to maintain one four thousand. We have a flight control problem”. The F/O complied and the request was approved by ATC. Following the approval of the ATC, the new target altitude of 14,000ft was set on the MCP.The Captain was unable to maintain the flight path and requested to return back to the departure airport.At 05:43:21, approximately five seconds after the last mainelectric trim up input, an automatic nose-down trimactivated for about 5s. The stabilizer moved from 2.3 to 1 unit. The rate of climb decreased followed by a descentin 3s after the automatic trim activation.
One second before the end of the automatic trim activation, the average force applied by the crew decreased from 100 lbs to 78 lbs in 3.5 seconds. In these 3.5 seconds, the pitch angle dropped from 0.5° nose up to -7.8° nose down and the descent rate increased from -100 ft/min to more than -5,000 ft/min. Following the last automatic trim activation and despite calculated column force of up to 110lbs, the pitch continued decreasing. The descent rate and the airspeed continued increasing between the triggering of the 4th automatic trim activation and the last recorded parameter value. At the end of the flight, Computed airspeed values reached 500Kt, Pitch values were greater than 40° nose down and descent rate values were greater than 33,000 ft/min. Finally, both recorders stopped recording at around 05 h 43 min 44s.
At 05:44 The Airplane impacted terrain 28 NM South East of Addis Ababa near Ejere(located 8.8770 N, 39.2516 E.) villageat a farm field and created a crater approximately 10 meters deep (last Airplane part found) with a hole of about 28 meters width and 40 meters length. Most of the wreckage was found buried in the ground; small fragments of the Airplane were found scattered around the site in an area by about 200 meters width and 300 meters long. The damages to the Airplane were consistent with a high energy impact. All157 persons on board: 2 flight crew (a Captain and a First Officer), 5 cabin crew and one IFSO, 149 regular passengers were fatally injured.
Probable cause of the accident
Repetitive and uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA input, and its unrecoverable activation system which made the airplane dive with the rate of -33,000 ft/min close to the ground was the most probable cause of the accident.
Contributing Factors
1. The MCAS design relied on a single AOA sensor, making it vulnerable to erroneous input from the sensor;
2. During the design process, Boeing failed to consider the potential for uncommanded activation of MCAS, but assumed that pilots would recognize and address it through normaluse of the control column, manual electric trim, and the existing Runaway Stabilizer NNC. The OMB and Emergency AD issued after the Lion Air accident included additional guidance but did not have the intended effect of preventing another MCAS-related accident;
3. While Boeing considered the possibility of uncommanded MCAS activation as part of its FHA, it did not evaluate all the potential alerts and indications that could accompany a failure leading to an uncommanded MCAS;
4. The MCAS contribution to cumulative AOA effects was not assessed;
5. The combined effect of alerts and indications that impacted pilot’s recognition and procedure prioritization were not evaluated by the Manufacturer;
6. Absence of AOA DISAGREE warning flag on the flight display panels (PFD);
7. The B737 MAX Crew difference CBT training prepared by Boeing and delivered to Pilots did not cover the MCAS system;
8. Failure by the manufacturer to design simulator training for pilots with regards to safety critical systems like MCAS with catastrophic consquences during undesired activation.
9. The manufacturer failed to provide procedures regarding MCAS operation to the crew during training or in the FCOM;
10. Failure by the manufacturer to address the safety critical questions raised by the airline which would have cleared out crew confusion and task prioritization;
The Preliminary report (available here) shows the following timeline. I have put some extracts here:
- At 05:38:00 Take off roll commenced
- At 05:38:44, shortly after liftoff, the left and right recorded AOA values deviated. Left AOA decreased to 11.1° then increased to 35.7° while value of right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a maximum value of 15.3°. At this time, the left stick shaker activated and remained active until near the end of the recording. Also, the airspeed, altitude and flight director pitch bar values from the left side noted deviating from the corresponding right side values. The left side values were lower than the right side values until near the end of the recording.
- At 05:38:46 and about 200 ft radio altitude, the Master Caution parameter changed state. The First Officer called out Master Caution Anti-Ice on CVR. Four seconds later, the recorded Left AOA Heat parameter changed state.
- At 05:39:22 and about 1,000 feet the left autopilot (AP) was engaged (it disengaged about 33 seconds later), the flaps were retracted and the pitch trim position decreased to 4.6 units.
- At 05:39:45, Captain requested flaps up and First-Officer acknowledged. One second later, flap handle moved from 5 to 0 degrees and flaps retraction began.
- At 05:39:55, Autopilot disengaged,
- At 05:39:57, the Captain advised again the First-Officer to request to maintain runway heading and that they are having flight control problems.
- At 05:40:00 shortly after the autopilot disengaged, the FDR recorded an automatic aircraft nose down (AND) activated for 9.0 seconds and pitch trim moved from 4.60 to 2.1 units. The climb was arrested and the aircraft descended slightly.
- At 05:40:03 Ground Proximity Warning System (GPWS) “DON’T SINK” alerts occurred.
- At 05:40:12, approximately three seconds after AND stabilizer motion ends, electric trim (from pilot activated switches on the yoke) in the Aircraft nose up (ANU) direction is recorded on the DFDR and the stabilizer moved in the ANU direction to 2.4 units. The Aircraft pitch attitude remained about the same as the back pressure on the column increased.
- At 05:40:20, approximately five seconds after the end of the ANU stabilizer motion, a second instance of automatic AND stabilizer trim occurred and the stabilizer moved down and reached 0.4 units.
- At 05:40:27, the Captain advised the First-Officer to trim up with him.
- At 05:40:28 Manual electric trim in the ANU direction was recorded and the stabilizer reversed moving in the ANU direction and then the trim reached 2.3 units.
- At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and FirstOfficer confirmed stab trim cut-out.
- At 05:40:41, approximately five seconds after the end of the ANU stabilizer motion, a third instance of AND automatic trim command occurred without any corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches were in the ‘’cutout’’ position
- At 05:40:44, the Captain called out three times “Pull-up” and the First-Officer acknowledged.
- At 05:40:50, the Captain instructed the First Officer to advise ATC that they would like to maintain 14,000 ft and they have flight control problem.
- From 05:40:42 to 05:43:11 (about two and a half minutes), the stabilizer position gradually moved in the AND direction from 2.3 units to 2.1 units. During this time, aft force was applied to the control columns which remained aft of neutral position. The left indicated airspeed increased from approximately 305 kt to approximately 340 kt (VMO). The right indicated airspeed was approximately 20-25 kt higher than the left. The data indicates that aft force was applied to both columns simultaneously several times throughout the remainder of the recording.
- At 05:41:20, the right overspeed clacker was recorded on CVR. It remained active until the end of the recording.
- At 05:41:30, the Captain requested the First-Officer to pitch up with him and the First-Officer acknowledged.
- At 05:41:32, the left overspeed warning activated and was active intermittently until the end of the recording.
- At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try.
- At 05:41:54, the First-Officer replied that it is not working.
- At 05:42:54, both pilots called out “left alpha vane”.
- At 05:43:04, the Captain asked the First Officer to pitch up together and said that pitch is not enough.
- At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two momentary manual electric trim inputs are recorded in the ANU direction. The stabilizer moved in the ANU direction from 2.1 units to 2.3 units.
- At 05:43:20, approximately five seconds after the last manual electric trim input, an AND automatic trim command occurred and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds. The aircraft began pitching nose down. Additional simultaneous aft column force was applied, but the nose down pitch continues, eventually reaching 40° nose down. The stabilizer position varied between 1.1 and 0.8 units for the remainder of the recording.
- The left Indicated Airspeed increased, eventually reaching approximately 458 kts and the right Indicated Airspeed reached 500 kts at the end of the recording. The last recorded pressure altitude was 5,419 ft on the left and 8,399 ft on the right
Flight profile from runway to last captured ADS-B point (Dave Reid)
The Ethiopian Airlines CEO at the crash site (Photo: Ethiopian Airlines)
The Interim Report
Conclusions
- 1. The aircraft has a valid certificate of airworthiness and maintained in accordance with applicable regulations and procedures;
- 2. There were no known technical problems before departure.
- 3. The aircraft weight and balance was within the operating limits.
- 4. The takeoff roll and lift-off was normal, including normal values of left and right angle-of-attack (AOA). During takeoff roll, the engines stabilized at about 94% N1. From this point for most of the flight, the N1 Reference remained about 94%.
- 5. Shortly after lift-off, the left and right recorded AOA values deviated. The left AOA values were erroneous and reached 74.5° while the right AOA reached a maximum value of 15.3°.The difference between the left and the right AOA values was 59° and remained as such until near the end of the recording.
- 6. Right after the deviation of the AOA the left stick shaker activated and remained active until the near end of the recording. The pitch Flight Director (F/D) bars disappeared on both left hand and right hand Primary Flight Displays (PFD). As the aircraft crossed 400 ft Radio Altitude the right and left pitch F/D bars appeared again.
- 7. Immediately after the LH AOA sensor failure, the left AOA erroneous values affected the LH FD pitch command, and the RH and LH Flight Director (FD) pitch bars started to display different guidance.
- 8. The Stall Management Yaw Damper Computer -1 (SMYDC 1) computed LH minimum operational speed and LH stick shaker speed greater than VMO (340 kt) without any alert or invalidity detection.Thus; the indicated LH airspeed was inside the minimum speed (red and black) band.
- 9. Approximately five seconds after the end of the crew manual electrical trim up inputs, a third automatic nose-down trim(MCAS) triggered. There was no corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches being in the ‘’cutout’’ position
- 10. The right hand over speed clacker sounded and it remained active until the end of the recording. The RH speed values varied between 360 kt and 375 kt (RH values). On the LH PFD, the LH computed airspeed oscillated between 335 kt and 350 kt.
- 11. Approximately five seconds after the last manual electric trim up input, a fourth automatic trim nose-down (MCAS) triggered. The stabilizer moved from 2.3 to 1 unit. The vertical speed decreased and became negative 3 s after the MCAS activation.
- 12. The difference training from B737NG to B737 MAX provided by the manufacturer was found to be inadequate.
- 13. The AOA Disagree message did not appear on the accident aircraft as per the design described on the flight crew operation manual.
- 14. AOA failure detection feature of the ADIRU did not detect the erroneous AOA from the left AOA sensor because it only considers the value to be erroneous when the AOA value is outside the physical range. Thus; SPD and ALT flag never appeared on the PFD.
- 15. MCAS design on single AOA inputs made it vulnerable to undesired activation.
- 16. The specific failure modes that could lead to uncommanded MCAS activation, such as an erroneous high AOA input to the MCAS, were not simulated as part of the functional hazard assessment validation tests. As a result, additional flight deck effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker activation) resulting from the same underlying failure (for example, erroneous AOA) were not simulated and were not documented in the stabilizer trim and auto flight safety assessment.
SAFETY RECOMMENDATIONS
- 1. The design of MCAS should consider the use of data from both AOA and/or other independent systems for redundancy.
- 2. The regulator shall confirm all probable causes of failure have been considered during functional hazard assessment.
- 3. The manufacturer shall insure the minimum operational speedcomputed by the SMYD to be within logical value. There should also be logic to validate the computation.
- 4. The difference training should also include simulator sessions to familiarize with normal and non-normal MCAS operation. The Training simulators need to be capable of simulating AOA failure scenarios.
- 5. The manufacture should confirm the AOA DISAGREE alert is functional whether the optional angle of attack indicator is installed or not.
- 6. The EAIB endorses the NTSB safety recommendation A-19-10 found in appendix 1
|
|
ET-AVJ 737 MAX-8 loss of control after take-off
