B38M, en-route south east of Addis Ababa Ethiopia, 2019
From SKYbrary Wiki
|On 10 March 2019, the left angle of attack vane of a Boeing 737-MAX 8 began recording erroneous values shortly after takeoff from Addis Ababa which triggered left stick shaker activation which continued for the remainder of the flight. Immediately after flap retraction was complete, a series of automatic nose down stabiliser trim inputs began, which the pilots were eventually unable to counter after which a high speed dive led to terrain impact six minutes after takeoff. The Investigation is continuing.|
|Actual or Potential
|Airworthiness, Loss of Control|
|Aircraft||BOEING 737 MAX 8|
|Type of Flight||Public Transport (Passenger)|
|Intended Destination||Jomo Kenyatta International Airport|
|Take off Commenced||Yes|
|ICL / ENR|
|Destination||Jomo Kenyatta International Airport|
|Approx.||28nm south east of Addis Ababa|
|Tag(s)||Copilot less than 500 hours on Type|
|Tag(s)||Significant Systems or Systems Control Failure,|
Degraded flight instrument display,
Uncommanded AP disconnect,
Indicating / Recording Systems
|Contributor(s)||OEM Design fault|
|Safety Net Mitigations|
|Malfunction of Relevant Safety Net||No|
|GPWS||Available but ineffective|
|Damage or injury||Yes|
|Aircraft damage||Hull loss|
|Fatalities||Most or all occupants (157)|
|Causal Factor Group(s)|
On 10 March 2019, the crew of a Boeing 737 MAX 8 (ET-AVJ) being operated by Ethiopian Airlines on a scheduled international passenger flight from Addis Ababa to Nairobi as ET302 and which had just taken off from runway 07R in day VMC reported a “flight control problem” to ATC and shortly afterwards contact was lost. The aircraft was subsequently found to have crashed into the ground at high speed and been completely destroyed killing all 157 occupants. There was no post crash fire.
An Investigation conducted in accordance with ICAO Annex 13 principles is being carried out by an Investigation Committee made up of investigators from the Ethiopian CAA Aircraft Accident Investigation Bureau. Both the CVR and the DFDR were recovered from the accident site and their data were subsequently successfully downloaded. ATC radar and voice recordings were also available.
The 29 year-old Captain had a total of 8,122 hours flying experience which included 103 command hours on the Boeing 737-8 MAX and a total of 4,017 hours on the Boeing 737 NG, 1,417 hours of which had been obtained in command after being upgraded to Captain on 26 October 2017 following initial issue earlier that year of his ATPL. His 737 MAX differences training was completed on 3 July 2018. No details of this differences training were given but it is known that it did not include any mention of MCAS, a significant difference from the 737 NG variant. The 25 year-old First Officer had a total of 361 hours flying experience of which 207 hours had been obtained on the Boeing 737 NG/MAX. He had obtained a type rating on Boeing 737 NG and 737 MAX on 12 December 2018 and been qualified to act as a First Officer without Training Captain supervision upon passing his Line Check on 31 January 2019.
The Aircraft & MCAS
The 737- MAX 8 was delivered new to Ethiopian Airlines on 15 November 2018. It was equipped with the same Enhanced Digital Flight Control System (EDFCS) as the 737 NG but had some additional Flight Control Computer (FCC) functionality which included a Maneuvering Characteristics Augmentation System (MCAS), the existence of which was not mentioned in corresponding documentation and was therefore unknown to customer airlines and their pilots. The Investigation found that no direct detection of MCAS activation was available from the FDR but it was possible to reliably determine when it had been active by indirect means.
The accident flight lasted just six minutes. A takeoff from runway 07R at Addis Ababa (field elevation 7,656 feet) was made with a flap setting of 5 degrees and a stabiliser trim setting of 5.6 units with both FDs on and both LNAV and VNAV modes armed. Takeoff clearance was given with the usual instruction to contact radar on 119.7 MHz once airborne.
The takeoff, with 94% N1 set - a setting which remained unchanged for the remainder of the flight - was normal but almost immediately after the aircraft became airborne, the recorded value of the left AoA sensor became incorrect. The left stick shaker was activated and remained continuously so until near to the end of the recording. At this time, the airspeed and altitude values provided by the left air data system began deviating from those on the right. Initially, the left AoA decreased to 11.1° then increased to 35.7° whilst the right AoA indicated 14.94°. Then, in less than one second, left AoA value rose to 74.5° as the right slightly increased to a maximum 15.3°. This difference between the left and right AoA continued until the end of the recording. Half a minute after takeoff, the first of a series of unsuccessful attempts to engage the AP was made - each time it dropped out again after between 2 and 32 seconds.
About a minute after takeoff, the First Officer called Radar and reported on a SHALA 2A SID passing 8,400 feet. The controller identified the flight and re-cleared it to FL 340 and “when able to turn right direct to RUDOL” which was followed by a corresponding reselection of the HDG bug. The Captain then called for flap zero but as flap retraction was completed, the erroneous left side AoA triggered the initiation of automatic (MCAS) nose-down trim which then continued for nine seconds and re-positioned the stabiliser trim from around 5.6 units to 2.1 units despite the Captain responding by pulling back on the control column to oppose this with a force in excess of 90lbs and using manual electric trim for 9 seconds.
Almost immediately, a second automatic nose-down trim activation occurred and continued for 7 seconds accompanied by two three second Mode 3 EGPWS DON’T SINK Alerts and a concurrent display of “PULL UP” on the PFD. After nine seconds of opposing this with manual electric trim inputs, the crew discussed and then agreed that the stab trim cut out switches should be operated. The aircraft was now 1500 feet aal and the stabiliser trim was at 2.3 units.
Approximately five seconds after the end of crew manual electric trim inputs in opposition to this second automatic nose-down trim, a third automatic nose-down trim activation began. With the electric stabiliser trim now disconnected, both pilots responded by pulling their control columns rearwards applying an average force of 94 lbs. As the automatic nose down trim finished, the Captain instructed the First Officer to tell ATC that they would like to maintain 14,000 as “we have a flight control problem”. This was done and ATC approval was given, but the Captain then recognised that the intended flight path could not be maintained and a request to return was made and approved with a turn onto a westerly heading which was then set. After 2½ minutes with the stabiliser trim cut out switches ‘on’, they were reset to the normal position without crew comment and briefly used to keep the stabiliser trim at 2.3 units.
Approximately five seconds after this, which was around five minutes after takeoff, a fourth automatic nose-down trim activation began. It lasted about five seconds during which the stabiliser moved from 2.3 units to 1 unit. One second before the end of this automatic trim activation, the average rearwards force being applied to the control column decreased from 100 lbs to 78 lbs in just 3½ seconds during which the aircraft pitch angle went from 0.5° nose up to 7.8° nose down and the rate of descent increased from 100 fpm to more than 5,000 fpm. Despite a recorded applied opposing force of up to 180 lbs, aircraft pitch continued to decrease as the rate of descent and airspeed increased. Just prior to terrain impact, the aircraft pitch was more than 40° nose down, the airspeed reached 500 KCAS and the rate of descent was 33,000 fpm.
In summary, the crew were faced with a failure of the left AoA sensing system immediately after takeoff which compromised the Captain’s PFD indications and airspeed and altitude. Since the crew were unable to keep the AP engaged, when the flaps reached zero, the first of four successive MCAS nose-down trim activations incorrectly triggered by the invalid left AoA input occurred. The thrust remained at the takeoff setting and it became increasing difficult, and eventually impossible, for the crew to successfully oppose the MCAS using elevator via their control columns or their electric stabiliser trim inputs.
The analysis of the factual findings of the Investigation has still to be completed and at this stage, they have been documented formally in summary as follows:
- The aircraft had a valid certificate of airworthiness and was maintained in accordance with applicable regulations and procedures;
- There were no known technical problems before departure.
- The aircraft weight and balance was within the operating limits.
- The takeoff roll and lift-off was normal, including normal values of left and right angle-of-attack (AoA). During the takeoff roll, the engines stabilized at about 94% N1. From this point for most of the flight, the N1 Reference remained about 94%.
- Shortly after lift-off, the left and right recorded AoA values deviated. The left AoA values were erroneous and reached 74.5° while the right AoA reached a maximum value of 15.3°.The difference between the left and the right AoA values was 59° and remained as such until near the end of the recording.
- Right after the deviation of the AoA the left stick shaker activated and remained active until the near end of the recording. The pitch Flight Director (FD) bars disappeared on both left hand and right hand Primary Flight Displays (PFD). As the aircraft crossed 400 ft Radio Altitude the right and left pitch FD bars reappeared.
- Immediately after the LH AoA sensor failure, the left AoA erroneous values affected the LH FD pitch command, and the RH and LH Flight Director (FD) pitch bars started to display different guidance.
- The Stall Management Yaw Damper Computer -1 (SMYDC 1) computed LH minimum operational speed and LH stick shaker speed greater than Vmo (340 kt) without any alert or invalidity detection. Thus, the indicated LH airspeed was inside the minimum speed (red and black) band.
- Approximately five seconds after the end of the crew manual electrical trim up inputs, a third automatic nose-down trim (MCAS) triggered. There was no corresponding motion of the stabiliser, which is consistent with the stabiliser trim cut out switches being in the ‘’cut out’’ position.
- The right hand overspeed ‘clacker’ sounded and it remained active until the end of the recording. The RH speed values varied between 360 kt and 375 kt (RH values). On the LH PFD, the LH computed airspeed oscillated between 335 kt and 350 kt.
- Approximately five seconds after the last manual electric trim up input, a fourth automatic trim nose-down (MCAS) triggered. The stabilizer moved from 2.3 to 1 unit. The vertical speed decreased and became negative 3 seconds after the MCAS activation.
- The difference training from B737NG to B737 MAX provided by the manufacturer was found to be inadequate.
- The AoA Disagree message did not appear on the accident aircraft as per the design described on the Flight Crew Operations Manual.
- The failure detection feature of the Air Data Inertial Reference Unit (ADIRU) did not detect the erroneous AoA from the left AoA sensor because it only considers the value to be erroneous when the AoA value is outside the physical range. Thus, the SPD and ALT flags never appeared on the PFD.
- MCAS design dependent on a single AoA input made it vulnerable to undesired activation.
- The specific failure modes that could lead to uncommanded MCAS activation, such as an erroneous high AoA input to the MCAS, were not simulated as part of the functional hazard assessment validation tests. As a result, additional flight deck effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker activation) resulting from the same underlying failure (for example, erroneous AoA) were not simulated and were not documented in the stabiliser trim and auto flight safety assessment.
Reporting of the Investigation
A Preliminary Report was published on 4 April 2019 and has since been superceded by an Interim Report which was published on 9 March 2020 and has been used as the basis for this summary.
Five Safety Recommendations were included in the Interim Report as follows:
- that the design of MCAS should consider the use of data from both AoA and/or other independent systems for redundancy.
- that the FAA shall confirm all probable causes of failure have been considered during functional hazard assessment.
- that Boeing shall ensure that the minimum operational speed computed by the Stall Management and Yaw Damper Computer (SMYDC) is within logical value. There should also be logic to validate the computation.
- that 737 MAX differences training should also include simulator sessions to familiarise pilots with normal and non-normal MCAS operation. Training simulators need to be capable of simulating AoA failure scenarios.
- that Boeing should confirm that the AOA DISAGREE alert is functional whether the optional angle of attack indicator is installed or not.
The Investigation also explicitly endorsed the 7 Safety Recommendations included in the NTSB Safety Recommendation which was issued on 19 September 2019.
- Maneuvering Characteristics Augmentation System (MCAS)
- The Joint Authorities Technical Review (JATR) - Boeing 737 MAX Flight Control System
- NTSB Safety Recommendations Report Arising from the Boeing 737 MAX-8 Fatal Accidents in 2018 and 2019
- Certification of Aircraft, Design and Production
- B38M, en-route, northeast of Jakarta Indonesia, 2018