B38M, en-route south east of Addis Ababa Ethiopia, 2019
From SKYbrary Wiki
|On 10 March 2019, left air data system faults on a Boeing 737-MAX 8 soon after departing Addis Ababa were followed by autopilot disconnection, left stick shaker activation and two successive periods of automatic nose down stabiliser causing EGPWS ‘DON’T SINK’ alerts. Recovery was achieved using manual stabiliser trim but prior to a third automatic pitch down, the trim system was switched off as per the runaway stabiliser drill but briefly reinstated to help recover from it. Recovery from a fourth automatic pitch down was not achieved and a high speed dive led to terrain impact six minutes after takeoff.|
|Actual or Potential
|Airworthiness, Loss of Control|
|Approx.||28nm south east of Addis Ababa|
|Tag(s)||Significant Systems or Systems Control Failure|
|Damage or injury||No|
|Aircraft damage||Hull loss|
|Fatalities||Most or all occupants (157)|
|Causal Factor Group(s)|
On 10 March 2019, the crew of a Boeing 737 MAX 8 (ET-AVJ) being operated by Ethiopian Airlines on a scheduled international passenger flight from Addis Ababa to Nairobi as ET302 and which had just taken off from runway 07R in day VMC reported a “flight control problem” to ATC and shortly afterwards contact was lost. The aircraft was subsequently found to have crashed into the ground at high speed and been completely destroyed killing all 157 occupants. There was no post crash fire.
An Investigation conducted in accordance with ICAO Annex 13 principles is being carried out by an Investigation Committee made up of investigators from the Ethiopian Ministry of Transport Aircraft Accident Investigation Bureau. Both the CVR and DFDR were recovered from the accident site and their data were subsequently successfully downloaded. It was immediately clear that difficulty in controlling the pitch of the aircraft had been a critical factor during the flight and noted that on Boeing 737 aircraft, this is achieved by means of hydraulically powered elevators and an electrically powered stabiliser with the elevators controlled by movement of the control columns and the stabiliser controlled by automatic or manual trim commands. The stabiliser may also be manually controlled through movement of the switches on the control column yokes or by rotating the pitch trim wheels.
The Flight It has been established that almost immediately after becoming airborne following a normal flap 5 takeoff, and with the aircraft at approximately 100 feet agl, the values of angle of attack (AOA) recorded on the left and right channels had begun to deviate. Whilst the right side remained around 15°, the left side decreased to 11.1° and then increased initially to 35.7° and then - in less than a second - to 74.5° and “the left stick shaker activated and remained active until near the end of the recording”. From this time, the left side display began to show different (and consistently lower) airspeed, altitude and flight director pitch bar values than those on the right side.
As the aircraft passed approximately 200 feet agl, an anti ice fault was annunciated and the recorded left AOA heat parameter changed state. Between 400 feet agl and 600 feet, the Captain made two calls for AP engagement which were both followed by “autopilot warnings”. After the second of these, the Captain asked the First Officer to check in with ATC on the Departure Radar frequency and the call was made advising that the aircraft was passing 8,400 feet QNH (the elevation of Addis Ababa airport is 7,656 feet amsl). At about the time this call was made, the left autopilot (AP) was successfully engaged but seconds after this, “small amplitude roll oscillations accompanied by lateral acceleration, rudder oscillations and slight heading changes” commenced and these continued when the AP disengaged just over half a minute later. Just before this happened, the Captain asked the First Officer to call ATC and request a track continuing on runway heading instead of following the SID and tell them that they were “having flight control problems”.
Within five seconds of the uncommanded AP disengagement, an automatic aircraft nose down (AND) activation began and the pitch trim (stabiliser) position moved from 4.60 to 2.1 units. This lasted for 9 seconds and converted the climb previously being achieved into a shallow descent and resulted in Terrain Avoidance and Warning System (TAWS) ‘DON’T SINK’ alerts occurring. An aft movement of the control column was recorded and a positive climb was re-established whilst the automatic AND input was still active. Approximately three seconds after the uncommanded AND input had stopped, manual electric pitch trim input in aircraft nose up (ANU) direction was recorded and this resulted in the pitch trim (stabiliser) position moving to 2.4 units. However, as the back pressure on the control column increased, the aircraft pitch attitude did not change significantly.
Five seconds after this pilot-initiated ANU pitch trim input had ceased, a second period of automatic AND pitch trim occurred decreasing the pitch trim (stabiliser) position to 0.4 units. This was accompanied by three further Terrain Avoidance and Warning System (TAWS) ‘DON’T SINK’ alerts. The Captain responded with another manual ANU pitch trim input and asked the First Officer to trim up with him. This action resulted in the stabiliser movement reversing and the pitch trim (stabiliser) position reaching 2.3 units. Upon completion of this action, the First Officer called “stab trim cut-out” twice, the Captain agreed and the First Officer confirmed. Approximately five seconds later, a third period of automatic AND pitch trim command occurred, this time “without any corresponding motion of the stabiliser”, which it was noted was “consistent with the stabiliser trim cutout switches (now being) in the ‘cutout’ position”. The Captain responded by calling out three times “pull-up” and the First-Officer acknowledged.
For approximately the next 2½ minutes, the stabiliser position moved in the AND direction from 2.3 to 2.1 units whilst “aft force was being applied to both control columns which remained aft of (the) neutral position”. The crew confirmed to each other that after disconnecting the stabiliser trim, they could no longer control it (although there was no mention on the CVR of whether this was attempted using the control column switches or the pitch trim wheel). During this time, the right side (correct) indicated airspeed increased from approximately 305 KIAS through Vmo (340 KIAS) and the right side overspeed aural warning was activated and remained active thereafter. The left side displayed airspeed remained up to 25 knots less than that on the right side. During this time, the Captain asked the First Officer to request radar vectors to return to the airport and the flight was given a right turn onto 260°. Towards the end of this 2½ minute period, both pilots were recorded as calling out “left alpha vane” and the Captain announced that “pitch is not enough” shortly before “two momentary manual electric trim inputs in the ANU direction were recorded”. These inputs resulted in pitch trim (stabiliser) position moving in the ANU direction from 2.1 units to 2.3 units.
Approximately five seconds after this final manual electric pitch trim input, a fourth period of AND automatic pitch trim command occurred and the pitch trim (stabiliser) position moved in the AND direction from 2.3 to 1.0 units over approximately 5 seconds. Despite the pilots’ added and simultaneous aft control column input throughout the remainder of the flight, the aircraft nose down pitch attitude continued to increase, eventually reaching 40° nose down with the recorded pitch trim (stabiliser) position varying between 1.1 and 0.8 units. By the end of the recording, the right side airspeed had reached 500 KCAS and the left side almost 460 KCAS and the recorded pressure altitude was 8,300 feet QNH on the right and 5,419 feet QNH on the left.
The aircraft impacted agricultural land near the settlement of Ejere creating a 10 metre deep crater approximately 28 metres by 40 metres. The condition of the wreckage was judged to be consistent with a high energy impact.
The Investigation so far It was noted the 29 year-old Captain, who had been Pilot Flying (PF) for the accident flight, had accumulated 8,122 hours total flying experience which included 1,417 hours on the 737 of which 103 were on the 737 MAX 8 variant. The 25 year-old First Officer had 361 hours total flying experience which included 207 hours on the 737 of which 56 hours were on type.
It was confirmed that following the issue of FAA AD 2018-23-51 on 7 November 2018 in the aftermath of the AOA-related fatal accident to a Lionair Boeing 737 MAX on 29 October 2018 it had been incorporated in the Aircraft Flight Manual (AFM) as required.
It was also confirmed that the 737 MAX 8/9 FCOM Bulletin issued by Boeing to all 737 MAX operators on 6 November 2018 which “directed flight crews to existing procedures to address an AOA failure condition that can occur during manual flight only” had been incorporated in the Ethiopian Airlines FCOM. Boeing had described the reason for issuing this Bulletin as “to emphasis the Procedures Provided in the Runway Stabiliser Non-Normal Checklist”. The Bulletin was prefaced by the following text:
“In the event of erroneous AOA data, the pitch trim system can trim the stabiliser nose down in increments lasting up to 10 seconds. The nose down stabiliser trim movement can be stopped and reversed with the use of the electric stabiliser trim switches but may restart 5 seconds after the electric stabiliser trim switches are released. Repetitive cycles of uncommanded nose down stabiliser continue to occur unless the stabiliser trim system is deactivated through use of both STAB TRIM CUTOUT switches in accordance with the existing procedures in the Runaway Stabiliser NNC. It is possible for the stabiliser to reach the nose down limit unless the system inputs are counteracted completely by pilot trim inputs and both STAB TRIM CUTOUT switches are moved to CUTOUT.”
The initial recovery actions in the Runway Stabiliser NNC for a situation where “uncommanded stabiliser trim movement occurs continuously and does not stop after the autopilot is disengaged” were noted as being to set both STAB TRIM CUTOUT switches to CUTOUT and, if the runaway continues, “grasp and hold the stabiliser trim wheel, trim manually and anticipate trim requirements”.
Both engines were recovered and showed no signs that their normal operation up to the point of impact had been compromised. Inspection also suggested that they were “operating at power at the time of impact”. The aircraft Technical Log was reviewed since delivery of the aircraft to the airline in November 2018 and no evidence of any serious or recurring defect was found. However, these rectified and non recurring defects did include some of potential relevance in early December involving temporary air data display malfunctions and one report of “the aircraft rolling during autopilot operation”. A similar check of recorded actions during an ‘A’ Check carried out in early February, again with no related findings.
The Initial Findings of the Investigation have been formally documented as follows:
- The aircraft possessed a valid certificate of airworthiness;
- The crew possessed the licence and qualifications to conduct the flight;
- The takeoff roll appeared normal, including normal values of left and right angle-of-attack (AOA).
- Shortly after liftoff, the value of the left angle of attack sensor deviated from that of the right angle of attack sensor and reached 74.5 degrees while the right angle of attack sensor value was 15.3 degrees; after this, the stick shaker activated and remained active until near the end of the flight.
- After autopilot engagement, there were small amplitude roll oscillations accompanied by lateral acceleration, rudder oscillations and slight heading changes; these oscillations continued after the autopilot disengaged.
- After the autopilot disengaged, the DFDR recorded four periods of automatic aircraft nose down (AND) stabiliser trim without pilot input. In response, three corrective movements of the stabiliser trim were recorded using the electric manual trim to counter and/or recover from the automatic AND input.
- The crew performed the runaway stabiliser checklist and set the stabiliser trim cut-out switch to the cut-out position and then confirmed that the manual trim operation was not working.
Safety Action taken by the Ethiopian Airlines on the day of the accident was to suspend operation of their 737 MAX 8 aircraft. Four days later, the Ethiopian CAA issued a NOTAM banning all flights by 737 MAX aircraft in Ethiopian airspace until further notice.
Two Safety Recommendations have been made so far as follows:
- that Boeing should review the aircraft flight control system in relation to flight controllability
- that Aviation Authorities shall verify that the review of the aircraft flight control system in relation to flight controllability has been adequately addressed by the manufacturer before the release of the aircraft to operations.
A Preliminary Report, on which this summary has been based, was published on 4 April 2019. It includes copies of relevant FCOM extracts (Appendices 2 and 3) and the 6 November 2018 FCOM Bulletin (Appendix 4).
EDITOR’S NOTE The following related developments were not mentioned in the Preliminary Report but the first two were direct responses to the accident and the third was a direct response to the issue of the Preliminary Report:
- On 13 March 2019, the FAA issued an ‘Emergency Notice of Prohibition’ to prevent continued operation of Boeing 737-MAX 8 and 9 aircraft by US certificated operators and such flight by any operators of these aircraft in the territory of the United States.
- On 19 March 2019, the US Secretary of Transportation requested the Department of Transport’s Inspector General to begin an “Audit of Certification for the Boeing 737-MAX 8 (2012-2017) to help inform the Department’s decision making and the public’s understanding, and to assist the FAA in ensuring that its safety procedures are implemented effectively”.
- On 4 April 2019, the same day the Investigation Preliminary Report was published, the Boeing Company Chairman, President & CEO Dennis Muilenburg issued a public statement in response to it, which included, in respect of both the Ethiopian and Lionair Boeing 737 MAX 8 accidents currently being investigated, the remark that “it's apparent that in both flights the Maneuvering Characteristics Augmentation System, known as MCAS, activated in response to erroneous angle of attack information." This is the first time Boeing has publicly acknowledged that the MCAS was involved in both accidents.