The Ethiopian Aircraft Accident Investigation Bureau (AIB) released its final report on the crash of Flight ET302, sharing its conclusions on why an Ethiopian Airlines Boeing 737 MAX went down shortly after takeoff.
The Boeing 737-8 MAX, registered as ET-AVJ, was operating a regularly scheduled flight from Addis Ababa Bole International Airport (ADD) to Jomo Kenyatta International Airport (NBO) in Nairobi, Kenya, on March 10, 2019. Just eight minutes after it lined up on ADD’s runway, at 5:44 AM local time (GMT +3), the 737 MAX impacted the ground some 28 nautical miles (51.8 kilometers, 32.2 miles) off Addis Ababa. All 157 people on board were killed in the crash, including eight crew members (two pilots, five flight attendants, and one In-Flight Security Officer) and 149 passengers.
Boeing delivered the airliner on November 17, 2018.
It was the second fatal crash of the aircraft type since its introduction in May 2017. The previous accident involved a Lion Air Boeing 737 MAX plunging into the Java Sea off the coast of Indonesia, claiming the lives of 189 people on October 29, 2018. Indonesian authorities released their final report of Lion Air Flight JT610 on October 25, 2019, just shy of the one-year anniversary of the accident.
737 MAX Flight control system and electrical abnormalities
While the Indonesian authorities found deficiencies in the maintenance procedures of the aircraft just prior to its fatal crash, they also found faults in the Federal Aviation Administration’s (FAA) certification processes as well as the infamous Maneuvering Characteristics Augmentation System (MCAS). The Ethiopian investigators, meanwhile, pointed out that “intermittent flight control system abnormalities began well before the accident flight,” which indicates that there were production defects present on the aircraft.
“Maintenance actions of relevance started occurring in December 2018 when the airplane was one month old and included several pilot write-ups involving temporary fluctuations of vertical speed and altitude,” continued the report. The investigators also noted that Ethiopian Airlines’ pilots conveyed three instances of the aircraft rolling during autopilot operations and that attitude and vertical speed indicators on the Primary Flight Display (PFD) “showed erratic and exaggerated indications”. Furthermore, the 737 MAX’s maintenance log book (MLB) recorded several instances of electrical anomalies, such as the Auxiliary Power Unit (APU) experiencing a protective shutdown due to a fault. In addition to the APU Fault Light, the Start Converter Unit (SCU) indicated that the APU’s start system was inoperative.
Due to the Captain’s personal computer power outlet not having power as well, the report stated that the “possibility of intermittent electrical/electronic system defects were an underlying issue”. All of the information, thus, could point out that the malfunction of the Angle of Attack (AoA) sensor upon take-off of the 737 MAX happened due to the loss of power on the left AoA Sensor Heater, elaborated the Ethiopian AIB.
“Evidence indicates the loss of power was likely due to a production-related intermittent electrical/electronic failure involving the airplane’s Electrical Wiring Interconnection System (EWIS) and the AOA Sensor part,” continued the report.
The investigators also noted that following the accident in Ethiopia, “Boeing informed the NTSB they had made an engineering design error in their initial AOA Sensor Hazard Analysis; Neither Boeing, the NTSB, nor the FAA informed Ethiopian authorities about this critical error.”
A miscalibrated sensor of the Lion Air 737 MAX or a bird strike that impacted the Ethiopian Airlines aircraft could not “explain the flight system alerting, maintenance messages and electrical/electronic system faults that were occurring on these airplanes in the weeks and days before their accidents.”
“These accidents were triggered by production quality defects that presented as intermittent system malfunctions. These types of defects are difficult to identify and troubleshoot,” determined the report.
Additionally, neither the MCAS nor lack of pilot training was the cause of the accident, as it “was the failure of the sensors due to the production quality defects,” continued the release, further driving the point that if nothing would have caused the AoA sensors to trigger the MCAS, “these two accidents would not have occurred”.
The Indonesian National Transportation Safety Committee (KNKT) also pointed out the MCAS’ flaws, including that Boeing and the FAA need to “more closely scrutinize the development and certification process for systems whose malfunction has the ability to lead to loss of control of the airplane”.
MCAS and faulty AoA data downed Ethiopian Airlines 737 MAX
Tthe Ethiopian AIB provided 88 findings that indicated deficiencies or were significant events in the accident’s timeline.
The Boeing 737 MAX, prior to its departure from ADD, had a valid airworthiness certificate and was maintained using the correct regulations and procedures. Nothing abnormal was spotted following the analysis of the take-off procedure, including the weight and balance, which were within operational limits. However, as soon as the aircraft went up into the air, the AoA sensors’ data deviated, and the stick shaker – indicating an aerodynamic stall to the pilots – continued to remain active until the end of the flight. Although the Indicated Speed (IAS) and Altitude (ALT) Disagree alerts were not recorded on the Flight Data Recorder (FDR), per computation, both should have triggered a few seconds from each other, before stopping simultaneously. The Cockpit Voice Recorder (CVR) indicated that the pilots did not discuss either of the alerts on the PFD.
“This has led to uncertainty about the appearance of alerts and the crew who thus did not apply the Airspeed Unreliable Non-Normal Check-list”.
The left AoA sensor failed immediately after takeoff, according to the investigators. As such, the MCAS triggered repeated nose-down movements using erroneous data until pilots lost control of the Boeing 737 MAX. What exacerbated the situation was the pilots’ lack of awareness and training of the system, “confusing alerts, and the startle factor,” as well as the fact that MCAS was designed to rely on a single sensor’s data, making it “vulnerable to undesired activation.” Still, when the captain countered one of the two trim-down inputs from the MCAS, stopping the Ground Proximity Warning System (GPWS) alert, the aircraft’s trim was not neutralized due to a reason unknown to the investigators.
Two more MCAS triggers were noted by the Ethiopian AIB, with the fourth and last one happening 18 seconds before the aircraft impacted the ground.
“Repetitive and uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA input, and its unrecoverable activation system which made the airplane dive with the rate of -33,000 ft/min close to the ground was the most probable cause of the accident,” the report concluded.