Ethiopia’s transport minister announced on Friday December 23 that state investigators in their final report on ET302, confirmed that a software malfunction was the main cause of the March 10, 2019 Boeing 737 Max crash.
The Ethiopian Airlines flight bound for Nairobi crashed six minutes after takeoff from Addis Ababa, killing all 157 passengers and crew.
Consistent with the preliminary report, the final report confirmed that the angle-of-attack sensor on the left side of the aircraft failed immediately after takeoff, sending erroneous data to the flight control system, said Dagmawit Moges.
The erroneous data triggered the maneuvering characteristics augmentation flight control system (MCAS), which repeatedly pointed the plane’s nose down until the pilots lost control of the plane, she said.
The report into the Ethiopian Airlines Group incident also concluded that all professionals and planes related to the crash were correctly certified
However, United States agency responsible for investigating aviation accidents, the National Transportation safety Board (NTSB) has released a detailed response with comments on the report from the Ethiopian Accident Investigation Bureau touching various areas including probable cause and human factors.
PROBABLE CAUSE
The NTSB cites the flight crew’s inadequate use of manual electric trim and management of thrust to maintain airplane control.
“we believe that the probable cause also needs to acknowledge that appropriate crew management of the event, per the procedures that existed at the time, would have allowed the crew to recover the airplane even when faced with the uncommanded nose-down inputs.”
It also points to the airline’s failure to ensure that its flight crews were prepared to properly respond to uncommanded stabilizer trim movement in the manner outlined in Boeing’s flight crew operating manual
The NTSB also identified as an inadequately addressed root cause, the airplane’s impact with a foreign object, which damaged the Angle Of Attack(AOA) sensor and caused the erroneous AOA values.
AIRFRAME/SYSTEMS ASPECTS
Investigations around AOA anomalies were facilitated by Collins Aerospace, the manufacturer of the airplane’s AOA sensor who presented their own report.
The report concluded that the observed performance deviation of the left AOA sensor, which was recorded by the Flight Data Recorder(FDR) 44 seconds after the beginning of takeoff roll, is consistent with the vane breaking at the hub and separating from the AOA sensor.
The report estimates that a bird weighing at least 0.5 pound (0.23 kilogram) impacting the vane at 170 knots (the estimated airspeed of the airplane at the time of the left AOA sensor performance deviation) would be sufficient to cause the vane to break at the hub and separate from the AOA sensor
In addition, the failure mode involving separation of the vane at the hub is consistent with the large and near-instantaneous initial change in the left AOA value and the resulting AOA dynamics observed in the FDR data.
But the NTSB expresses concern that the EAIB draft report omits factual information, analysis, findings, contributing factors, and safety recommendations regarding bird hazards and the effectiveness of bird mitigations at Addis Ababa airport.
The EAIB draft report includes multiple findings that question the functionality of the manual electric trim system, But the NTSB begs to differ. Its assessment found that no trim system failure scenarios were consistent with the FDR data and that the behavior of the electric manual trim parameter recorded on the FDR was consistent with flight crew input.
OPERATIONAL AND HUMAN FACTORS
The NTSB claims the EAIB draft report continues to focus heavily on system design issues. But that Flight crew performance played a critical role in the accident sequence and that a discussion of the accident flight crew’s performance (including CRM) was not sufficiently developed in the EAIB draft report
“As we have reiterated throughout the investigation, design mitigation must adequately account for expected human behavior to be successful, and a thorough understanding of the flight crew’s performance in this accident is required not only for robust design mitigations but also for operational and training safety improvements necessary to achieve multiple layers of safety barriers to trap human errors and prevent accidents.”
EAIB report states that IAS (indicated airspeed) DISAGREE and ALT (altitude) DISAGREE messages were not displayed to the crew during the accident flight and explains that, because the AOA DISAGREE message did not appear, the IAS DISAGREE and ALT DISAGREE messages also did not appear.
According to the NTSB, although the FDR was not programmed to record the presence or absence of the IAS DISAGREE and ALT DISAGREE messages, all conditions were met for the alerts to be presented to the crew.
The NTSB admits that a software discrepancy caused the AOA DISAGREE message not to appear, but the software discrepancy was unrelated to, and had no effect on, the display of the IAS DISAGREE and ALT DISAGREE messages.
Given that the conditions were met for the IAS DISAGREE and ALT DISAGREE messages to be annunciated to the crewmembers, their lack of conversation or action in response to the annunciations should be explored in the context of the flight deck environment, workload, crew experience, and training. The report’s assumption that those messages did not appear, which is contrary to Boeing’s description of the alerting system and the results of simulator testing during the investigation, severely limits the opportunity for recognizing and addressing potential crew training and experience improvements the NTSB says.
The EAIB draft report states that no flight crew reference document explained that autothrottle thrust commands could be affected by erroneous AOA inputs. – regarding this, the NTSB believes the flight crew should simply have been trained on 737-8 MAX non-normal procedures as in-flight anomalies are time critical and non-normal procedures are designed to provide flight crews with information to diagnose and respond to a system-related issue in a timely manner based on observable flight deck effects.
The NTSB also asserts that MCAS did not make the plane uncontrollable and if the crew had manually reduced thrust and appropriately used the manual electric trim, the airplane would have remained controllable despite uncommanded MCAS input.
It further claims that the crew did not appropriately perform non-normal procedures after receiving annunciations relating to unreliable airspeed, stall warning, and runaway stabilizer. The crew also did not respond as expected to the overspeed warning by disconnecting the autothrottle and reducing power.
Crew Resource Management (CRM)
The NTSB points to various CRM aspects not discussed in the report. These include:
- Division of duties
- Operator CRM training
- Expected/as-trained CRM performance
- Flight deck communication
- First officer’s limited flight experience
- Potential authority gradient
Boeing Safety Action
Boeing made a number of corrective measures in the wake of the 737 MAX crashes:
The software updates include AOA signal monitoring (from both AOA sensors), MCAS activation and stabilizer resynchronization logic, maximum command limit, and flight deck alerting.
FAA Safety Action
With the FAA also facing the heat, a number of actions were taken regarding the 737 MAX and safety:
As a result, neither the pilot-in-command nor the second-in-command can operate the 737 MAX unless they have completed appropriate ground and flight training. Further, flight training is required to be conducted in a Level C or D full flight simulator.
Ethiopian Airlines did reach a final settlement with Boeing on the MAX crash and has since resumed its delivery schedule for Boeing 737 MAX aircraft on order as well as flight operations with the MAX in the early part of 2022.
