Ethiopian Airlines Flight 302: How Flawed Software, High Speed, Other Factors Doomed the Boeing 737 MAX

Minutes after take-off, the pilots of an Ethiopian Airlines 737 MAX were caught in a bad situation.

As soon as the pilots retracted the flaps and slats, according to flight data, a key sensor began to feed faulty information into Boeing's Maneuvering Characteristics Augmentation System (MCAS), designed to prevent stalls.

Flying at full take-off power, according to the flight data, the crew then struggled with nose-down commands from MCAS, four aviation experts told Reuters. The high speed and the jet's forward-leaning posture made it nearly impossible to use the controls to pull the nose up.

Moments later, the Boeing jet hit the ground, killing all 157 people onboard after six minutes of flight.

A complicated picture of what happened in the cockpit of Flight 302 on March 10 is emerging from the sparse commentary of a preliminary report and a new data plot showing how crew and technology interacted.

Ethiopia's transport minister said on Thursday that the pilots followed all correct procedures in trying to keep the plane in the air.

"The preliminary report confirmed beyond reasonable doubt that the crew followed the right procedures," Ethiopian Airlines said in a statement to Reuters on Sunday. "Under the circumstances, with a number of simultaneous warnings in the cockpit, the crew have performed professionally."

The engines remained at full take-off power as the airline's youngest-ever but highly-experienced captain, a 29-year-old with 8,122 hours of flying time, and his 25-year-old co-pilot, with 361 hours, flew the aircraft out of its initial climb.

That would be an unusual step in a regular flight, according to the experts and five current and former pilots interviewed by Reuters, most of whom were not authorised to speak publicly.

"You would never, ever have full power for the whole flight," said Hart Langer, a veteran former senior vice president for flight operations at United Airlines.

The reason the engines continued at full take-off power was not given in the report. But it is not part of a usual procedure for pilots dealing with the loss of key information such as the sensor data, the four experts said.

Search workers carry a tyre at the scene of the Ethiopian Airlines Flight ET 302 plane crash

Engine power
The Ethiopian Airlines statement suggested the crew left the throttles at take-off power because they intended to continue to climb and were hampered by the nose-down commands of MCAS.

By the end, the aircraft was travelling at 500 knots (575 mph, 926 kmph), far beyond the Boeing jet's operating limits.

The Ethiopian Airlines statement said "no excess speed was noted at the initial phases of the flight."

The aircraft's gathering speed and its downward "trim" when MCAS switched on for the last time may have contributed to a situation in which the pilots were unable to fight flawed Boeing software that eventually sent the jet into an uncontrollable dive, the four experts said after studying the data.

Trim is a manual or automatic setting that helps to keep the plane on a desired up or down trajectory by making it harder for pilots to pull the other way.

The Ethiopian Airlines crash, and another in Indonesia five months earlier, have left the world's largest planemaker in crisis as its top-selling jetliner is grounded worldwide, and Ethiopia scrambling to protect one of Africa's most successful companies.

All 737 MAX aircraft have been grounded and Boeing is working on an MCAS software fix and extra training that it says will prevent a repeat of such accidents.

CEO Dennis Muilenburg said on Friday the two accidents were caused by a chain of events, "with a common chain link being erroneous activation of the aircraft's MCAS function."

Sources who reviewed the crash data said the problems started barely 12 seconds after take-off.

A sudden spike in black box data was consistent with a bird or other debris hitting the plane as it was taking off, shearing away a vital airflow sensor, said the four experts and two US officials briefed on the data.

Ethiopian Airlines on Sunday called that scenario "completely speculative". Chief investigator Amdye Ayalew Fanta said on Thursday there was no indication of such damage.

Boeing said it would not comment on ongoing investigations.

As with the Lion Air crash in Indonesia, faulty data from the 'angle of attack' sensor, which measures how the wing is cutting through the air, may have set off a volatile chain of events.

In both cases, the faulty sensor tricked the plane's computer into thinking the aircraft was about to stall, or lose lift. The anti-stall MCAS software then pushed the nose down forcefully by intervening in the aircraft's trim system.

The first time the MCAS software kicked in, flight data shows the Ethiopian Airlines pilots reacted quickly by flicking switches under their thumbs - they had recognised the movements as the same type flight crews had been warned about after the Lion Air crash.

But data shows they were not able to fully counteract the computer's movements. At that point, they were a mere 3,000 feet above the airport, so low that a new warning - a computerised voice saying "don't sink" - sounded in the cabin.

When MCAS triggered again, the jetliner's trim was set to push the nose down at almost the maximum level, flight data shows, while the control column noisily vibrated with another stall warning called a "stick shaker."

This time, the pilots countered MCAS to greater effect, the experts said after studying the data. But when they turned off the system - as they were instructed to do by Boeing and the US Federal Aviation Administration (FAA) in the wake of the Lion Air disaster - the nose was still trimmed downwards, making it harder to pull up the plane.

The combination of the plane's speed - edging up towards design limits with the engines still at their take-off power - and the trim setting meant the pilots would have had to exert 50 pounds of force to pull back the control columns, the four experts and one of the pilots said, and moving a backup manual wheel instead was impossible.

Ethiopian Airlines' position is that the control problems only resulted from the crew's losing battle with MCAS, a source familiar with the airline's thinking said. Boeing declined to comment. The preliminary report did not cover this issue.

'Pull up, pull up'
The captain called out "pull up" three times, according to the cockpit voice recorder. The co-pilot reported problems to air traffic control. In the meantime, the aircraft's speed remained abnormally high, the five pilots and four aviation experts said.

Several experienced pilots said there was an array of stressful factors sapping the pilots' attention.

Among the distractions was a "clacker" warning telling the pilots their aircraft was going too fast. This only kicked in after the MCAS system had started firing, the airline said.

"As pilots have told us, erroneous activation of the MCAS function can add to what is already a high-workload environment," Muilenburg said Thursday, adding Boeing was "sorry for the lives lost" in the crash. "It's our responsibility to eliminate this risk. We own it and we know how to do it."

As the nose gradually fell, the captain asked the co-pilot to try to trim the plane using the manual backup wheel in the centre console to help the plane recover from the dive, according to the voice recorder.

But it was too hard to move the wheel. Both men then tried to pitch the nose up together. The captain, according to the report, said it was not enough.

MCAS re-activates
Data shows the electric trim system was switched back on in an apparent effort to force the reluctant nose higher, the experts said. This in turn would have also reconnected MCAS.

Reactivating MCAS is contrary to advice issued by Boeing and the FAA after Lion Air. The report did not address that. The airline did not comment.

The pilots managed to lift the nose slightly using the electric thumb switches on their control column. The data readout shows they flicked those switches only briefly. The report does not provide a reason for this. It does show the pilots fully engaged in trying to save the plane.

With its power restored, a final MCAS command kicked in, eventually pushing the nose down to a 40 degree angle at 500 knots, far beyond the plane's safe operating speed, defined by Boeing as 340 knots.

As the 737 MAX plunged, G-forces turned negative, pulling occupants out of their seats.

Just six minutes after take off, the plane crashed into a field.

© Thomson Reuters 2019