A day before the one-year anniversary of the Ethiopian Airlines crash of a Boeing 737 MAX that killed 157 people, the interim investigation report blamed Boeing’s design of the jet’s new flight control system and the training Boeing offered pilots.
In highlighting the role in the crashes played by MCAS — the Maneuvering Characteristics Augmentation System, which Boeing designed to push the nose of the aircraft down in certain circumstances where the plane tended to pitch up — the report reiterates what’s by now widely accepted within the aviation world.
In an interview last week, Steve Udvar-Hazy, an important figure in the industry whose Air Lease Corp. (ALC) is a big customer of both Airbus and Boeing and who regularly advises top management at both jetmakers, described how he tested MCAS in a simulator and concluded the original version was a “flawed” design.
“Had there been no MCAS system, those planes wouldn’t have crashed,” he said.
The Ethiopian report states that MCAS initially activated three times, forcing the pilots on Flight 302 to struggle with the controls as they tried to pull the nose back up, before a final further activation led to loss of control and the crash.
737 MAX CRISIS COMPLETE COVERAGE »
The report notes Boeing had assumed that pilots would handle such a system failure by using a standard procedure that involved switching the system off and then using a manually turned wheel to swivel the horizontal tail so as to pull the nose back up.
Boeing had highlighted this procedure in bulletins sent to the airlines following the first crash of a MAX with Lion Air Flight 610 the previous October. The Ethiopian pilots must have been keenly aware of both the danger and Boeing’s recommended counteraction.
The report concludes that the pilots indeed did switch off the system after the first three MCAS activations, but then found the manual trim wheel immovable due to the high forces acting on the tail of the aircraft.
Faced with extreme difficulty in manually pulling the nose back up, the pilots switched the electrical controls back on in an apparent effort to use those to counter the plane’s nose-down angle. However, this re-activated MCAS one final time.
The nose-down angle then increased to 7.8 degrees and the plane’s descent rate increased from 100 feet per minute to more than 5,000 feet per minute.
Though the pilots were pulling on their control columns with up to 180 pounds of force, the plane’s nose-down angle continued increasing and and the pilots lost control.
By the end, the plane, which was never more than 8,400 feet above the ground, was descending at a tremendous rate of more than 33,000 feet per minute and hit the ground at 575 miles per hour.
System flawed
The report does not mention any shortcomings in the way the pilots handled the emergency, an omission that the Federal Aviation Administration (FAA) seemed to allude to in a statement issued in response to the report.
“We believe it’s important to have the full final report to evaluate it against other independent reports so that we might fully understand all of the factors — both mechanical and human — that played a role in this tragic loss of life,” the FAA said.
Still, the focus on the design defects in MCAS is by now widely accepted within the aviation world, notably by ALC founder and chairman Udvar-Hazy.
ALC ordered 150 MAX planes and had taken delivery of 15 before the plane was grounded.
Udvar-Hazy, an experienced private pilot who is certified to fly 737s, said Boeing gave him the opportunity to test in a simulator both the original MCAS design and the updated version now being prepared for the jet’s return to service.
He described the original design as “very aggressive.”
“I did a whole bunch of takeoffs with different speeds, different settings and that thing is pretty violent, the old system,” he said. “It’s a wild horse.”
“I have 11,000 hours in jets as a captain, and I could see where, if it comes as a stunning surprise – because I already knew it was going to do it – you could easily lose control of the airplane,” Udvar-Hazy said. “It was just a bad design.
“Had there not been anything like that, all those people may still be alive,” he added.
Post-crash tests
The Flight 302 interim report describes MAX simulator tests conducted in July 2019, more than four months after the crash, that re-created the conditions on the flight and showed the forces on the tail would have been too strong and would have rendered the manual wheel “not movable.”
On the crash flight, when the flight crew tried to use the manual trim wheel, the nose-down angle would have required about 40 turns of the wheel to get back to the neutral position, the report found. In the simulator, pilots could move it no more than a couple of turns at speeds below those reached on the flight.
The pilots allowed the plane to exceed the airplane’s maximum design speed of 340 knots (391 miles per hour) before they lost control.
Throughout the flight, the autothrottle that controls the engine thrust was engaged and the engines remained at maximum takeoff thrust.
That’s because the failure of the left Angle of Attack (AOA) sensor, which is what triggered MCAS to activate, also affected the altitude reading on that side, sending the flight control computer a reading lower than the true altitude. On that flight, the computer was using only the left-side sensors to control the systems, including the autothrottle.
Once the plane passed above a certain altitude, the flight control computer should have switched the autothrottle mode to allow the pilots to select a lower thrust setting. According to the report, that altitude was reached around 1 minute and 28 seconds after takeoff, as computed from the correct altitude reading from the instruments on the right side of the jet.
However, taking input only from the erroneous left-hand-side sensors, the MAX’s flight computer “did not detect the thrust reduction altitude when it was sending valid engine commands” and so the autothrottle remained at the maximum takeoff thrust setting.
At that point, the pilots could have, and should have, reduced the thrust manually, said aviation safety consultant John Cox. Yet perhaps overwhelmed by the cacophony of cockpit warnings, he said, they didn’t react to the jet’s rapid acceleration and didn’t throttle back.
The report also notes that all the additional flight deck warnings that were going off during the emergency, which must have confused and distracted the pilots, “were not simulated and were not documented” in Boeing’s system safety assessment of MCAS, the document it used to obtain Federal Aviation Administration certification of the system.
The investigation was conducted by the Ethiopian authorities with the participation of the U.S. National Transportation Safety Board (NTSB). Boeing was a party to the investigation through the NTSB.
The report characterizes Ethiopian Airlines pilot training as following “a well-organized and logically sequenced integrated syllabus for the ground and flight training.”
However, it concludes that the “difference training” provided by Boeing for pilots moving from the earlier model 737 to the MAX, consisting of a course on a computer lasting a couple of hours, “was found to be inadequate.”
Boeing said Monday in a statement that “we look forward to reviewing the full details and formal recommendations that will be included in the final report from the Ethiopian Accident Investigation Bureau.”
The report includes Boeing’s standard defense of its design: that it assumed a failure of MCAS causing uncommanded movement of the horizontal tail would prompt a pilot to immediately counter that movement and cut off the system, and that this action “should not require exceptional piloting skill or strength.”
The report notes that these assumptions on pilot reaction “are used across all Boeing models when performing functional hazard assessments of flight control systems.”
Boeing has said that, following the crashes, those assumptions will be changed.
The opinions expressed in reader comments are those of the author only and do not reflect the opinions of The Seattle Times.