Country
Crash of a Boeing 737 MAX 8 near Debre Zeit: 157 killed
Date & Time:
Mar 10, 2019 at 0844 LT
Operator:
Registration:
ET-AVJ
Survivors:
No
Schedule:
Addis Ababa – Nairobi
MSN:
62450/7243
YOM:
2018
Flight number:
ET302
Crew on board:
8
Crew fatalities:
Pax on board:
149
Pax fatalities:
Other fatalities:
Total fatalities:
157
Captain / Total hours on type:
1417.00
Copilot / Total hours on type:
207
Aircraft flight hours:
1330
Aircraft flight cycles:
382
Circumstances:
On March 10, 2019, at 05:38 UTC, Ethiopian Airlines flight 302, Boeing 737-8(MAX), ET-AVJ, took off from Addis Ababa Bole International Airport bound to Nairobi, Kenya Jomo Kenyatta International Airport. ET302 was being operated under the provisions of the Ethiopian Civil Aviation Regulations (ECARAS) as a scheduled international flight between Addis Ababa Bole International Airport (HAAB), Ethiopia and Jomo Kenyatta Int. (HKJK) Nairobi, Kenya. It departed Addis Ababa with 157 persons on board: 2 flight crew (a Captain and a First Officer), 5 cabin crew and one IFSO, 149 regular passengers. At 05:36:12 the Airplane lined up on runway 07R at field elevation of 7,656 ft with flap setting of 5 degrees and a stabilizer trim setting of 5.6 units. Both flight directors (F/D) were ON with LNAV and VNAV modes armed. At 05:37:17the F/O reported to Tower ready for takeoff and at 05:37:36ATC issued take off clearance to ET-302 and advised to contact radar on 119.7MHz. The takeoff roll and lift-off was normal, including normal values of left and right angle-of-attack (AOA). During takeoff roll, the engines stabilized at about 94% N1. Shortly after liftoff, the left Angle of Attack sensor recorded value became erroneous and the left stick shaker activated and remained active until near the end of the recording. In addition, the airspeed and altitude values from the left air data system began deviating from the corresponding right side values. The left and right recorded AOA values began deviating. Left AOA decreased to 11.1° then increased to 35.7° while the right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a Maximum value of 15.3°, the difference between LH and RH AOA was59°and near the end of the recording it was 490. At 05:39:30, the radar controller identified ET-302 and advised to climb FL 340 and when able to turn right direct to RUDOL. At 5:39:51, the selected heading increased from 072° to 197°. After the flaps were fully retractedthe1stautomatic nose-down trim activated and engaged for 9 seconds positioning the stabilizer trim to 2.1 units. The pilot flying pulled to pitch up the Airplane with a force more than 90lbs. He then applied electric trim-up inputs. Five seconds after the end of these inputs a second automatic nose-down trim activated. At 5:40:22, the second automatic nose-down trim activated. Following nose-down trim activation GPWS DON’T SINK sounded for 3 seconds and “PULL UP” also displayed on PFD for 3 seconds. At 05:40:43, approximately five seconds after the end of the crew manual electrical trim up inputs, a third automatic trim nose-down was recorded but with no associated movement of the stabilizer. At 05:40:50, the captain told the F/O: “advise we would like to maintain one four thousand. We have a flight control problem”. The F/O complied and the request was approved by ATC. Following the approval of the ATC, the new target altitude of 14,000ft was set on the MCP. The Captain was unable to maintain the flight path and requested to return back to the departure airport. At 05:43:21, approximately five seconds after the last main electric trim up input, an automatic nose-down trim activated for about 5s. The stabilizer moved from 2.3 to 1 unit. The rate of climb decreased followed by a descent in 3s after the automatic trim activation. One second before the end of the automatic trim activation, the average force applied by the crew decreased from 100 lbs to 78 lbs in 3.5 seconds. In these 3.5 seconds, the pitch angle dropped from 0.5° nose up to -7.8° nose down and the descent rate increased from -100 ft/min to more than -5,000 ft/min. Following the last automatic trim activation and despite calculated column force of up to 110lbs, the pitch continued decreasing. The descent rate and the airspeed continued increasing between the triggering of the 4th automatic trim activation and the last recorded parameter value. At the end of the flight, Computed airspeed values reached 500Kt, Pitch values were greater than 40° nose down and descent rate values were greater than 33,000 ft/min. Finally, both recorders stopped recording at around 05 h 43 min 44s. At 05:44 The Airplane impacted terrain 28 NM South East of Addis Ababa near Ejere (located 8.8770 N, 39.2516 E.) village at a farm field and created a crater approximately 10 meters deep (last Airplane part found) with a hole of about 28 meters width and 40 meters length. Most of the wreckage was found buried in the ground; small fragments of the Airplane were found scattered around the site in an area by about 200 meters width and 300 meters long. The damages to the Airplane were consistent with a high energy impact. All 157 persons on board: 2 flight crew (a Captain and a First Officer), 5 cabin crew and one IFSO, 149 regular passengers were fatally injured.
Probable cause:
Repetitive and uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA input, and its unrecoverable activation system which made the airplane dive with the rate of -33,000 feet per minute close to the ground was the most probable cause of the accident.
The following contributing factors were identified:
1. The MCAS design relied on a single AOA sensor, making it vulnerable to erroneous input from the sensor;
2. During the design process, Boeing failed to consider the potential for uncommanded activation of MCAS, but assumed that pilots would recognize and address it through normal use of the control column, manual electric trim, and the existing Runaway Stabilizer NNC. The OMB and Emergency AD issued after the Lion Air accident included additional guidance but did not have the intended effect of preventing another MCAS-related accident;
3. While Boeing considered the possibility of uncommanded MCAS activation as part of its FHA, it did not evaluate all the potential alerts and indications that could accompany a failure leading to an uncommanded MCAS;
4. The MCAS contribution to cumulative AOA effects was not assessed;
5. The combined effect of alerts and indications that impacted pilot’s recognition and procedure prioritization were not evaluated by the Manufacturer;
6. Absence of AOA DISAGREE warning flag on the flight display panels (PFD);
7. The B737 MAX Crew difference CBT training prepared by Boeing and delivered to Pilots did not cover the MCAS system;
8. Failure by the manufacturer to design simulator training for pilots with regards to safety critical systems like MCAS with catastrophic consequences during undesired activation.
9. The manufacturer failed to provide procedures regarding MCAS operation to the crew during training or in the FCOM;
10. Failure by the manufacturer to address the safety critical questions raised by the airline which would have cleared out crew confusion and task prioritization;
The following contributing factors were identified:
1. The MCAS design relied on a single AOA sensor, making it vulnerable to erroneous input from the sensor;
2. During the design process, Boeing failed to consider the potential for uncommanded activation of MCAS, but assumed that pilots would recognize and address it through normal use of the control column, manual electric trim, and the existing Runaway Stabilizer NNC. The OMB and Emergency AD issued after the Lion Air accident included additional guidance but did not have the intended effect of preventing another MCAS-related accident;
3. While Boeing considered the possibility of uncommanded MCAS activation as part of its FHA, it did not evaluate all the potential alerts and indications that could accompany a failure leading to an uncommanded MCAS;
4. The MCAS contribution to cumulative AOA effects was not assessed;
5. The combined effect of alerts and indications that impacted pilot’s recognition and procedure prioritization were not evaluated by the Manufacturer;
6. Absence of AOA DISAGREE warning flag on the flight display panels (PFD);
7. The B737 MAX Crew difference CBT training prepared by Boeing and delivered to Pilots did not cover the MCAS system;
8. Failure by the manufacturer to design simulator training for pilots with regards to safety critical systems like MCAS with catastrophic consequences during undesired activation.
9. The manufacturer failed to provide procedures regarding MCAS operation to the crew during training or in the FCOM;
10. Failure by the manufacturer to address the safety critical questions raised by the airline which would have cleared out crew confusion and task prioritization;
Final Report:
Crash of a Boeing 737 MAX 8 off Jakarta: 189 killed
Date & Time:
Oct 29, 2018 at 0631 LT
Operator:
Registration:
PK-LQP
Survivors:
No
Schedule:
Jakarta - Pangkal Pinang
MSN:
43000
YOM:
2018
Flight number:
JT610
Crew on board:
8
Crew fatalities:
Pax on board:
181
Pax fatalities:
Other fatalities:
Total fatalities:
189
Captain / Total hours on type:
5176.00
Copilot / Total hours on type:
4286
Aircraft flight hours:
895
Aircraft flight cycles:
443
Circumstances:
The aircraft departed runway 25L at Jakarta-Soekarno-Hatta Airport at 0621LT bound for Pangkal Pinang, carrying 181 passengers and 8 crew members. The crew was cleared to climb but apparently encountered technical problems and was unable to reach a higher altitude than 5,375 feet. At this time, the flight shows erratic speed and altitude values. The pilot declared an emergency and elected to return to Jakarta when control was lost while at an altitude of 3,650 feet and at a speed of 345 knots. The airplane entered a dive and crashed 12 minutes after takeoff into the Kerawang Sea, about 63 km northeast from its departure point. The airplane disintegrated on impact and few debris were already recovered but unfortunately no survivors. It has been reported that the aircraft suffered various technical issues during the previous flight on Sunday night but was released for service on Monday morning. Brand new, the airplane was delivered to Lion Air last August 18. At the time of the accident, weather conditions were considered as good. The Cockpit Voice Recorder (CVR) was found on 14 January 2019. In the initial stages of the investigation, it was found that there is a potential for repeated automatic nose down trim commands of the horizontal stabilizer when the flight control system on a Boeing 737 MAX aircraft receives an erroneously high single AOA sensor input. Such a specific condition could among others potentially result in the stick shaker activating on the affected side and IAS, ALT and/or AOA DISAGREE alerts. The logic behind the automatic nose down trim lies in the aircraft's MCAS (Maneuvering Characteristics Augmentation System) that was introduced by Boeing on the MAX series aircraft. This feature was added to prevent the aircraft from entering a stall under specific conditions. On November 6, 2018, Boeing issued an Operations Manual Bulletin (OMB) directing operators to existing flight crew procedures to address circumstances where there is erroneous input from an AOA sensor. On November 7, the FAA issued an emergency Airworthiness Directive requiring "revising certificate limitations and operating procedures of the airplane flight manual (AFM) to provide the flight crew with runaway horizontal stabilizer trim procedures to follow under certain conditions.
Probable cause:
Contributing factors defines as actions, omissions, events, conditions, or a combination thereof, which, if eliminated, avoided or absent, would have reduced the probability of the accident or incident occurring, or mitigated the severity of the
consequences of the accident or incident. The presentation is based on chronological order and not to show the degree of contribution.
1. During the design and certification of the Boeing 737-8 (MAX), assumptions were made about flight crew response to malfunctions which, even though consistent with current industry guidelines, turned out to be incorrect.
2. Based on the incorrect assumptions about flight crew response and an incomplete review of associated multiple flight deck effects, MCAS’s reliance on a single sensor was deemed appropriate and met all certification requirements.
3. MCAS was designed to rely on a single AOA sensor, making it vulnerable to erroneous input from that sensor.
4. The absence of guidance on MCAS or more detailed use of trim in the flight manuals and in flight crew training, made it more difficult for flight crews to properly respond to uncommanded MCAS.
5. The AOA DISAGREE alert was not correctly enabled during Boeing 737-8 (MAX) development. As a result, it did not appear during flight with the mis-calibrated AOA sensor, could not be documented by the flight crew and was therefore not available to help maintenance identify the mis-calibrated AOA sensor.
6. The replacement AOA sensor that was installed on the accident aircraft had been mis-calibrated during an earlier repair. This mis-calibration was not detected during the repair.
7. The investigation could not determine that the installation test of the AOA sensor was performed properly. The mis-calibration was not detected.
8. Lack of documentation in the aircraft flight and maintenance log about the continuous stick shaker and use of the Runaway Stabilizer NNC meant that information was not available to the maintenance crew in Jakarta nor was it available to the accident crew, making it more difficult for each to take the appropriate actions.
9. The multiple alerts, repetitive MCAS activations, and distractions related to numerous ATC communications were not able to be effectively managed. This was caused by the difficulty of the situation and performance in manual handling, NNC execution, and flight crew communication, leading to ineffective CRM application and workload management. These performances had previously been identified during training and reappeared during the accident flight.
consequences of the accident or incident. The presentation is based on chronological order and not to show the degree of contribution.
1. During the design and certification of the Boeing 737-8 (MAX), assumptions were made about flight crew response to malfunctions which, even though consistent with current industry guidelines, turned out to be incorrect.
2. Based on the incorrect assumptions about flight crew response and an incomplete review of associated multiple flight deck effects, MCAS’s reliance on a single sensor was deemed appropriate and met all certification requirements.
3. MCAS was designed to rely on a single AOA sensor, making it vulnerable to erroneous input from that sensor.
4. The absence of guidance on MCAS or more detailed use of trim in the flight manuals and in flight crew training, made it more difficult for flight crews to properly respond to uncommanded MCAS.
5. The AOA DISAGREE alert was not correctly enabled during Boeing 737-8 (MAX) development. As a result, it did not appear during flight with the mis-calibrated AOA sensor, could not be documented by the flight crew and was therefore not available to help maintenance identify the mis-calibrated AOA sensor.
6. The replacement AOA sensor that was installed on the accident aircraft had been mis-calibrated during an earlier repair. This mis-calibration was not detected during the repair.
7. The investigation could not determine that the installation test of the AOA sensor was performed properly. The mis-calibration was not detected.
8. Lack of documentation in the aircraft flight and maintenance log about the continuous stick shaker and use of the Runaway Stabilizer NNC meant that information was not available to the maintenance crew in Jakarta nor was it available to the accident crew, making it more difficult for each to take the appropriate actions.
9. The multiple alerts, repetitive MCAS activations, and distractions related to numerous ATC communications were not able to be effectively managed. This was caused by the difficulty of the situation and performance in manual handling, NNC execution, and flight crew communication, leading to ineffective CRM application and workload management. These performances had previously been identified during training and reappeared during the accident flight.
Final Report:
