Circumstances:
On March 10, 2019, at 05:38 UTC, Ethiopian Airlines flight 302, Boeing 737-8(MAX), ET-AVJ, took off from Addis Ababa Bole International Airport bound to Nairobi, Kenya Jomo Kenyatta International Airport. ET302 was being operated under the provisions of the Ethiopian Civil Aviation Regulations (ECARAS) as a scheduled international flight between Addis Ababa Bole International Airport (HAAB), Ethiopia and Jomo Kenyatta Int. (HKJK) Nairobi, Kenya. It departed Addis Ababa with 157 persons on board: 2 flight crew (a Captain and a First Officer), 5 cabin crew and one IFSO, 149 regular passengers. At 05:36:12 the Airplane lined up on runway 07R at field elevation of 7,656 ft with flap setting of 5 degrees and a stabilizer trim setting of 5.6 units. Both flight directors (F/D) were ON with LNAV and VNAV modes armed. At 05:37:17the F/O reported to Tower ready for takeoff and at 05:37:36ATC issued take off clearance to ET-302 and advised to contact radar on 119.7MHz. The takeoff roll and lift-off was normal, including normal values of left and right angle-of-attack (AOA). During takeoff roll, the engines stabilized at about 94% N1. Shortly after liftoff, the left Angle of Attack sensor recorded value became erroneous and the left stick shaker activated and remained active until near the end of the recording. In addition, the airspeed and altitude values from the left air data system began deviating from the corresponding right side values. The left and right recorded AOA values began deviating. Left AOA decreased to 11.1° then increased to 35.7° while the right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a Maximum value of 15.3°, the difference between LH and RH AOA was59°and near the end of the recording it was 490. At 05:39:30, the radar controller identified ET-302 and advised to climb FL 340 and when able to turn right direct to RUDOL. At 5:39:51, the selected heading increased from 072° to 197°. After the flaps were fully retractedthe1stautomatic nose-down trim activated and engaged for 9 seconds positioning the stabilizer trim to 2.1 units. The pilot flying pulled to pitch up the Airplane with a force more than 90lbs. He then applied electric trim-up inputs. Five seconds after the end of these inputs a second automatic nose-down trim activated. At 5:40:22, the second automatic nose-down trim activated. Following nose-down trim activation GPWS DON’T SINK sounded for 3 seconds and “PULL UP” also displayed on PFD for 3 seconds. At 05:40:43, approximately five seconds after the end of the crew manual electrical trim up inputs, a third automatic trim nose-down was recorded but with no associated movement of the stabilizer. At 05:40:50, the captain told the F/O: “advise we would like to maintain one four thousand. We have a flight control problem”. The F/O complied and the request was approved by ATC. Following the approval of the ATC, the new target altitude of 14,000ft was set on the MCP. The Captain was unable to maintain the flight path and requested to return back to the departure airport. At 05:43:21, approximately five seconds after the last main electric trim up input, an automatic nose-down trim activated for about 5s. The stabilizer moved from 2.3 to 1 unit. The rate of climb decreased followed by a descent in 3s after the automatic trim activation. One second before the end of the automatic trim activation, the average force applied by the crew decreased from 100 lbs to 78 lbs in 3.5 seconds. In these 3.5 seconds, the pitch angle dropped from 0.5° nose up to -7.8° nose down and the descent rate increased from -100 ft/min to more than -5,000 ft/min. Following the last automatic trim activation and despite calculated column force of up to 110lbs, the pitch continued decreasing. The descent rate and the airspeed continued increasing between the triggering of the 4th automatic trim activation and the last recorded parameter value. At the end of the flight, Computed airspeed values reached 500Kt, Pitch values were greater than 40° nose down and descent rate values were greater than 33,000 ft/min. Finally, both recorders stopped recording at around 05 h 43 min 44s. At 05:44 The Airplane impacted terrain 28 NM South East of Addis Ababa near Ejere (located 8.8770 N, 39.2516 E.) village at a farm field and created a crater approximately 10 meters deep (last Airplane part found) with a hole of about 28 meters width and 40 meters length. Most of the wreckage was found buried in the ground; small fragments of the Airplane were found scattered around the site in an area by about 200 meters width and 300 meters long. The damages to the Airplane were consistent with a high energy impact. All 157 persons on board: 2 flight crew (a Captain and a First Officer), 5 cabin crew and one IFSO, 149 regular passengers were fatally injured.
Probable cause:
Repetitive and uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA input, and its unrecoverable activation system which made the airplane dive with the rate of -33,000 feet per minute close to the ground was the most probable cause of the accident.
The following contributing factors were identified:
1. The MCAS design relied on a single AOA sensor, making it vulnerable to erroneous input from the sensor;
2. During the design process, Boeing failed to consider the potential for uncommanded activation of MCAS, but assumed that pilots would recognize and address it through normal use of the control column, manual electric trim, and the existing Runaway Stabilizer NNC. The OMB and Emergency AD issued after the Lion Air accident included additional guidance but did not have the intended effect of preventing another MCAS-related accident;
3. While Boeing considered the possibility of uncommanded MCAS activation as part of its FHA, it did not evaluate all the potential alerts and indications that could accompany a failure leading to an uncommanded MCAS;
4. The MCAS contribution to cumulative AOA effects was not assessed;
5. The combined effect of alerts and indications that impacted pilot’s recognition and procedure prioritization were not evaluated by the Manufacturer;
6. Absence of AOA DISAGREE warning flag on the flight display panels (PFD);
7. The B737 MAX Crew difference CBT training prepared by Boeing and delivered to Pilots did not cover the MCAS system;
8. Failure by the manufacturer to design simulator training for pilots with regards to safety critical systems like MCAS with catastrophic consequences during undesired activation.
9. The manufacturer failed to provide procedures regarding MCAS operation to the crew during training or in the FCOM;
10. Failure by the manufacturer to address the safety critical questions raised by the airline which would have cleared out crew confusion and task prioritization;
