ET302 Interim Report Fingers MAX Flight-Control System, Offers No Analysis

The Ethiopian Transport Ministry’s interim report on the crash of Ethiopian Airlines Flight 302 (ET302) focuses on the role played by a now-redesigned 737 MAX flight control law implicated in an earlier MAX accident as well as inadequate pilot training.

Released Mar. 9, a day before the one-year anniversary of the ET302 accident, the 136-page report contains no analysis. “The analysis is in progress and will be included in the final report,” it said.

Six recommendations highlight problems already identified in other probes, including the final report on the first fatal MAX accident, the October 2018 crash of Lion Air Flight 610 (JT610), and work done by the U.S. NTSB and several committees.

The ministry’s report recounts the failings in the MAX’s design, particularly its maneuvering characteristics augmentation system (MCAS) flight-control software that provides nose-down horizontal stabilizer input in certain flight profiles. In both MAX accidents, MCAS was activated by faulty angle-of-attack (AOA) data, triggering a series of nose-down inputs that confused and ultimately overwhelmed the crews. 

Designed to be transparent to pilots, the system was not included in MAX training or flight manuals, so pilots had no idea it existed. Boeing assumed an MCAS-related failure would be recognized as runaway stabilizer—a scenario that it believed any pilot could manage in seconds. The function’s supposed transparency and familiar failure modes led Boeing to conclude that pilots did not need special training or information about it.

“The difference training from B737NG to B737 MAX provided by the manufacturer was found to be inadequate,” one of the report’s findings said.

The MCAS’s existence became widely known following the JT610 accident. Boeing and the FAA combined to issue an emergency airworthiness directive in early November 2018 that explained the system’s function and failure modes. Boeing followed up with an airline operators’ message that reference the MCAS specifically, introducing it to most pilots for the first time.

While the first accident was enough to prompt Boeing to start work on changing the MCAS logic, the system was not thrust into the spotlight until after the ET302 accident and subsequent MAX grounding. The FAA directive and Boeing message are two key differences between the JT610 and ET302 accidents—the Lion Air crew had no idea the MCAS existed, but the ET302 crew apparently did. The ministry’s report confirmed that the airline revised MAX flight manuals on the day the directive was released. The report does not provide details on whether Ethiopian’s crews were given any additional information on the MCAS. 

The ET302 crew’s reactions to the MCAS activation included using electric trim switch inputs to counter the nose-down movements and pulling back on their control yokes. But they did not counter all of the nose-down input, and the faulty AOA data continued to trigger the MCAS. After two MCAS activations, the crew toggled stabilizer-trim cutout switches, which interrupted the MCAS, but also left pilots with only the hand-operated trim wheel to move the stabilizer. 

Aerodynamic forces created during a runaway stabilizer condition can render the trim wheel nearly impossible to move. If one pilot is pulling back on the yoke—a natural reaction to counter-act uncommanded nose-down inputs—the force on the elevator, part of the horizontal stabilizer, increases. This makes the stabilizer harder to move. Add in an airspeed increase that a nose-down attitude introduces, and the situation becomes more difficult. This is what the ET302 crew faced. 

When the crew attempted to manually adjust the stabilizers, the mis-trim was 2.5 deg., the report said. The aircraft’s airspeed—its thrust levers set at 94% N1 takeoff thrust and never adjusted—was 340 kt.

“By the time the [first officer] tried to move the trim wheel manually, a force between 42-53 lb. was required according to the aircraft manufacturer computation,” the report said. Investigators determined that the ET302 crew would have needed 40 turns of the wheel to correct the 2.5 deg. of mis-trim. Simulator trials done as part of the probe found that difficulty in turning the wheel increased as airspeed and amount of mis-trim increased. Investigators concluded the trim wheel was “not movable” at airspeeds higher than 220 kt. and mis-trim values of 2.5 deg. or more, the report said.

Unable to crank the trim wheel, the ET302 crew toggled the stabilizer motor back on, which enabled the MCAS—still acting on faulty AOA data—to activate again. The ET302 was able to climb but could not counter the MCAS’s nose-down inputs, leading to a final, fatal dive.

The ministry’s report makes clear that faulty AOA data started the fatal accident sequence because the MAX’s flight control computer software detected, erroneously, that the aircraft’s nose was too high. That activated the MCAS and the series of nose-down stabilizer movements. The failed JT610 AOA sensor was caused by improper calibration by a supplier. The Ethiopian report does not shed light on why ET302’s vane failed, nor does it mention the part as being among the wreckage recovered. The report offers no insight into flight-crew actions not directly related to managing the MCAS activations.

ET302’s accident and the quick link to an MCAS activation led to the MAX fleet’s global grounding—which is still in place—while Boeing addresses several issues, including revisions to the MCAS logic. Recommendations made by the ministry’s report, including adding a second AOA data feed to the system, ensuring that an alert detailing AOA data variations is active on all MAXs, and adding simulator sessions for all MAX pilots, are either in the works or have been urged by Boeing.

Boeing’s changes to the MAX also will include training modules that focus on manual trim wheel scenarios.