Ethiopian pilots fought the 737 MAX flight controls almost from takeoff, preliminary report shows

SEATTLE -- The preliminary investigation into the crash of Ethiopian Airlines Flight 302 last month revealed Thursday that pilots began fighting the Boeing 737 MAX’s new automatic flight-control system barely a minute after leaving the ground, after a sensor failed shortly after takeoff.

Boeing Chief Executive Dennis Muilenburg reacted with a statement from the Renton 737 factory expressing "the immense gravity of these events across our company," and acknowledging the role the new Maneuvering Characteristics Augmentation System, or MCAS, played in the crash.

"As pilots have told us, erroneous activation of the MCAS function can add to what is already a high-workload environment. It's our responsibility to eliminate this risk," Muilenburg said. "We own it and we know how to do it."

The "black box" flight-recorder data shows that after MCAS swiveled the plane's horizontal tail to push the nose sharply down three times in succession, the pilots hit the cut-off switches stopping the automatic action and tried to adjust the tail manually, according to the report by the Accident Investigation Bureau of Ethiopia's Transport Ministry.

In doing so, they were following instructions provided by Boeing last November, following the crash of Lion Air Flight 610, on how to deal with such an inadvertent triggering of the new flight-control system.

Ahead of the release of the full report, Ethiopian Transport Minister Dagmawit Moges held a news conference in the capital, Addis Ababa, that was almost entirely focused on vindicating the actions of the pilots. "The crew performed all the procedures repeatedly provided by the manufacturer but was not able to control the aircraft," she said.

The report says that while trying to follow Boeing's directions, about three minutes into the flight, the two pilots found that the manual system for moving the horizontal tail -- also known as the stabilizer -- "was not working." This meant they couldn't move the large stabilizer wheel in the cockpit that is connected via cables to the tail.

Flight-control experts told The Seattle Times this week that was probably because the forces on the tail of the plane moving at high speed -- at that point, the airspeed was higher than the jet’s maximum operating speed limit -- made it next to physically impossible to move the stabilizer wheel as Boeing had recommended.

A nose dive to the ground

From the flight's first moments, the false sensor signal had activated the "stick shaker," vibrating the control column as a stall warning, and giving the pilot alerts that their airspeed, altitude and pitch readings were unreliable. And as the flight lost altitude, an audible warning sounded that the plane was too close to the ground: "Don't sink!"

Struggling to climb throughout, the jet never rose higher than about 7,000 feet above the ground.

About four minutes into the flight, the pilots gave up on the manual stabilizer wheel and switched the electric power to the tail back on, then used the thumb switches on the control column to pitch the nose back up.

Bjorn Fehrm, a pilot and an analyst with Leeham.net, said he understood this as a last-ditch desperate attempt to gain control.

"These guys were heading down. They couldn't move the stabilizer trim wheel. What do you do?," he said. The answer was to try the electric switches again, even though that re-activated the MCAS.

Five seconds later, the MCAS kicked in again and once more pushed the nose sharply down without pilot response.

With that, six minutes after takeoff, the data shows the plane dived and rolled over before plowing into the Earth in a "high-energy impact," at a speed of about 575 mph.

In November, Boeing had outlined what to do if a sensor failed and triggered MCAS: a few steps that concluded with hitting a pair of cutoff switches to turn off the electrical motor that moves the stabilizer, and then moving the stabilizer manually by turning a wheel in the cockpit.

So why did the Ethiopian jet crash, despite the pilots having those instructions?

Fehrm said it's because they were unaware that at high speed, the manual stabilizer wheel they were instructed to use could seize up and become immovable, a key piece of information he said Boeing and the FAA should have stressed in their bulletins to pilots around the world in November.

Former Boeing flight-controls engineer Peter Lemme also points to a design change that greatly reduced the pilots' options.

In previous models of the 737, the two cutoff switches for the stabilizer had different functions and it was possible to flip one that turned off automatic, noncommanded movement while not flipping the other, which would allow the pilot to continue to move the stabilizer with the thumb switches.

But on the MAX, the two cutoff switches have the same function; one is simply a backup to the other. These switches now cut all power to the motor that moves the stabilizer. So they cut off not only automatic movements not commanded by the pilot, including MCAS, but also the ability of the pilot to move the tail electrically.

That left the pilots with nothing but the manual stabilizer wheel that wouldn't budge.

Troublingly unreliable sensors

Beyond possible design flaws, another big question to be answered concerns the failure of the sensor that inadvertently activated the system, the triggering event in both the Lion Air and Ethiopian crashes.

There are two such "angle-of-attack" sensors, one either side of the aircraft, that measure the angle between the wing and the airflow. Only one is used to trigger MCAS on any given flight, alternating to the other sensor on subsequent flights.

The data shows that the failure occurred on Flight 302 quite different from the way it occurred on the Lion Air flight. In the earlier case, the two sensors were about 20 degrees divergent throughout the flight and even on the ground while taxiing for takeoff, but otherwise moved up and down in sync.

On the Ethiopian flight, both sensors showed normal readings on the ground during the takeoff roll. But just 44 seconds after leaving the ground, the left angle-of-attack sensor deviated from the right and in less than a minute, the two were wildly divergent by as much as 60 degrees.

Lemme said it's possible a bird may have hit the left sensor and that the Lion Air failure must have had a completely different cause.

Two failed sensors at Lion Air, both on the accident flight and on a previous flight, followed by the failure of another just over four months later on the Ethiopian jet, is troubling.

Lawrence Sciortino, a West Seattle-based retired pilot with 35 years' experience flying for Eastern and United airlines in both Boeing and Airbus jets, said that angle-of-attack sensors are historically extremely reliable, and this failure rate seems much higher than normal.

"In my career, I don't remember ever having a single angle-of-attack probe send an erroneous signal," he said. "After all, it's a simple device. Why are we having so many failures?"

Lemme said he's seen data that pegged the reliability of the angle-of-attack vanes on a 747 jumbo jet at 93,000 flight hours.

"That's like the lifetime of an airplane before it fails," said Lemme. "The investigators will have to look at the manufacturer, at the repair facilities and at the installation of these vanes."

The angle-of-attack vanes are manufactured by Rosemount Aerospace of Minnesota, a subsidiary of United Technologies. According to a Bloomberg report, the Lion Air crash plane had its angle-of-attack sensor repaired before the accident at XTRA Aerospace in Miramar, Florida.

In a Facebook post, Greg Feith, former senior air-safety investigator with the National Transportation Safety Board (NTSB), said "the primary question is what caused the fault with the angle of attack immediately after liftoff."

Software fix in the works

It's up to Boeing to find answers to the questions raised by the crashes about both the reliability of the sensor equipment and the design of the MCAS flight controls.

Meanwhile, Ethiopian Airlines is upholding the competence of the Flight 302 pilots, saying in a statement Thursday that they "followed the Boeing-recommended and FAA-approved emergency procedures to handle the most difficult emergency situation created on the airplane.

"Despite their hard work and full compliance with the emergency procedures ... they could not recover the airplane from the persistence of nose diving," the statement added.

Retired Boeing director Bob Bogash, a veteran of the local aviation scene, wrote in a note to peers Thursday that though Americans "are so fond of bad-mouthing foreign air carriers, foreign pilots, foreign maintenance, etc as the cause of our accidents ... we do like their money."

Both the Lion Air and Ethiopian crews "were totally tuned in to the latest and greatest about the MAX and the MCAS system. Didn't help them," he wrote. "Hitting the Stab Trim Cutout switches didn't save them. Using the Manual Trim Wheel didn't save them."

His assessment is that the pilots on both flights "acted calmly and professionally."

Boeing CEO Muilenburg said while the Ethiopian and Lion Air tragedies "continue to weigh heavily on our hearts and minds," Boeing remains "confident in the fundamental safety of the 737 MAX."

The imminent software update, he said "will eliminate the possibility of unintended MCAS activation and prevent an MCAS-related accident from ever happening again."

With that, Muilenburg seemed to accept responsibility for the accidents while still looking toward a future for the MAX.

“When the MAX returns to the skies with the software changes to the MCAS function, it will be among the safest airplanes ever to fly,” he said.