Accident timeline of Ethiopian 302
On the morning of March 10, 2019, at about 08:44 local time, Ethiopian Airlines Flight 302 (ET302), a Boeing 737–8 (MAX), crashed near Bishoftu, Ethiopia, shortly after takeoff from Addis Ababa Bole International Airport, Ethiopia. The flight was a regularly scheduled international passenger flight from Addis Ababa to Jomo Kenyatta International Airport, Nairobi, Kenya. There were 157 passengers and crew on board. Everyone died, and the aircraft was destroyed.
I know the land well where ET302’s charred bore scars the earth. I lived in Ethiopia in the mid-1980s and flew daily at low altitudes across its terrain. This familiarity is in part why I find the ET302 pilots’ struggle so visceral, knowing specifically what filled their cockpit’s field of vision as the nose-down 737 encroached the speed of sound. But the crucial aspect of ET302’s fate for me is technical: As an experienced airline captain who has been a long-time advocate for The Boeing Company’s engineering ethos and its historical regard for human factors and pilot judgment, I have studied the Ethiopian Airlines report on this accident and I’ve been shaken by what the report reveals.
Although the official black box data and transcript have yet to be released — and which will no doubt broaden our knowledge — there are irrefutable facts that we already have. This paper provides readers with a time-line understanding of these facts and their implications for the design of human-centered artificial intelligence and engineering systems.
Captain Yared Getachew was the pilot-in-command of Ethiopian Airlines Flight 302 on that fateful morning. Ahmednur Mohammed was his fully licensed and qualified co-pilot. Captain Getachew was well experienced with more than 8,000 hours of total flight time and his training included recent recurrent simulator time in an advanced 737 simulator located in Miami, Florida. (There are not that many advanced, full-motion 737 simulators in the world, particularly for Boeing’s latest models.) All aspects of his licensing and training records were unremarkable except for the glowing praise given by arm’s-length training captains and check pilots. Ethiopian Airlines is a respected world airline with a good safety record and Captain Getachew was an esteemed captain with a bright future.
The two pilots received takeoff clearance from Addis control tower and at about 8:38 a.m., they started their takeoff roll on runway 07R. Addis Ababa Bole airport is located at 7,625 feet — well more than a mile above sea level. This high altitude, combined with Ethiopia’s equatorial temperatures, imposes a natural performance penalty on all aircraft operations, causing a loss of engine thrust while also requiring aircraft to achieve faster ground speeds on takeoff. This morning the air was only 75 percent as dense as air at sea level. For those who are familiar with aviation terminology, the “density altitude” was 9,251 feet.
Many airline captains can go through their entire careers and never once take off at a density altitude of more than 9,000 feet. Captain Getachew did it routinely.
An airline takeoff at heavy gross weight is a high-drama event. Because of the high altitude, ET302 on March 10 was operating close to the upper limits of the aircraft’s performance. They were carrying close to a full load of people, lots of baggage, a considerable amount of cargo, and a good bit of fuel for the two-hour, 721 statute-mile flight to Nairobi. It is important to remember this when analyzing Captain Getachew’s actions during this flight. He would have been acutely aware of his aircraft’s heavy weight and the proximity to all the various aircraft-performance limits: Maximum takeoff weight, maximum tire rotation speed, and so on.
Before the takeoff, a series of calculations are made to determine a critical speed called “V1.” If any major failure or warning occurs at or below the V1 speed, the aircraft can be safely stopped on the runway. If any such failure or warning occurs at a speed above V1, the flight must continue because there is not enough runway to safely stop the aircraft. Common practice is for the pilot‘s “throttle hand” to remain on the throttles until V1 speed, at which point the pilot puts both hands on the control wheel: This is the human moment of mentally committing to flight.
The flight data recorder for ET302 shows that liftoff occurred about 40 seconds after takeoff was initiated, at about 8:38:40 a.m. local time. According to the Ethiopian government’s preliminary report, just after liftoff, the captain’s angle-of-attack sensor (alpha vane) started indicating a wildly out-of-normal-range angle of 74.5 degrees. The first officer’s alpha vane was reading a normal 15 degrees, which is perfectly normal for takeoff. Pilots don’t see the angle-of-attack readings directly. The alpha vanes give input to various flight data and control systems. A 74.5 degree angle of attack of is so far beyond the normal range (normally 0 to 17 degrees), that its output should have been suspect immediately; but, instead, Boeing’s flight data systems interpreted this sustained and contextually nonsensical output to mean that the aircraft was close to a stall. Four seconds after liftoff, the captain’s stick shaker activates.
A stick shaker (figure 1) is a little electric gadget attached to the control columns of most Boeing commercial aircraft. The stick shaker activates to warn pilots that the aircraft is extremely close to a stall, which means the aircraft is not moving through the air fast enough for the wings to produce the necessary lift required for flight.
Every airline captain in the world would be alarmed at having the stick shaker activate four seconds after takeoff. As an experienced airline pilot, my blood ran cold when I read this in the report. I’ve never had a stick shaker sound continuously outside a simulator. This event would have received Captain Getachew’s full attention. Remember: He is acutely aware of the aircraft’s heavy weight.
What is Captain Getachew thinking at this point? I know what I would have been thinking. As pilots, we depend on other airline employees for all sorts of critical tasks — the refueller, the baggage handlers, the cargo handlers, and many others. Thoughts would be that someone made a mistake with the cargo load and unintentionally overloaded the aircraft as has happened to me a couple of times during my airline career.
The stick shaker does not stop for the remainder of the flight. Some pilots have criticized Captain Getachew for leaving the throttles at takeoff power. When I think about what he was facing, it is quite plausible that I would have left the throttles at takeoff power too. That stick shaker would have been telling me in no uncertain terms, “Something is not right — you must be going too slow for the weight of the aircraft.”
Airline pilots learn to increase thrust when they are in doubt. Under no circumstances could I imagine myself reaching for the throttles and reducing thrust while the stick shaker was doing its thing, particularly not right after takeoff while operating close to the ground.
This morning, as the stick shaker activates, the flight data recorder indicates that the captain’s airspeed and altimeter decrease, deviating significantly from the first officer’s readings for altitude and airspeed. The captain might not have immediately noticed the deviation from his first officer’s instruments, but he would have noticed that his airspeed and altitude dropped. Both of these indications would reinforce the validity of the stick-shaker warning in his mind and would again prompt him to leave his engine power at maximum.
Two seconds after the stick shaker activates, the Master Caution light illuminates with a loud chime now sounding to alert both pilots to this large yellow light located directly at the captain’s eye level, about 12 inches from his face. The first officer calls out “Master Caution Anti-ice,” and he pushes the master caution light to extinguish the light per his training. Of course, this warning makes no sense at all. One or more anti-ice systems isn’t working? The temperature outside is +17 degrees Celsius. Ice is not a factor. This is a contextually ridiculous warning that delivers no useful insights to the pilots, but its occurrence adds considerably to the cockpit disorder at a critical moment.
Already, only 46 seconds from the start of takeoff, there is a lot of chaos and confusion for the captain to manage. He does the smart thing and decides to shed some of his workload: He attempts to engage the autopilot. This is a wise decision; pilots are taught to reduce their own workload when encountering any sort of problem, so they are better enabled to manage bad situations. Manually flying an aircraft is cognitively demanding.
However, when Captain Getachew engages the autopilot, it immediately disengages and the autopilot-disengage aural warning loudly sounds. Two seconds later he attempts again to engage the autopilot. Immediately the autopilot disengages, delivering another loud aural warning. At this point the aircraft is climbing quickly and they are 630 feet above ground.
First Officer Ahmednur has been observing all the unusual sounds and warnings and these distractions have pulled him away from his pilot-not-flying duties. The captain reminds him to contact departure radar and this jostles Ahmednur into action; he switches the radio from tower to departure control frequency and tells departure radar (air traffic control) ET320 is currently climbing through 8,400 feet (above sea level) and on their way to 32,000 feet.
At 1,000 feet above ground it is interesting to note that Captain Getachew has electrically trimmed the horizontal stabilizer more “nose up” by almost a full degree: In small increments he has moved the trim from 4.6 units (degrees) to 5.6 units. The captain has done this using the electric trim thumb switches on his control wheel.
Let’s pause for a moment here to discuss horizontal trim. Almost all aircraft have horizontal trim systems. When pilots wish to climb to a high altitude, they will use back pressure on the control wheel, pulling it toward their body. Climbing to a higher altitude can take a while and it is uncomfortable to maintain a constant back pressure on the control wheel for long periods of time. To solve for this, aircraft are designed with trim systems that allow pilots to relieve any constant pressure they must exert to maintain an airspeed or altitude.
Commercial transport aircraft generally have extremely powerful trim mechanisms that cater not only for relieving control pressures but also for people and cargo being widely and unevenly distributed between the aircraft’s rearmost and frontmost sections. A powerful trim system can accommodate for shifts in center of gravity, when, for example, people move from back to front.
The powerful trim systems of commercial transport aircraft derive from having horizontal stabilizers that move; the entire horizontal surface rotates within a limited range around a pivoting axle that connects both left and right horizontal stabilizers together. The elevators are attached to the trailing edge of the stabilizer and the relatively small surface area of the elevators is what the pilot’s control wheels are attached to. On the Boeing 737 MAX, the horizontal stabilizer is moved electrically by a motor inside the tail of the aircraft. This diagram (figure 2) may help clarify:
Here is an important point about commercial transport aircraft trim systems: Because trim is achieved by moving the entire stabilizer, and because the elevators are much smaller than the entire stabilizer, pilots cannot overcome a badly out-of-trim stabilizer with their control wheels. Stabilizer trim has much more control authority than the elevators.
On the Boeing 737, trim is controlled by two thumb switches on the control wheel. Pull the thumb switches down to trim nose up. Press the switches up to trim nose down. Figure 3 is an image of the thumb switches and other trim controls on the 737 MAX.
Why are there two thumb switches when there is only one electric motor? Because ever since the 1950s, Boeing has used two switches wired in series for their trim systems as a failsafe: If one switch develops a fault, it cannot independently cause the stabilizer trim motor to operate. Both switches must “close” for electric trim to work. Early Boeing engineers understood how important it was to never have an uncommanded trim action.
If the trim’s electric motor ever stops working, there is a way to move the stabilizer on the 737 manually: There are trim wheels on either side of the central console, one for each pilot. These wheels are connected by cable to the trim mechanism. When trim is being moved electrically, these wheels turn, making a distinctive sound. (When a pilot needs to trim manually using these wheels, there is a little fold-out handle inside each wheel that the pilot can access for turning it by hand.)
One last note about the 737 horizontal trim system: Because of the system’s enormous control authority, Boeing installed cutout switches on the center console that allow either pilot to quickly shut down the electric circuit providing power to the trim motor. These switches are part of a drill that 737 pilots often practice in simulator training to deal with an unlikely scenario called “runaway stabilizer”: If the electric trim turns itself on for some reason, pilots are to use these switches to remove power from the electric trim motor. We’ll see later that these cutout switches were used on ET302.
Back in the cockpit with Captain Getachew, the flight data recorder shows that he had been trimming the aircraft nose up, using his electric trim switches. Why? Here is my hypothesis: The nonstop stick shaker and the drop he sees in his airspeed and altitude readings has made him unconsciously increase the back pressure on his control wheel. He wants the safety of altitude and, despite all his stall-avoidance training, he pulls back — then he “trims out” the back pressure. (Pilots are trained to trim out any constant back or forward pressure they must use on the control wheel.) With the stick shaker shaking the control wheel, Getachew’s ability to feel for correct trim may be hampered; nevertheless, he trims nose up in small increments during the early stages of the takeoff climb out. At about 1,000 feet he tries again to engage the autopilot. On this third attempt, the autopilot successfully engages for a few seconds. Once the autopilot has engaged, Captain Getachew calls for the flaps to be retracted and Ahmednur raises the flaps.
When the autopilot is engaged, it controls the horizontal stabilizer trim. The autopilot senses the need for nose-down trim and moves the trim back to 4.6 units, close to where it was set for takeoff.
While the autopilot is engaged, air traffic control (ATC) responds and clears ET320 to climb to 34,000 feet and clears them to turn right for their flight south to Nairobi. Ahmednur acknowledges this instruction, and the autopilot level change mode is engaged. However, instead of selecting a new altitude, Captain Getachew sets an airspeed target of 238 knots and leaves the autopilot altitude target at 32,000 feet — possibly a sign that the captain is cognitively overloaded with everything that is going on in the cockpit.
Following their departure flight plan, the captain adjusts the autopilot heading command from 072 degrees (the runway heading) to 197 degrees for the turn south to Nairobi. Five seconds later the autopilot disengages for the third time. The captain then asks his first officer to contact ATC and request permission to maintain runway heading and to also let ATC know they are having flight control problems. Again, Captain Getachew is making the right decisions to reduce his workload. He is no longer concerned with getting to Nairobi; he asks for permission to fly on his current heading until he gets things sorted out.
It is important to note the timing here. Captain Getachew wants ATC to know they are having flight control problems. But he makes this request to his first officer a full three seconds before the first activation of MCAS. Why does the captain think he is having flight control problems at this point?
1) His stick shaker has been shaking and making noise since liftoff.
2) His airspeed seems low, and confirms the stick shaker as valid.
3) His altimeter is telling him he’s much lower than he actually is.
4) His autopilot won’t stay engaged.
5) He’s getting strange master caution warnings.
Three seconds later, a hidden system known as MCAS activates without any indication, making its first nose-down command. The horizontal stabilizer electric trim motor activates for nine seconds in the nose-down direction. Stabilizer trim moves from 4.6 units to 2.1 units. This is an astonishing amount of nose-down trim. If Captain Getachew thought he was having flight control problems before, those problems are much worse now.
There has been a lot of discussion of Boeing’s MCAS system in the news lately. Let’s review what the system is and how it works. MCAS is an acronym for Boeing’s Maneuvering Characteristics Augmentation System. It is an extremely simple computerized system that was designed to improve the 737 MAX flight control in certain situations, primarily when the aircraft is operating at slow speeds. MCAS senses aircraft situation by taking input from a single angle-of-attack indicator, called an “alpha vane.” When an aircraft is flying with a high angle of attack, it is at risk of stalling — the condition where the wings stop producing enough lift and the aircraft falls. Since the beginning of heavier-than-air flight, aircraft stalls have been the classic cause for accidents. Because Boeing changed the size and location of the engines on the 737 MAX, altering the flight handling characteristics of the aircraft, their engineering team decided to create MCAS to assist pilot control when approaching any flight situation where a stall might be close to occurring.
Notably, and contrary to their historical ethos, Boeing also decided not to provide any mention of MCAS in their flight manuals nor provide any opportunity for pilots to learn about MCAS during their training. Boeing did not install any annunciator to indicate when MCAS was operating, nor did they develop any procedure for dealing with an MCAS that was not operating properly- that is, not until after the Lion Air crash that occurred five months before Ethiopian Flight 302. After the Lion Air crash, Boeing advised pilots who encountered any problem with MCAS, to use the “Runaway stabilizer” checklist: Switch both stab trim cutout switches to “Cutout” and use manual trim for the remainder of the flight.
Figure 4 is a helpfully informative illustration:
Back in the cockpit of ET302: As soon as MCAS operates, the aircraft immediately stops climbing and begins descending. The aircraft’s Ground Proximity Warning System (GPWS) sounds an alert and gives a loud aural warning, “Don’t sink!”
Captain Getachew pulls back on his control wheel to stop the descent and he uses a little nose-up trim to help his efforts. Trimming electrically, he moves the trim back from 2.1 units to 2.4 units. Why so little? Experienced pilots learn to make small, incremental adjustments to trim. This is what Captain Getachew was doing. He wasn’t sure what was occurring; events were happening that he did not understand. He had things under control but he was being cautious. Again, the stick shaker was still shaking his control wheel and hampering his efforts to feel for correct trim.
Five seconds after the captain has trimmed a little nose up, the hidden MCAS re-activates again without annunciation and commands more nose down. Trim moves from 2.4 units to 0.4 units. Flight control is now becoming a serious problem. The stick shaker is still shaking and sounding, and now the GPWS activates three times in quick succession, with its loud voice warnings, “Don’t sink!” Captain Getachew is now using a lot of back pressure with his control column to keep the aircraft from descending and it isn’t easy.
Surprisingly, the captain now asks his first officer to trim nose up with him, as if the captain believes his trim switches are no longer working. He has just trimmed nose up, but the aircraft is acting as if he had trimmed nose down. Clearly, he is confused.
The preliminary accident report shows that trim moves nose up due to the pilots using their thumb switches, from 0.4 units to 2.4 units at this time. Following this, Ahmednur proves to the world that he has been well trained: At 8:40:35 a.m. on the cockpit voice recorder, Ahmednur calls out twice in quick succession, “Stab trim cutout,” waiting for the captain’s confirmation that this action should be taken. In my mind’s eye I see Ahmednur with his left hand on the stab trim cutout switches, looking at the captain while he calls out, awaiting confirmation. Captain Getachew agrees and Ahmednur next confirms, “Stab trim cutout,” as the switches are used to remove electrical power from the trim system.
MCAS tries to activate a third time, but because the switches are now in the cutout position, no trim movement occurs.
Shortly after they act together to cut out the trim, Captain Getachew asks Ahmednur to help him, calling out, “Pull up!” three times in quick succession. The flight data recorder shows back pressure being applied from both control columns in varying degrees throughout the remainder of the flight.
From about 8:41 a.m. to about 8:43 a.m., the aircraft’s airspeed, as recorded from the first officer’s indicator, increases from 330 knots (indicated) to about 365 knots (indicated). At their altitude, 365 knots-indicated airspeed equates to about 468 knots true airspeed, or about 539 mph. The stick shaker is still shaking.
The maximum safe operating airspeed for the 737 MAX is 340 knots indicated airspeed, so when they reach this speed at 8:41:20 a.m., the right overspeed warning clacker starts to sound. This is an unusual situation: The stick shaker (essentially a low-speed warning) and the high-speed warning are sounding simultaneously. Captain Getachew’s airspeed indicator is showing about 25 knots less than the first officer’s. He is trying to sort true warnings from false warnings while also working to keep the aircraft from diving into the ground.
At 8:41:46 a.m., the captain asks the first officer if trim is functional. This might seem a little surprising, given that the captain confirmed stab trim cutout just a minute earlier. I think this demonstrates just how much stress the captain is experiencing. He doesn’t even seem able to look at the cutout switches; he is completely occupied with trying to maintain level flight. The first officer replies that the trim is not working and asks Captain Getachew if he can try it manually. The captain tells him to try. Ahmednur pulls out the manual handle on his trim wheel (located close to his left knee) and tries to turn the trim wheel. Six seconds later, the first officer replies that manual trim is not working.
Note: The control forces on the horizontal stabilizer at this point are enormous: The aircraft is traveling at high speed, the stab is quite badly out of trim and the elevators at the trailing edge of the horizontal stab are exerting a large opposing force. These forces make it difficult to move the trim manually. Precisely when electric assistance would be critically helpful, it is no longer available.
At this time Captain Getachew asks Ahmednur to request radar vectors to return to Addis airport and 14,000 feet as an altitude. He also tells Ahmednur again to let the controller know that they are having control problems. ATC grants the requested altitude and gives them a heading that will return the flight to Addis airport.
Captain Getachew is struggling to control the aircraft’s pitch attitude and their altitude. At 8:43:04 a.m. he again asks the first officer for his help in pulling back on the control column and this time he says out loud, “Pitch is not enough.” The captain realizes that he needs to adjust stabilizer trim. It is not an option; he is not able to maintain control without getting the stabilizer back into proper trim.
At 8:43:11 a.m. Flight ET320’s altitude is 13,400 feet and the flight data recorder records two momentary electric trim inputs from the captain’s control wheel trim switches. Trim moves from 2.1 units to 2.3 units. Captain Getachew has re-energized the electric trim by restoring the cutout switches to normal. His trained response would be to cautiously trim a little at a time, using electric trim to take some of the pressure off his struggles with the control wheel. But he is being careful because his previous use of trim seemed to make it much worse. He is desperate to regain control of his aircraft and manual trim does not seem to be working. Unknown to Captain Getachew — due to a glaring omission in the Boeing aircraft flight manual — is the fact that by his restoring power to the trim system and then using his electric trim, he is unknowingly re-activating a system that will kill him and all his passengers.
The hidden, persistent, and out-of-control MCAS re-activates per its ill-conceived programming. Five seconds after the captain’s use of electric trim, MCAS, without any warning or annunciation, commands another nose-down trim action. The stabilizer trim moves from 2.3 units to 1.0 units — an enormous trim change, given their high speed.
Now the aircraft pitches very quickly to a nose-down angle of 40 degrees below level — an astonishing angle. This is the final dive.
Airspeed is high before this terrifying dive begins, but now airspeed increases well above the aircraft’s design limits. At the end of the flight data recording, the first officer’s airspeed indicator (the only accurate airspeed indicator due to the failure of the captain’s alpha vane) is indicating more than 500 knots, which puts the aircraft at or beyond the speed of sound.
This final dive took more than thirty seconds. It would begin with both pilots being lifted out of their seats; the negative g-forces of such a dive would cause bedlam in the passenger cabin. During the nose-over entry into the dive, the pilots, restrained only by their seat belts, would have difficulty pulling back on their control columns. Throughout the sustained dive, they would be hanging by their seat belts, further impeding their ability to pull back. Despite this, the flight data recorder shows that both pilots were engaged in pulling back with considerable pressure. However, none of their efforts could ever overcome the control authority of the massive horizontal stabilizer that was so badly out-of-trim.
Several observers on the ground reported seeing smoke from the aircraft before it crashed. There is no indication of anything that may have generated combustion smoke or caught on fire. It is more likely that observers witnessed a condensation cloud from the speed-of-sound shock wave. The temperature at the airport was 17 degrees Celsius and the dewpoint was 9 degrees, good atmospheric conditions for a condensation cloud to form from a shock wave.
Twenty-eight miles from the airport, the hole in the farmer’s field was only 28 meters wide by 40 meters long. Most of the wreckage was buried deep in the ground.
References
Federal Democratic Republic of Ethiopia Ministry of Transport (2019). Aircraft Accident Investigation Bureau Preliminary Report No. AI-01/19. Retrieved May 28, 2019, from https://flightsafety.org/wp-content/uploads/2019/04/Preliminary-Report-B737-800MAX-ET-AVJ.pdf
Figure 2: 737 tail section. The New York Times (2018, November 16). Retrieved June 1, 2019, from https://www.nytimes.com/interactive/2018/11/16/world/asia/lion-air-crash-cockpit.html
Figure 3: Boeing 737 Max cockpit layout. Retrieved June 1, 2019, from http://benedict-xvi.blogspot.com/2017/10/boeing-737-max-cockpit-layout.html
Figure 4: Nolan, M. (2018, November 15). The Seattle Times. Retrieved May 28, 2019, from https://www.seattletimes.com/business/boeing-aerospace/faa-evaluates-a-potential-design-flaw-on-boeings-737-max-after-lion-air-crash/)
Figure 5: 737 MAX stab trim cutout switches. Retrieved June 1, 2019, from https://www.stripersonline.com/surftalk/uploads/monthly_2019_05/164929-1020x764.jpg.c8a4b7defbbc23e1fa030c283d81dbc9.jpg
Figure 6: 737 manual trim wheel with handle extended. Retrieved June 1, 2019, from https://www.pprune.org/rumours-news/614857-indonesian-aircraft-missing-off-jakarta-62.html