Ethiopian-Led 737 MAX Probe Ignores Human Factors Issues

The Ethiopian-led investigation’s final report on the second fatal Boeing 737 MAX accident underscores what has long been accepted: Design and certification mistakes set the stage for the disaster. But the report ignores pilot performance issues that some involved in the probe conclude played an even greater role in the accident sequence, leaving potentially insightful safety factors unexplored.

The report on the March 2019 crash of Ethiopian Airlines Flight 302 (ET302) released Dec. 23 by Ethiopia’s aircraft accident investigation bureau (EAIB) sheds little more light on the 737 MAX saga (AW&ST Nov. 23-Dec. 6, 2020, p. 16) that started with a similar accident on Lion Air Flight 610 (JT610) in October 2018. The EAIB concluded that faulty data from a broken angle-of-attack (AOA) sensor told the 737-8’s flight control software that the nose was too high and the aircraft was in danger of stalling. That activated a series of flight-deck alerts and warnings and eventually the aircraft’s maneuvering characteristics augmentation system (MCAS), which directed the horizontal stabilizer to point the 737-8’s nose down repeatedly (AW&ST March 25-April 7, 2019, p. 16). The pilots, clearly confused, did not maintain control. Ten contributing factors listed in the report focus on flaws in the MCAS design and Boeing’s incorrect conclusion that pilots would respond a certain way, with memorized steps, if the system activated erroneously.

• Lengthy probe concludes accident factors all link to Boeing
•  U.S. and French investigators say pilot training and performance played key roles
•  Key facts, including CVR portions, were omitted from the EAIB report

Investigators from France’s accident investigation bureau, the BEA, and the U.S. NTSB who participated in the probe generally agree with the EAIB’s analysis of the MCAS’ role. But the 330-page report does little to explain one of the key differences between the two accidents: why the ET302 pilots were not better prepared for an MCAS-related malfunction despite significant communication about the system to operators following the Lion Air accident.

Both the BEA and NTSB contend that the EAIB’s lack of focus on flight-deck human factors paints an incomplete picture of the ET302 accident. The U.S. agency determined that despite the cascading series of alerts and failures and the unneeded MCAS activation, the pilots should have been able to control the 737-8 using basic airmanship and specific instructions provided following JT610.

“[A]ppropriate crew management of the event, per the procedures that existed at the time, would have allowed the crew to recover the airplane even when faced with the uncommanded nose-down inputs,” the NTSB said in formal comments submitted to the EAIB in March 2022 as part of international investigation protocol and made public along with the final report.

Added to the 737 MAX family for certification reasons, the MCAS was largely unknown before the Lion Air accident. In the weeks that followed, Boeing and the FAA determined operators needed information on the flight control law, including how to counteract it.

Regulators around the world, including in Ethiopia, ordered 737 MAX operators to give pilots specific, Boeing-provided instructions—but not formal training—on how to respond to uncommanded horizontal stabilizer trim movement.

Ethiopian Airlines distributed the instructions to pilots via its Logipad electronic flight bag system, investigators found. But the BEA suggests that the airline did little beyond pushing the critical information out.

Logipad “was used to disseminate the information related to the MCAS system issued following the previous 737 MAX accident and did not allow the airline to ensure that the crews had read and correctly understood this information,” the BEA said in its formal comments.

The ET302 crew’s struggles were not limited to the MCAS.

Much of the BEA’s analysis focuses on a 1-min. 15-sec. period between the first sign of trouble shortly after the aircraft departed—a stick-shaker stall warning triggered by the faulty AOA data—and the initial MCAS activation. The stall warning plus two other visual messages triggered by the bad AOA data that appeared soon after on both the captain’s and first officer’s primary flight displays (PFD)—indicated airspeed (IAS) disagree and altitude (ALT) disagree—should have prompted specific responses from the pilots.

“On the activation of the stick shaker, the flight crew must apply the approach to stall or stall recovery procedure, which is a memory item,” the BEA said. As documented in the 737 MAX pilot manual and quick-reference handbook, the first steps in each procedure “are to hold the control column firmly, disengage the autopilot and auto-throttle, and then smoothly apply a nose-down input,” the French agency added. But the only change in the aircraft’s state was nose-down inputs.

The EAIB’s report suggests the crew acted per Boeing’s recommended training, which is usually done with the auto-throttle already disengaged. Further, Boeing’s training protocol does not cover “how to conduct an approach to stall training with the autopilot not engaged, nor for a stall condition during departure,” the EAIB added.

The crew never touched the throttles, which remained at takeoff power, and attempted to use the autopilot multiple times throughout the 6-min. flight. An AOA failure and the cascading warnings triggered should have prompted opposite reactions—from memory.

“Non-normal procedures related to erroneous AOA inputs instruct the crew to disengage both the autopilot and autothrottle, thereby preventing the erroneous AOA inputs from affecting flight control and throttle movements,” the NTSB said. “The observable flight deck effects associated with erroneous AOA inputs include the activation of the stick shaker and the annunciation of the IAS disagree and ALT disagree messages.”

Ethiopian investigators contend that the IAS and ALT disagree prompts, which are not captured by the 737 MAX flight data recorder (FDR), never appeared on either PFD. But both the BEA and NTSB insist that conditions were met to trigger both prompts, a position validated in tests during the investigation and by the absence of evidence that the systems malfunctioned.

“Given that the conditions were met for the IAS disagree and ALT disagree messages to be annunciated to the crew members, their lack of conversation or action in response to the annunciations should be explored in the context of the flight deck environment, workload, crew experience and training,” the NTSB said. “The report’s assumption that those messages did not appear, which is contrary to Boeing’s description of the alerting system and the results of simulator testing during the investigation, severely limits the opportunity for recognizing and addressing potential crew training and experience improvements.”

Leaving the autothrottle connected—it remained at takeoff thrust due in part to the system failures—helped set the stage for the MCAS to overwhelm the pilots. Once the conditions for MCAS activation were met, manual flying with flaps up, the erroneous AOA data triggered nose-down inputs.

The EAIB concluded that ET302’s pilots were aware of Boeing’s post-Lion Air directive. Among its instructions: counter unneeded nose-down inputs with nose-up inputs via switches and, if necessary, disconnect the automatic trim motor via another switch and use a manual wheel to move the horizontal stabilizer.

“If the crew had conducted the procedure [as described], the crew would have used manual electric trim to reduce control forces,” the NTSB said. “However, FDR data show minimal crew use of manual electric trim.”

The crew disconnected the automatic trim motor, but the aircraft’s airspeed, which had increased due to the faulty AOA data’s effects, meant the forces on the horizontal stabilizer were too strong to move the trim wheel. The crew then reengaged the trim motor, in direct contrast to the MCAS activation response directive.

“The report misses an opportunity to evaluate the effectiveness of air carrier training related to the relationship between airspeed and manual trim control forces and make safety recommendations, as appropriate, to improve industry training,” the NTSB said.

The EAIB cited the high-stress scenario as the reason the pilots did not follow procedures.

“During abnormal situations, flight crews are assumed to be capable of maintaining control of the flightpath and performing a rapid diagnosis that will allow them to identify the correct response and actions to apply,” the EAIB report said. “However, a significantly unusual abnormal situation can lead to a total loss of understanding. The stick shaker here represented a major disruption in managing the situation and the rapid onset of multiple inconsistent cues and abnormalities. As a consequence, the effectiveness of the crew’s [crew resource management] was seriously affected.”

Both the BEA, which provided readouts from ET302’s FDR and cockpit voice recorder (CVR) at the Ethio-pians’ request, and the NTSB contend that the investigation intentionally masks obvious clues that pilot training likely played a major role in the accident.

“The CVR transcript provided in the . . . report is not complete, omits key statements related to the flight crew’s performance during the accident flight and inappropriately adds analytical commentary to transcribed statements,” the NTSB said. “Of immense importance is that the original transcript was developed by the entire investigative team, including international team members, whereas the changes to the transcript were made unilaterally by the EAIB. The current presentation of the CVR transcript prevents the reader from having a complete and an objective understanding of the event.”

The BEA noted that what the pilots did not discuss is as instructive as what was left out of the published transcript.

“There were no crew exchanges on the CVR regarding the IAS disagree or ALT disagree messages, which supports the conclusion that the . . . messages were most probably not seen by the crew throughout the flight,” the BEA said. “The coordination and the communication between the captain and the [first officer] were very limited and insufficient. There was no discussion nor diagnosis with respect to the nature of the events onboard.”

The final report’s text did not include the BEA’s or NTSB’s comments, appending them via a weblink instead—an unusual step suggesting sharp notable disagreement between the two agencies and the EAIB. Both the BEA and NTSB took the equally unusual step of releasing their submissions publicly once the final report was out.

“As we have reiterated throughout the investigation, design mitigation must adequately account for expected human behavior to be successful, and a thorough understanding of the flight crew’s performance in this accident is required not only for robust design mitigations but also for operational and training safety improvements necessary to achieve multiple layers of safety barriers to trap human errors and prevent accidents,” the NTSB said.

Whether Ethiopian Airlines or its regulator addressed some of the human factors issues behind the scenes is unclear.

Early findings from both accident probes and related investigations led regulators to order changes to the 737 MAX’s flight control computer system and pilot training as well as fleet-wide safety enhancements (AW&ST April 18-May 1, 2022, p. 14). They also prompted the U.S. to call for an International Civil Aviation Organization-led panel examining global pilot training and manual flying proficiency. The group has been meeting regularly since early 2021.