The Ethiopian 737 Max 8 crash preliminary report was released late yesterday and we were provided a rich set of rudimentary data visualizations, coupled with a transcript from the cockpit to decipher. First things first: a word on speculation of air disasters. This is a preliminary report. It is not final, and we will certainly learn more as the investigation continues.
However, this is an industry discussion site and the intended audience is professionals in aviation. With a healthy dose of objectivity, we can begin to discuss likely scenarios and missing information that will help piece things together. We are professionals, and we can look at the data available and begin to move the dial in likely directions, keeping transparent what we know and don’t know.
Having had that taken care of, let’s begin by first comparing Boeing and Ethiopian Airlines responses. In a nutshell, Boeing says the MCAS system would not bring down the aircraft if the crew followed the appropriate procedure. Ethiopian says the pilots followed the appropriate procedure. It is a classic he-said / she-said… or is it? What if both Boeing and Ethiopian are correct? Is it possible that the crash could have been averted following the appropriate procedure and that the appropriate procedure was followed?
The entire preliminary report can be found at through this link. There are 33 pages of information regarding the aircraft and the flight, however it is the flight data recorder inputs and the cockpit voice recorder transcriptions we will spend time reviewing.
The 737 Max 8 departed runway 7R at Addis Ababa Bole International Airport on March 10th, 2019. Shortly after take-off, the captain and first officer’s angle of attack indicators disagreed, in what was almost certainly a malfunction on the captain’s side. Simultaneously, the stick shaker activated and the crew began troubleshooting and completing the required checklists. The crew reported to ATC that they were having flight control problems, and mentioned specific challenges keeping the nose up. Eerily similar to the Lion Air incident a month prior in its pitch control problems, the Ethiopian 737 Max 8 crashed seven minutes after becoming airborne.
While much of the focus in other analyses has been on the pitch trim position and the manual and automatic trim inputs, we will take a look at many other factors which may have played a role beyond the trim challenges. First, however, let’s look at exactly what the trim was doing.
In all of these charts, the x-axis is time, and the y-axis is in units identified for each parameter. The pink line represents whether or not the manual electric trim was commanded by the pilots. Peaks above the center line show moments where the pilots commanded nose-up trim, and those below show pilot-commanded nose-down trim.
The blue line shows automatic trim being applied by the aircraft. In this case, it is largely suspected and almost entirely confirmed it was the MCAS system applying these nose-down trim commands.
The red line shows the actual stabilizer trim position, correlating with the electric nose up or nose down commands by pilots or the MCAS system. You can see that shortly after takeoff, the pilot commands slight nose down trim, followed by nose up trim, and the trim position responds. Longer periods of trim up or down commands correspond with larger movements in the stab trim.
Before we move on, there is one indication that seems to have been overlooked by most, yet would have had an intense impact on the pilots; the stick shaker activation. Shortly after leaving the ground, the angle of attack vane on the captain’s side returns erroneous data. Simultaneously, the stick shaker activates on the captain’s side, violently (and noisily) shaking the control column warning the pilot the aircraft is about to stall. It is both mentally and physically jarring by design to alert the pilot in no uncertain terms to the pending disaster. Only, the aircraft was not about to stall, it only thought it was (or half, thought it was) by the erroneous angle of attack indication. This could be especially confusing considering only the captain’s control column was shaking, and not the first officer’s.
After full flap retraction, the MCAS begins automatically trimming the nose down in earnest. The trim actions and reactions then look very similar to that of the fateful Lion Air crash, until roughly 45 seconds later when the MCAS system applies nose-down trim and the trim does not respond. This corresponds with the CVR readings in that the crew followed the appropriate procedure and selected the TRIM STAB CUTOFF switches.
The stick-shaker is both mentally and physically jarring by design to alert the pilot in no uncertain terms to the pending disaster. To have this activated the entire flight would have been exhausting.
A few things to consider during this time: the MCAS does not immediately activate. This is likely due to the little-known delay between the time the crew applies manual nose up trim and the MCAS activates. This could prove to be critical to both crashes. In the early stages of the Ethiopian crash, the captain may have been commanding intermittent nose up trim in just enough intervals to keep the MCAS system in the delay. This isn’t confirmed, however the interval between manual nose up trim commands during that time is certainly very close to the delay time you can see later in the flight.
Also, it should be noted that manual nose up trim seems to override the MCAS’ relentless nose down trim. This is evidenced by the fact that any manual nose up trim command by the pilots corresponds with the automatic nose down trim ceasing. This cycle repeats many times in the Lion Air crash as the struggle between the pilots and the MCAS to control the stab trim becomes obvious. The two are never activated at the same time.
Comparing the trim position with the flight column inputs goes a long way in explaining how trim works and is felt by the pilot.
As pitch trim moves down (the top red line), you do not necessarily see the pitch of the aircraft drop. What you see is movement in the bottom parameter in that chart, control column position. This reflects how far the pilots need to pull back on the control column to control the aircraft. The notable change to watch is how much harder the pilots need to pull back as the stab trim continues its nose down trim. When compared to the spike in control column position at the beginning of flight signifying take off rotation, you can see that the control column must be held back further than even at rotation just to keep the aircraft level. While this shows control column position, what it does not clearly show is the pressure required to hold the control column at that position. This is where the speed of the aircraft can play a massive role in the amount of pressure required, and whether or not the aircraft can even remain controllable.
When looking at the speed of the aircraft, we do, in fact, see the speed steadily increasing. The bottom parameter also shows engine power, which remains at or near maximum during the entire flight. As the pilots fought with the nose down trim, the airspeed was steadily increasing, demanding more and more force to hold the control column back as far as required to keep the aircraft level. For three minutes, the pilots wrestled with the control column, exerting forces that would be increasingly physically demanding.
Why didn’t the pilots slow down to relieve some of the control column pressure? This, we do not know, other than to suggest the trained instinct of a pilot. With a properly trimmed aircraft, a reduction in power will lower the nose while an increase in power will raise the nose. It would be understandable for the pilots of ET302 to think that reducing the power would further drop the nose, just like it would in almost every other situation. In a fight for their life against an airplane that was not behaving according to their commands, and the nose of which they were struggling to keep from dropping below the horizon, a reduction in power could seem the last thing you would want to do. It may very well have been the airspeed that was making the aircraft more difficult to keep level while it would have been very logical for them to think it was the only thing keeping them in the air.
The data suggests the AOA disagree would not have happened until the aircraft left the ground, after which the same conditions would have applied to North American pilots as it did to the Ethiopian pilots.
This hypothesis is reinforced as the pilot asks for help from the first officer in pulling back on the control column. During this time, the speed gradually increases until the first officer’s high speed clacker begins to sound, signaling an over-speed situation. It is important to point out that the clacker is very aptly named due to the loud, annoying sound it makes when activated. You can’t miss it, and with the stick shaker continually having been activated during the entire flight, it would have been a very noisy flight deck.
Finally, in what seems like the final nail in the coffin for the doomed 737 Max, the automatic nose down trim activates once more for five seconds. It is from this trim and speed combination that the aircraft becomes uncontrollable and pitches to a terrifying 40 degrees nose down attitude.
Why did the MCAS reactivate? We know the STAB TRIM CUTOFF switches had been moved to CUTOFF. There are only two logical answers: either the aircraft somehow overrode the cutoff switches… or the pilots manually reactivated the stab trim. There is evidence for the latter as short bursts of nose up trim were recorded, followed by the five second delay, and the final reactivation of the MCAS.
After physically fighting this aircraft for three minutes, the pilots could no longer provide enough force to override the nose down trim. In what is personally the most terrifying piece of data in this report, the control column position indicator records a maximum aft position while the aircraft nose continues to drop. After physically fighting to keep the nose of the aircraft level for three minutes, you can see the last gasp of desperation as they pulled back as hard as they could, only to have the aircraft betray them for the final time.
What we know:
The Captain’s Angle of Attack Indicator was providing incorrect readings.
This is what caused the stick shaker to activate, and ultimately the MCAS to automatically trim the nose down.
The MCAS engaged in a similar manner to the Lion Air crash; upon flap retraction.
Before the flaps were retracted, the MCAS was not active, and the pilots were easily able to maintain control of the aircraft. It is worth noting the quick action taken by the Lion Air pilots in regards to flap position. Without understanding why the aircraft pitch was difficult to control after retracting the flaps, the Lion Air crew immediately re-extended the flaps. This matches the sound advice I was given years ago: “If you flip a switch and all hell breaks loose, flip it back.” The presence of mind of the Lion Air pilots to re-extend the flaps is an indication of good piloting that should not go unrecognized.
Moving the STAB TRIM CUTOFF switches to CUTOFF did, in fact, disable the MCAS system.
Just like Boeing said would happen, the cutoff switches did, in fact prevent the MCAS system from applying nose down trim. This is evidenced by the fact that automatic nose down trim was commanded, but no change in pitch trim was recorded. Of course this is entirely under the dark cloud of the fact that…
The aircraft trim reactivated two and a half minutes later, followed by a delay and the reactivation of the MCAS system to an uncontrollable nose down trim position.
We do not know why the trim system reactivated. This is the question we must answer to fully understand what happened with ET302.
What we think we know:
The Captain’s AOA indicator was working correctly on the takeoff roll.
This is a critical piece of information that refutes the North American pilot unions’ claims that the dual AOA indicators would have prevented such an event in their aircraft. The data suggests the AOA disagree would not have happened until the aircraft left the ground, after which the same conditions would have applied to North American pilots as it did to the Ethiopian pilots. While not confirmed, it looks as though that additional system would not have prevented this situation.
The pressures required to pull back on the control column would have been immense
It is difficult to explain the challenges of flying an aircraft out of trim until you’ve done it. During the one time I trained on such a situation in the simulator, the instructor briefly demonstrated the forces required and then removed the malfunction out of fear that we may break the flight controls in the sim. It isn’t just your arms that are pulling on the control wheel. Your feet are pushing on the dash board at the same time. All I can offer is an anecdote on how exhausting it was in the simulator for the 20 seconds we were forced with the situation. I cannot imagine doing it for 3 minutes
The cockpit was very, very noisy
As soon as the stick-shaker fired, it would have been difficult to hear anything else on the flight deck. It is a very loud sound by design, and the vibration of the column itself adds to the noise and physical challenges for the pilots. Add to that the increasing airspeed to the max speed of the 737 at that altitude, and finally the over-speed clacker, and it was chaos. I can think of no situation in training where the stick shaker would be activated and the over-speed clacker would be sounding at the same time, this close to the ground. The impossibility of the situation would have been hellish. Yet, this is important beyond just the mental impacts. With as much noise and vibration that was being generated, it stands to reason the pilots would not hear nor feel the trim wheel physically spinning as a result of the MCAS. Even though they followed the checklist, they may not have known exactly what was happening.
While this effectively was runaway trim, it didn’t act like runaway trim.
Runaway trim is simulated in the training environment exactly how it sounds. Trim that can’t be stopped and will “run away” the first chance it gets. However, if you were to introduce a 5 second delay between any manual inputs and the MCAS system repeating it’s nose down trim commands, and it would feel very different.
The effects of this seem to be illustrated in the Lion Air crash, where the pilots continued to apply manual nose up trim, after which the MCAS applied nose down. What are interesting are the sharp valleys in the trim position, yet plateaued peaks. This suggests manual trim immediately cut out the MCAS-directed automatic nose down trim, while the nose down trim did not resume immediately after the pilots stopped providing trim inputs. After the delay, the MCAS resumed pitching the nose down. To a pilot in an emergency trying to figure out why the airplane is seemingly breaking the laws of physics, if you command trim up, the trim goes up, then stops when you stop it, how would you know to wait the 5 seconds to see if it started again?
The question is rightfully asked whether these pilots should ever have been put in the position to require extreme piloting skill to return an aircraft safely to the ground.
This delay could very easily have prevented the trigger required in the pilots to recognize this as runaway trim. In fact, it’s not runaway trim at all since you can stop it, and it doesn’t start again until just about the moment your attention is pulled somewhere else… such as an altitude disagree, an airspeed disagree, an AOA disagree, a continuous stick shaker impossibly accompanied by an overspeed clacker, the mountain in front of you, not to mention the airplane you are struggling to keep from pointing itself at the ground. I would go as far to suggest that to an engineer, this is a classic case of runaway trim, but it may never be recognized as such by the pilot. It would better be described as a sneaky trim, or walk-away trim.
What we need to know
Why didn’t manual trim work?
It appears that the first officer attempted to manually override the trim by physically spinning the large trim wheel. It also appears that it did not work. Why? Was it too heavy due to the extreme airspeed and forces on the stabilizer? Was there miscommunication in the cockpit by what the captain and checklist meant by “manual trim”? After all, the FDR records electric trim as “manual”.
If, in fact, the procedure was followed perfectly and manual trim would not bring the aircraft back to a controllable state, how were the pilots to know their only hope was turning the electric trim system… and MCAS… on again? Which leads us to the biggest question:
Why did the trim activate again?
Either the airplane became sentient and decided to override its own override, or the pilots re-engaged the trim. It is absolutely critical to this accident investigation that investigators find out why the MCAS activated again.
From the report:
“At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working.”
What did the captain mean by asking “if the trim is functional”? Was he suggesting the first officer manually try to turn the physical trim wheel, or that he try the electric manual trim again, for which the STAB TRIM CUTOFF switches were still in CUTOFF? If the first officer did attempt to physically spin the wheel and was unable, why?
This happened slightly less than two minutes before the electric trim actually did engage. We know the trim re-engaged very closely to the same point the captain asked for help pitching up and that “pitch is not enough”. Seven seconds later, there is a manually commanded nose up trim command, which does actually raise the nose slightly. The command is not long enough to make a difference, and after the five second delay, the MCAS engages for the final time.
If the pilots did not reactivate the trim in an ill-fated last attempt to save the plane, then the plane itself overrode a supposedly fail-safe cutoff switch, and the problem runs far deeper than the MCAS system.
If the pilots did reactivate the trim, one could understand why. The captain had said just seven seconds earlier that he could no longer control the pitch of the aircraft. It is at least logical that they would try the trim one last time, only if that was how the situation played, why didn’t they recognize the trim was working and continue providing nose up trim?
Disturbingly, that is the easier explanation. If the pilots did not reactivate the trim in an ill-fated last attempt to save the plane, then the plane itself overrode a supposedly fail-safe cutoff switch, and the problem runs far deeper than the MCAS system.
The mistake seems to have made in the MCAS system design, and the rush to call it’s errors “stab trim runway” when the actual MCAS trim situation differs in critical ways.
This accident could probably have been prevented had the pilots been specifically trained on the intricacies and false information from an MCAS event. The pilots could have recognized the situation and returned the aircraft safely to Addis Ababa. But… in this author’s opinion, without that specific training and explanation of how the MCAS would lead them down a dangerous path, it would have taken extreme piloting skill to the level we may have never seen before.
Conversely, the question is rightfully asked whether these pilots should ever have been put in the position to require extreme piloting skill to return an aircraft safely to the ground. The mistake seems to have made in the MCAS system design, and the rush to call it’s errors “stab trim runway” when the actual MCAS trim situation differs in critical ways. The human component still matters.
I couldn’t imagine the terror taking hold in the back of the aircraft, but what sticks with me is the final moments of the pilots finding desperate and perhaps even heroic strength to pull the control wheel back to its stops, only for it to not matter. I don’t know what I would have done in the same situation, but I do know it would have been confusing, exhausting, and absolutely terrifying.
The human component still matters.
I conclude with one final piece of explicitly transparent opinion: Just because pilots probably could have saved a malfunctioning aircraft doesn’t mean the aircraft should have ever been certified to put them in that situation to begin with.