Ethiopia Ministry of Transport releases report on Ethiopian Airlines Boeing 737 MAX accident

Ethiopia's Ministry of Transport Aircraft Accident Investigation Bureau (AAIB) released (10-Mar-2020) its interim investigation report on Ethiopian Airlines flight ET302, a Boeing 737 MAX, which crashed shortly after take off from Addis Ababa. Key investigation findings included:

• There was a deviation between the left and right recorded angle of attack (AoA) values, which remained as such until near the crash;
• Right after the deviation of the AoA, the left stick shaker activated and remained active until near the crash;
• Immediately after the left hand AoA sensor failure, the left AoA erroneous values affected the left hand light display pitch command, and the right hand and left hand flight director pitch bars started to display different guidance;
• There were four uncommanded automatic nose-down trim movements triggered via the MCAS. For some of these, there was no corresponding motion of the stabiliser, which is consistent with the stabiliser trim cutout switches being in the ''cutout'' position;
• The difference training from the 737NG to 737 MAX provided by the manufacturer was found to be inadequate;
• The AoA Disagree message did not appear on the accident aircraft as per the design described on the flight crew operation manual;
• AoA failure detection feature of the Air Data Inertial Reference Unit did not detect the erroneous AoA from the left AoA sensor because it only considers the value to be erroneous when the AoA value is outside the physical range. Thus, the speed and altitude (SPD and ALT) flag never appeared on the primary flight display;
• MCAS design on single AoA inputs made it vulnerable to undesired activation;
• The specific failure modes that could lead to uncommanded MCAS activation, such as an erroneous high AoA input to the MCAS, were not simulated as part of the functional hazard assessment validation tests. As a result, additional flight deck effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker activation) resulting from the same underlying failure (for example, erroneous AoA) were not simulated and were not documented in the stabiliser trim and auto flight safety assessment;
• The AAIB made the following recommendations:
  • The design of MCAS should consider the use of data from both AoA and/or other independent systems for redundancy;
  • The regulator shall confirm all probable causes of failure have been considered during functional hazard assessment;
  • The manufacturer shall ensure the minimum operational speed computed by the SMYD to be within logical value. There should also be logic to validate the computation;
  • The difference training should also include simulator sessions to familiarise with normal and non-normal MCAS operation. The training simulators need to be capable of simulating AoA failure scenarios;
  • The manufacture should confirm the AoA DISAGREE alert is functional whether the optional angle of attack indicator is installed or not. [more - original PR]