The pilots of Ethiopian Airlines Flight 302 performed all the procedures recommended by Boeing to save their 737 Max 8 aircraft but could not pull it out of a flight-system-induced dive, a preliminary report into the crash concluded Thursday.
In a brief summary of the much-anticipated preliminary report on the March 10 crash, Ethiopian Transport Minister Dagmawit Moges told reporters that the “aircraft flight-control system” contributed to the plane’s difficulty in gaining altitude after it left Addis Ababa airport. It crashed six minutes later, killing all 157 on board.
She said the crew “performed all the procedures, repeatedly, provided by the manufacturer but was not able to control the aircraft.”
As in the aftermath of a Boeing 737 Max 8 crash in Indonesia in October, attention in the Ethiopian Airlines crash has zeroed in on a flight-control system known as the Maneuvering Characteristics Augmentation System, or MCAS, which pushes the nose of the aircraft down to avoid a stall.
But later Thursday, Boeing confirmed to The Washington Post that it had found a second software problem that the Federal Aviation Administration has ordered fixed — separate from the anti-stall system that is under investigation in the two crashes and is involved in the worldwide grounding of the aircraft.
That additional problem pertains to software affecting flaps and other flight-control hardware and is therefore classified as critical to flight safety, said two officials who spoke on the condition of anonymity to discuss the probe.
The realization of a second software problem explains why the timeline that Boeing projected publicly last week for getting hundreds of the aircraft airborne again has slipped, the officials said.
Boeing initially said it planned to submit fixes for its stall-prevention system to the FAA for review last week. On Monday, an FAA spokesman said the agency instead expected to receive the final package of software “over the coming weeks.”
“Obviously, we ended up at a situation that in hindsight was not supposed to happen,” one of the officials familiar with the investigation told The Washington Post. “Now, you don’t want to be in a situation where there was one contributing factor to an accident, and then three weeks later you find another one.
In a statement, Boeing called the additional problem “relatively minor” but did not offer details of how it affects the plane’s flight-control system. “We are taking steps to thoroughly address this relatively minor issue and already have the solution in work to do that.”
Moges did not mention MCAS by name during Thursday’s news conference, despite repeated questions from journalists, but her comments suggested that the system was activated during the flight and that the pilots were not able to use Boeing’s recommended methods to disable it.
Boeing later acknowledged that the system had malfunctioned and apologized.
“We at Boeing are sorry for the lives lost in the recent 737 MAX accidents,” chief executive Dennis A. Muilenburg said. “These tragedies continue to weigh heavily on our hearts and minds, and we extend our sympathies to the loved ones of the passengers and crew on board Lion Air Flight 610 and Ethiopian Airlines Flight 302. All of us feel the immense gravity of these events across our company and recognize the devastation of the families and friends of the loved ones who perished.
“The full details of what happened in the two accidents will be issued by the government authorities in the final reports, but, with the release of the preliminary report of the Ethiopian Airlines Flight 302 accident investigation, it’s apparent that in both flights the Maneuvering Characteristics Augmentation System, known as MCAS, activated in response to erroneous angle of attack information.”
The preliminary report, which stops short of determining the cause of the crash, chronicles the chaotic last moments in the cockpit before the crash.
The report indicates that a minute after takeoff from Bole International Airport, one of the angle of attack sensors sent bad information to the aircraft’s computer system, activating the stick shaker — a vibration in the pilots’ controls that warns of an impending stall.
Reacting to the faulty data, MCAS kicked in to force the plane’s nose down. MCAS activated at least four separate times, and each time the pilots fought unsuccessfully to regain control of the plane.
Investigators think MCAS also contributed to the Oct. 29 crash of the Lion Air flight, where they say erroneous data from an angle of attack sensor caused the system to force the nose of that plane down repeatedly. Pilots were unable to regain control, and the Lion Air plane eventually plunged into the Java Sea, killing all 189 on board.
After the Indonesia crash, Boeing issued a bulletin outlining how to disable MCAS in case of a malfunction, and Thursday’s preliminary report indicated that the Ethiopian pilots followed that procedure.
According to black-box data released by Ethiopian investigators, the pilots struggled to regain control of the plane from the system, which repeatedly put the plane into a descent. The pilots tried to use a backup manual trim system in an attempt to raise the plane’s nose. The trim system is also used to stabilize a plane.
The captain called out “pull up” three times to tell the first officer to raise the nose, and in the last seconds of the flight, both pilots tried together to arrest the plane’s dive but still could not regain control, according to the report.
Experts say that the airplane was traveling too fast for the manual trim wheel to be operated.
“At higher speed, manual trim may not be available due [to] air load on the stabilizer,” said John Cox, a former pilot and an airline-safety consultant who has been privately briefed on the evidence by people familiar with the investigation. “Not enough force can be generated manually to move the trim.”
In the final struggle, as described in the report, the aircraft pitched downward, eventually diving at 40 degrees and crashing into the ground at 575 mph.
Amid reports that a foreign object might have damaged one of the Ethiopian plane’s sensors on takeoff, Amdeye Ayalew, the head of the accident investigation, said information from the recovered data recorders gave no such indication.
“We did not find any information regarding the foreign object damage on the aircraft,” he said. “Is there a structural design problem? No, we cannot verify that now.”
Officials said a full report would be completed within a year of the crash.
Ethiopian Airlines said the report absolves the pilots, who “followed the Boeing recommended and FAA-approved emergency procedures.”
“Despite their hard work and full compliance with the emergency procedures, it was very unfortunate that they could not recover the airplane from the persistence of nose diving,” the airline said.
The new revelations about the jetliner come after Boeing, grappling with fallout from the two deadly crashes, outlined upgrades to the aircraft’s software and increased training for 737 Max pilots.
After the Lion Air crash, Boeing proposed a software fix in November that would have prevented MCAS from engaging in a situation such as developed during the Ethiopian Airlines flight, according to a document obtained by The Post.
The FAA reviewed the proposal and negotiated the terms for the fix with Boeing into January, according to the document.
One of the final steps in certifying the software fix as sufficient was a series of test flights by FAA pilots, which, for weeks ahead of time, had been scheduled for the second week of March.
That turned out to be the week of the Ethiopian Airlines crash.
Internally at Boeing, a board of engineers set up to review the 737 Max soon discovered the second software problem, according to the company. The flaw was shared with the FAA, which decided it should also be addressed through a software update.
Boeing said it would take about an hour for technicians to load the MCAS software update for the planes. The software fixes will change the way MCAS receives information, requiring feeds from both angle of attack sensors rather than one before the anti-stall system is triggered. It is unclear how the additional problem will affect the update timetable.
The updated MCAS will also have more limits on how often it will engage, and Boeing will make changes that prevent the anti-stall feature from angling the plane’s nose too far downward in its attempts to correct for a possible stall.
On Wednesday, Boeing announced that Muilenburg had joined pilots aboard a flight to test the updated MCAS software as part of the certification requirements and that “it worked as designed.”
Boeing introduced MCAS, an unprecedented computerized device designed to push the plane’s nose down to combat that added lift provided by the new engines, and to prevent a “stall” that could cause the plane to crash.
There have been 17 generations of the 737 since it began flying, and Boeing wanted the Max to perform exactly like its predecessor, the 737 NG.
The Max 8 single-aisle aircraft is the most recent iteration of the 737 line — the world’s most popular commercial airliner, which first flew in 1967. The Max has been the fastest-selling plane in Boeing’s history, with nearly 4,700 sold or on order.
The Justice Department’s criminal division is looking into the Max jets, while the Transportation Department’s inspector general is investigating the way they were certified. Transportation Secretary Elaine Chao has formed an “expert special committee” to review the certification procedures for the planes.
The FAA said late Wednesday it is creating a technical review team that will be headed by a former top U.S. transportation safety official and will include representatives of NASA and foreign civil aviation authorities.
According to the preliminary report, the aircraft’s data recorder was recovered March 11 and had data from 73 hours of operation, covering 16 flights, including the fatal flight. The voice recorder, which was recovered the same day, had just over two hours of information, which included the previous flight in addition to Flight 302.
The plane crashed in a farm field, and the wreckage indicated evidence of a “high energy impact.” There was no indication of fire. The crash created a crater roughly 33 feet deep, 92 feet wide and 131 feet long. Most of the plane’s wreckage was buried in the ground, but small fragments were found scattered in an area roughly 656 feet wide and 984 feet long.
