Few airplane crashes have had repercussions on the scale of Ethiopian Airlines Flight 302, which plunged into the ground six minutes after takeoff on March 10, 2019. On its own, the crash was a tragedy, an avoidable accident that took the lives of 157 men, women, and children. But because it was a nearly new Boeing 737 Max jet, and because another 737 Max had crashed under similar circumstances less than five months before, its destruction raised the shocking possibility that the latest model from the world’s most venerable jet manufacturer might be fundamentally unsafe.
In the aftermath, the 737 Max was grounded around the world, and as investigators labored to understand what had happened, observers were left to speculate on the basis of limited information. Then last week Ethiopia’s Aircraft Accident Investigation Bureau released a 33-page preliminary report into the incident, including partial transcripts of the cockpit voice recorder and readouts of the flight data recorder. Together, they allow us to understand with much greater precision what happened during the doomed flight and why the plane’s design flaws were so dangerous.
8:37:34 a.m.: A 737 Max aircraft, Ethiopian registry ET-AVJ, is waiting near the threshold to runway 07R at Addis Ababa Bole International Airport. The weather is fair, sunny and 61 degrees, with a light wind out of the northeast. With seats for 160 passengers, the plane is nearly full. Those aboard include 148 adult passengers and two children from 35 countries, including eight Americans. The Nigerian writer Pius Adesanmi is on board, as is Ralph Nader’s grand-niece, Samy Stumo, and seven members of the United Nations World Food Program. At just four months old, the plane still has that fresh-out-of-the-box feel, with olive-green seats in the back and red ones up front.
The control tower gives the flight permission to take off. The plane — all white, with the word “Ethiopian” emblazoned across the front of the fuselage in four-foot-high letters and the red, yellow, green of Ethiopia’s national colors splashed on its tail in the shape of feathers — rolls forward and makes a 90 degree turn to line up with the runway centerline. It’s a beautiful day to go flying.
8:38:00 a.m.: Its CFM International Leap-1B jet engines throttling up to full takeoff power, the 737 Max eases forward. Its 160,000-pound mass steadily gains speed under the massive engines’ thrust. At an elevation of 7,656 feet, the airport is more than 2,000 feet higher than Denver International, and it takes longer for the plane to get airborne. As the plane reaches rotation speed, passengers in the left-hand side window seats can see the Entoto Mountains rising above the airport terminal.
The captain pulls back on the control yoke and the plane’s nose lifts into the air. Though just 29, he has amassed more than 8,000 hours flight experience in nine years with the airline, including more than 1,000 in the 737.
Seconds later, the main gear leaves the ground and the sun-drenched landscape falls away. The plane is airborne, bound for Nairobi, Kenya.
8:38:44 a.m.: Just as the plane’s main gear lifts from the runway pavement something goes wrong with a sensor on the left-hand side of the nose. Perhaps a bird hits it. The sensor, called an angle-of-attack or AOA vane, measures the relative angle between the fuselage and the flow of air. If this angle gets too big, it means that the nose is too high and the plane is on the verge of a dangerous aerodynamic stall which could cause the wing to lose lift dramatically. As a safety feature, Boeing’s designers have equipped the plane with a system called MCAS that will automatically push the nose down when the angle of attack is too large. The broken sensor indicates, incorrectly, that the plane is now in such a state. The MCAS doesn’t kick in immediately, however, because it’s not designed to work when the plane is in takeoff configuration.
8:39:45 a.m.: One minute into the flight, the captain asks the first officer to raise the flaps — slatlike extensions that extend below the trailing edge of the wing to provide extra lift at low speeds — and he does so. As the flaps slide back under the wing, the plane is now in the state that MCAS was designed for.
8:39:55 a.m.: In a clear sign that something is amiss, the autopilot turns itself off. In the cabin the passengers are getting shaken as the plane rolls back and forth, bumping and sinking. The captain asks the first officer to call the control tower and say that they are having control problems.
8:40:00 a.m.: The MCAS activates. An electric motor drives a wheel by the captain’s knee, and with each rotation it makes a “beep.” The wheel is mechanically linked to the broad horizontal surface in the tail, the stabilizer, that moves the nose up and down. The MCAS’s command pitches the plane forward into a dive — an alarming sensation for the pilots, given that the plane is still just a few hundred feet above the ground. The passengers momentarily feel light in their seats, as though in a car cresting the top of a hill. The pilots respond immediately by pulling back on their control yokes. These move a smaller control surface on the back of the stabilizer called the elevator so that it drives the nose back up again. They also use a switch on their yokes to trim the stabilizer back up. By doing this they manage to stop the nose from dropping further, but the plane is still losing altitude. Then the MCAS kicks in again, moving the stabilizer so that it drops the nose even further. Now things are looking really dangerous.
In the back of the plane, it’s a bumpy ride. Something is clearly wrong, but it’s impossible for the passengers to guess what that might be.
8:40:35 a.m.: “Stab trim cut-out!” the first officer says — that is, the electrical trim system for the stabilizer must be disconnected. “Stab trim cut out!” The captain agrees. They recognize that they are experiencing a runway MCAS, a condition that destroyed Lion Air Flight 610 less than five months before. They flip a pair of switches that disables the trim system, and along with it the MCAS.
8:41:46 a.m.: The pilots have made a mistake that is easy to overlook amid the confusion, but which will have severe consequences. When they shut off the electric trim system to disable MCAS, they also shut off their ability to use the electric switch on the top of their yokes to trim the stabilizer back into a neutral position. The only way they can move it now is by cranking the wheel by hand. But because the stabilizer is positioned opposite to the elevator, there are strong aerodynamic forces pushing on it, effectively pinning it in place. The problem is made worse by another inadvertent mistake the pilots have made: They’ve left the engines at full takeoff power, which has caused the plane to accelerate to high speed. This adds to the pressure on the stabilizer. Try as they might to crank the stabilizer back into position by hand, the pilots can’t get it to budge.
8:42:10 a.m.: The captain asks the co-pilot to called air traffic control and ask them for permission to return to the airport. The co-pilot does this and permission is granted. Following ATC’s instructions, they turn the plane to the east. The plane makes a wobbly roll to the right, the wings quivering as it dips and rises in relation to the horizon. Soon the right wing is pointed sharply down as the plane’s turn steepens.
8:43:04 a.m.: For minutes now, the captain has been using brute physical force to pull the control yoke back in order to keep the plane’s nose from sinking. Now he asks the first officer to help him. It’s exhausting work, and they can’t keep it up forever. Because the engines remain at full power, the plane is flying right at the top end of its design speed. Any faster, and it risks getting torn apart.
It’s terrifying for a pilot to struggle to control his airplane, and the surge of intense fear makes it impossible to think creatively, an effect psychologists call “cognitive tunneling.” Failing to grasp that he should reduce engine power, and unable to think of any good way to get the stabilizer back into trim, the captain apparently settles on a desperate gambit: He will turn the electrical trim system back on, and hope that the system will allow him to put the stabilizer back in neutral trim.
8:43:11 a.m.: The captain briefly toggles the manual switch to trim the nose up, then toggles it again. He is tentative, as if testing to see how big an effect the move will have given the plane’s extremely high speed.
8:43:20 a.m.: The demon awakened by the restoration of electric trim reappears. MCAS kicks back in, pushing nose steeply down. There’s no reason for the system to deploy at this speed — it was added to the 737 Max to prevent unintended stalling at low speed, hardly a danger with the plane at the high end of its speed envelope — but its designers apparently failed to consider that this kind of situation might arise.
The captain and first officer pull back on their yokes with all their strength, but the nose plunges lower and lower, until they’re barreling toward the ground like a roller-coaster. The men are left hanging in their straps as the indicated airspeed blasts through its design envelope.
Any passengers not wearing their seat belts would be wrenched from their seats, dropped back down, then flung onto the ceiling as the plane’s dive steepens. The view out the window would have been of a sickeningly raked horizon, and the ground drawing nearer with palpable velocity.
8:43:45 a.m.: Ethiopian Airlines Flight 302 impacts a farm field at nearly 700 miles per hour, killing everyone aboard instantly and creating a crater 90 feet wide and 120 feet long. Wreckage is driven into the soil up to 30 feet deep.
