Aircraft Accidents and Lessons Unlearned XXXVII: Ethiopian Airlines Flight 302

The Ethiopian Airlines flight 302 (EA302) Interim Accident Report AI-01/19, was released March 9, 2020. It stated in the Executive Summary that on March 10, 2019, EA302, a Boeing 737-8 MAX, registration ET-AVJ, departed Addis Ababa Bole airport (HAAB) on a scheduled commercial flight. Almost five minutes later, the airliner impacted terrain twenty-eight nautical miles southeast of HAAB. What were the actual root causes – not probable causes – of this accident?

The accident was investigated by the Aircraft Accident Investigation Bureau (AIB) in Ethiopia, “… in accordance with the proclamation No 957/2016 and Annex 13 to the International Civil Aviation Organization (ICAO), which governs how member States of the ICAO conduct aircraft accident investigations internationally.” Contributors included the French Bureau d’Enquêtes et d’ Analyses (BEA), the Ethiopian Civil Aviation Authority (ECAA) and the National Transportation Safety Board (NTSB). AI-01/19 referred to a Maintenance and Airworthiness working group, but did the AIB employ inexperienced engineers to investigate maintenance issues, just like the NTSB does? An experienced avionics or mechanic-trained investigator would have asked the correct root cause questions.

On page 8, below AI-01/19’s FOREWORD, is the AIB disclaimer: “The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents; it is not the purpose of this activity to apportion blame or liability.” It could be argued that not only was Boeing singled out, but that responsibility was deflected from Ethiopian Airlines. In the wake of the Lion Air 610 (LA610) accident on October 29, 2018, the international community’s blaming of Boeing and the Federal Aviation Administration was based solely on speculation – no facts. However, both the LA610 report: KNKT 18.10.35.04, and the AI-01/19 Interim report, proved those accusations misdirected.

Boeing delivered the first B737-MAX into service on May 16, 2017. In the first year alone, 130 B737-MAXs had been delivered, flying over 41,000 successful flight cycles (118,000 flight hours). Had the LA610 or the EA302 accident reports referenced if any of the other thirty-five B737-MAX operators had similar autopilot problems? Did the other operators even experience these problems? If they did, did they call Boeing for help? And, if there were no other similar problems, would the AIB have reported it or did they omit that information? What about where the LA610 report described how Lion Air ignored maintenance issues related to the accident? Ethiopian Airlines took their first B737-MAX delivery on June 30, 2018. Is it realistic that Ethiopian Airlines flew the B737-MAX for 252 days with no similar autopilot issues in their entire fleet? Possible, but not likely. Then, at what point does the aircraft’s unsafe handling become the air operator’s responsibility? After all, the B737-MAX had a solid, proven record.

To be clear, any aircraft mechanic with modern aircraft technology experience would understand that in everyday operation, some anomalies can ‘sleep’ for months while other problems cannot. A structural problem could sleep; it could take many months or years for a structural problem to manifest itself, like a casting defect, composite delamination or subsurface corrosion. However, avionics problems are different; they rarely sleep, especially when systems, such as autopilot avionics, had been used regularly for close to 60,000 flight cycles – not hours but cycles – in eighteen months. Was it feasible for autopilot anomalies to sleep for eighteen months? Again, possible, but not likely.

The Ethiopian Minister of Transport (EMT) stated in the April 4, 2019, Preliminary report, “The crew performed all the procedures repeatedly provided by the manufacturer [Boeing] but was unable to control the aircraft.” If the EMT’s statement was accurate, why omit it from AI-01/19? What procedures did the EMT refer to? Did the EMT ever produce these reckless ‘Boeing’ procedures? If not, why not?

The EMT’s remark directly reflects on Boeing’s experience. The EMT claimed Boeing wrote procedures that put EA302 in danger. In fact, neither Boeing, nor any other manufacturer, would write procedures directing the pilots to repeatedly engage a system that was clearly malfunctioning. For one, the pilots’ attention should have been on flying the aircraft, not on fixing issues that were best troubleshot on the ground.

For two, pilots do not receive maintenance or avionics training; they have no experience in this field and should not troubleshoot or try to ‘fix’ anything in flight; in other words, ‘Pilots are not Mechanics’. And the third point is, by continually forcing a broken system to engage increases the chances that the problem will get worse, as what appeared to happen with EA302. Ironically, the NTSB, who pushed the ‘broken Boeing design’ theory, did not recognize this scenario, even though it mirrored what happened with their Alaska Airlines 261 investigation. In that accident, the aircraft would have landed safely, except the pilots kept troubleshooting the horizontal stabilizer, until it irretrievably broke away from the jackscrew.

The EA302 pilots experienced problems with Autopilot right away; the left and right angle of attack (AOA) vanes deviated from each other shortly after departing HAAB. However, despite the AOA deviations, stabilizer trim problems and gauge disagreements, the pilots repeatedly tried to force the autopilot to engage. Even when the left stick shaker announced an imminent stall (non-stop, from ten seconds into the flight until impact five minutes later) and the erratic actions of various autopilot systems, the pilots tried forcing the autopilot to engage FOUR … SEPARATE … TIMES. And what were EA302’s Standby instruments reading? Did the AIB check the Standby with the flight recorder data? Did the AIB question why there was a delayed turnback when the control columns required greater-than-normal physical exertion to move or when control did not improve? Was an emergency declared? Why did the pilots fly away from HAAB at 238 knots (273 miles per hour), instead of circling above? This action increased the flight time for EA302’s eventual inflight turnback. Did Ethiopian Airlines train their pilots to fixate on the autopilot or were these the ‘phantom procedures’ the EMT said Boeing wrote?

One likely answer: Ethiopian Airline’s cultural practices dictated their operational procedures. Had Ethiopian Airlines discouraged their pilots from inflight turnarounds or diversions? Why would they? Because deviations cost the airline money and time. A discouraged inflight diversion was the root cause for Avianca 52, another State-owned airline. Avianca dissuaded their pilots from diverting from their scheduled destination, JFK airport. The airliner circled for too long; their fuel burned too low to divert to Boston and they crashed in Cove Neck, New York, fifteen miles from JFK, flying on fumes.

With EA302, it took an aviation eternity of three and a half minutes of failed troubleshooting before the captain requested a return to HAAB. That … was the root cause of this accident; a failure to recognize the decaying situation and make the decision to return. Has this happened before? Yes, many airline and aerospace disasters resulted from Management pushing to save time and/or money. None were more infamous than the Space Shuttles Columbia and Challenger, which were two proven vehicles (just like the B737). The shuttles’ explosive ends were a metaphor for operator mismanagement; for taking the decision process away from the Experienced and giving it to the Bean Counters.

A second reason to blame culture was that one of the B737-MAX’s selling points was how having the computer fly the aircraft was more economical. A pilot enters the route into the auto flight system, engages, then just monitors. Unfortunately, once airborne, EA302’s autopilot could not engage – despite the FOUR forced attempts. The pilots became fixated on the autopilot and fighting the aircraft to maintain level flight. They embodied Einstein’s Insanity definition: “Doing the same thing over and over again and expecting different results.” When the autopilot repeatedly kicked off, the airplane was telling the pilots, ‘No! Stop! Think! It’s not working! Go back to HAAB!’ Even in aviation, No means NO!

Boeing is a manufacturer; they build aircraft and components designed to make their customers money. The B737-MAX is fundamentally a proven airliner with newer technologies. The B737-MAX’s advances mean the computer flies the aircraft more efficiently; it makes quicker, more precise flight adjustments than a pilot could make. This … is what air operators demand: the design of newer technologies.

Consequently, Boeing can only teach an operator how to correctly use the new B737-MAX tech; Boeing cannot dictate to operators how to fly it in revenue service. Boeing cannot prevent an operator’s misuse – or abuse – of the technology’s intent. Any tech improvement is a privilege the manufacturer provides. It is not an operator’s right to mishandle the tech. In an aircraft, tech is a compliant servant; its purpose is to provide help and relief; its potential is to be respected, not abused. Why? Because, if given the chance, the tech becomes an unforgiving master; it has neither patience nor empathy. Perhaps Boeing’s error was turning the pilot into a passenger with a front row seat. When airlines insist on the computer flying, the pilots become wholly reliant – subservient? – to the tech; some become lost without it; pilots lose their proficiency. More and more pilot decisions are then entrusted to the computer.

Another concern: Ethiopian Airlines is Ethiopia’s flag carrier; the ICAO Member State of Ethiopia owns the airline. This means the Ethiopian government (AIB) investigated its own airline, its own self. Can a government objectively investigate itself? Historically speaking? No! For example, in 1999, Egypt Air flight 990 crashed in the Atlantic. The NTSB reported that the first officer deliberately crashed the aircraft. The State of Egypt, which owns Egypt Air, pushed back against the NTSB’s overwhelming evidence, claiming that Egypt Air 990 crashed due to ‘mechanical problems.’ The EA302 accident was front and center on the world stage; Ethiopia Airline’s culture – and by association, Ethiopia itself – was under the ICAO microscope. How could the AIB be impartial?

Another missed issue: A Business Insider article dated May 21, 2019, stated that EA302’s AOA sensor was damaged by a bird strike. Was this feasible? Possible, but highly unlikely. But, perhaps EA302’s fate closely paralleled National Airlines 102 in one respect: the AIB – just like the NTSB – failed to ask an important question: What differed from the aircraft’s previous takeoff and the accident flight’s takeoff? With National Air 102, it was the crippling landing in Bagram with overweight cargo. With EA302, the plane was serviced on the ground in HAAB.

When EA302 was being serviced before the accident flight, there was heavy activity around the airliner. Ramp equipment, like an air conditioner cart, a baggage cart or food truck, could have easily damaged an AOA vane. Did Ethiopian Airlines terminate employees who damaged an aircraft? If so, what was the incentive for someone to report damage? Did the AIB ignore the possibility of an aircraft strike?

A few last questions: The AIB, NTSB, BEA, ECAA and others all agreed that Boeing’s auto flight design was flawed. What AIB expert determined that? How was it determined? Where is their incriminating data? The AIB, NTSB, BEA, ECAA, ICAO all lack the necessary technical expertise to judge Boeing’s design. Instead, they delivered exaggeration and speculation, no improvements to safety.

Investigation root causes are meant to be learned for prevention, not shelved to be forgotten. There is an old saying, ‘If you know the facts, argue the facts; if you know the law; argue the law. If you have neither, bang the table.’ Interim report AI-01/19 gives the impression of ‘table-banging’ about it.