How flawed software and excess speed doomed an Ethiopian Airlines 737 MAX

PARIS/SEATTLE/SINGAPORE: Minutes after take-off, the pilots of an Ethiopian Airlines 737 MAX were caught in a bad situation.

A key sensor had been wrecked, possibly by hitting a foreign object, according to four aviation experts and two U.S. officials who were briefed on the flight data.

As soon as the pilots retracted the flaps and slats, according to flight data, the sensor began to feed faulty information into the Maneuvering Characteristics Augmentation System (MCAS), designed to prevent stalls.

Flying at full take-off power, according to the flight data, the crew then struggled with nose-down commands from MCAS, the four experts said. The high speed and the jet`s forward-leaning posture made it nearly impossible to use the controls to pull the nose up.

Moments later, the Boeing Co jet hit the ground, killing all 157 people onboard after six minutes of flight.

A complicated picture of what happened in the cockpit of Flight 302 on March 10 is emerging from the sparse commentary of a preliminary report and a new data plot showing how crew and technology interacted.

Ethiopia`s transport minister said on Thursday that the pilots followed all correct procedures in trying to keep the plane in the air.

"The preliminary report confirmed beyond reasonable doubt that the crew followed the right procedures," Ethiopian Airlines said in a statement to Reuters on Sunday. "Under the circumstances, with a number of simultaneous warnings in the cockpit, the crew have performed professionally."

The airline`s youngest-ever but highly-experienced captain, a 29-year-old with a lengthy 8,122 hours flying time, and his 25-year-old co-pilot, with 361 hours, left the engines at full take-off power. 

That would be an unusual step in a regular flight, according to four experts and five current and former pilots interviewed by Reuters, most of whom were not authorised to speak publicly.

"You would never, ever have full power for the whole flight," said Hart Langer, a veteran former senior vice president for flight operations at United Airlines.

The reason the pilots continued at full take-off power was not clear from the report. But it is not part of a usual procedure for dealing with the loss of key information such as the sensor data, the four experts said.

The Ethiopian Airlines statement suggested the crew left the throttles at takeoff power because they intended to continue to climb and were hampered by the nose-down commands of MCAS.

By the end, the aircraft was travelling at 500 knots (575 mph, 926 kph), far beyond Boeing`s operating limits. The Ethiopian Airlines statement said "no excess speed was noted at the initial phases of the flight."

The aircraft`s speed and its nose-down angle when MCAS switched on for the last time may have left them unable to fight flawed Boeing software that eventually sent the jet into an uncontrollable dive, the four experts said after studying the data. 

The Ethiopian Airlines crash, and another in Indonesia five months earlier, have left the world`s largest planemaker in crisis as its top-selling jetliner is grounded worldwide, and Ethiopia scrambling to protect one of Africa`s most successful companies.

All 737 MAX aircraft have been grounded and Boeing is working on an MCAS software fix and extra training that it says will prevent a repeat of such accidents.

Chief Executive Dennis Muilenburg said on Friday that both accidents were caused by a chain of events, "with a common chain link being erroneous activation of the aircraft`s MCAS function." 

BIRD STRIKE 

Sources who reviewed the crash data said the problems started barely 12 seconds after take-off.  A sudden spike in black box data was consistent with a bird or other debris hitting the plane as it was taking off, shearing away a vital airflow sensor, said the four experts and two U.S. officials.
Ethiopian Airlines on Sunday called that scenario "completely speculative".

Ethiopian investigator Amdye Ayalew Fanta said a preliminary report released by Ethiopian investigators did not contain any indications of this. Boeing said it would not comment on ongoing investigations.

As with the Lion Air crash in Indonesia, the damaged `angle of attack` sensor, which measures how the wing is cutting through the air, may have set off a volatile chain of events.

In both cases, the faulty sensor tricked the plane`s computer into thinking the aircraft was about to stall, or lose lift. The anti-stall MCAS software then pushed the nose down forcefully with the aircraft`s "trim" system, normally used to maintain level flight.

The first time the MCAS software kicked in, flight data shows the Ethiopian Airlines pilots reacted quickly by flicking switches under their thumbs - they had recognised the movements as the same type flight crews had been warned about after the Lion Air crash. 

But data shows they were not able to fully counteract the computer`s movements. At that point, they were a mere 3,000 feet above the airport, so low that a new warning - a computerised voice saying "don`t sink" - sounded in the cabin.

When MCAS triggered again, the jetliner`s trim was set to push the nose down at almost the maximum level, flight data shows, while the control yoke noisily vibrated with another stall warning called a "stick shaker." 

This time, the pilots countered MCAS more effectively, the experts said after studying the data. But when they turned off the system - as they were instructed to do by Boeing and the U.S. Federal Aviation Administration (FAA) in the wake of the Lion Air disaster - the nose was still pointed downward, leaving the jetliner vulnerable.

The combination of their speed and a nose-down attitude meant up to 50 pounds of force would be needed to move the control column, the four experts and one of the pilots said, and moving the manual trim wheels was impossible. 

`PULL UP, PULL UP`

The captain called out "pull up" three times, according to the cockpit voice recorder. The co-pilot reported problems to air traffic control. In the meantime, the aircraft`s speed remained abnormally high, the five pilots and four aviation experts said. 

The sensor problems and loss of airflow data would have affected airspeed information too. In such cases, pilots are trained to turn off automatic engine settings and control thrust manually, according to a Boeing checklist, the pilots told Reuters. 

Data confirms the engines stayed at nearly full power. Still, several experienced pilots said there was an array of stressful factors sapping the pilots` attention.

"As pilots have told us, erroneous activation of the MCAS function can add to what is already a high-workload environment," Muilenburg said Thursday. "It`s our responsibility to eliminate this risk." 

Among the distractions was a "clacker" warning telling the pilots their aircraft was going too fast. As the nose gradually fell, the captain asked the co-pilot to try to trim the plane manually using a wheel in the centre console to help the plane recover from the dive, according to the voice recorder. 

But it was too hard to move the wheel. Both men then tried to pitch the nose up together. The captain, according to the report, said it was not enough. 

MCAS RE-ACTIVATES

Data shows the MCAS-related systems were switched back on. That would also reactivate the electric trim system, making it easier to force the reluctant nose higher, the experts said.

Reactivating MCAS is contrary to advice issued by Boeing and the FAA after Lion Air. The report did not address that. The airline did not comment.

The pilots managed to lift the nose slightly using the electric thumb switches on their control yokes. But the data readout shows they flicked those switches only briefly.

With its power restored, a final MCAS command kicked in, eventually pushing the nose down to a 40 degree angle at 500 knots, far beyond the plane`s safe operating speed, defined by Boeing as 340 knots.

As the 737 MAX plunged, G-forces turned negative, pulling occupants out of their seats. Just six minutes after take off, the plane crashed into a field.