Aircraft Accident Investigation Bureau Interim report March, 2020 ?Harm auntc - 9 MAR 2020 mm mm hit-Mae "I'm l'utl yr? 33.? .: i '3 I ll'; 'l'l1'2ll The International Civil Aviation Organization (ICAO), Montreal, (CANADA) National Transportation Safety Board, USA BEA, France Subject: - Interim Investigation Report of accident 737-8 MAX ET-AVJ. ET-302 The Federal Democratic Republic of Ethiopia Minster of Transport compliments to the International Civil Aviation Organization, as per the ICAO annex 13 the Interim Report of the investigation ET-302, in this regard we have attached the interim report of the accident with this letter and the ?nal report is on progress. With kind Regards, pian Airlines Group Addis Ababa +251 ?5 518292 '5 +251 "5515023 +25] 115 518049 1238 ll'l? hm'l'? \l In l'n\l Aircraft Accident Investigation Bureau Interim report March, 2020 The Federal Democratic Republic of Ethiopia Ministry of Transport Aircraft Accident Investigation Bureau Interim Investigation Report on Accident to the B737-8 (MAX) Registered ET-AVJ operated by Ethiopian Airlines On 10 March 2019 09 March, 2020 Report No. AI-01/19 Aircraft Accident Investigation Bureau Interim report March, 2020 Table of Content s Table of Contents ............................................................................................................................................................. 3 Foreword .............................................................................................................................................................................. 5 I.Organisation of the Investigation .............................................................................................................................. 6 Acronyms.............................................................................................................................................................................. 7 ii.Synopsis ........................................................................................................................................................................... 10 III. Executive summary............................................................................................................................................. 10 1. Factual Information ............................................................................................................................................ 11 1.1 History of the Flight........................................................................................................................................... 11 1.2 Injuries to Persons ............................................................................................................................................. 18 1.3 Damage to Aircraft ............................................................................................................................................. 18 1.4 Other Damage ...................................................................................................................................................... 18 1.5 Personnel Information ..................................................................................................................................... 18 Flight Crew .................................................................................................................................................. 18 1.5.1 1.6 Aircraft Information .......................................................................................................................................... 21 1.6.1 General .......................................................................................................................................................... 21 1.6.2 Engines.......................................................................................................................................................... 28 1.6.3 Airplane Systems Description ............................................................................................................. 30 1.6.4 Weight and Balance ................................................................................................................................. 52 1.7 Meteorological Information ........................................................................................................................... 52 1.8 Aids to Navigation .............................................................................................................................................. 54 1.9 Communication ................................................................................................................................................... 55 1.10 Aerodrome Information .................................................................................................................................. 55 1.10.1 RWY and TWY Markings and LGT ..................................................................................................... 56 1.10.2 Infrastructure ............................................................................................................................................. 56 1.11 Flight Recorders.................................................................................................................................................. 57 1.11.1 Digital Flight Data Recorder ................................................................................................................. 58 1.11.2 Cockpit Voice Recorder .......................................................................................................................... 62 1.12 Wreckage and Impact Information ............................................................................................................. 63 1.12.1 Recovered Wreckage Examination ................................................................................................... 69 1.13 Medical and Pathological Information ...................................................................................................... 77 1.14 Fire ........................................................................................................................................................................... 77 1.15 Survival Aspects.................................................................................................................................................. 77 1.16 Test and Research .............................................................................................................................................. 77 1.16.1 Simulator assessment of control column and trim wheel force............................................ 77 1.16.2 Engineering simulator and flight control test rig assesments ............................................... 80 1.16.3 angle of attack ............................................................................................................................................ 82 1.16.4 Airplane behavior under CMD A ..................................................................................................... 100 1.16.5 Alerts and Warning ............................................................................................................................... 104 1.17 Organizational and Management Information .................................................................................... 107 1.17.1 Aircraft Operator ................................................................................................................................... 107 1.17.2 Hazard Identification as Part of Safety Risk Management ................................................... 109 1.17.3 Federal Aviation Administration (FAA) Aircraft Certification............................................ 110 1.17.4 Maneuvering Characteristics Augmentation System (Mcas) .............................................. 118 1.17.5 Ethiopian Type Certificate Acceptance Process ........................................................................ 125 1.17.6 Airworthiness Regulations ................................................................................................................ 125 2. ANalysis ................................................................................................................................................................ 130 Aircraft Accident Investigation Bureau Interim report 3. 3.1 March, 2020 conclusions .......................................................................................................................................................... 130 Findings ............................................................................................................................................................... 130 4. Safety Recommendations .............................................................................................................................. 132 5. appendices ........................................................................................................................................................... 133 Aircraft Accident Investigation Bureau Interim report March, 2020 FOREWORD The Aircraft Accident Investigation Bureau of Ethiopia The AircraftAccident Investigation Bureau (AIB) is the investigation authority in Ethiopia responsible to the Ministry of Transport for the investigation of civil aircraft accidents and serious incidents in Ethiopia. The mission of the AIB is to promote aviation safety through the conduct of independent, separate investigations without prejudice to any judicial or administrative action consistent with Annex 13 to the Convention on International Civil Aviation. The AIB conducts the investigations in accordance with the proclamation No 957/2016 and Annex 13 to the Convention on International Civil Aviation Organization, which governs how member States of the International Civil Aviation Organization (ICAO) conduct aircraft accident investigations internationally. The investigation process involves the gathering, recording and analysis of all available information on the accidents and incidents; determination of the causes and/or contributing factors; identification of safety issues; issuance of safety recommendations to address these safety issues; and completion of the investigation report. In carrying out the investigations, the AIB will adhere to ICAO’s stated objective, which is as follows: “The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents; it is not the purpose of this activity to apportion blame or liability’’. Aircraft Accident Investigation Bureau Interim report March, 2020 I.ORGANISATION OF THE INVESTIGATION On 10th March 2019 at around 05:47, FDRE Ministry of Transport and AIB were informed the loss of radio and radar contact with flight ET 302 a few minutes after take-off from Addis Ababa Bole International Airport. After having established without doubt that the Aircraft had disappeared, the Ethiopian Authorities launched a technical investigation team. In accordance with article 26 of the Convention and ICAO Annex 13 “Aircraft Accident and Incident Investigation”, an Investigation Committee (IC) from Ethiopian AIB investigators was formed by a ministerial decree issued by the Minister of Transport in order to conduct the technical investigation. An investigator-incharge (IIC) was designated in the same decree to lead and initiate the investigation immediately. As per Annex 13 provisions, in the investigation participated: ECAA and Ethiopian Airlines Group - Technical Advisors to AIB NTSB - Accredited Representative State of Design and Manufacturer BEA - Accredited representative, State which provided facilities & experts for the read out of DFDR & CVR As per the Ethiopian Government decision and agreement between the FDRE Ministry of Transport and the French Bureau d’Enquêtes et d’ Analyses pour la sécurité de l’aviation civile (BEA), the DFDR and CVR were read at the BEA facilities at Le Bourget, near Paris, France. Both recorders were transported directly to the BEA under the custody of the State of Occurrence accompanied by members from the AIB and readings were performed by BEA personnel in association with and under the direct supervision of the IIC. On request of Ethiopia and as per Annex 13 Article 5.23, BEA has appointed an accredited representative and assisted AIB for the analysis of FDR data. For this investigation, working groups were initially built up as follows: • Operations • Maintenance & Airworthiness • Power plant • DFDR and CVR Later on the group merged into operations, systems and DFDR- CVR groups until this interim report published. A Search & Rescue (SAR) team performed search by Ethiopian Air force, Ethiopian Airlines Group and Abyssinian flight service. Search operations were conducted in full coordination with Federal, Regional police and other Government bodies. At the time of the publication of this interim report, the final report is under progress. Aircraft Accident Investigation Bureau Interim report March, 2020 Acronyms ADIRS Air Data Inertial Reference System ADIRU Air Data Inertial Reference Unit ADM Air Data Module ADR Air Data Reference/Air Data System ADC Air Data Computer AFCS Automatic Flight Control System AFDS Automatic Flight Director System AGB Accessory Gear Box AGL Above ground Level AFM Aircraft Flight manual AIB Accident Investigation Bureau AMM Aircraft Maintenance Manual AND Aircraft Nose Down AOA Angle Of Attack A/P Auto Pilot APU Auxiliary Power Unit A/T Auto-Throttle ATC Air Traffic Control AT Auto throttle BEA Bureau d’Enquêteset d’Analyses pour la sécurité de l’aviation civile BOV Bias Out of View CAS Computed Air Speed CG Center of Gravity CGO Cargo CLB Climb CMD CSMU Command – Auto pilot may engage in command (CMD) or in Control Wheel Steering (CWS) Crash survivable Memory Unit CVR Cockpit Voice Recorder CWS Control Wheel Steering DEU Display Electronic Unit DFDAU Digital Flight Data Acquisition Unit DFCS Digital Flight Control System DPC Display Processing Computer DU Display Unit EASA European Aviation Safety Agency ECAA Ethiopian Civil Aviation Authority ECAB Engineering cabin ECARAS Ethiopian Civil Aviation Rules and Standards EDFCS Enhanced Digital Flight control system EEC Engine Electronic Control Aircraft Accident Investigation Bureau Interim report EFS March, 2020 EGPWS Elevator Feel System. Inside the whole document, EFS is never used for Elevator Feel Shift function. Enhanced Ground Proximity Warning System EGT Engine Temperature EIS Entry to Service FAA Federal Aviation Administration FCC Flight Control Computer FCOM Flight Crew Operating Manual FCTM Flight Crew Training Manual F/D Flight Director F/O First Officer FDAU Flight Data Acquisition Unit FDR Flight Data Recorder FL Flight Level FMA Flight Mode Annunciator FMC Flight Management Computer GA Go Around GPS Global Positioning System GPWS Ground Proximity Warning System GVI General Visual Inspection HDG Heading HPC High pressure compressor HPT High Pressure Turbine IC Investigation committee ICAO International Civil Aviation Organization IFSO In-flight Security Officer IIC Investigator In Charge IRS Inertial Reference System ISFD Integrated Standby Flight Display LMC Last Minute Change LE Leading Edge LH/RH Left Hand, Right Hand LNAV Lateral Navigation (A/P mode) LPT Low pressure Turbine MAC Mean Aerodynamic Chord MCAS Maneuvering Characteristics Augmentation System MCP Mode Control Panel MLB Maintenance Log Book MMO Mach Number – Maximum Operating value MRO Maintenance Repair Organization MSA Minimum Safe Altitude NCD No Computed Data NM Nautical Miles Aircraft Accident Investigation Bureau Interim report March, 2020 NOTAM Notice to Air Men NTSB National Transportation Safety Board PCU Power Control Unit PF Pilot Flying PFD Primary Flight Display PLI Pitch Limit Indicator QNH QRH Question Normal Height – Altimeter sub-scale setting to obtain elevation when on the ground Quick Reference Handbook RA Radio Altitude RH Right Hand RWY Runway SAE Safran A/C Engine SAR Search and Rescue SAT Static Air Temperature SMYDC Stall Management and Yaw Damper Computer SPD Speed SSM Status Sign Matrix STS Speed Trim. System SWS Stall Warning System TAS True Air Speed TAT Total Air Temperature TCDS Type Certificate data Sheet TE Trailing Edge THR HLD Thrust Hold (A/T mode) TGB Transfer Gear Box TO Take off mode TRA Throttle Resolver Angle UTC Coordinated Universal Time VHF Very High Frequency VMO Velocity – Maximum Operating value VNAV Vertical Navigation (A/P mode) VS Vertical Speed YD Yaw Damper Aircraft Accident Investigation Bureau Interim report March, 2020 II.SYNOPSIS The Accident was notified by the operator/ATC to the Accident Investigation Bureau the same day right after the accident occurred. Aircraft Date and time Operator Place of the Accident Type of flight Persons on board Consequences and damage Boeing 737-8MAX registered ET-AVJ 10 March 2019 at 05:44 UTC Ethiopian Airlines Group 28 NM South East of Addis Ababa Bole International Airport Scheduled passengers flight ET-302 Addis Ababa (Ethiopia) – Jomo Kenyatta (Kenya) Captain; First-Officer; 5 Cabin Crew; 1 In Flight Security Officer (IFSO); 149 passengers from different countries with different nationalities 157 fatalities; aircraft destroyed TABLE1: SYNOPSIS III. EXECUTIVE SUMMARY On March 10, 2019, at 05:38 UTC, Ethiopian Airlines flight 302, Boeing 737-8(MAX), ET-AVJ, Took off from Addis Ababa Bole International Airport bound to Nairobi, Kenya Jomo Kenyatta International Airport. ET 302 was being operated under the provisions of the Ethiopian Civil Aviation Regulations (ECARAS) as a scheduled international flight between Addis Ababa Bole International Airport (HAAB), Ethiopia andJomo Kenyatta Int. (HKJK) Nairobi, Kenya. It departed Addis Ababa with 157 persons on board: 2 flight crew (a Captain and a First Officer), 5 cabin crew and one IFSO, 149 regular passagers. At 05:36:12 the airplane lined up on runway 07R at field elevation of 7,656 ft with flap setting of 5 degrees and a stabilizer trim setting of 5.6 units1.Both flight directors (F/D) were ON with LNAV and VNAV modes armed.At 05:37:17the F/O reported to Tower ready for takeoff and at 05:37:36ATC issued take off clearance to ET-302 and advised to contact radar on 119.7 MHz. The takeoff roll and lift-off was normal, including normal values of left and right angle-of-attack (AOA). During takeoff roll, the engines stabilized at about 94% N1. Shortly after liftoff, the left Angle of Attack sensor recorded value became erroneous and the left stick shaker activated and remained active until near the end of the recording. In addition, the airspeed and altitude values from the left air data system began deviating from the corresponding right side values. The left and right recorded AOA values began deviating. Left AOA decreased to 11.1° then increased to 35.7° while the right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a maximum value of 15.3°, the difference between LH and RH AOA was greater than 59°and continued until the end of the recording. At 05:39:30, the radar controller identified ET-302 and instructed to climb FL 340 and when able to turn right direct to RUDOL. At 5:39:51, the selected heading increased from 072° to 197°. As soon as the flaps were retracted the1st automatic nose-down trim activated and engaged for 9 seconds positioning the stabilizer trim to 2.1 units. The pilot flying pulled to pitch up the airplane with a force greater than 90lbs. At 5:40:22, the second automatic nose-down trim activated. Following nose-down trim activation GPWS DON’T SINK sounded for 3 seconds and “PULL UP” also displayed on PFD for 3 seconds. At 05:40:43, approximately five seconds after the end of the crew manual electrical trim up inputs, a third automatic trim nose-down activated. Aircraft Accident Investigation Bureau Interim report March, 2020 At 05:40:50, the captain told the F/O:“advise we would like to maintain one four thousand. We have flight control problem”. The F/O complied and the request was approved by ATC. Following the approval of the ATC, the new target altitude of 14000ft was set on the MCP.The Captain was unable to maintain the flight path and requested to return back to the departure airport.At 05:43:21, approximately five seconds after the last manual electric trim up input, an automatic nose-down trimactivated for about 5 s. The stabilizer moved from 2.3 to 1 unit. The rate of climb decreased followed by a descentin 3 s after the automatic trim activation. One second before the end of the automatic trim activation, the average force applied by the crew decreased from 100 lbs to 78 lbs in 3.5 seconds. In these 3.5 seconds, the pitch angle dropped from 0.5° nose up to -7.8° nose down and the descent rate increased from -100 ft/min to more than -5,000 ft/min. Following the last automatic trim activation and despite recorded force of up to 180 lbs, the pitch continued decreasing. The descent rate and the airspeed continued increasingbetween the triggering of the 4th automatic trim activation and the last recorded parameter value. At the end of the flight, Computed airspeed values reached 500kt, Pitch values were greater than 40° nose down and descent rate values were greater than 33,000 ft/min.Finally; both recorders stopped recording at around 05 h 43 min 44 s. At 05: 44 :The Aircraft impacted terrain 28 NM South East of Addis Ababa near Ejere( located 8.8770 N, 39.2516 E.) villageat a farm field and created a crater approximately 10 meters deep (last aircraft part found) with a hole of about 28 meters width and 40 meters length. Most of the wreckage was found buried in the ground; small fragments of the aircraft were found scattered around the site in an area by about 200 meters width and 300 meters long. The damages to the aircraft are consistent with a high energy impact. All 157 persons on board: 2 flight crew (a Captain and a First Officer), 5 cabin crew and one IFSO, 149 regular passagers were fatally injured. Aircraft Accident Investigation Bureau Interim report March, 2020 INTENTIONALL LEFT BLANCK Aircraft Accident Investigation Bureau Interim report March, 2020 1. FACTUAL INFORMATION 1.1 HISTORY OF THE FLIGHT On March 10, 2019, at about 05:44 UTC2, Ethiopian Airlines flight ET-302, a Boeing 737-MAX 8, Ethiopian registration ET-AVJ, crashed shortly after takeoff from Addis Ababa Bole International Airport (HAAB), South East of Addis Ababa near Ejere Town. The flight was a regular scheduled international passenger flight from Addis Ababa to Jomo Kenyatta International Airport (HKJK), Nairobi, Kenya. There were 157 passengers and crew on board. All were fatally injured, and the aircraft was destroyed. The following chronological history of flight was reproduced from verified data retrieved from the aircraft DFDR, CVR, Air Traffic Control (ATC) recordings and radar transcripts. According to the CVR data and the control column forces recorded in the DFDR, the captain was the pilot flying. Phase1:From takeoff to Autopilot engagement(from 5h 36 min 12 s until 5h 39 min 23 s) At 5:36:12 the airplane lined up on runway 07R at field elevation of 7,656 ft with a flap setting of 5 degrees and a stabilizer trim setting of 5.6 units3.Both flight directors (F/D) were ON with LNAV and VNAV modes armed. Auto throttle (A/T) was armed. At 05:37:17the F/O reported to Tower ready for takeoff. ATC advised the crew to stand by. The F/O confirmed standing by. At 05:37:36, ATC issued take off clearance to ET-302 and advised to contact radar on 119.7 MHz. Following the take-off clearance, the crew advanced the throttle and checked the stability of the engines parameters. At 05:37:51, take-off roll began from runway 07R At 5:37:53, the crew engaged the automatic takeoff and climb sequence (F/D TO mode and A/T TO sequence) by pushing the TOGA switch and the A/T moved the throttles forward. The takeoff roll and lift-off was normal, including normal values of left and right angle-of-attack (AOA). During takeoff roll, the engines stabilized at about 94% N1. From this point for most of the flight, the N1 Reference remained about 94%. At 05:38:14the F/O called 80 knots. At 05:38:32 Automatic V1 call 2 All times listed is Universal Coordinated Time (UTC), as recorded on the FDR. 3 The value of 5.6 unit was a consistent setting for the takeoff. The stabilizer positions rangesfrom 0 unit nose down to 17 unit nose up. A value of 4 unit corresponds to a neutral position. 11 Aircraft Accident Investigation Bureau Interim report March, 2020 Once VR was reached, at 05:38:34 the F/O called “rotate” and the aircraft liftoff. At 05:38:43 “positive rate” confirmed, at about 50 ft radio altitude, the flight director roll mode changed to LNAV. At 05:38:44, shortly after liftoff, the left and right recorded AOA values began deviating. Left AOA decreased to 11.1° then increased to 35.7° while value of right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a maximum value of 15.3°, the difference between LH and RH AOA was greater than59°and continued to be until the final loss of control. At the same time: - As a result of the erroneous left AOA value, the left stick shaker activated and the red and black stripe band exceeded the displayed LH airspeed. The left stick shaker remained active until near the end of the recording. - Right and left altitude and airspeed indications started diverging (the computations of LH values were affected by erroneous LH AOA values). From that time: - LH displayed altitude values were lower than the actual pressure altitude values displayed on the RH side. - LH displayed airspeed values were lower than the actual airspeed values displayed on the RH side. - RH and LH pitch F/D bar positions started displaying different commands (erroneous LH AOA values affected the computation of LH F/D). At 05:38:46: - Pitch F/D bars disappeared (“Bias Out of View” – BOV) on both RH and LH Primary Flight Displays (PFD), as the threshold for the comparator between LH and RH F/D pitch display below 400ft RA was reached. - On the LH PFD, invalid operational speeds, corrupted by the erroneous left AOA value, were displayed (LH stick shaker speed and LH minimum operation speed were always greater than the LH computed airspeed).The current LH airspeed was inside the barber band of the speed tape (black and red stripes underlying a dangerously too low speed). At 5:38:48, Anti-ice was annunciated, bya master caution.The F/O called out “Master caution/anti ice” and the captain acknowledged the master caution. At 05:38:56the captain stated “command” to engage the auto pilot (A/P). A/P disconnect warning sounded for 2 seconds. At 5:38:59, as the airplane crossed 400 ft Radio Altitude, VNAV mode engaged. From that time, the F/D TO mode and associated pitch comparator was no longer active and the F/D pitch bars reappeared. - VNAV pushbutton light illuminated. - LNAV pushbutton light illuminated again. 12 Aircraft Accident Investigation Bureau Interim report March, 2020 At 05:39:01, the captain called out “Command” again. A/P disconnection warning sounded for 2 seconds. At 05:39:12, the F/O contacted ATC radar, calling out a “SHALA 2A departure, crossing 8.400 ft”. At the time the RH baro-corrected altitude recorded values reached 8,400 ft, the LH barocorrected altitude values were about 400 ft lower. During that communication, HDG select mode was manually engaged. The heading displayed on the MCP was 0720 which is cositent with runway heading for RWY 07R. During this first phase of the flight, the airplane was kept in trim through the use of the manual electrical trim commands, there was limited force required on the control column. Before CMD A engaged, the stabilizertrim position was around 5.6 units, with elevator positions around 4° (consistent with the elevator neutral position for the stabilized flight condition). Phase 2: During Autopilot control (from 5h 39 min 23 s until 5h 39 min 56s) At 05:39:23, at about 1,000 feet Radio Altitude, the crew attempted a third auto-pilot engagement. CMD A (LH autopilot) engaged in HDG/VNAV modes. The pitch trim position decreased to 4.6 units. Six seconds after the autopilot engagement, there were small amplitude roll oscillations (± 5° of bank) accompanied by lateral acceleration, rudder oscillations and slight heading changes. This was most likely the result of reduced yaw damper gains due to erroneous LH AOA values.These oscillations also continued after the autopilot was disengaged. While the autopilot was engaged,systems continued to be suppliedby the erroneous LH AOA values. As a result, SMYDC4-1 computed erroneous LH minimum operational speed values higher than the current LH computed airspeed and the FMC selected airspeed. As the LH minimum operational speed was greater than the FMC selected speed at that time, speed reversion occurred (selection of the erroneous minimum operational speed as target speed) and autopilot commanded a pitch down to accelerate towards the erroneous minimum operating speed. At 05:39:30, the radar controller identified ET-302 and instructed to climb FL 340 and when able to turn right direct to RUDOL. At 05:39:37, the F/O read back the clearance to the ATC. At 5:39:38: 800 ft above field elevation was reached with the reference of the LH barocorrected altitude reference. As per automatic takeoff and climb sequence design, the A/T switched to the ARM mode. At 05:39:42, the crew engaged Level Change mode and set MCP speed to 238kt. At 05:39:45, flaps retraction was commanded by the captain and the F/O complied. 4 Stall Management and Yaw Damper Computer 13 Aircraft Accident Investigation Bureau Interim report March, 2020 At 5:39:51, selected heading increased from 072° to 197°. At the same time, the captain told the F/O to advise ATC that they were “unable and request to maintain runway heading” At 05:39:56, A/P disconnected automatically after remaining engaged for 32 seconds as the following logic conditions were reached:  Climb command with climb rate too low for five seconds  Airspeed low relative to the minimum operating speed which was erroneously calculated by the SMYD-1. At the beginning of this phase, the airplane was climbing with an increasing vertical speed and a trend to pitch up. Oncethe autopilot engaged the autopilot tried to increase the airspeed, because of the minimum speed reversion (erroneous LH minimum operational speed based on erroneous LH AOA value). The A/P initially trimmed nose down 0.5 units. This nose-down trim stopped the increase in pitch at8.4°.Then pitch started to decrease. It also stopped the increase in vertical speed at 1,500 ft/min which then also started to decrease. A/P commanded a second nose-down trim. The engagement of the LVL CHG mode and the selection of a new target speed most probably led to several transient AP mode computations leading to the decrease in vertical speed to stop at around 450 ft/min and the pitch values to stabilize at around 4°. After that, the erroneous excessive minimum speed related to the erroneous AOA triggered again an AP pitch down order to increase the speed. After reaching a maximum altitude of around 9,100 ft (RH baro corrected altitude) during this phase, the airplane started descending. At the end of this phase, the pitch angle was around 1°, the stabilizer was at 4.6 units and the vertical speed was around -1,400 ft/min but Flaps were still moving up. Phase 3: From A/P disconnect to stabilizer trim cutout (from 5h 39 min 56 s until 5h 40 min 38s) At the time A/P disconnected, LH pitch F/D bar disappeared due to the same logic conditions that caused the AP disconnect.The LH pitch F/D bar appeared and disappeared several times as the climb rate varied above and below the minimum threshold.The PF applied an increasing force towards pitch up. Between5:39:59 and 5:40:02 the captain said:”Request to maintain runway heading; “We are having flight control problems ». 14 Aircraft Accident Investigation Bureau Interim report March, 2020 During this transmission: At 5:40:00:As the flaps reached the up position and the autopilot was OFF, the FCC activated the 1st automatic nose down trim for a duration of 9 seconds triggered by erroneous left AOA value.Three seconds after the automatic nose-down trim. o On the LH PFD, red and black stripes band was displayed all along the speed tape. It stayed displayed until the end of the recording. The LH computed airspeed was 246 kt while the RH computed airspeed was 267 kt. o GPWS DON’T SINK warning sounded for 3 seconds. o PULL UP message appeared on both PFD for 14 seconds. At 5:40:06, the F/O advised ATC that they are unable to maintain SHALA 1A and the captain reminded him to request runway heading. This request was approved by ATC. At the end of the first automatic nose-downtrim activation; the stabilizer position was 2.1 units with the PF pulling to pitch up the airplane, with a force greater than 90lbs. At 5:40:14, the crew trimmed up for about2 seconds. The trim reached 2.3 units. At 5:40:22, the secondautomatic nose-downtrimactivated. Following nose-down trim activation, GPWS DON’T SINK sounded for 3 s and PULL UP also displayed on PFD for 3 s. At 5:40:29, the captain asked the F/O to trim up with him. Manual electrical trim up were recorded (from 5 h 40 min 28 s) for 9 s, which stopped the second automatic nose-downtrim activation before its expected end (automatic nose-down trim activated for around 7 s instead of 9 s). During manual electrical trim up, GPWS DON’T SINK warnings triggered twice for around 3 s each time. After 9 s of manual electric trim up, the crew discussed to cutout the stab trim, which is done at about 5 h 40 min 38 s. During this phase: - At the beginning, FMC detected a significant difference between the RH and LH True Airspeed (erroneous LH ADIRUcomputed values due to erroneous LH AOA value). From this time, FMC did not send any valid commandto A/T. The A/T stayed in the Arm Mode. The loss of valid FMC commanddid not triggerany alert or mode reversion. - As a result of the erroneous LH AOA value and the increasing airspeed, SMYDC 1 computed LH minimum operational speed and LH stick shaker speed greater thanVMO (340 kt) without any alert or invalidity detection. At the end of this phase: - the stabilizer position was at 2.3 units, - Theairplane was 1,500 ft above the airfield elevation (computed from the RH pressure altitude). But, the LH pressure altitude was 1,000 ft lower. 15 Aircraft Accident Investigation Bureau Interim report March, 2020 - The actual computed airspeed was 332 kt (value displayed on RHPFD) while the erroneous value displayed on the LH PFD was 308 kt. - Pitch attitude was around 2.5° with a vertical speed of 350 ft/min. - Roll oscillations continued and the heading slightly increased. At the end of the phase, the aircraft heading was around 080°. Phase 4: flight while the stab trim cutout switches were in the cutout position (from 5h 40 min 38 s until 5h 43 min 11 s) During this whole phase, the crew applied an average force value of 94lbs on the control column. At 05:40:43: approximately five seconds after the end of the crew manual electrical trim up inputs, a third automatic nose-downtrim triggered. There was no corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches beingin the ‘’cutout’’ position. At the beginning of this phase, the captain succeeded in pitching up the airplane, the vertical speed value was 1,800 ft/min, increasing. At 5:40:45, the captain requested the F/O to pull up with him (“Pull with me”). Both pilots applied force on the control column. From that time until the end of this phase, pitch values oscillated between 7° nose up and -2° nose down. Pitch increased when both pilots applied forces, pitch decreased when a single pilot applied force (force oscillated between 80 lbs and 110 lbs). The vertical speed variations followed the variations of the pitch angle, with vertical speeds oscillating between -2,500 ft/min and + 4,400 ft/min. Crossing 9,500 ft (RH Baro corrected altitude – erroneous LH baro corrected altitude: 8,500 ft), the crew requested to stop climb at 14,000 ft5. At 05:40:50, the captain told the F/O:“advise we would like to maintain one four thousand. We have flight control problem”. The F/O complied. The request was approved by ATC. Following the approval of ATC, the new target altitude was set on the MCP. At 5:41:21the RH speed exceeded 340kts and the over speed clacker sounded. It remained active until the end of the recording as RH airspeed remained above Vmo. The RH speed values stabilized between 360 kt and 375 kt and on the LH PFD, the LH computed airspeed oscillated between 335kt and 350kt. At 05:41:23, the selected altitude reached 14,000 ft. The captain called out “speed”, which was acknowledged by the F/O. From 05:41:31 until 05:41:40, the captain asked the F/O to pitch up with him. 5 14,000 ft is the Minimum Safe Altitude in that sector 16 Aircraft Accident Investigation Bureau Interim report March, 2020 At 05:41:47, the Captain asked the F/O if the trim was functional. The First-Officer replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 5:41:56 the F/O stated “It is not working”. The captain replied “keep with me” at several occasions and said that they should go up to 14,000 ft. At 5:42:12, the crew requested a vector to return to the airport. At 5:42:15, the F/O requested “Radar Ethiopian three zero two request vector to return to home » Following ATC instruction to turn to 260°, a new target heading of 262 ° was set.The aircraft heading at that time was 1020.. At 5:42:47, the captainsaid« Ok, what was it? Master Caution? The F/O says« Master caution? » The captain asked the F/O to verify. The F/O answered “Master Caution Anti Ice”. The captain said“Left Alpha Vane”. The F/Oacknowledged“Left Alpha Vane” the FDR data at this time is consistent with the crew pressing the MASTER CAUTION recall button to review the existing faults. During this phase, the crew was applying an average force of 94 lbs for a long time. From 5 h 41 min 25 s, bank angle progressively increased to the right and heading increased towards the new selected heading. At the end of the phase: - The airplane was at an altitude of 6,200 ft above the airfield elevation (computed from the RH pressure altitude). LH altitude values were 1,250 ft lower. - Computed airspeed was around 367 kt (RH value), LH erroneous value was 344 kt. - The pitch angle of the airplane was lower than 1° - The vertical speed was around + 125 ft/min and decreasing - The bank angle was around 21° right, with a slight trend to increase. Phase 5: Stab trim cut out switches back in normal position until the end of the flight (from 5h 43 min 11 s until 5h 43 min 44 s) At 5:43:11, the crew tried to engage the A/P. A/P warning sounded for 3 s. At the time of the A/P engagement attempt, 2 short-time manual electrical trim up inputs were recorded , from which it can be concluded that the stabilizer cutout switches had been restored to the normal position6; at this time, the stabilizer position was 2.3 units. At 05:43:21, approximately five seconds after the last manual electric trim up input, automatic nose-down trim triggered for about 5 s. The stabilizer moved from 2.3 to 1 unit. 3 seconds after the automatic nose-down trim activation, the vertical speed decreased and became negative. One second before the end of the automatic trim nose-down activation, the average force applied by the crew decreased from 100 lbs to 78 lbs in 3.5 seconds. 6 The discrete parameter of the manual electric trim command records command (up or down) only when both stab trim cutout switches are in the normal position 17 Aircraft Accident Investigation Bureau Interim report March, 2020 In these3.5 seconds, the pitch angle dropped from 0.5° nose up to -7.8° nose down and the descent rateincreased from -100 ft/min to more than -5,000 ft/min.Following the last automatic nose-downtrim activation and despite recorded force of up to 180 lbs, thepitch continued decreasing. The descent rate and the airspeed continued increasing. At 05:43:36the EGPWS sounded: “Terrain, Terrain, Pull Up, Pull up” The recordings stoped 23 seconds after the activation of the 4th automatic nose down trim. At the end of the recording: - Computed airspeed values reached 500 kt - Pitch values were greater than 40° nose down - Vertical speed values were greater than 33,000 ft/min. Both recorders stopped recording at around 05 h 43 min 44 s. 1.2 INJURIES TO PERSONS Injuries Fatal Serious Minor None TOTAL Flight Crew 8 8 Passengers 149 149 Total in Aircraft 157 157 Others - Table: 2 1.3 DAMAGE TO AIRCRAFT The aircraft was destroyed. 1.4 OTHER DAMAGE The farm land excavated with deep and wide hole not to be used for further farming. 1.5 PERSONNEL INFORMATION 1.5.1 FLIGHT CREW The flight crew consisted of the captain and the first officer, five flight attendants and an InFlight Security Officer (IFSO). All crew were certified in accordance with the ECAA requirements. 1.5.1.1 PILOT IN COMMAND The pilot in command was 29 years old. According to Ethiopian Civil Aviation Authority (ECAA) records, the Captain’s most recent simulator proficiency check was October 1, 2018. The captain graduated from Ethiopian Aviation Academy on July 23, 2010. A review of the captains training records indicated that he received his 737-800 First Officer type rating on January 31, 18 Aircraft Accident Investigation Bureau Interim report March, 2020 2011 and completed his PIC type rating for the 737-800 October 26, 2017, B737MAX differences training on 03 July, 2018. According to Ethiopian Airlines records, the captain has the following flight experiences: PIC has flown as first officer on different Aircraft, like B737 from 22 April, 2011 to 06 February 2013 for 2600hrs, 767 from February 2013, to October, 2014 and B777 and 787 for 2145hrs for consecutive time. From 26 October, 2017 until the end of the event he was a captain on B737 and flown for 1417 hrs as PIC on type. Pilot in command Male,aged 29 Licenses CPL issued on 23-07-2010 ATPL issued on 27-07-2017 Simulator Based training B737-7/800 Renewed on 01-10-18 valid until 30-03-19 Annual Medical Check Renewed on 12-12-18 valid until 11-12-19 Rest before Last flight 72 hrs Aviation Carrier Details Student Pilot, EAL Aviation Academy From August 2008 To July2010 B737-700/800 (First Officer) Qualified on 31-01-11 B767/757 (First Officer) Qualified on 09-05-13 B777 (First Officer) Qualified on 04-02-15 B787(First Officer) Qualified on 17-08-15 B737- 700/800 (Captain) Qualified on 26-10-17 B737- 800 Max (Captain) Qualified on 03-07-18 Flying Experience Total Flying Hours 8122:00 hrs B737-700/800 4017:00 hrs B737-700/800/as PIC 1417:00 hrs B737-8 MAX 103:00 Flying time within last ninety days 266:09 Flying time within last thirty days 62:00 Flying time within last seven days 17:43 Flying time on the day of Occurrence 06minutes TABLE 3: PILOT IN COMMAD INFORMATION 19 Aircraft Accident Investigation Bureau Interim report March, 2020 The pilot’s ECAA license was permitted to act as pilot-in-command in commercial air transport operations on Boeing 737-7/800 (dated 26 October, 2017) and Boeing 737 MAX (dated 03 July, 2018.) The pilot had a first-class medical certificate with no limitations dated December 12, 2018. A review of the medical exam that resulted in the issuance of this certificate showed no vision or hearing deficiencies, and on the certificate application, the pilot stated he was taking no prescription or non-prescription medications. 1.5.1.2 FIRST-OFFICER According to Ethiopian Airlines records, the First-Officer has the following flight experience: First Officer Male, Aged 25 License CPL issued on 12-12-18 Simulator Based training B737-700/800 Renewed on 03-12-18 valid until 02-12-19 Annual Medical Check Renewed on 30-08-18 Valid until 29-08-19 Rest Before Last Flight 65 hrs Aviation carrier Details Student Pilot,EAL Aviation Academy From March 2017 To August 2018 B737-700/800 (First Officer) Qualified on 12-12-18 B737-800 Max(First Officer) Qualified on 12-12-18 Flying Experience Total Flying Hours 361:00hrs B737-700/800/MAX 207:26 hrs Flying time last ninety days 207:26hrs Flying time last thirty days 71hrs Flying time last seven days 10:57hrs Flying time on the day of occurrence 06 minutes TABLE 4: FIRST OFFICER INFORMATION The first-officer was 25 years old. According to ECAA records, the first-officer’s most recent simulator event was listed as a proficiency check and occurred on December 3, 2018. His line training/check (conducted in the B737 aircraft) was completed on January 31, 2019. The first-officer’s ECAA license was permitted to act as first-officer in commercial air transport operations in Boeing 737-7/800 dated December 12, 2018 and Boeing 737 MAX dated December 12, 2018. 20 Aircraft Accident Investigation Bureau Interim report March, 2020 The first-officer had a first-class medical certificate with no limitations dated July 30, 2018. A review of the medical exam that resulted in the issuance of this certificate showed no vision or hearing deficiencies, and on the certificate application, the pilot stated he was taking no prescription or non-prescription medications. He reported no medical conditions. 1.5.1.3 FLIGHT ATTENDANT According to records provided by ET, the cabin crew consisted of 5 female flight attendants. They were fully licensed in accordance with the provisions of the ECAA. 1.5.1.4 IFSO The IFSO was seated in the front passenger’s cabin amongst the passengers. He was counted for the load-sheet as a passenger and listed on the passengers manifest under a coded name. However, he was listed on the Crew General Declaration (CGD) and his official status on board was “extra-crew”. The IFSO was licensed in accordance with the provisions of the ECAA national regulations after completing the appropriate AVSEC courses and was authorized to fly on board of Ethiopian airplanes in the capacity of IFSO sitting with the regular passengers. 1.6 AIRCRAFT INFORMATION 1.6.1 GENERAL The B737-8 (MAX) is a low wing, narrow body single aisle, jet transport with a conventional tail unit configuration, powered by two bypass turbofan CFM Leap-1B engines mounted on pylons beneath the wings. The Aircraft is manufactured by Boeing Commercial Aircraft and is the fourth generation of the 737 series. According to the Boeing Company’s website, the Aircraft was designed to carry 162-178 passengers, depending on seating configuration. The 737-8 MAX was launched on August 30, 2017, and type certificated with the FAA on March 8, 2017. ET-AVJ was a B737-8 MAX single aisle transport aircraft configured in a 160 passenger multiclass arrangement manufactured by the Boeing Company and delivered to Ethiopian Airlines on 15 November, 2018. The Aircraft was powered by two LEAP-1B Turbo Fan Engines manufactured by CFM International. The Aircraft had 1330.3 hours with a total of 382 cycles at the time of the accident. Aircraft Type: Fixed Wing Multi-Engine Model: 737-8 (MAX) Registration Number ET-AVJ Aircraft Serial Number 62450 Aircraft Manufacturer Boeing Commercial Aircraft Aircraft Category: Transport Seating arraignment: Multi-Class PAX Seating Capacity: 160 21 Aircraft Accident Investigation Bureau Interim report March, 2020 Max. T/O Weight: 82,190 kg Total Time: 1330.3 hours Total Cycles: 382 Engine Type: Turbo Fan Number of Engines: 2 Engine Manufacturer: CFM International Engine Model: LEAP-1B28B1G05 Manufactured Year: 2018 Aircraft Owner Ethiopian Leasing (5-737) LTD Address: C/O WALKERS CORPORATE LIMITED, CAYMAN CORPORATE CENTER, 27 HOSPITAL ROAD, GEORGE TOWN, GRAND CAYMAN KY1-9008, CAYMAN ISLANDS Ethiopian Airlines Group Aircraft Operator Address: Bole International Airport P.O. Box 1755 Addis Ababa, Ethiopia Operator Certificate Number: CATO01/270295 TABLE 5: AIRCRAFT INFORMATION 1.6.1.2 AIRCRAFT FLIGHT AND MAINTENANCE LOG The Maintenance Log Book (MLB) was reviewed in detail for the last 39 flights from 26 February 2019 until 09 March 2019 (previous flight to the accident flight). In addition, the records were reviewed for the 1A check conducted in early February. Over the previous 39 flights, the MLB cited in particular: Captain’s flight compartment PC power outlet has no power; the crew oxygen cylinder was replaced due to low pressure; and the APU would not start. All three issues led to maintenance actions and did not reoccur. In addition, the MLB was reviewed at a higher level for all flights back to the delivery flight in November 2018. Maintenance actions of relevance occurred in early December 2018 and involved several write-ups involving temporary fluctuations of vertical speed and altitude as well as a report of the aircraft rolling during autopilot operation and altitude and vertical speed indication on the PFD showed an erratic and exaggerated indication. Maintenance actions were performed and none were reported to have reoccurred. According to the Ethiopian Civil Aviation Authority (Document number ECAA/AWS/OF/025, Ethiopian Airlines (the ‘operator’) is authorized to conduct maintenance on various aircraft per 22 Aircraft Accident Investigation Bureau Interim report March, 2020 certificate number 002/88. The Op. Spec issued to the operator states that operations shall be conducted in accordance with the Ethiopian Civil Aviation Authority Rules and Standards (ECARAS), part 6. Authorized Maintenance Program: Certificate number 002/88 authorizes the following airframe maintenance: Manufacturer Boeing Boeing Make/Model B737300/400/500/600/700/ 800/900 B737MAX Capability Line and Base Maintenance Limitations No limitation Line and Base Maintenance Line and Base Maintenance Line and Base Maintenance Line and Base Maintenance Limited up to and including 1’A’ checks No limitation Boeing B757/767 Boeing B777-200/300 Boeing B787-8/-9 Airbus A350 XWB-900 Line and Base Maintenance Bombardier Fokker DHC-8-400 & DHC-8100/200/300 F27MK050 Diamond DA40NG Diamond DA42NG De Havilland DHC-6 Line and Base Maintenance Line and Base Maintenance Line and Base Maintenance Line and Base Maintenance Line and Base Maintenance No limitation Limited up to and including all ‘2C’ checks Limited up to and including all “1C” checks No limitation No limitation No limitation No limitation No limitation TABLE 6: OPERATOR MAINT. PROGRAM 1’A’ Check: Per the maintenance limitations noted above, a 1’A’ check was conducted on the accident airplane between 01 February and 04 February, 2019. This check primarily concentrates on routine inspection for airworthiness (General Visual Inspection - GVI) as well as check and replacement of lubrication. 23 Aircraft Accident Investigation Bureau Interim report March, 2020 Airworthiness Directives (AD) Ethiopian Airlines provided an AD compliance report for review by the the AIB. This included airworthiness directives being tracked for the airframe, the two installed engines and appliances. The AD summary report included the limits, intervals, and current status (as applicable). A review of the Airworthiness Directive status report for the airplane, power plants and appliances was conducted. All applicable AD’s had been incorporated during aircraft production. No AD’s affected the two installed engines or APU. There is one AD service bulletin listed as open; this involves the prevention of fires in the lavatories from burning paper, etc. This is an inspection bulletin with an interval of flight hours of 940. The next inspection was scheduled at 1940 flight hours. One of the AD’s listed on the AD compliance report was AD-2018-23-51, Titled “To Address this potential resulting nose down trim”. The compliance report indicates that compliance was through AFM revision on 11/08/2018. Service Bulletin (SB) Summary: A review of the service bulletin list includes the installation of engine Electronic Engine Control (EEC) control software version 6.5 (07 January, 2019) as well as the installation of new shoulder bearings and a hinged loop clamp on a fuel tube located on the engine. The installation is intended to improve reliability of the clamp. 1.6.1.3 MAINTENANCE HISTORY The aircraft maintenance history containing daily flight and maintenance information was reviewed from the date range of November 15, 2018 (delivery date) through March 10, 2019 (accident flight). Maintenance Record Logbook On March 15, 2019, the Maintenance Group performed a review and documented Ethiopian Airlines daily maintenance record logbook pages 518301 to 502140 for aircraft ET-AVJ. Additionally, all the daily technical logs that extend back to the delivery flight (Nov 15, 2018) were reviewed. Special emphasis was put on any log entry pertaining to abnormal indication or airplane behavior. Log Ref Date DEP ARR Write ups Rectify Action 502140 10Mar, 19 9Mar, 19 JNB ADD None None ADD JNB 9Mar, JNB ADD Installed 3 each LG Down Removed 3each down lock pins lock pins None None 502139 502138 24 Other work performed LG Aircraft Accident Investigation Bureau Interim report 502137 19 8Mar, 19 ADD JNB March, 2020 1.Installed3 each LG down lock pins 2. APU fault Light is on (APU is INOP) to clear add remark 8-Mar19 8-Mar19 PAR ADD APU Fault Light is on (APU is INOP) 1. Removed 3 each LG down lock pins 2. (ref IFIM 49-61-00700-801 rev# 201901150301, 15 Jan 2019) Bite done on OMF, fund msg #1 (4941254). Replaced the SCU and APU success fully started with APU limited restart Transferred to ADD page (501137) NA NA Green sheet - parked per above Green sheet - parked per above 7-Mar19 7-Mar19 JNB ADD None None ADD JNB APU Fault Light is on, APU had a protective shutdown Rev# 201902150301 15Jan 2019 - OMF Bite shows mnt msg 4941254(start converter unit shows start system in op); Re-racked unit and APU started with APU limited restart eunction as per IFIM 4940-00- 810-818 7-Mar19 6-Mar19 TLV ADD None None ADD TLV All landing gear down lock pins installed Removed 3 each landing gear down lock pins 502130 5-Mar19 NBO ADD Installed all gear pins Removed all landing gear pins 502129 5-Mar19 ADD NBO 502128 5-Mar19 4-Mar19 4-Mar19 TLV ADD None None ADD TLV Installed gear pins Removed gear pins ABV ADD Replaced cylinder 4-Mar19 ADD ABV Crew O2 cylinder pressure is below 1000 psi None 502136 502135 502134 502133 502132 502131 502127 502126 502125 Engine Diagnosis data downloaded Gas path cleaning of engines three Downloaded engine diagnostic data 25 None crew O2 Downloadin g engine Aircraft Accident Investigation Bureau Interim report March, 2020 diagnostic data & recording APU EGT TLV ADD None None ADD TLV None None 3-Mar19 2-Mar19 JNB ADD None None ADD JNB 3 each pins installed Removed all 3 each landing gear down lock pins 518320 2-Mar19 EBB ADD Auto land accomplished successfully at EBB Noted 518319 2-Mar19 2-Mar19 1-Mar19 ADD EBB None None JNB ADD None None ADD JNB FLIGHT COMPARTMENT PC POWER OUTLET HAS NO POWER (CAPTAIN) PERFORMED CAPTAIN Inspection PC OUTLET INITIAL of TGB EVALUATION AND savage FOUND CAPTAIN PC screens OUTLET HAS NO POWER 1-Mar19 1-Mar19 N/A WHD ADD None None ADD WHD None None N/A N/A Deferred to ADD 28-Feb19 JNB ADD Pc power outlet no power, Captain's (preflight) Daily check performed in JNB without specific task card / no MX data made either. Check if needs to be performed for a legal dispatch Check both nose wheels for proper inflation. During ground roll vib increasing with wheel spin up -----knocking of gear strut. 518324 3-Mar19 518323 518322 518321 518317 518316 518315 518314 518313 518312 26 Noted and daily check performed as per BTC 32-270-01102-01 Balanced tire pressure and inspect both tires for wear, all landing gear components, also shock struts all found normal as per IFIM 32-1-00 809 810. Rev# 201902150301 is Feb 2019 Visual check of scheduled Aircraft Accident Investigation Bureau Interim report 518311 518310 518309 518308 518307 518306 518305 518304 518303 518302 51830 1 Log Ref 24640 24628 28-Feb19 N/A March, 2020 Installed 3 each landing gear down lock pins. Removed 3 each landing gear down lock pins,. Daily check expired at 18092 and now at 19582 Performed daily check at 20:28 on 28-02-2019 (not logged in the MX system) TGB inspection task performed 27-Feb19 27-Feb19 26-Feb19 26-Feb19 WHD ADD None None ADD WHD None None None TLV ADD None None None ADD TLV None 26-Feb19 25-Feb19 TLV ADD None None ADD TLV Installed gear pins All three landing gears are removed 25-Feb19 25-Feb19 25-Feb19 25-Feb19 Date 10-Dec18 NBO ADD None None ADD NBO None None NBO ADD None None ADD NBO None None DEP LAD ARR ADD Rectify Action BITEonOMFshowsnorelatedfault. GVIperformedforstaticports,no damagefound;noFODfound.BITE doneonFMCforADIRUfalts,found none.OPCperformedasperAMM 34-21-00-710-806;testpassed 7 Dec18 LAO ADD Write ups Capt.Sidealtimeterindica tion erraticallyshowedadesce ntanda lowerlevelandbacktonor mal indicationatFL380 Duringapproach@1000' AGLtheA/C startsrollingtotherightwi ththe autopilotengaged. None 27 NAV data update, engine diagnostic data Download.D ownloading engine diagnostic data Performed OP checked of SPCU BITEdoneofFMCCDU(DFCS);no faultfoundasper22-11-34-040-80. Performedlandverifytestasper AMM2211-00-700-801;found normal Aircraft Accident Investigation Bureau Interim report 23645 4-Dec18 DOH ADD 23639 3-Dec18 DAR ADD March, 2020 Duringapproachat8600f eet, altimeterrapidlydescend edand returnedtonormalcausin gautopilot toreverttoCWS"P",LNAVremained engaged. Aftertakeoff,altitudeandvertical speedindicatoronbothPF D'sshowed anerraticandexaggerate dindications (movingupanddownvery rapidly)for about 2 sec. and then returned to back normal IFIM34-31-00-810-819-Noexisting faultfoundonOMF.Faulthistory foundonOMFisthatMMRisnot givingvaluedinput.FromOMF, as perthemanualMMRoperational test.Preformedtest-passed.Per AMM3437-00-710-801,ranop test;passed AMM46-13-02-710-801OMFshows nofaultininboundFDE.Faulthas nofaulthistoryandalsohasno relatedfault.FMCoperationaltest performedasperAMM34-61-00710-801andtestshowsnofault TABLE: 7 ALL DAILY TECHNICAL LOGS The only scheduled check of the Aircraft occurred from 01 February and 04 February 2019. This is a routine check and General Visual Inspection (GVI) of various areas of the airframe. No major discrepancies or repairs were noted for this check. 1.6.2 ENGINES The accident engines were CFM LEAP-1B28B1, a high bypass, dual rotor, axial flow turbofans. The engine consists of 3 major assemblies: low pressure compressor (LPC), core engine, and low-pressure turbine (LPT). The core engine consists of a two-stage high pressure turbine (HPT) which drives the ten-stage high pressure compressor (HPC). The four-stage integrated fan and low-pressure compressor (booster) is driven by a five-stage LPT. The annular designed combustion chamber increases the HPC discharge air velocity to drive the high- and lowpressure turbines. An accessory drive system provides drive requirements for engine mounted aircraft accessories and is driven by the high-pressure module. The accessory drive system includes two sub-modules which can be removed or installed at engine level, the accessory gearbox (AGB) and the transfer gearbox (TGB). The engine control system supplies manual and automatic control inputs to operate the engine.The engine control system has these components: • Thrust levers (forward and reverse) • Thrust lever resolvers • Engine start levers • Thrust lever interlock solenoids 28 Aircraft Accident Investigation Bureau Interim report March, 2020 Figure : 1 – CFM LEAP 1B - Cross Section 1.6.2.1 ENGINE HISTORY According to the engine’s FAA Type Certificate Data Sheet (TCDS) E00088EN, Revision 4, dated November 30, 2018, the engine has a maximum takeoff thrust rating of 29,317 pounds flatrated1 to 86°F (30°C) and a maximum continuous thrust rating of 28,690 pounds flat-rated to 77°F (25°C). Engine Serial Number 602722 (L/H) 602695 (R/H) Last Install Date October 2018 October 2018 Last Shop Visit N/A N/A Cycles SinceInstall 382 382 Cycles Since New 382 382 Cycles Since Shop Visit N/A N/A Time Since Install 1330 hours 1330 hours Time Since New 1330 hours 1330 hours Time Since Shop Visit N/A N/A TABLE 8: ENGINE INFORMATION The USA and Safran Aircraft Engines (SAE) (formerly Snecma (Société Nationale d'Etude et de Construction de Moteurs d'Aviation) Moteurs of France). The division of labor is such that Safran is responsible for the Fan and LPT modules while GE is responsible for the remainder of the engine – HPC, Combustor, and HPT. 29 Aircraft Accident Investigation Bureau Interim report March, 2020 1.6.2.2 MAINTENANCE RECORDS & REPORTS According to CMF record, both engines were compliant with the following service bulletins: SB 72-0222 – Inspect TGB scavenge screens (Feb 22, 2019) SB73-0014 - PSS Blow Out and vacuum proc. (Jan. 16, 2019) SB 73-0016 – New EEC software Version 6.5 (Jan. 8, 2019) CFM also reported that no monitoring alerts, customer notification reports (CNR), or abnormal records were reported on these engines since entry into service (EIS). Additionally, no recent maintenance tasks were declared on either engine. The engine sends electronic ‘snapshots’ to CFM at engine start and after takeoff and no anomalies were noted during the previous flight. The exhaust gas temperature (EGT) margin is routinely monitored on the airplane and electronically transmitted to CFM for maintenance surveillance. A review of these records revealed an EGT margin on both engines at the time of the accident was greater than 80°C. CFM has reviewed snapshot reports from ET-AVJ over the last four flights – three on March 9th and the event flight on March 10th. These reports were reviewed for engine parameter content with no unexpected or unusual engine conditions identified. All parameters are within expected values for the respective phase of flight with no engine faults detected. According to the Ethiopian logbooks, only two procedures had been accomplished in the last 30 days a water wash and an Engine Data Diagnosis Download. 1.6.3 AIRPLANE SYSTEMS DESCRIPTION 1.6.3.1 AOA OVER VIEW The angle of attack (AOA) system senses angle of airflow between a reference line on the airplane and the wind direction. Angle of Attack (AOA) Sensors The Boeing 737-8 (MAX) has two independent angle-of-attack (AOA) sensors, one on each side of the forward fuselage. The AOA sensors consist of an external vane which rotates to align with the local airflow connected to two internal resolvers which independently measure the rotation angle. A wedge vane is mounted external to the airplane to accurately sense local airflow angle. Embedded heater in vane thermally compensates to increase vane surface temperature in high flow and icing. It is coupled to electrical transducers via mechanical shaft. The vane is mechanically balanced with a counterweight. 30 Aircraft Accident Investigation Bureau Interim report FIGURE2: AOA SENSOR March, 2020 FIGURE3: AOA LOCATION ON A BOEING 737 The AOA sensor used on the Boeing 737-8 (MAX)-8 is made by Collins Aerospace. Each AOA sensor (left and right) is connected to the respective Stall Management Yaw Damper (SMYD) computer and the respective. Both the SMYD andADIRU monitor the circuits within the AOA sensor. 1.6.3.2 USE OF AOA VALUES The AOA values are directly used by the ADIRU to compute the following parameters o Mach corrected values o CAS corrected values o Altitude corrected values - By the SMYDC o to manage the Stall warning activation o to compute the loop gain of the yaw damping system o to compute stick shaker speed o to compute operational speeds o to compute the Pitch Limit Indicator (PLI) - By the FCC o To trigger MCAS activation o To compute MCAS duration Erroneous AOA values would also impact the following systems (non-exhaustive list) - - ADIRU, for the computation of TAS, Baro corrected altitude,…etc F/D and autopilot: with invalid CAS, Baro altitude,…etc FMC o through baro altitude values, with potential impact on the autothrottle commands 31 Aircraft Accident Investigation Bureau Interim report March, 2020 1.6.3.3 AOA VANE AND ANTI-ICE PROTECTION AOA vane heating belongs to the anti-ice protection. In case of a fault of the vane heating, the following systems activate: - the master caution triggers (master caution light illuminates) - the ANTI-ICE light (right system annunciator) switches on - The [L/R] ALPHA VANE message illuminates (on the Probe heat panel of overhead panel). The vane heating monitoring is based on current detection circuit. After the current drops, there is a delay of 3 to 5 s before the light “[L/R] Alpha Vane” illuminates and the master caution triggers. FIGURE 4: MASTER CAUTION ANTI-ICE FIGURE 5: PROBE HEAT PANEL 32 Aircraft Accident Investigation Bureau Interim report March, 2020 AOA Monitoring The ADIRU performed a limited monitoring of the AOA sensor, based on the signal received from the resolver. The ADIRU generates “AOA signal failed” information if it detects one or more of the following conditions: - the resolver output is zero volts the combined amplitude is outside the acceptable range The calculated AOA vane shaft angle is outside the range defined by the mechanical stops. The ADIRU generates “AOA failed” information when it detects any of the above conditions or if the reference (excitation) voltage signal provided to the AOA sensor from the aircraft 28VAC power bus is out of range. Impact of AOA failure on ADIRU ADIRU is advertised of AOA vane heating failure. In this case, ADIRU goes on providing its parameters without any information of failure. ADIRU only records a failure code inside its BITE memory. If the ADIRU detects any failure through its AOA monitoring the ADIRU provides its output data with invalidity information (NCD – No Computed Data or FW – Failure warning). In this case, the systems receiving these data do not use them; in particular, the Display Processing Computer (DPC), sets up flag on the PFD: - SPD flag appears on the PFD and speed tape is no more displayed ALT flag appears on the PFD and altitude tape is no more displayed. 1.6.3.4 AIR DATA SYSTEM TheBoeing737 MAX 8 is equipped with an Air Data Inertial Reference System (ADIRS) that provides flight data to the flight deck display panels, flight management computers, flight controls, engine controls and all other systems requiring inertial and air data information. The ADIRS combines the Air Data System (ADS) function and the Inertial Reference System (IRS) function into a single device identified as an Air Data Inertial Reference Unit (ADIRU). The ADIRUs provide inertial position and track data to the flight management system and provide attitude, altitude and air speed data to the flight deck displays. The ADIRUs process information measured by internal gyros and accelero meters and information from the air data sensors. Pitot and Static System The pitot static system is comprised of three separate pitot probes and six flush static ports; two of these pitot probes and four of the static ports interface with the Air Data Modules (ADM), which convert pneumatic pressure to electrical signals and send these data to the ADIRUs. The remaining auxiliary pitot probe and alternate static ports provide pitot and static pressure to the standby instruments. The auxiliary pitot probe is located on the first officer’s side of the aircraft. 33 Aircraft Accident Investigation Bureau Interim report March, 2020 The ADM connected to the Captain’s pitot probe sends information to the left ADIRU, while the ADM connected to the First Officer’s pitot probe sends information to the right ADIRU. The remaining ADMs are located at the balance centers of the Captain’s and First Officer’s static ports. The ADM connected to the Captain’s static ports sends information to the left ADIRU for display of the captain’s instruments, while the ADM connected to the First Officer’s static ports sends information to the right ADIRU for display on the first officer’s instruments. Air Data Reference (ADR) The Air Data Reference (ADR) function of the ADIRU is to sense the aircraft’s pitot and static pressures external to the aircraft and convert them into digital electrical signals. These pressures, in conjunction with the Total Air Temperature (TAT) and the aircraft’s AOA are used by the ADIRU to calculate basic air data information (parameters) for transmission to various systems on the aircraft. Some of the parameters that the ADIRU transmits include: altitude, computed airspeed, and true airspeed. Another function of the ADIRU is to provide AOA information (corrected angle of attack) directly to the Flight Control Computers as an input to the MCAS function. Both the altitude and airspeed use static pressure which includes calculations for a correction factor of the Static Source Error Correction (SSEC). This is a compensation for pressure errors caused by the airframe’s aerodynamic effects on the static port. The static ports have been located to minimize errors. Compensation for the remaining errors is provided by a correction algorithm comprised of three factors: basic correction, thrust effect compensation and ground effects compensation. The ADR uses the following parameters as primary parameters: - The static pressure coming from the static ports The total pressure coming from the pitot probes The AOA values coming from the AOA vanes The Total Air Temperature (TAT) parameters coming from the TAT probes 34 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 6: Illustrated static and total air pressure system 1.6.3.5 ENHANCED DIGITAL FLIGHT CONTROL SYSTEM (EDFCS) The Boeing 737 MAX 8 is equipped with an Enhanced Digital Flight Control System (EDFCS). The EDFCS system on the 737 MAX 8 is the same as the 737 NG with the following added functionality in the flight control computer (FCC) software: 1. Maneuvering Characteristics Augmentation System (MCAS), 2. Emergency Descent in Autopilot and Flight Level Change Mode, 3. Spoiler Control Electronics Interface, 4. Autopilot Roll Command Alerting System. The EDFCS provides integrated operation of the following major flight control functions: - Altitude Alert Autopilot (including Autoland) Flight Director Speed Trim Mach Trim Maneuvering Characteristics Augmentation System (MCAS) FMC Interface & Mode Control Autothrottle Interface, N1 Limits, & Mode Control (for those airplanes equipped with a separate external autothrottle computer). The EDFCS has a mode control panel (MCP), two FCC’s, and actuator inputs to the flight control system. The MCP is the primary interface between the flight crew and the FCCs. The FCCs get inputs from several systems such as the Air Data Inertial Reference System (ADIRS) and the 35 Aircraft Accident Investigation Bureau Interim report March, 2020 Flight Management Computer (FMC) and sends commands to the aileron and elevator actuators. These actuators control the movement of the ailerons and elevators, which control the flight path of the airplane. There are two autopilots, autopilot A from FCC A and autopilot B from FCC B. When you engage an autopilot from the MCP, the autopilot can control the airplane attitude through these phases of flight: Climb, Cruise, Descent, Approach, Go-around and Flare. FIGURE 7: EDFCS GENERAL DESCRIPTION 1.6.3.6 AUTOPILOT The autopilot is engaged by selecting one of two autopilot push button engage switches located near the right edge of the MCP, between the Vertical Speed display window and the right hand Flight Director toggle switch The control column force must be less than 5 lbs. and the control wheel force must be less than 3 lbs. for the autopilot to engage. If the forces exceed these values, then attempting to engage the autopilot results in an autopilot disconnect warning. The normal autopilot disengagement mechanism is via the quick disconnect pushbutton switches on the captain’s and first-officer's control wheels. An alternate disengage mechanism is provided by the disengage bar located on the bottom edge of the MCP just below the engage buttons. An amber strip is exposed when the bar is down to positively indicate activation of the disengage bar. Pressing a lighted engage pushbutton also disconnects the autopilot (except when dual engaged for fail operational autoland—in this case only the corresponding channel disconnects). 36 Aircraft Accident Investigation Bureau Interim report March, 2020 Certain failures of the EDFCS or interfacing systems will cause the autopilot to automatically disconnect when the failure occurs. The autopilot may also automatically disconnect upon use of certain source select switches but can (sometimes) be reengaged. Upon autopilot disconnect, the autopilot disengage light on the Autoflight Status Annunciator will indicate disconnect by flashing red. The annunciator is located just above both the Captain's and First Officer's Secondary EFIS displays. This will be accompanied by an aural warning. The pilot may reset the warnings by pressing the autopilot disengage switch on the wheel or the light on the Warn Annunciator. The warning will continue for 2 seconds regardless of how quickly the pilot might reset the warning. 1.6.3.7 FLIGHT DIRECTOR Selecting a Flight Director toggle switch to the ON position activates the Flight Director. The left switch enables the Flight Director Command bars on the captain's primary EFIS display. The right switch enables them on the first officer's display. When a Flight Director is initially selected ON, the bars will be out of view and there will be no active mode. Subsequent use of the TOGA switch or an MCP mode selection will bring the bars into view. The Flight Director Master light located next to the switch indicates which baro correction is currently in-use by the autopilot/Flight Director for calculations such as Altitude Alert or Altitude Acquire. Under normal operations, the left FCC provides the Flight Director commands for the left display and the right FCC provides similar commands for the right display. The Flight Director Command bars are biased out of view in the event of a mode failure. Flight Director Selection is annunciated by a green “FD” on the primary EFIS display when the autopilot is not engaged. Flight Director Modes may be engaged and used alone or may be displayed in conjunction with autopilot operation. 1.6.3.8 AUTO THROTTLE Overview The auto throttle (A/T) system provides automatic thrust control from the start of takeoff through climb, cruise, descent, approach and go–around or landing. The A/T system controls engine thrust in response to the mode selected by the flight crew through the EDFCS, Mode Control Panel (MCP), Flight Management Computer (FMC) and ADIRU. The speed information taken from the ADIRU is used to calculate throttle lever rate commands to set engine thrust during changing flight conditions. All the information is processed by FCCA, which provides commands to the thrust lever servo motors controlling thrust lever movement. The autothrottle Arm switch is a magnetically held two-position switch, located on the left side of the MCP, between the IAS/MACH display window and the left Flight Director toggle switch. Arming the A/T is preparing the system to engage in the N1, MCP SPD, or FMC SPD mode. A green light near the autothrottle Arm switch is illuminated when the autothrottle Arm switch is in the ARM position. In the ARM state the autothrottle will accept mode requests from the autopilot or TOGA switch and engage the appropriate autothrottle mode. While on the ground, the FMC must be in the takeoff mode for the autothrottle Arm switch to hold in the ARM 37 Aircraft Accident Investigation Bureau Interim report March, 2020 position and arm the system. Moving the autothrottle Arm switch to OFF or activating an autothrottle quick disengage switch (which causes the autothrottle Arm switch to move to the OFF position) disconnects the autothrottle. There is an autothrottle quick disengage switch installed on the outside edge of each thrust lever. Five autothrottle modes are available: N1, Speed, Go-Around, Retard and Throttle Hold. For each flight phase, the flight crew can select the A/T N1 or speed modes from the MCP or directed by the FMC. During takeoff, pushing TO/GA switch engages the A/T in N1 mode and causes the engine thrust to increase to the takeoff (TO) N1. TABLE9: AUTOTHROTTLE MODES A/T and computers FIGURE 8: A/T SYSTEM - GENERAL DESCRIPTION 38 Aircraft Accident Investigation Bureau Interim report March, 2020 The FMC calculates thrust N1 limits and N1 targets for each flight phase. The data goes to the Display Processing units (DPU). The DPU shows the N1 limits on the engine display. The DPC send the N1 targets to the EECs which calculate equivalent TRA targets to send to the A/T to set thrust. The A/T uses the EEC TRA targets to set thrust during takeoff, climb, and max thrust goaround. The FMC also sends N1 targets directly to the A/T. During takeoff and max thrust go-around, the A/T uses EEC TRA targets and FMC N1 targets to set thrust. The A/T function converts the target N1 values from the FMC to an equivalent TRA target. The target N1 rating is dependent on the FMC engaged mode. During takeoff, climb, and max thrust go-around, the FMC N1 targets are the same as the N1 limits. The A/T function in FCC A sends A/T discrete digital data to both FCCs. The FCCs use this data to determine the mode the A/T is in and to which modes it will allow a change. The FCCs send mode request discretes to the A/T to select A/T modes consistent with the active EDFCS mode. The A/T needs also a valid N1 target from the FMC to switch from the ARM mode into another mode. 1.6.3.9 SMYDC Autoslats The autoslat system is designed to enhance airplane stall characteristics at high angles of attack during takeoff or approach to landing. When TE flaps 1 through 25 are selected, the LE slats are in the extend position. As the airplane approaches the stall angle, the slats automatically begin driving to the full extended position prior to stick shaker activation. The slats return to the extend position when the angle of attack is sufficiently reduced below the stall critical attitude or when flaps are raised to up or when computed airspeed exceeds 230 kts. Autoslat operation is controlled by the SMYD computers using angle-of-attack to determine when the airplane is approaching stall. Either SMYD can provide the autoslat function by itself. Speed limits The speed limits computed by SMYD are described in the following table. Recorded parameter Maximum HIGHSPDBUFFETSPDFDR Maneuver Speed/High Speed Buffet Minimum FCMINOPERATINGSPDFDR Maneuver Speed Minimum Speed Meaning/display impact Speed tape impact: bottom of the amber bar below VMO/MMO providing 1.3 G manoeuver capability Speed tape impact: top of the amber bar above the minimum speed (black and red lower stripes) STICKSHAKERSPEEDSMYDC1FDR Speed tape impact: top of the STICKSHAKERSPEEDSMYDC2FDR black and red lower stripes. Stick shaker speed. TABLE10: SPEED LIMIT 39 Aircraft Accident Investigation Bureau Interim report March, 2020 Note: When flaps are up, the bottom of the amber bar indicates the maximum maneuver speed. This airspeed provides 1.3 G maneuver capability to high speed buffet (or an alternative approved maneuver capability set in the FMC maintenance pages). Yaw Damper (YD) At low angle of attack, YD dampens sideslip induced lateral-directional motion and provides turn coordination. At high angle of attack, turn coordination is disabled, yaw damper does not suppress sideslip and has a reduced Dutch roll damping. The yaw damper system consists of a main and standby yaw damper. Both yaw dampers are controlled through Stall Management/Yaw Damper (SMYD) computers. The SMYD computers receive inputs from both ADIRUs, both control wheels and the YAW DAMPER switch. SMYDs provide yaw damper inputs to the main rudder Power Control Unit (PCU) or standby rudder PCU, as appropriate. Stall warning Naturalstallwarning(buffet)usuallyoccursataspeedpriortostall.Insomeconfigurationsthemargin betweenstallandnaturalstallwarningislessthandesired.Therefore,anartificialstallwarningdevice, astickshaker,isusedtoprovide the required warning. Eachcontrolcolumnhasaneccentricweightmotorwhichcanvibratethecolumntoalertthepilotsbefo reastalldevelops.Thesystemisarmedinflightatalltimes.The systemis deactivated on the ground, exceptduring the ground test. Two independent, identicalSMYD computersdeterminewhen stall warning isrequired based upon: - Alpha vaneangle of attackoutputs ADIRU outputs Anti–ice controls Wing configurations Air/ground sensing Thrust FMC outputs The AOA sensor is connected to the SMYD and provides the measured angle of the direction of air flow relative to the fuselage. If the AOA sensor detects an excessive angle of attack compared to the design characteristic of the737 MAX 8, the SMYD will activate the stick shaker to provide aural and tactile alert to the flight crew. Two SMYD computers provide output for stall warning to include stick shaker, Pitch Limit Indicator, and maneuver and operating air speed limits. The SMYD1 activates the Captain’s stick shaker, and S M Y D 2 activates the F/O stick shaker. Vibrations from either stick shaker can be felt in both columns through the mechanical column interconnect. 1.6.3.10 PITCH CONTROL SYSTEM PitchcontrolfortheBoeing737 MAX 8isprovidedbytwoelevatorsanda horizontal stabilizer, which are both moveable control surfaces located on the empennage. 40 Aircraft Accident Investigation Bureau Interim report March, 2020 Elevator system The Boeing737 MAX8 elevator control system provides primary pitch control of the airplane using two elevators that are hydraulically powered with manual reversion available in the event of a loss of hydraulics. This control system is activated by fore and aft motion of the captain's and first officer's control columns, which are connected via a torque tube with a forward cable control quadrant mounted at each end. Elevator control cables are routed from the quadrants aft and attach to a pair of aft elevator control quadrants, which are mounted on the lower elevator input torque tube7. This tube is mechanically connected, via linkages, to each of the two power control units (PCUs) input control arm assembly. When rotated, the lower torque tube input arm assembly provides a simultaneous command to each PCU to extend or retract. The two PCUs operate in unison and are powered by separate hydraulic systems, the left unit from hydraulic system “A” pressure and the right unit from hydraulic system B pressure. The output rod of each PCU is connected to the upper torque tube, which is directly linked by pushrods to each elevator. Elevator Feel system An elevator feel computer provides simulated aerodynamic forces on the control column based on total pressure (from two dedicated pitot probes mounted on the vertical stabilizer) and stabilizer position. Feel force is transmitted to the control columns by the elevator feel and centering unit. To operate the feel system the elevator feel computer uses either hydraulic system A or B pressure, whichever is higher. Stall warning and control is enhanced by the Elevator Feel Shift (EFS) module and the speed trim system. The speed trim system is a function within the Flight Control Computers which enhances speed stability characteristics. MCAS is a sub function of the speed trim system. These systems work together to help the pilot prevent further movement into a stall condition. Higher aft control column forces and the stick shaker system provide warning that the airplane is about to be in or is in a stall condition. During high AOA operations, the Stall Management/Yaw Damper (SMYD) reduces yaw damper commanded rudder movement. The EFS module increases hydraulic system pressure to the elevator feel and centering unit during a stall. This approximately doubles control column forces for a typical stall entry. The EFS module is armed whenever an inhibit condition is not present. Inhibit conditions are aircraft on the ground, radio altitude less than 100 feet, or autopilot engaged. However, if EFS is active when descending through 100 feet RA, it remains active until AOA is reduced below approximately stickshaker threshold. There are no flight deck indications that the system is properly armed or activated. As airspeed decreases towards stall speed, the speed trim system trims the stabilizer nose down and enables MCAS above stickshaker AOA. With this trim schedule the pilot must pull more aft column to stall the airplane. With the column aft, the amount of column force increase with the onset of the EFS module is more pronounced. Horizontal stabilizer As shown in Figure the horizontal stabilizer controls the pitch trim of the airplane; its leading edge can be moved to a maximum position of 4.2 degrees up and 12.9 degrees down by the 7 The aft elevator controls are located in the empennage aft of the stabilizer rear spar. 41 Aircraft Accident Investigation Bureau Interim report March, 2020 rotation of a jackscrew, which is connected to the front spar fitting of the stabilizer via a ballnut. The horizontal stabilizer is positioned by a single electric trim motor controlled through either of the stabilizer trim switches located on the pilots’ control wheels or autopilot trim. The Speed Trim System, including the Speed Trim function and the MCAS function, can also command the trim motor when the autopilot is off. The main electric and autopilot stabilizer trim functions have two speed modes: high speed with flaps extended and low speed with flaps retracted. If the autopilot is engaged, actuating either pair of stabilizer trim switches automatically disengages the autopilot. The stabilizer trim wheels rotate whenever electric stabilizer trim is actuated. The stabilizer may also be positioned by manually rotating the stabilizer trim wheels. FIGURE 9: HORIZONTAL STABILIZER MOVEMENT The total range of the Horizontal Stabilizer movementis 17.1degrees (orunits) which are depicted on the scale on the stabilizer trim indicator located on the center pedestal in the cockpit. A s s h o wn i n F i g. 9 , when the stabilizer trim indicator is at the 0 position, the Horizontal Stabilizer is at its full leading-edge up position (aircraftistrimmedfull airplane nosedown). 42 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 10: STABILIZER TRIM INDICATOR Operation with Autopilot Off a) Electric Trim Switch Control Stabilizer trim can be commanded by the flight crew by using electric trim switches located on the outboard side of the captain’s and first officers control wheels. Each control wheel contains two switches (arm and control) mounted side by side; when activated, the arm switch closes a relay to provide electrical power (115V AC) to the stabilizer trim motor; while the control switch provides the directional control to the stabilizer trim motor. Both switches (arm and control) must be activated in an airplane nose up or nose down direction in order for the stabilizer trim motor to rotate the stabilizer jackscrew to reposition the horizontal stabilizer. FIGURE 11: TRIM SWITCHES ON THE LH YOKE 43 Aircraft Accident Investigation Bureau Interim report March, 2020 b) Manual Trim Wheel Control Manual stabilizer control is accomplished through cables which allow the pilot to position the stabilizer by rotating the stabilizer trim wheels. The stabilizer is held in position by two independent brake systems when there is no electric command present to move the stabilizer. Manual rotation of the trim wheels can be used to override the brake systems, autopilot, or main electric trim. The effort required to manually rotate the stabilizer trim wheels may be higher under certain flight conditions. If the stabilizer trim system is actively trimming, grasping the stabilizer trim wheel will stop stabilizer motion. Approximately 15 rotations of the stabilizer trim wheel are required for each degree (unit) of stabilizer movement. FIGURE 12: THE TRIM WHEEL, WITH THE HANDLE EXTENDED c) Speed Trim Function The 737 -300, -400 and -500 (737 Classic) as well as the -600/700/800/900 (737 NG) family of airplanes incorporated a Speed Trim System to augment the basic airplane's speed stability during certain low speed, high thrust flight conditions by moving the horizontal stabilizer during manual flight (autopilot not engaged). The STS was carried over to the 737-7/-8/-9 (737 MAX) family of airplanes. Additionally, on 737 MAX airplanes, the MCAS function was added to the STS to address the pitch characteristics described above The Speed Trim function, which is part of the Speed Trim System, is implemented as a control law within the flight control computer (FCC8), and commands incremental stabilizer trim through the automatic trim control system circuitry. There are two different stabilizer trim rates depending on whether position of the flaps9. A schedule determines the desired incremental stab deviation from the last trimmed position as a function of airspeed and flap position. 8 9 The flight control computers (FCC) are part of the Enhanced Digital Flight Control System. When the flaps are down, the stabilizer rate is three times faster than when the flaps are up. 44 Aircraft Accident Investigation Bureau Interim report March, 2020 d) MCAS The MCAS is a function within the Speed Trim System and, when activated, moves the stabilizer during non-normal flaps up, manual flight, high angle of attack maneuvers to provide a desirable increase in stick force gradient and a reduced pitch up tendency. Similar to the Speed Trim function, the MCAS function is also a flight control law10 contained within each of the two FCCs. MCAS is only active in the master FCC for that flight. At airplane power-up, the master FCC defaults to the left side FCC; and will then alternate between the left and right FCC by flight. The master FCC is not affected by the position of the Flight Director switches. The FCCs receive inputs from several systems including the Air Data Inertial Reference specific to the MCAS, the control law commands the stabilizer trim as a function of the following: air/ground signal, flap position, angle of attack, pitch rate, true airspeed and Mach. FIGURE 13: DIAGRAM SHOWING THE COMPONENTS OF MCAS 11 The AOA and Mach inputs are provided to each FCC by the associated air data inertial reference unit (ADIRU). Each ADIRU receives AOA information from one of the two resolvers contained within the associated AOA sensor (i.e. the Left ADIRU uses left AOA vane and the Right ADIRU uses the right AOA vane). Information from the other resolver contained within the AOA sensor is provided to the Stall Management Yaw Damper Computer (SMYD), which is used, 10 11 MCAS is an open loop flight control law. Reference Boeing 737 MAX MCAS briefing, dated March 25, 2019. 45 Aircraft Accident Investigation Bureau Interim report March, 2020 along with data from other sources, for the purpose of calculating and sending commands to the Stall Warning System (SWS)12. As originally delivered, the MCAS became active during manual, flaps-up flight (autopilot not engaged) when the AOA value received by the master FCC exceeded a threshold based on Mach number. When activated, the MCAS provided a high rate automatic trim command to move the stabilizer towards Aircraft Nose Down. The magnitude of the aircraft nose down command was based on the AOA and the Mach. After the non-normal maneuver that resulted in the high AOA, and once the AOA fell below a reset threshold, MCAS would move the stabilizer to approximately the original position and reset the system. At any time, the stabilizer inputs could be stopped or reversed by the pilots using their yoke-mounted electric stabilizer trim switches, and then the MCAS system will reset after a 5 second delay. The latter behavior is based on the assumption that flight crews use the trim switches to completely return the airplane to neutral trim. In the FCC software version current at the time of the accident, if the original elevated AOA condition persists for more than five seconds following an MCAS flight control law reset, the MCAS flight control law will command another stabilizer nose down trim input (with the magnitude based on the AOA and Mach sensed at that time). On all 737 models, column cutout switches interrupt stabilizer commands, either from the autoflight system (e.g. FCC) or the electric trim switches in a direction opposite to elevator command. On the 737NG and MAX, two column cutout switching modules, one for each control column, are actuated when the control columns are pushed or pulled away from zero (hands off) column position. When actuated, the column cutout switching modules interrupt the electrical signals to the stabilizer trim motor that are in opposition to the elevator command. The MCAS function requires the stabilizer to move nose down in opposition to the column commands when approaching high angles of attack. To accommodate MCAS, the column cutout function in the first officer’s switching module was modified to inhibit the aft column cutout switch while MCAS is active, allowing aircraft nose-down stabilizer motion with aircraft noseup column input. Once MCAS is no longer active, the normal column cutout function in the stabilizer nose down direction is re-instated. Operation with Autopilot On When an autopilot is engaged, the trim commands are intended to move the stabilizer in the direction to reduce the amount of trim held by the elevators. When the autopilot is engaged, the FCC provides automatic trim up and trim down commands to the horizontal stabilizer and this moves the stabilizer to reduce the amount of trim held by the elevators. Stabilizer Trim Cutout Switches There are two stabilizer trim cutout switches located next to each other on the aisle stand just aft of the flap lever. They are identified as the STAB TRIM PRI (stabilizer trim primary) cutout 12 The SWS operates the control column stick shakers to alert the crew when the airplane is nearing an aerodynamic stall. 46 Aircraft Accident Investigation Bureau Interim report March, 2020 switch and the STAB TRIMB/U (stabilizer trim back up) cutout switch. If either switch is positioned to CUTOUT, power is removed from the stabilizer trim motor and neither main electric trim nor automatic trim can move the stabilizer. 1.6.3.11 PFD INDICATIONS The Display Processing Computer (DPC) in the MAX Display System processes the data displayed on the PFDs. The Boeing 737 MAX 8 has two DPCs. The DPC receives ARINC 429 digital data and analog discrete from various aircraft systems. The DPCs processes these data to be displayed on the Display Units (DU) located within the flight deck. Both DPCs receive data from both the left and right ADIRU and either DPC is capable of driving the captain’s and first officer’s displays. FIGURE 14: MAX DISPLAY SYSTEM PFD flags In the event of certain system failures, the data provided to the Display Processing Computer (DPC) may become invalid, e.g. No Computed Data (NCD) or Failure Warning (FW).In response, DPC and the Primary Flight Display (PFD) will show a flag on the particular parameter (ALT, SPD, ATT, etc.) with amber color and the particular parameter will not be shown in the PFD. In response, the Primary Flight Display (PFD) may show a flag on the particular parameter (ALT, SPD, ATT, etc.) with amber color and/or the particular parameter will not be shown in the PFD. Fig.15 provides an example of the speed and altitude flags. 47 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 15: INSTRUMENT SPD AND ALT FLAGS APPEAR ON PFD IAS and ALT disagree Both DPCs compare each other’s data and in the case that the data is not similar at certain values for a certain period of time, the corresponding disagree message will be displayed on both PFDs. 1. IAS disagree (Indicated Airspeed disagree) message appears if the airspeed indications on both PFDs different by more than 5 knots for more than 5 seconds. 2. ALT disagree (altitude disagree) message appears if the altitude indication on both PFDs different by more than 200 feet for more than 5seconds. 48 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE16: IAS AND ALT DISAGREE MESSAGES ON THE PFD Minimum Maneuver Speed and Minimum Speed The minimum maneuver speed is indicated by the top of the amber bar on the PFD when the aircraft is in flight. This airspeed provides:  The 1.3 g maneuvers capability to stick shaker below approximately 20,000 feet.  The 1.3 g maneuver capability to low speed buffet (or an alternative approved maneuver capability set in the FMC maintenance pages) above approximately 20,000 ft. The minimum speed is indicated by the red and black barber pole. The top of barber pole indicates the speed at which stick shaker occurs. 49 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE17: MINIMUM MANEUVER SPEED AND MINIMUM SPEED INDICATIONS ON THE PFD Maximum Operating Speed The maximum operating speed (maximum Mach operating speed (Mmo) or maximum operating speed (Vmo)) is displayed by the red and black barber pole warning band and the maximum maneuver speed is displayed by the amber bar on top of the speed tape indication on the PFD. The maximum operating speed is shown in Figure 18 below. The bottom of the barber pole indicates the maximum speed as limited by the lowest of the following:  Vmo/Mmo  Landing gear placard speed  Flap placard speed When an over-speed condition occurs, a clacker aural warning will be active. The warning clackers can be silenced only by reducing airspeed below Vmo/Mmo. FIGURE 18: MAXIMUM OPERATING SPEED 50 Aircraft Accident Investigation Bureau Interim report March, 2020 1.6.3.12 ALERTS AND WARNINGS GPWS mode 3 A Mode 3 provides alerts for significant altitude loss after takeoff or low altitude go-around with landing gear or flaps not in the landing configuration. The amount of altitude loss that is permitted before an alert is given is a function of the height of the aircraft above the terrain as shown below. This protection is available until the EGPWS determines that the aircraft has gained sufficient altitude that it is no longer in the takeoff phase of flight. Significant altitude loss after takeoff or during a low altitude go-around activates the EGPWS caution lights and the aural message “DON’T SINK, DON’T SINK”. The aural message is only enunciated twice unless altitude loss continues. These are the systems that supply inputs for Mode 3 operation:      Radio altimeter transceivers Left and right ADIRUs GPWS module Landing gear handle switch SMYDC 1 and 2. The GPWC uses this data to detect mode 3 alerts:        Radio altitude Inertial altitude Inertial vertical speed Barometric altitude Barometric altitude rate Flap angle Gear position. The alert envelope is the following one: FIGURE19: ALERT ENVELOPE FOR THE MODE 3A (FROM AMM §34-49-00) 51 Aircraft Accident Investigation Bureau Interim report March, 2020 1.6.3.13 FEEL DIFF PRESS ALERT The elevator feel computer uses hydraulic pressure from the system A and B flight control modules. When there is a difference of 25 percent between system A and system B metered pressure the feel differential pressure switch closes. When this switch is closed for more than 30 s, the FEEL DIFF PRESS light illuminates (Overhead panel). The FEEL DIFF PRESS belongs to the flight control (FLT CONT) master caution group (left side glareshield). Overspeed Two independent Mach/airspeed warning systems (one for each side) provide a distinct aural warning (clacker sound), as long as the maximum operating airspeed (VMO/MMO) is exceeded. The signal is triggered by the ADIRU. 1.6.4 WEIGHT AND BALANCE The Aircraft left the stand with a weight of 72,011kg;the weight was distributed as follows:  Operating Empty Weight: 47,090 kg;  Passenger weight (148 adults and 2 children): 11,309 kg;  A last-minute change (LMC) corrected the final weight to take into account the no-show of one passenger (- 100 kg).  Hold weight (baggage13): 2,912 kg;  Block fuel: 10,700 kg. The taxing fuel weight was 115 kg. The takeoff weight was 71,896 kg. The regulated takeoff weight is 72,400 kg. Takeoff Center of Gravity (CG) was 23.12. For this flight, the weight and balance determined by the crew of the Aircraft were within the limits defined by the manufacturer. 1.7 METEOROLOGICAL INFORMATION The accident occurred at 05:44 UTC. The pertinent Addis Ababa Bole International Airport, (HAAB) surface weather observations provided by the National Meteorological Agency of Ethiopia are as follows: MET REPORT HAAB 100300Z Wind RWY 25 06010KT RWY 07 07004KT Vis 10km CLD FEW 750M 13 MET REPORT HAAB 100330Z Wind RWY 25 06010KT RWY 07 06006KT Vis 10km CLD FEW 750M There was 205 kg of mail on board the aircraft according to the load sheet 52 MET REPORT HAAB 100400Z Wind RWY 25 05008KT RWY 07 05006KT Vis 10km CLD FEW 750M Aircraft Accident Investigation Bureau Interim report March, 2020 T/TD 13/110 C QNH 1028 HPA QFE 776.0 HPA T/TD 13/110 C QNH 1028 HPA QFE 776.2 HPA T/TD 13/110 C QNH 1028 HPA QFE 776.5 HPA METREPORT HAAB 100430Z MET REPORT HAAB 100500Z MET REPORT 100530Z Wind RWY 25 05008KT RWY 07 05006KT Wind RWY 25 06008KT RWY 07 05008KT Wind RWY 25 07010KT RWY 07 05010KT Vis 10km CLD FEW 750M T/TD 15/110 C QNH 1028 HPA QFE 776.6 HPA = METAR HAAB 100300Z 07004KT 9999 FEW025 13/11 Q1028= Vis 10km CLD FEW 750M T/TD 16/110 C QNH 1029 HPA QFE 776.8 HPA = METAR HAAB 100500Z 06008KT 9999 FEW 025 16/100C Q1029= Vis 10km CLD FEW 750M T/TD 17/090 C QNH 1029 HPA QFE 777.0 HPA = METAR HAAB 100400Z 06008KT 9999 FEW 025 13/110 C Q1028= TABLE 11: MET DATA DURING THE EVENT 06:00(05:00 UTC) 10/03/2019 FIGURE 20: MET DATA DURING THE EVENT 53 HAAB Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE21: WIND FROM BELOW LINK DATE AND TIME 10/03/2019 PLACE OF ORIGIN HAAB WSET 31 HAAB HAAA 100400Z SIG MET 01 VALTD 100500/100900 HAAA HAAB ADDIS ABEBA C/D TURR FCST= TAF from Addis Ababa Bole International Air Port TAF HAAB 092130 Z 12008KT BKN026= 1000/1106 09008KT 9999SCT028 SCT090 BECMG 1007/1011 TAF HAAB 100330Z 1006/1112 12010G20KT CAVOK BECCMG 1009/1012 16016KT BECMG 1012/1015 10012G22KT= MET REPORT HAAB 100500Z Wind - runway 25: 060 degrees 8 kt, and runway 07: 050 degrees 8 ktVisibility: 10km; few cloud 750 m; temperature: 160C; dew point: 100C QNH: 1029 hPa; QFE: 776.8 hPa MET REPORT HAAB 100530Z Wind - runway 25: 070 degrees 10kt, runway 07: 050 degrees, 10ktVisibility: 10km; few cloud 750 m; temperature: 170C; dew point: 090C QNH: 1029 hPa; QFE: 777 hPa 1.8 AIDS TO NAVIGATION Not applicable 54 Aircraft Accident Investigation Bureau Interim report March, 2020 1.9 COMMUNICATION The Ethiopian Accident Investigation Bureau obtained VHF communications information and transcribed pertinent portions of the communications between the flight crew and air traffic control. The VHF Communication frequencies involved were: Ground - 121.29 MHz, Tower 118.1 MHz & Departure (radar) is 119.7 MHZ. 1.10 AERODROME INFORMATION Addis Ababa aerodrome has two runways which consisted of two parallel paved surfaces designated 07R/25L and 07L/25R. The elevation of the airport is 2333.5 m. The Aircraft took off on runway 07R which was 3800 m long and 45 m wide. The runway was not grooved but visual inspection revealed a very smooth runway with proper crowning. The Airport elevation is 2319/2314m, on both sides (RWY07& 25) has 3800x45m asphalt concrete, take off run and 3890x45m take off distance available. The airport is located N085851.85521& E0384848.71485. Airport name Airport identification Airport operator Certificate number Adm. Certificate dated Certificate effective for Runway Direction Runway Length Runway Width Surface Condition Addis Ababa Bole Int. Airport HAAB Ethiopian Airlines Group AC/01/2006 ETH/ 1 June 2015 2 years 07R / 25L 3800 m 45 m Asphalt Concrete The RWY has performed adequate skid resistance to ensure safe landing and takeoff for aircraft; the level of skid resistance provided by a pavement surface is expressed in terms of the surface friction value. The smaller values mean poorer friction and more slippery conditions. The runway surface condition (friction measurement or estimate of the braking action) at Airport is measured using a Mu-meter. According to the Airfield Services Division procedure the runway shall be measured by towing the Mu-meter back and forth five to ten meters from the centerline of the runway at 65 kilometers per hour. Bole International airport RWY friction test has been done by test speed which is indicated below by friction coefficient. N o RWY designation Friction coefficient values (%) Remarks 1 2 RWY 07R RWY 25L A 58 66 Medium Good B 62 58 C 54 67 Average 58 63 Table12: RWY FRICTION COEF. VALUE 55 Aircraft Accident Investigation Bureau Interim report March, 2020 Measurement has been carried out on a long line on each side of the center line, approximately 3m or the distance from the center line on which most operations took place. 1.10.1 RWY AND TWY MARKINGS AND LGT Runway LGT edge elevated bi- directional and brilliance control of combination of white and amber lights. Threshold lights: Green light across displaced threshold TWY markings: Centerline. Taxi holding position edge TWY designator boards TWY LGT: Edge elevated Omni directional blue lights. 1.10.2 INFRASTRUCTURE The runway, stop way and taxiway surfaces are all covered in tarmac. The aerodrome has night lighting. All of the obstacles are equipped with lighting systems. The runway has white runway lights, red runway end lights and green unidirectional threshold lights. The stop ways have red lights. Runway 25, which is equipped for instrument approaches, has centerline approach lighting over a distance. No operational anomalies were noted in the lighting either by the crew of flight MSR 851 or by the crews of having used it before and after the accident. FIGURE 22:AIRPORT STRUCTURE 56 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 23: RWY & TAXI WAY LAYOUT 1.11 FLIGHT RECORDERS The Aircraft was equipped with a Digital Flight Data Recorder (DFDR) and Cockpit Voice Recorder (CVR), which were located in the aft cabin and aft cargo hold (respectively) section of the aircraft. DFDR CVR FIGURE 24: DFDR AND CVR AS DISCOVERED ON THE ACCIDENT SITE. 57 Aircraft Accident Investigation Bureau Interim report March, 2020 1.11.1 DIGITAL FLIGHT DATA RECORDER The aircraft was equipped with a FA2100 NAND DFDR manufactured by L3-com with part number 2100-4945-22 and serial number 001217995. On 11 March 2019, the DFDR was recovered from the accident site by the AIB. On 12 March 2019 the DFDR chassis with the Crash Survivable Memory Unit (CSMU) attached were transported to the French BEA recorder facility for data downloading. The delegation from ETHIOPIAN AIB, arrived at the BEA facilities. The team visited the BEA facilities and an agreement was prepared to describe how the readout operations would be performed. Following the signature of the executive technical cooperation program document, the recorders data recovery operations started. National Transportation Safety Board (NTSB) of United States of America as Accredited Representatives, advisors (Boeing, FAA) and EASA participated in the operation The ETHIOPIAN AIB had brought a suitcase containing the equipment that was recovered on the accident site: - A complete recorder (chassis and CSMU) - A CSMU separated from its chassis - A chassis without its CSMU The information provided by the manufacturer indicated that the aircraft was fitted with the following recorders. FDR CVR Manufacturer L3-com FA2100 NAND L3-com FA2100 NAND Part number 2100-4945-22 2100-1925-22 Serial number 001217995 001289168 TABLE13: FDR, CVR IDENTIFICATION The opening of the recorders and data extraction were done following BEA FA2100 NAND procedure, which is based on the AIK Accident Investigator Procedure, FA2100 series, Rev 7 dated 16th September 2015 published by L3 communications (reference 905-E1436-22). FIGURE 25 : DFDR IN THE SUITCASE 58 Aircraft Accident Investigation Bureau Interim report March, 2020 The memory puck was opened and the electronic board containing the memory component support was extracted. The memory board identification was P/N 205-E5458-04, S/N 001157901 and the flex identification was 024-E5675-20 REV, 1809-1. FIGURE26 : FDR MEMORY BOARD, FLEX AND CONNECTOR The memory board was visually inspected with a Keyence microscope. Apart from the connector pads, the memory board was in good condition. There was no trace of impact. The two memory chips as well as the micro-processor were found in good condition. The recorder read-out was performed by BEA (Bureau d’Enquête Analyses pour la sécurité de l’aviation civile) investigators for the Ethiopian Accident Investigation Bureau (AIB) under the authority of Ethiopian investigators with the participation of the U.S National Transportation Safety Board (NTSB), The Boeing Company, U.S Federal Aviation Administration (FAA) and EASA. The down loaded file provided more than 73hrs of valid data, including the flight of the event. The FDR data were decoded using the Boeing data frame provided by the NTSB and described in the document Digital flight data acquisition unit 737 Max Data frame interface control and requirements document, reference D226A101-6, rev E dated 10th January 2019. 1.11.1.1 DFDAU Information The validity tests and the way the DFDAU provides the invalidity information to the FDR are defined inside the appendix B of 737 Max Data frame interface control and requirements document. The following has to be taken into account when analyzing the recorded FDR data: - - FDAU records the invalidity pattern once 4 consecutive invalid values have been received. As a consequence, when an invalidity pattern is detected inside the recorded data, the 4 previous samples shall also be considered as invalid Taking into account the invalidity pattern (Data – Error code – Data – 0), an invalidity of a parameter during less than 6 samples cannot be detected inside the recorded data. 59 Aircraft Accident Investigation Bureau Interim report March, 2020 Indeed, the FDAU would transmit in this case: 4 samples of data as if they were valid, then the invalidity pattern starting with the data and then only the error code (the 6th values recorded after the start of the invalidity). For a parameter recorded each second, up to 6 s of invalidity may not provide any cue inside the recorded data. These impacts are illustrated in the Fig 27 with the same parameter plotted twice (raw recorded values on the top and engineering values on the bottom). FIGURE27: ILLUSTRATION OF THE INVALIDITY RECORDING Specific information for FDR data analysis Stab trim cutout switches positions No discrete parameter records the positions of the stab trim cutout switches. However, some recorded parameters provide information on these positions: - The discrete parameter of the manual electric trim command records command (up or down) only when both stab trim cutout switches are in the normal position. - The discrete parameter of the FCC trim command records command whatever the positions of the stab trim cutout switches are. When FCC commands are recorded, if no stabilizer motion is recorded, it means that at least one stab trim cutout switch is in the CUTOUT position. 60 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 28: STAB TRIM CUTOUT SWITCHES POSITION MCAS Detection No discrete parameter records the MCAS activation. However, MCAS activation can be detected with the following recorded information: 1. The autopilot is not engaged 2. The flaps are retracted 3. The stabilizer move is commanded by the FCC in the “down” position 4. If stabilizer moves, o The stabilizer moves toward aircraft nose down command. o This move of the stabilizer, if it is in opposition with the pilot command (pilot pulling aft), is only possible under MCAS activation. o The speed of automatic moves of the stabilizer is typically limited when flaps are up. This speed reaches 0.27°/s only under MCAS activation. 5. If stabilizer did not move, the FCC command shall last during a time consistent with the MCAS computed duration. 6. If a manual trim command was performed before, MCAS triggers after a delay of 5 s. 61 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 29: MCAS DETECTION WITH FDR DATA 1.11.2 COCKPIT VOICE RECORDER The aircraft was fitted with a FA2100 NAND CVR manufactured by L3 Communications with part number 2100-1925-22 and serial number 001289168. FIGURE 30: CVR CSMU 62 Aircraft Accident Investigation Bureau Interim report March, 2020 On 11 March 2019, the CVR was recovered from the accident site by the AIB. The CVR CSMU was transported to the BEA recorder facility for data downloading. The CMSU was found separated from the chassis during wreckage recovery. The read-out was performed by BEA under the authority of the Ethiopian Accident Investigation Bureau (AIB), with the observation of the National Transportation Safety Board (NTSB) of United States of America. The memory board identification was P/N 205-E5458-04, S/N 001158641 and the flex identification was 024-E5675-20 REV, 1809-1. FIGURE 31: CVR MEMORY BOARD AND FLEX The CVR memory board and flex were visually inspected with the Keyence microscope. There was no damage on the board and the connector was in good condition. A second observation with the X-ray was made, which confirmed that the connector soldering were in good condition. The memory unit recorded 2 hours, 4 minutes and 14 seconds of aircraft operation, which contained 2 flights including the accident flight. 1.12 WRECKAGE AND IMPACT INFORMATION The accident site was located near Ejere, Ethiopia with a GPS location of 8.8770 N, 39.2516 E. The investigation team had much of the wreckage moved from the impact site to a secured location on Addis Ababa AIB store. The wreckage pile measures approximately 5’ high and about 30’ in diameter. Assistance from Ethiopian Airlines recovered a number of flight control components – some aredocumented above during the on-site examination. Below is a detailed exam of each of the identified components The Aircraft impacted terrain at a farm field and created a crater approximately 10 meters deep (last aircraft part found) with a hole of about 28 meters width and 40 meters length. Most of the wreckage was found buried in theground; small fragments of the aircraft were found 63 Aircraft Accident Investigation Bureau Interim report March, 2020 scattered around the site in an area by about 200 meters width and 300 meters long. The damages to the aircraft are consistent with a high energy impact. Flight path From North to South FIGURE 32: TOP VIEW OF THE CRATER FIGURE 33: CLOSE VIEW OF THE CRATER BEFORE EXCAVATION 64 Flight path from North to South Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 34: ACCIDENT SITE LEFT HAND ENGINE (S/N602722) The left engine core was recovered from the site and examined by the group The engine was reportedly recovered at a depth of approximately 10 to 15 meters depth on the left side of the excavation site. The predominant feature of the deformation of the entire remaining core was axial deformation. 65 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 35 : LEFT HAND ENGINE SECTION RIGHT HAND ENGINE (S/N602695) The right engine core was recovered from the site and examined by the group. The recovered core of the right engine was more damaged than the left-hand engine. The engine was reportedly recovered at a depth of approximately 1 0 to 15 meters depth on the right side of the excavation site. The predominant feature of the deformation of the entire remaining core was axial deformation. 66 Aircraft Accident Investigation Bureau Interim report FIGURE 36: R/H ENGINE - S/N 602695 – CORE FIGURE 38: R/H ENGINE - S/N 602695 – FAN DISK FRACTURED March, 2020 FIGURE 37: - R/H ENGINE - S/N 602695 – FAN DISK FIGURE 39: R/H ENGINE - S/N 602695 - RETENTION LUGS - HIGH PRESSURE COMPRESSER (HPC) The HPC case was fractured and a portion of it remained with the core and the HPC stages were nd rd separated from the core. The 1st, 2 and 3 stage blisks were found together and were missing th th their airfoils. The 4 , 6 , and the 8th to 10th stages were not found. The 5th stage was found separately, and it was also missing its airfoils. The 7th stage web was fractured circumferentially. The stator sections could not be identified. 67 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 40: - R/H ENGINE - S/N 602695 – HPC STAGES 1 TO 3 FIGURES 41:- R/H ENGINE - S/N 602695 – HPC STAGE 7 COMBUSTION SECTION The combustor was severely crushed and most of it was missing into pieces. FIGURE 42 : COMBUSTOR CRASHED The Airworthiness Group, comprised of members from Ethiopian CAA, Boeing, and NTSB convened at accident site, located near Ejere, Ethiopia, on March 12, 2019 to examine the aircraft wreckage with a specific focus on flight controls and the air data system components. 68 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE43: RECOVERED WRECKAGE PILE ON THE SITE 1.12.1 RECOVERED WRECKAGE EXAMINATION The investigation team had much of the wreckage moved from the impact site to a secured location on Addis Ababa AIB store. The wreckage pile measures approximately 5’ high and about 30’ in diameter. Assistance from Ethiopian Airlines recovered a number of flight control components – some are documented above during the on-site examination. Below is a detailed exam of each of the identified components. FIGURE 44: RECOVERED WRECKAGE PILE EXAMINATION OF THEENGINES Because the serial number plates were not found, the handedness of the engines was not readily identifiable, so the serial numbers of some internal components were used to make this 69 Aircraft Accident Investigation Bureau Interim report March, 2020 determination. The serial numbers were compared to the CFM build records to confirm the engine serial number and therefore airplane location. See (Table 14 & 15). Designation Fan Disk LPC Stage 2-4 Spool HPC Stage 1 Blisk HPC Stage 2 Blisk HPC Stage 3-4 Blisk Spool HPC Stage 5 Blisk HPC Stage 6-10 Spool ESN 602722 (Installed Left Position) Part Number Serial Recovered S/N Identified Number* 364-040-010-0 HB150486 364-905-100-0 MA510264 2639M71G02 GWN13E24 x 2552M02P02 GLHW0C40 x 2552M03G02 GLHW0A6N x 2552M05P02 2552M06G04 TMT138N0 GWN13ENJ x x HPT Rotor Disk Stage 1 2600M21G02 GWN13ECE x HPT Rotor Disk Stage 2 LPT Rotor Disk Stage 1 LPT Rotor Disk Stage 2 LPT Rotor Disk Stage 3 LPT Stage 4, Disk STBSHF 2547M01G02 364-021-030-0 364-021-130-0 364-021-230-0 364-001-611-0 TMT130CR PC740173 PC738557 PC738549 HC278966 x x x x x LPT Rotor Disk Stage 5 364-600-011-0 GA005072 x x x x x Note Not Recovered Not Recovered Remained with core Remained with core Remained with core Remained with core Remained with core Remained with core, Rim not recovered Remained with core Separated from engine core Separated from engine core Separated from engine core Separated from engine core Foundwithstage5rotatingai rseal attachedP/N364-062-0100,S/N DY168293 TABLE 14 :LEFT HAND ENGINE PART IDENTIFICATION S/NS Designation Fan Disk LPC Stage 2-4 Spool HPC Stage 1 Blisk HPC Stage 2 Blisk HPC Stage 3-4 Blisk Spool HPC Stage 5 Blisk ESN 602695 (Installed Right Position) Part Number Serial Recove S/N Note Number* red Identifie d 364-040-010- HB150564 x x Separated from engine core 0 364-905-100- MA510373 Not Recovered 0 Separatedfromenginecore(stage 2639M71G02 TMT146AG x 1-3 recovered together) Separatedfromenginecore(stage 2552M02P02 GLHW0A66 x 1-3 recovered together) Stage 3 recovered with Stage 1-2. 2552M03G02 GLHW0A67 x Stage 4 not recovered. 2552M05P02 GLHW0CKH x HPC Stage 6-10 Spool 2552M06G03 GWN13EAH x HPT Rotor Disk Stage 1 2600M21G02 GWN13EEE x HPT Rotor Disk Stage 2 LPT Rotor Disk Stage 1 2547M01G02 TMT1469H 364-021-030- PC735264 0 364-021-130- PC681407 0 364-021-230- DY386829 0 364-001-611- PC640864 0 x x Separated from engine core. Spoolseparatedfromengine.Stage 7hub/webseparatedfromengine, rimnotrecovered.Otherstagesnot recovered. Separated from engine core. Rim section liberated and found protruding from HPT Case. Remained with engine core Remained with engine core x Remained with engine core x Remained with engine core x Remained with engine core LPT Rotor Disk Stage 2 LPT Rotor Disk Stage 3 LPT Stage 4, Disk STBSHF 70 Aircraft Accident Investigation Bureau Interim report LPT Rotor Disk Stage 5 364-600-0110 March, 2020 GA004847 x Separated from engine core. Found with stage 5 rotating air seal attachedP/N364062-010-0,S/N HB301273 *Serial Number based on CFMI Delivery Records TABLE 15 : RIGHT HAND ENGINE PART IDENTIFICATION S/NS HIGH LIFT CONTROL SYSTEM COMPONENTS The Airworthiness group located components from the high lift control system at the accident site and within the wreckage pile located at the Addis Ababa airport AIB store. Image of the trailing edge flap system Image of a flap transmission and ballscrew Two parts of the actuation system were located and examined at the impact site. One consists of the ballscrew, yoke, gimbal and flap transmission; the other consists of just the ball screw, yoke, and gimbal (see Figures respectively). 71 Aircraft Accident Investigation Bureau Interim report FIGURE45: FLAP TRANSMISSION & BALLSCREW March, 2020 FIGURE46: FLAP TRANSMISSION The installed location of each unit has not been identified. The position of each gimbal is consistent with the flaps in the fully retracted position. During the examination of the wreckage pile located at the Addis Ababa airport AIB store, the Airworthiness group identified a total of 4 (including the ones identified at the impact site) trailing edge flap transmissions (there are 8 total); three of these had the ball nut and gimbal still attached. FIGURE47:TRAILING EDGE FLAP TRANSMISSIONS AND BALL SCREWS Again, all three were found in the fully retracted position. There was one additional transmission portion that was found as well as three ball screw segments. All examined damage appears consistent with high energy impact. 72 Aircraft Accident Investigation Bureau Interim report March, 2020 LEADING EDGE SLATS ACTUATORS The high lift control system consists of the trailing edge flaps and the leading edge slats. Two of the 8 leading edge slat actuators were photographed (see Figures below) at the impact site. The installed location for each actuator has not been identified. The actuator position, as photographed, is in the fully retracted position. During the examination of the wreckage pile located at the Addis Ababa airport AIB store the Airworthiness group identified a total of three leading edge slat actuators at the impact site. The actuator position, as photographed, are in the fully retracted position, FIGURE 48: SLAT ACTUATOR (POSITION UNKNOWN) FIGURE 49: LEADING EDGE SLAT ACTUATORS The Airworthiness group located components from the horizontal stabilizer control system at the accident site and within the wreckage pile located at the Addis Ababa AIB store. Two parts of the control system were located and examined at the impact site. One consists of aft cable drum; the other consists of the stab trim actuator (see Figures below respectively). These components do not provide any evidence of what position the horizontal stabilizer may have been at the time of impact. 73 Aircraft Accident Investigation Bureau Interim report FIGURE 50:AFT CABLE DRUM March, 2020 FIGURE51:STAB TRIM ELECTRIC MOTOR HOUSING Most of the located components of the stabilizer trim system were located once the wreckage was transported to Bole International Airport. The only part of the stab trim system located on site was the motor housing (see above). Referencing figure 51 above, the parts located in the wreckage pile at the airport consisted of the Primary Brake Housing (has the Lower Gimbal on it), the entire jackscrew (fractured into three pieces), and the ballnut (jammed onto the screw). The damage to the components of the stabilizer trim system is consistent with a high energy impact. STABILIZER TRIM NOTES & POSITION The figure belowshows the relationship of the ballnut position along the ball screw. There is a safety rodwhich acts as a secondary load path should the ball screw fracture in service for any reason. It is attached to a separate set of secondary gimbals below the primary support gimbals on the primary brake housing and to the top of the ball screw. Figure 54 shows the safety rod and that it protrudes out from the ball nut. However, the fracture faces on the 5” long upper screw portion (note the measurement in Figure 53) match those found near the ballnut upper stop. This is consistent with the safety rod being pulled out several inches prior to final fracture. 74 Aircraft Accident Investigation Bureau Interim report March, 2020 Figure52 : recovered Stabilizer Trim components Examining the fracture surfaces, the upper screw segment fits with the facture face just inside the ballnut giving a measurement between the stops on the ballnut and the upper ballnut stop of ~5”. Referencing Boeing document D251A122 (737NG Control Position Data), this measurement equates to a stabilizer trim setting of 1.5 degrees Airplane Nose Down (AND) or an indicated position of 2.5 units of trim. Although the data is for the 737NG, the position of the MAX stab trim holds the same relationship. According to Boeing: Stab. Angle Stab. Units (deg) Airplane Nose Down (Stab Leading Edge Up) Mechanical Limit 4.71 -0.71 Main Electric Nose Down (AND) Limit with flaps down (flap not 4.45 -0.45 up) Main Electric Nose Down (AND) Limit with flaps up 0.15 3.85 Neutral Stabilizer 0 4.00 Main Electric Nose Up Limit -10 14.00 Airplane Nose Up (Stab Leading Edge Down) Mechanical Limit -12.40 16.40 Table 16: STAB NOTES & POSITION 75 Aircraft Accident Investigation Bureau Interim report FIGURE53:UPPER BALLSCREW SEGMENT March, 2020 FIGURE 54: BALLNUT AND UPPER BALLSCREW SEGMENT PITCH CONTROL SYSTEM (ELEVATOR) The Airworthiness group located components from the elevator control system within the wreckage pile located at the Addis Ababa airport property. FIGURE55: ELEVATOR PCU ACTUATOR PISTON The only components that were located for this system were the output torque tube, the mach trim actuator, a small portion of the Elevator feel and centering unit, and a small piece of the elevator input torque tube. The Figure 55 above shows the recovered components of the elevator control system. Note that all components, like the lateral components show significant 76 Aircraft Accident Investigation Bureau Interim report March, 2020 damage consistent with a high-energy impact. The upper torque tube was fractured in half. Only a small portion of the lower (input) torque tube was recovered along with a piston of the Elevator Power Control Unit actuator. The Mach Trim Actuator was found in the fully retracted position. 1.13 MEDICAL AND PATHOLOGICAL INFORMATION Medical and pathological information is under study and will be accessible in the final investigation report. 1.14 FIRE There was no evidence of fire. 1.15 SURVIVAL ASPECTS There were no survivers 1.16 TEST AND RESEARCH Three Major tests were conducted: 1. Column force and manual trim force evaluation using B737-8- Max CAE-Training Simulator at Ethiopian Airlines 2. Flight deck environment and column force evaluation using the Boeing Engineering simulator (ECAB) in Seattle 3. Manual Trim evaluation using Flight Controls Test Rig (FCTR) in Seattle 1.16.1 SIMULATOR ASSESSMENT OF CONTROL COLUMN AND TRIM WHEEL FORCE Up on the investigative committee decision, 3 simulation tests were conducted at a simulator facility located in Addis Ababa between July 19, 2019 and July 31, 2019. The sessions were conducted in a CAE manufactured B737 MAX level D full flight simulator to assess the control column forces that were present and evaluate the manual trim wheel forces that were required to operate the manual trim wheel at the time the flight crew tried to use it on the event flight. These assessments enabled to investigate a conversation from the cockpit voice recorder (CVR) that took place between the captain and the first officer. Particularly:   Conversation where the captain asks the first officer to pitch up with him at different points on the event flight Conversation about the use of manual trim wheel where the captain asks the first officer to trim up and the first officer replied it is not working On all sessions carried out, the simulator was set up with the weight and C.G. values of the event flight and weather condition was set to the same condition that was present at the time of the event flight. On session 1, a survey was conducted to analyze the relationship between number of manual trim wheel turns and corresponding trim unit change. It was noted that a change in 1 unit of 77 Aircraft Accident Investigation Bureau Interim report March, 2020 trim (cockpit indication) requires about 15 turns of the manual trim wheel. This finding agrees with the information supplied by the manufacturer. The aircraft was set up to the condition with thrust and trim values of the event flight when the crew moved the stab trim cutout switches to cutout. Then the pilot occupying the captain seat tried to climb to 14,000ft by pulling on the control column to evaluate the amount of force needed. The pilot on the first officer seat then started to pull together with the other pilot and together managed to establish a pitch attitude of 5-10 degrees. The forces needed from both pilots to achieve this were considered significantly very high and unbearable for the duration held. Then the pilot attempted to control the aircraft and return for landing with elevator authority only with the trim unit set at 2.3 and trim cutout switch set to cutout while adjusting thrust manually. The attempt was unsuccessful. On session 2, in order to qualitatively assess the force on the manual trim wheel through two turns at different speeds and trim conditions, speeds 220, 250, 300kts and trim values 2.5, 3.5 & 4.5 were chosen respectively. The aircraft was then trimmed for level flight at 10,000ft and the hands off trim values were noted for all three speeds. Speed 250 6.2 220 6.8 Hands off trim value 300 5.3 TABLE 17: HANDS OFF TRIM VALUE The following qualitative definitions were agreed at the start of the session. Assessment level: A = trim wheel not movable B = trim wheel barely movable (1 turn not completed) C = trim wheel moves with great difficulty (2 turns not completed) D = trim wheel moves with some difficulty (2 turns completed) The trim was set to 4.5 then stab trim was set to cut out. Then the pilot tried to trim the airplane nose up with the manual trim wheel while the other pilot maintained level flight by applying force on the control column. This test was repeated for trim values 3.5 and 2.5. The pilots took turns in evaluating the required force to turn the trim wheel. Both pilots also applied force together whenever one pilot was unable to move the wheel. The following table is a summary of the qualitative assessment. 78 Aircraft Accident Investigation Bureau Interim report March, 2020 Trim position units 4.5 3.5 2.5 Hands off trim values Speed 250 ----------A 6.2 220 D C B 6.8 300 ----------A 5.3 TABLE 18: QUALITATIVE ASSESSMENT OF TRIM VALUE On session 3, the qualitative assessment of the manual trim wheel through 2 turns was repeated and the same finding was observed. As the trim position from the event flight at the time the stab trim was in cutout and the pilots tried to use manual trim wheel was close to 2.5 units, this trim value was used to analyze the amount of miss trim at different speeds and determine the relationship of control column force, trim wheel force and amount of mis-tirm. The following table is a comparison of the mis-trim Mis-trim = hands off trim value – current trim Hands of trim value Trim value 4.5 3.5 2.5 Speed 220 250 300 6.8 6.2 5.3 Mis-trim value / assessment value 2.3 / D 1.7 0.8 3.3 / C 2.7 1.8 4.3 / B 3.7 /A 2.8 /A TABLE 19: MIS- TRIM EVALUATION RESULT It was observed that the greater the mis-trim value, the greater the force required by the pilot on the control column to fly level flight and consequently the greater the force required turning the manual trim wheel. As the trim value from the event flight was around 2.5 units by the time the crew tried to use the manual trim wheel, even at a speed of 220 kts the difficulty level of turning the manual trim wheel was level B (barely movable/ 1 turn not completed). The number of manual trim wheel turns that needed to be applied to get the hands off trim value was calculated by multiplying the mis-trim value by 15. The following table indicates the number of manual trim wheel turns required to reach the hands off trim value from a trim value of 2.5 units at the three different speeds. 79 Aircraft Accident Investigation Bureau Interim report Hands of trim value Mis-trim value when trim set at 2.5 Number of manual trim wheel turns required March, 2020 220 6.8 4.3 Speed 250 6.2 3.7 300 5.3 2.8 64.5 55.5 42 Summary of observations 1. The greater the mis-trim value, the greater the force required by the pilot on the control column to fly level flight and consequently the greater the force required to turn the manual trim wheel. 2. At a speed of 220 kts, the difficulty level of turning the manual trim wheel was found to be level B (barely movable/ 1 turn not completed) for the trim value of 2.5 units, which was the trim value on the event flight by the time the crew tried to use the manual trim wheel. 3. For all speeds higher than 220 Kts and trim set at a value of 2.5 units, the difficulity level of turning the manual trim wheel was level A (trim wheel not movable). 4. It takes about 15 turns of the manual trim wheel to get a 1 unit trim change. 5. On the event flight during the time the flight crew tried to use the manual trim wheel, about 40 turns of the manual trim were required to get back to the neutral position. 1.16.2 ENGINEERING SIMULATOR AND FLIGHT CONTROL TEST RIG ASSESMENTS From 16-19 December 2019, the investigation team conducted Engineering simulator sessions on the Boeing engineering simulator(ECAB) in Seattle configured for Boeing 737-8 (MAX). Trim wheel tests were also performed at the Flight Controls Test Rig (FCTR). The team consisted of representatives from EAIB, NTSB, BEA, FAA and Boeing. The main objective of the simulator sessions was to provide a better understanding of the accident flight and observe various messages, lights, various failure modes and flight deck effects related with the event flight. It was also to understand the flight crew workload during different scenarios. 80 Aircraft Accident Investigation Bureau Interim report March, 2020 SIMULATOR SESSIONS ON THE ECAB Multiple ECAB sesseions were conducted to evaluate the event flight from different perspective. Further tests and research is in progress awaiting ECAB back drive of the FDR data and will be part of the final report. TRIM WHEEL EVALUATION AT THE FLIGHT CONTROLS TEST RIG (FCTR) Multiple scenarios were executed to run different manual trim Wheel forces for ET-302 flight conditions on ground as well as at different speeds and altitudes using Flight Controls Test Rig (FCTR). A trim wheel evaluation was performed at the Flight Controls Test Rig (FCTR). Tests were done with aircraft on ground as well as at different speeds and altitudes with different trim settings. It should be noted that: - The maximum possible mistrim setting on the FCTR is -1.5 unit. - 15 wheel rotations are necessary for 1 unit of trim. - The first test was conducted with aircraft on ground at 0 kt. Expected force on the wheel 10 Lbs.  It was noted that the wheel was easy to operate, the FCTR matched the physical aircraft very closely and that it was qualitatively close to CAE training simulator forces. The FCTR instrumentation recorded static force of approximately 9.3 pounds. The second test was conducted with aircraft at 12,000 ft, 250 kts, in trim condition (expected 15 lbs force).  It was noted that the wheel was a bit more difficult to operate but that it was still doable with one hand. It was qualitatively close to CAE training simulator forces. The FCTR instrumentation recorded static force of approximately 15 pounds. The third test was performed at 12,000 ft, 340 kts (VMO), in trim condition (expected 21 lbs force.  It was noted that the trim wheel force become much more difficult to operate than in condition 2. The wheel motion became jerky, straining efforts to turn it. Impact on speech. Qualitatively more difficult than on CAE training simulator. 15 turns would be tiring. Rig instrumentation recorded static force of 21 pounds. The fourth test was conducted at 15,000 ft and 340kts (VMO), -1.5 units (mist-rim)14, expected 35 lbs force.  It was noted that it was impossible to turn the wheel with one hand confirming the first officer’s statement “it was not working” meaning “hard to move. Some participants expressed surprise at the difficulty. It was possible to turn the wheel with two hands although not convenient at all. The level of force for this condition was found to be 14 When the first officer reported that he could not move the trim-wheel, the mis-trim was about 2.5 degrees at 340 kt 81 Aircraft Accident Investigation Bureau Interim report March, 2020 between 30 and 40 lbs. It was agreed that difficulty would increase further outside the normal operating envelope (as in the accident case). The mistrim level on the event flight was 2.5 units at 340 Kts but since the FCTR is limited to 1.5 unit of miss trim, the actual event flight condition could not be tested. Manual trim forces were not attempted in the ECAB as it was not calibrated for the MAX. Manual trim was evaluated in the Flight Controls Test Rig (FCTR). 1.16.3 ANGLE OF ATTACK AOA VALUES At 5 h 38 min 44 s, the LH AOA recorded values began drifting from the RH AOA recorded values; before that time, no clue of concern existed on the LH AOA recorded values. The first decrease of AOA wasby2.6° record (1 sample) before a sudden increase to more than 60° in half of a second followed by a slower increase to 74.5° At 5 h 38 min 48 s, a master caution triggered. From that time, the primary AOA heat LH recorded values underlined a failure of the vane heating (first recorded OFF value at 5 h 38 min 51s, sampling rate of the parameter: 0.25 Hz). The reason of the master cautionwas the anti-ice left alpha vane indication. Note: the master caution was no longer recorded as active at 5 h 38 min 55 s. From the CVR transcript, at 5 h 42 min 48 s, the Captain requested the recall of the master caution. At that time, master caution had only triggered once. Following the master caution recall, the crew exchanged “Master Caution Anti Ice” and “Left Alpha Vane”. FIGUR E 56: AOA VALUES DURING THE BEGINNING OF THE FLIGHT 82 Aircraft Accident Investigation Bureau Interim report March, 2020 The recorded computed airspeed values and the recorded corrected pressure altitude values were computed with the signal coming from the AOA sensor resolver No2. Their values were consistent with the shape of the LH AOA recorded values (for both parameters, an increase followed by a decrease). The triggering of the stick shaker underlined that the signal coming from the resolverNo1 matched also the LH AOA recorded values. Due to the way the AOA values were recorded, both resolvers of LH AOA sensor provided similar values. The failure impacted the signals provided by both resolvers of the LH AOA sensor. According to the description provided in §1.6.3.3 it took between 3 to 5 s between the AOA heat failure and the triggering of the associated master caution. The LH AOA heat failure triggered at a time consistent with a single event leading to both heat failure and erroneous values from both resolvers at the same time. 1.16.3.1 IMPACT OF AOA FAILURE ON ADIRS Detection of the AOA failure by ADIR As LH AOA vane heating failure occurred, LH ADIRU continued providing its parameters without any information of failure. LH ADIRU provided the recorded LH computed airspeed values. These recorded values never showed any invalidity pattern during the whole flight of the event. LH ADIRU provided output data without any invalidity information. As a consequence, - SPD flag never appeared on the PFD - ALT flag never appeared on the PFD ADR During the flight of the event, the recorded altitude values, the recorded CAS values and the recorded Mach numbers diverged after LH and RH AOA values divergence. 83 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 57: AIR DATA PARAMETERS The RH and LH computed total pressure values were identical. The difference between the recorded Mach number and between the recorded computed airspeed values were due to the difference of the corrected static pressure values. The airplane manufacturer recomputed the uncorrected static pressure for both sides, with the recorded LH and RH AOA values. FIGURE 58: UNCORRECTED STATIC PRESSURE COMPUTED BY THE AIRPLANE MANUFACTURER Uncorrected static pressure values from both sides were identical. The difference between the LH and RH side corrected pressure values were therefore only due to the AOA correction. On the LH side, the erroneous LH AOA values induced corrected static pressure values greater than the true corrected static pressure values. This increase of the LH corrected pressure values induced: - LH pressure altitude values lower than the true altitude values LH computed airspeed values lower than the true computed airspeed values. 84 Aircraft Accident Investigation Bureau Interim report March, 2020 The RH air data parameters were not affected. IRS Most of the recorded IRS parameters did not show any variation following the AOA failure. On the contrary, the computed wind, on the left side, was clearly affected by that failure. FIGURE 59: IMPACT OF AOA FAILURE ON THE WIND COMPUTED VALUES The LH IRS was selected for the flight of the event. The invalid wind computed values impacted also the FMC that smoothed the values coming from the selected IRS. On the Captain display, the wind direction and the wind speed values were incorrect. 1.16.3.2 IMPACT OF AOA FAILURE ON ENGINES AND A/T Impact of Failed AOA Values on FMC (Engine Part) For the takeoff phase, the N1 limit mode was the TO mode and the N1 recorded values corresponded to 95% of N1max. At 7,000 ft of elevation, it indicates that the take-off was performed with Max Takeoff Thrust. Indeed, at 7,000 ft of elevation, between 15°C and 20°C, the Max Takeoff thrust corresponds to 95% of N1. Note: At 5 h 39 min 52 s, the difference between the computed LH and RH TAS values reached the threshold value used by FMC to detect inconsistency. Whatever the impact of these 2 samples might have had, no information of invalidity can be recorded inside the FDR recorded data. 85 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE60: FMC PARAMETERS FOR THE ENGINES 86 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 61: FOCUS ON INVALID N1 DATA FROM FMC On The Figure 61: - The start of the recorded invalidity patterns was identified and tagged. - According to the DFDAU design the four values preceding the invalidity pattern shall also be considered as invalid. They were plotted using diamond symbols. At the same time, the difference between the TAS computed on each side reached too high a value, N1 LIMIT MODE parameter (FMC) switched to “Not Available” mode. IMPACT OF AOA FAILED VALUES ON AUTO-THROTTLE (A/T) During the whole flight of the event, A/T stayed engaged and no A/T warning triggered. At the beginning of the flight, the A/T was in ARM mode. At 5 h 37 min 43 s, the TRA recorded values showed an increase, from 36° to 45° in 3 s. During that move, THR TORQUE-[1/2] recorded values stayed null. That move was manually performed. - At 05 h 37 min 53 s, the TO/GA switch was pushed. A/T switched to the N1 mode. The automatic takeoff and climb was engaged. A/T moved automatically the throttles forward (THROTTLE RATE CMD-[1/2] values, THR TORQUE-[1/2] values were positive). TRA did not move anymore until the end of the flight because the FMC used the LH baro corrected 87 Aircraft Accident Investigation Bureau Interim report March, 2020 altitude values, which were lower than the true ones. Thus, FMC did not detect the thrust reduction altitude when it was sending valid engine commands. And LH and RH TAS diverged by more than 25 kts the FMC did not send any valid N1 target values FIGURE 62: AUTO THROTTLE BEHAVIOR DURING THE FLIGHT OF THE EVENT As expected: - At a recorded computed airspeed of 84kt (5 h 38 min 14 s), the A/T switched to the THR HOLD mode (no other mode recorded). - When the airplane altitude reached 800ft above the field elevation, computed from the LH baro corrected altitude (at 5 h 39 min 38 s, the airplane reached a LH baro-corrected altitude of 8,416 ft), the A/T switched from THR HOLD to ARM mode. Note: the true altitude of 800 ft above the field elevation was in fact reached at 5 h 39 min 22 s (RH baro-corrected altitude of 8,416 ft). 19 s after the engagement of the ARM mode, the FMC detected the discrepancy between the LH and RH TAS values. At that time, the airplane was descending and the maximum height above field elevation it had reached before was 950 ft (from the LH baro corrected altitude). The thrust reduction altitude was not reached at that time. The TARGET N1-[1/2] and of the N1 BUG DRIVE ENG[1/2] values transmitted by the FMC decreased to 89% (5 h 39 min 58.7 s) with the flag NCD. Due to the invalidity flag, A/T function disregarded this new target. 88 Aircraft Accident Investigation Bureau Interim report March, 2020 Note: By design, when no valid airspeed is available, the FMC changes the TARGET N1-[1/2] to the climb value. A N1 target value of 89% is consistent with a Climb phase. Summary on A/T behavior During the flight of the event, A/T was engaged in the automatic takeoff sequence and due to the erroneous LH AOA values: - LH and RH TAS diverged by more than 25 kts. From 5 h 39 min 57, the FMC did not send any valid N1 target values - The thrust reduction altitude was reached around 5 h 39 min 28 (computed from the RH baro corrected altitude). However, the FMC used the LH baro corrected altitude values, which were lower than the true ones. The FMC did not detect the thrust reduction altitude when it was sending valid engine commands. 1.16.3.3 IMPACT OF AOA FAILURE ON SMYDC Stall management Following the increase of the left AOA values: - the autoslat system triggered (SMYDC 1), the LH stick shaker engaged the LH elevator feel shift triggered. At 5 h 39 min 56 s, the autoslat system stopped and the flap handle was at 0 position and flaps were moving up (flaps position lower than 1) with LH computed airspeed values reaching 230kt and RH computed airspeed value 250kt. 89 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE63: AUTOSLAT, LEFT STICK SHAKER AND ELEVATOR FEEL SYSTEM At 5h 39 min 44s SMYDC-2 disabled the RH autoslat function due to the RH computed airspeed (230kt reached). SMYDC1 disabled the LH autoslat function 12 s later due to the invalid LH computed airspeed. SMYDC Computed Speed From 5 h 40 min 13 s The LH FC Minimum operating speed computed by the SMYDC 1 reached values greater than VMO;3s later The LH stick shaker speed reached values greater than VMO. The invalidity of these computed speeds was not detected by any computers. From 5 h 41 min 30 s until the end of the flight by computing the equivalent Mach number, the left Stick Shaker Mach computed numbers were greater than the MMO (0.82) ; At 5 h 41 min 17 s, SMYDC1 computed FC minimum operational speed values greater than High speed values. Both values were computed by the same computer SMYDC 1. 90 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 64: SMYD COMPUTED SPEEDS LIMITS The speed tape of the airplane had a range of 120kt (60kt above and below the actual computed airspeed). As soon as the stick shaker speed reached values higher than the actual computed airspeed plus 60kt, red and black stripes are displayed all along the border of the speed tape. During the flight of the event, the red and black stripes should have been displayed almost all the time from 5 h 40 min 03 s until the end of the flight (parameter Full Red black Stripes). 1.16.3.4 IMPACT OF AOA FAILURE ON FLIGHT CONTROLS Stabilizer Stabiliser commanded moves Takeoff was performed with a trim position set at 5.7 units. During the beginning of the flight, several manual electrical trim inputs were recorded. These inputs limited the force the captain applied to the control column. Between the lift off and the engagement of CMD A, the stabilizer moved between 4.9 and 5.9 units. When A/P was engaged, the stabilizer was at 5.6 units. 91 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 65: STABILIZER COMMANDED MOVES Under A/P, 3 FCC A/P trim down commands were recorded and the stabilizer trim values decreased to 4.6 units. When A/P disengaged, one single sample of FCC trim UP was recorded (Speed Trim activation). At 5 h 40 min 00 s, MCAS function triggered for the first time. At the end of the MCAS activation, the stabilizer position was 2.1 units. Manual electrical trim UP input was recorded from 5 h 40 min 14 s for 2 s. The stabilizer reached a position of 2.38units. At 5 h 40 min 21 s, MCAS triggered for the second time. At the end of the 2 nd MCAS activation, the stabilizer position was 0.4 units. Note: The MCAS function should have commanded stabilizer move towards aircraft nose down for 9.3 s but, during that period of time, the movement of the trim towards nose down command was limited to only 6s, the MCAS command was stopped by manual electrical trim up command. The crew trimmed up for 9 s. The stabilizer position reached 2.3 units. At 5 h 40 min 43 s, the MCAS function triggered for the third time. The stabilizer did not move. The Stab Trim Switches were then in the CUTOUT position. As manual electrical stabilizer trim command was recorded up to 5 h 40 min 37 s, the move of the switches into the CUTOUT position occurred between 5 h 40 min 38 s and 5 h 40 min 43 s. 92 Aircraft Accident Investigation Bureau Interim report March, 2020 According to the CVR transcript, the crew exchanged about the use of “stab trim cutout”. At 5 h 40 min 37 s, the Captain expressed “yes, do it”, followed by the F/O answer “Stab trim cut-out”. Note: At 5 h 40 min 38 s, it is assumed that F/O moved the stab trim switches into the CUTOUT position. At the end of the flight, (at 5 h 43 min 11 s), one pulse of manual electrical stabilizer trim up command was recorded (one single sample), followed 3 s later by a pulse of 2 samples. The stabilizer reached 2.3 units. At those times, both Stab Trim Cutout switches were in the NORMAL position. The following exchanges were provided by the CVR transcript: 05:43:09 “Put Them UP” 05:43:11 COMMAND put it on. Note: It is assumed that the Stab Trim switches were back into the normal position at around 5 h 43 min 10 s. At 5 h 43 min 21 s, the MCAS function activated for the 4th time. The stabilizer position reached 1 unit. From that point until the end of the recording, no other commanded move of the stabilizer occurred. Trim stabilizer force The airplane manufacturer computed the force to apply on the trim wheel handle to move the stabilizer. The stabilizer position values used to compute the force were synchronized with the recorded stabilizer positions values. With this synchronization, the FDR UTC time 5 h 41 min 50 s corresponds to the time value of 1,225.5 s (time used by the airplane manufacturer for its computation). Taking into account the force applied on the control column, it was possible to assess that the copilot was pulling the control column until 5 h 41 min 49 s From the CVR transcript: - At 5 h 41 min 50 s, the captain requested the F/O to try moving the trim manually. - At 5 h 41 min 50.5 s: a sound similar to the trim wheel handle extension was detected. - At 5 h 41 min 51 s, the copilot confirmed “Trim up” - At 5 h 41 min 55.5 s, the captain used an “expression of expectation” - At 5 h 41 min 56 s, the copilot stated: “it is not working”. The time during which the F/O tried to manually move the trim was then between 5 h 41 min 51 s and 5 h 41 min 56 s. 93 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 66: FORCE NEEDED TO MOVE THE TRIM WHEEL By the time the FO tried to move the trim wheel manually a force between 42 lbs and 53 lbs was required according to the aircraft manufacturer computation, (see Figure 6). Elevator feel system Note: This part starts at the time the LH AOA sensor erroneous values. IMPACT OF THE ELEVATOR FEEL SYSTEM BEFORE THE A/P ENGAGEMENT Before the A/P engagement, the recorded low force level underlined an airplane rather properly trimmed in pitch. At that time, the stabilizer position was 5.62 units (nose up setting) and the elevators position was of 3.5° (nose down setting). 94 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 67: FORCE BEFORE A/P ENGAGEMENT IMPACT OF THE ELEVATOR FEEL SYSTEM ON THE CREW FEELING AFTER THE A/P DISCONNECTION Note1: the airplane manufacturer computed the pressure the elevator feel system delivered during the flight of the event. After the A/P disconnection, from the end of the 1st FCC trim down command until the end of the flight, the Elevator Feel system delivered a constant pressure that was the maximum pressure. Note 2: the airplane manufacturer confirmed that the FEEL DIFF PRESS master caution never triggered during the whole flight of the event. Indeed, when the conditions were met to close the feel differential pressure switch (before CMD A engaged), the duration of closure was shorter than the confirmation timer (30 s), after auto pilot disconnection, the conditions were not met anymore to close the feel differential pressure switch, 95 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 68: FELT FORCE AND ELEVATOR POSITION The gradient of force felt by the crew can be illustrated by the comparison between the force applied on the control column and the position of the elevator. Between 5 h 40 min 10 s and 5 h 43 min 25 s, statistics were computed: - mean values of the smoothed elevator position: -3.0° - mean value of the smoothed computed average force: 94.4 lbs Figure shows that from 5 h 40 min 10 s until the end of the flight: - an elevator position close to -3° required a force close to 94.4 lbs - a decrease of the elevator position below -3° required a force greater than 94.4 lbs - an increase of the elevator position above -3° required a force lower than 94.4 lbs - similar elevator position required similar force values 1.16.3.5 IMPACT OF AOA FAILURE ON FLIGHT DIRECTOR F/D invalidity periods With the erroneous values of the LH AOA sensor, the RH and LH pitch F/D diverged. LH and RH pitch F/D recorded invalid patterns for the first time. Then the RH pitch director did not experience invalidity pattern anymore but 3 other periods of invalidity were recorded on the LH pitch director. 96 Aircraft Accident Investigation Bureau Interim report March, 2020 Each time the LH or the RH invalidity pattern was recorded, the recorded invalidity code (NCD - No Computed Data) underlined a pitch F/D bar biased out of view. Note: as the invalidity code was always NCD, the pitch command bar was only BOV. F/D flag did not trigger during the whole flight of the event. FIGURE 69: FLIGHT DIRECTOR DURING THE FLIGHT 1st invalidity period At the time of the 1st invalidity, F/D was in T/O mode and the radio altitude was lower than 400 ft. Note: Below 400 ft, during TO mode, LH and RH pitch bars positions are compared with each other. If the difference between both pitches bars position exceeds a defined threshold, both pitch bars are BOV. 97 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 70: FLIGHT DIRECTORS - START OF THE FLIGHT When the LH and RH AOA values diverged, LH pitch F/D commands recorded values quickly decreased to -32° while RH pitch F/D recorded values slightly increased to -0.4°. The difference between LH pitch F/D values and RH pitch F/D values were greater than the threshold above which FCCs comparators triggers and both F/D pitch were biased out of view. At 5 h 38 min 59 s, the radio altitude reached values greater than 400 ft RA increasing. The F/D was displayed again as per design, the comparator function stops above 400 ft. Note: The LH pitch F/D values were due to the erroneous LH AOA values and their impact on computed data (information sent by ADIRU 1 and SMYDC 1 to FCC A). Other invalidity periods During the remaining time of the flight, 3 other periods of invalidity were recorded: - From 5 h 39 min 56 to 5 h 40 min 16 s - From 5 h 41 min 22 to 5 h 41 min 33 s - From 5 h 43 min 29 to the end of the flight The computation of the LH F/D pitch behavior by the airplane manufacturer allowed the detection of 2 other periods of invalidity, with too small a duration for the invalidity to be recorded inside the FDR data: - From 5 h 42 min 01 for 0.5 s - From 5 h 42 min 41 for 3 s 98 Aircraft Accident Investigation Bureau Interim report March, 2020 Each invalidity period was due to the following conditions, described as an unsafe condition in the Aircraft Maintenance Manual: - The F/D was in speed mode. - The airplane should have been climbing but the computed vertical speed value of the airplane had been lower than the Climb Threshold for 5 consecutive seconds. - At the LH side the airplane approached to stall LH F/D pitch commands (A/P not engaged) FIGURE71: PITCH F/D COMMANDS Inside the Figure: - the LH and RH pitch F/D bar was plotted without the period when the pitch F/D bars were BOV - the difference between the RH and LH pitch F/D command was plotted (LH F/D bar minus RH F/D bar) - The recorded pitch F/D parameter is the angle between the center of the PFD (the symbolic airplane in fact) and the position of the bar. To allow a better understanding of what the pitch bar requested, commanded pitch parameters were computed. For instance, at the beginning of the rollout phase, the pitch F/D bars requested a pitch of 10° and moved after to request a pitch of around 15°. When the rotation occurred, the 99 Aircraft Accident Investigation Bureau Interim report March, 2020 airplane pitch increased, the target pitch (commanded pitch parameters) stayed almost constant around 15°, while the recorded pitch F/D bar parameters decreased. Note: Nothing allowed questioning the RH pitch F/D bar positions and the airplane manufacturer did not underline any concern with the RH pitch F/D bar positions. The RH pitch F/D bar positions are then considered as valid positions versus the airplane attitude, speed and engaged modes. Except under the autopilot, the LH pitch F/D bar position was at least 10° lower than the RH pitch F/D bar. The commands provided by the LH pitch F/D bar were not consistent with the true airplane status and the engaged modes. Note: The complete understanding of the LH pitch bar behavior is still under investigation by the airplane manufacturer, especially due to the following periods: - Shortly after the second A/P disconnection warning, the LH F/D bar position moved up towards the true pitch of the airplane. - From 5 h 40 min 16 s to 5 h 40 min 50 s, the LH F/D bar position was close to the true pitch of the airplane, before moving down. Summary of AOA impact on F/D pitch command Once the LH AOA values diverged from the RH AOA values, the LH pitch F/D bar provided command that were not consistent with the true state of the airplane and the engaged modes. LH F/D pitch bar was BOV (biased out of view) 6 times. Each time, airborne systems detected an important inconsistency: - Systems detected first an important divergence between RH and LH pitch F/D commands, when the airplane was below 400 ft. - Then systems detected unsafe conditions for the other disappearance periods Each time LH pitch F/D bar automatically reappeared, without any crew action. 1.16.4 AIRPLANE BEHAVIOR UNDER CMD A CMD A engagement At 5 h 39 min 23 s, CMD A engaged in HDG/VNAV modes. 100 Aircraft Accident Investigation Bureau Interim report March, 2020 Roll axis under CMD A FIGURE 72: ROLL AXIS UNDER CMD A The roll axis under CMD A behaved as expected: - RH and LH roll F/D commands were consistent with each other. - Under HDG mode, the heading was kept within 2° of accuracy At 5 h 39 min 50 s the crew selected a new heading (197°) Pitch axis under CMD A With the VNAV SPD mode engaged, the airplane was expected to climb towards the target altitude of the flight plan (32,000 ft) at a speed close to the FMC target airspeed. 101 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 73: CMD A ENGAGEMENT The longitudinal engaged mode (VNAV SPD) is a speed mode. Note: In speed mode, the autopilot controls a speed that is the maximum between Minimum Operating Speed, FMC speed and selected speed. At that time of the flight of the event, this maximum was the erroneous Minimum Operating Speed values computed by SMYDC 1. As the speed controlled by the autopilot was higher than the current LH computed airspeed, CMD A commanded a decrease of the airplane pitch to increase the speed. As the flaps were extended, the elevator authority of the autopilot was limited and the autopilot commanded 2 stabilizer moves towards nose down to decrease the airplane pitch. The crew engaged the LVL CHG longitudinal mode (speed mode also) at 5 h 39 min 42 s and increased the target airspeed (MCP setting), reaching 238 kt at 5 h 39 min 49 s. After a transient period due to the speed setting, the airplane pitch continue decreasing. CMD A disconnection Note: The autopilot uses a condition similar to the condition used by the pitch F/D to be BOV. In speed mode, when the airplane should climb but the computed vertical speed value of the airplane is lower than the Climb Threshold for, the autopilot automatically disengages. With the decrease of the pitch, the vertical speed of the airplane decreased and get below the Climb Threshold speed. CMD A automatically disengaged. Summary of airplane behavior under CMD A The airplane behaved as expected on the lateral axis. 102 Aircraft Accident Investigation Bureau Interim report March, 2020 On the longitudinal axis, the erroneous Minimum Operating Speed values computed by the SMYDC 1 (due to erroneous LH AOA values) misled the autopilot. As those values were greater than the current LH computed airspeed, the autopilot commanded a decrease of the airplane pitch, leading to a stop of climbing followed by a start of descent. At the connection of CMD A, the airplane was climbing with a vertical speed of around 1,000 ft/min increasing, a pitch value of around 7° increasing and a stabilizer position of 5.6 units. When CMD A automatically disconnected, the airplane was descending with a vertical speed of around -1,400 ft/min, a pitch angle of around 1° and a stabilizer position of 4.6 units. FIGURE74: CMD A - SUMMARY 103 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 75: A/P WARNING AT THE END OF THE FLIGHT 1.16.5 ALERTS AND WARNING GPWS At 5 h 40 min 3 s, the GPWS alert ‘DON’T SINK’ sounded twice inside the cockpit. The previous maximum recorded height was 1,646 ft. The mean vertical speed of the airplane before the maximum value was around 12 ft/s. An alert triggering around 1,271 ft – after 229 ft of altitude loss - was consistent with the alert envelop defined in the Figure 21. Once the alert was engaged, an inertial vertical speed becoming positive stopped the alert; an inertial vertical speed becoming negative triggered the aural message and the warning. During all these alerts, the ‘PULL UP’ message should have been displayed on both PFD. At the end of the flight, the combination of the vertical speed and the height of the airplane made the terrain and pull up warning trigger. 104 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 76: GPWS ALERTS Other alerts FIGURE 77: ALERTS DURING THE FLIGHT MASTER CAUTION The first master caution triggered at 5 h 38 min 48 s during 7 s. The reason for this master caution was anti-ice left alpha vane. At 5 h 42 min 47 s, the crew exchanged about the master caution. Then master caution triggered a second time at 5 h 42 min 51 s during 2.5 s. The crew detected: “Master Caution/anti Ice/left Alpha Vane”. 105 Aircraft Accident Investigation Bureau Interim report March, 2020 FIGURE 78: MASTER CAUTION RECALL The third master caution triggered at 5 h 43 min 40 s. This master caution is still under investigation. IAS, ALT DISAGREE These alerts are not recorded in the FDR. Their time of appearance has been computed, as per computation, the IAS disagree alert should normally have triggered at 5 h 38 min 49 s, and stopped at 5 h 43 min 28 s. It might have triggered again at 5 h 43 min 36 s during 4 s. As per computation, the ALT disagree alert should have triggered at 5 h 38 min 51s and stopped at 5 h 43 min 28 s. it might have triggered again at 5 h 43 min 36 s during 4 s. Over speed Over speed warning RH side triggered at 5 h 41 min 21 s and stayed engaged until the end of the end of recording Over speed warning LH side triggered at 5 h 41 min 33 s for 15.5 s, at 5 h 42 min 02 s for 8 s and at 5 h 42 min 45 s. It stayed engaged until the end of the recording. 106 Aircraft Accident Investigation Bureau Interim report March, 2020 1.17 ORGANIZATIONAL AND MANAGEMENT INFORMATION 1.17.1 AIRCRAFT OPERATOR The operator Ethiopian Airlines group(ETAG) has valid Air Operator Certificate (AOC) number CATO-01/270295 Ethiopian Airlines group operates a total of 126 aircraft consisting of : No 1 2 3 3 4 5 6 7 8 9 Aircraft type Airbus A350 Boeing787-8 Boeing B787-9 Boeing 767-300 Boeing777-200 Boeing777-300 Boeing B737-800 B737-700, B737-8MAX Q-400 Total 14 19 6 6 16 4 20 10 4 27 TABLE 20: AIRCRAFT IN TYPE Ethiopian Pilot Training School The Pilot Training School is commissioned in 1964. The development of this training facility has made Ethiopian Airlines self-sufficient in meeting its requirements for pilots. This is accomplished through the engagement of highly qualified and experienced Ethiopian Airlines training staff. Over the last 50 years, the Pilot training school has trained pilots for African and the Middle East countries. The Pilot Training School currently offers accredited training programs for Commercial Pilot License with Instrument and Multi-engine Rating (CPL/IR/ME) and Multi-crew Pilot License (MPL). The Pilot Training School offers a comprehensive and internationally acclaimed Commercial Pilot License with Instrument and Multi engine rating for over half a century. The school has highly experienced instructors for both flight and ground trainings. In addition, Ethiopian airlines have equipped itself with all the necessary facilities: simulators, aircrafts (glass cockpit DA 40NG and Cesena 172) and well equipped ground classrooms and computer based training rooms. The syllabus is developed based on Ethiopian Civil Aviation Authority Regulations and ICAO requirements for Airline Transport Pilot License (ATPL), CPL and IR/ME Requirements. Moreover, due consideration is given to fulfill EASA ATPL Theoretical Knowledge requirements. Hence, The EASA and JAA-FCL detailed theoretical knowledge training syllabus is benchmarked for completeness and determination of scope and level of details. 107 Aircraft Accident Investigation Bureau Interim report March, 2020 Ethiopian airlines pilot training follows a well-organized and logically sequenced integrated syllabus for the ground and flight training. The theoretical Knowledge Courses comprise a total time of 920 class hours, including 80 hours for general English and 120 hours for Aviation English course. The CPL training also trains and offers regulatory body requirements, such as the ICAO English Language Proficiency requirements that necessitate the provision of structured Aviation English Training in the Pilot Training School. It also provides rating services for ICAO Level 4 English Requirements for Pilots The training program guides students seamlessly from ab-initio training to airliner type rating, using simulation designed for multi-crew training. It also addresses the increased rates of loss of control in airline operations through Upset Prevention and Recovery Training (UPRT). In addition, train the trainees to combat the continuing dominance of multi-crew human factors in accidents through Threat and Error Management (TEM) and Crew Resource Management (CRM) Ethiopian MRO Ethiopian MRO Services is a division of Ethiopian and is established in 1957 to provide MRO services for aircraft, engines and components of Ethiopian and third party customers. The primary base of Ethiopian is at Bole International Airport, Addis Ababa, Ethiopia. Ethiopian MRO is utilizing “Maintenix”, a state of the art MRO management IT system also Selected by Boeing for Gold-care program. The values of Ethiopian MRO focus on the exceptional customer satisfaction. Ethiopian MRO has the capability to perform full airframe checks, including Heavy Maintenance on Boeing and Bombardier model of airplanes at its base station. The base airframe maintenance comprises various dedicated shops. These include Structures shop, Interior Shops, Non-Destructive–Testing (NDT) shop, Machine Shop. Ethiopian MRO Engine shop has full overhaul capability of CFM56-3/7, PW120, and GTCP331-200 APU as well as modular maintenance capability for PW2000, PW4000 engines supported by various repair shops. In support of its engine overhaul facility, Ethiopian is utilizing a fully equipped with up to 100,000 pound jet engine test cell and two modern turboprop engine test beds. The base station also has different mechanical and avionics shops with a repair capability of components on Boeing and Bombardier model of airplanes. These include Pneumatic, Hydraulic, Fuel, Wheels & Brakes, Electrical, Communication & Navigation and Instrument shops. Ethiopian MRO provides Engineering support to Ethiopian Flight and Third party customer on the following:    Aircraft Maintenance program & Task Card Engineering Aircraft System Engineering Aircraft Maintenance Planning & Record Controls 108 Aircraft Accident Investigation Bureau Interim report  March, 2020 Tool Engineering 1.17.2 HAZARD IDENTIFICATION AS PART OF SAFETY RISK MANAGEMENT Safety risk management requires the service provider to develop and maintain a formal process to identify hazards that may contribute to aviation safety-related occurrences. Hazards may exist in ongoing aviation activities or be inadvertently introduced into an operation whenever changes are introduced to the aviation system. In this case, hazard identification is an integral part of the change management processes as described in SMS framework element 3.2 – The management of change. The service provider shall develop and maintain a formal process that ensures that hazards in operations are identified. Hazard identification shall be based on a combination of reactive, proactive and predictive methods of safety data collection. Hazard identification is the first step of Safety Risk Management (SRM), the ICAO Annex 19 Appendix 2, described that aircraft operator must develop and maintain a process that ensures that hazards associated with flight operations are identified based on a combination of reactive, proactive and predictive methods of safety data collection. The ICAO Document 9859 provided guidelines to develop SMS within organization including aircraft operator. The subchapter 2.5.2.10 of the document describes two main methodologies for identifying hazards, as follows: a) Reactive, which involves analysis of past outcomes or events. Hazards are identified through investigation of safety occurrences. Incidents and accidentsare an indication of system deficiencies and therefore can be used to determine which hazard(s) contributed to the event. b) Proactive, which involves collecting safety data of lower consequence events or process performance and analyzing the safety information or frequency of occurrence to determine if a hazard could lead to an accident or incident. The safety information for proactive hazard identification primarily comes from flight data analysis (FDA) programs, safety reporting systems and the safety assurance function. a. organizational safety policies and safety objectives; a. organizational roles and responsibilities related to safety; b. basic SRM principles; c. safety reporting systems; d. the organization’s SMS processes and procedures; and e. human factors. The following explanations regarding the hazard identification process are excerpted from the ICAO Document 9859 subchapter 9.4.4. Safety reporting system is one of the main internal sources within aircraft operator to identify hazard, especially a voluntary safety reporting system. Personnel at all levels and across all disciplines are encouraged to identify and report hazards and other safety issues through their safety reporting systems. Safety reporting systems should be readily accessible to all personnel. A paper-based, webbased or desktop form can be used depending on the situation. Having multiple entry methods 109 Aircraft Accident Investigation Bureau Interim report March, 2020 available maximizes the likelihood of staff engagement. Everyone should be made aware of the benefits of safety reporting and what should be reported. 1.17.3 FEDERAL AVIATION ADMINISTRATION (FAA) AIRCRAFT CERTIFICATION 1.17.3.1 TYPE CERTIFICATION PROCESS The Federal Aviation Administration (FAA) is responsible for prescribing minimum standards required in the interest of safety for the design, material, construction, quality of work, and performance of aircraft, aircraft engines, and propellers (Ref. 49USC44701). Product certification 21 is a regulatory process administered by the FAA to ensure that an aircraft manufacturer’s product conforms with Federal Aviation Regulations (FAR). Successful completion of the certification process enables the FAA to issue a Type Certificate (TC) or an Amended Type Certificate. To obtain a TC or an Amended Type Certificate, the manufacturer must demonstrate to the FAA that the aircraft or product being submitted for approval complies with all applicable regulations. The FAA determines whether or not the applicant has met its responsibility to show compliance to the applicable regulations. The Federal regulations that apply to type certification of transport-category aircrafts are 14 CFR Part 21, 25, 26, 33, 34, and 36. The Part 25 regulations are those concerned with the airworthiness standards for transport-category aircrafts and are organized into subparts A through G. These regulations represent the minimum standards for airworthiness; an applicant’s design may exceed these standards and the applicant’s tests and analyses may be more extensive than required by regulation. The specific applicable regulatory requirements and how compliance will be demonstrated is documented in an FAA approved certification plan. 1.17.3.2 CERTIFICATION GUIDANCE FAA Order 8110.4C, titled “Type Certification”, prescribes the responsibilities and procedures the FAA must follow to certify new civil aircraft, aircraft engines, and propellers, or changes thereto, as required by 14 of the CFR Part 21. This order is primarily written for internal use by the FAA, its designees, and delegated organizations. The order provides procedures and policy for the type certification of products and, unless stated otherwise, the type certification process in this order applies to all U.S. TCs, including amended TCs and Supplement Type Certificate (STCs). 1.17.3.3 TYPICAL CERTIFICATION PROCESS FAA Order 8110.4C contains section that presents a high-level flow diagram of the certification events that typically make up the life cycle an aircraft. The diagram is meant to explain the type certification process, not to dictate precisely how the project should flow. Although the model shows the proper sequence of events for certificating a product, the various aspects of the project generally progress through the process at different times and at different rates. The model divides the product’s type certification life cycle into phases based on The FAA and Industry Guide to Product Certification. For each of the certification events identified on the flow diagram, the Order also provides information describing each event identifiesexpectations and develops specific interface procedures between the applicant and the FAA. 110 Aircraft Accident Investigation Bureau Interim report March, 2020 As part of the overview, the FAA provided a high-level flow diagram of the certification events that contained similar information as the diagram within Order 8110.4c. FIGURE 79: DIAGRAM OF FAA CERTIFICATION PROCESS 1.17.3.4 FAA CERTIFICATION OFFICE The FAA has 10 Aircraft Certification Offices (ACO) which are responsible for approving the design certification of aircraft, aircraft engines, propellers, and replacement parts for those products. There are also specialized certification offices which include the Engine Certification Office (ECO), the Military Certification Office (MCO), the Boeing Aviation Safety Oversight Office (BASOO), and the Delegation Systems Certification Office (DSCO). FAA’s BASOO responsibilities include oversight of Boeing’s Organization Designation Authorization (ODA), involvement in certification of safety critical areas as well as novel and unusual designs and assisting foreign Civil Aviation Authorities (CAAs) in validation of Boeing products. The BASOO was responsible for the certification oversight and approval for the Boeing 737-8 (MAX). 1.17.3.5 CERTIFICATION BASIS 111 Aircraft Accident Investigation Bureau Interim report March, 2020 According to Type Certificate Data Sheet15 (TCDS) A16WE, revision 64, dated October 10, 2018, Boeing applied for a transport category amended type certificate (ATC) for the 737-8 airplane on June 30, 2012. The ATC was approved on March 8, 2017. The Boeing 737-8 airplane was added as the most recent model in a series of derivative models (or “changed aeronautical products”) that were approved and added to the Boeing type certificate (TC), originally issued for the Boeing 737-100 on December 15, 1967. The applicable certification basis for the 737-8 airplane is Title 14, Code of Federal Regulations (14 CFR) part 25 as amended by Amendments 25-0 through 25-137, plus amendment 25-141 with exceptions permitted by 14 CFR 21.101. The Boeing Model Boeing 737-8 (MAX) and Boeing 737-9 was granted an exception per 14 CFR 21.101(b) for § 25.795(c)(2) based on the demonstration and justification that security features were present in the type design. These security features must be in consideration in any subsequent type design change, modification, or repair to ensure the level of safety designed into the Boeing 737-8 (MAX) and 737-9 is maintained. In lieu of the following, compliance to § 25.795(c)(2), Amendment 25-127, may be shown: Amended Type Certification (Atc)Application General Certification Meeting (Completed) Technical Familiarization Meeting (Completed) FAA Acceptance of Master Certification Plan Certification Basis Established (G-1 Issue Paper ) FAA Acceptance of (Related) Detailed Certification Plans Type Certification Authorization Approved FAA Certification Flight Test Completed ATC Issuance January 2012 March 2012 May 2012 November 2013 February 2014 November 2016 August 2016 February 2017 March TABLE20: COMPLIANCE TO § 25.795(C) (2), AMENDMENT 25-127 1.17.3.6 CERTIFICATION BASIS FOR CHANGED AVIATION PRODUCTS The certification basis for changed aeronautical products allows an aircraft manufacturer to introduce a derivative model as a design update on a previously certificated aircraft and add the changed product onto an existing TC. The FAA approves such changes if it finds that the changes are not significant enough to warrant application for a new TC. This process enables a manufacturer to introduce derivative aircraft models without having to resubmit the entire aircraft design for certification review. The manufacturer can use the results of some of the analyses and testing from the original type certification todemonstrate compliance, in which case the regulations that were in effect on the date of the original TC apply. Title 14 CFR 21.101, Subpart D, specifies the requirements for demonstrating airworthiness compliance for changed aeronautical products. The current revision of 14 CFR 21.101, amendment 21.92, which became effective on April 16, 2011, states that an application for a changed aeronautical product to be added to a TC “must show that the changed product complies with the airworthiness requirements applicable to the category of the product in 15A Type Certificate Data Sheet (TCDS) is a formal description of the aircraft, engine or propeller. It listslimitations and information required for type certification including airspeed limits, weight limits, thrust limitations, etc. 112 Aircraft Accident Investigation Bureau Interim report March, 2020 effect on the date of the application.” This regulation is more specific than previous revisions regarding what can be used from the original certification basis in an application for a derivative model involving a major change. On April 25, 2003, the FAA issued FAA Order 8110.48, How to Establish the Certification Basis for Changed Aeronautical Products, which provides the procedures that the FAA utilize for determining the certification basis for changes to type certificated products including changes made through an amended Type Certificate which is the method utilized for the G-IV. The handbook refers to FAA Advisory Circular 21.101-1, establishing the Certification Basis of Changed Aeronautical Products, which contains an acceptable means, but not the only means, to comply with 14 CFR 21.101. On July 21, 2107, this Order 8110.48 was cancelled and replaced by Order 8110.48A. Expectations and develops specific interface procedures between the applicant and the FAA. During a meeting with the NTSB24, the FAA provided a high-level overview of the certification process for an amended type design program. The briefing indicated that the applicant would start by conducting familiarization briefings and submitting the following to the FAA: a Certification Project Notification (CPN), a Program Notification Letter (PNL) and a Master Certification Plan (MCP). These documents detail the changes and identify the regulatory requirements and policies that are applicable; they also identify areas of change associated with the FAA airworthiness directives. As part of the overview, the FAA provided a high-level flow diagram of the certification events that contained similar information as the diagram within Order 8110.4c. 1.17.3.7 SYSTEM SAFETY ASSESSMENT PROCESS The process for developing and certifying a safety-critical system must provide assurance that all significant single failure conditions have been identified and that all combinations of failures which lead to hazardous or catastrophic airplane level effects have been considered and appropriately mitigated. Aircraft manufacturers provide this assurance through their safety assessment processes. The safety assessment process is divided into two parts; the airplane level safety assessment and the individual system safety assessments. The airplane safety assessment assures the robustness of the overall airplane system design that implements the required airplane functions. The individual system safety assessments assure the system designs meet their safety requirements and support the airplane level safety assessment. The airplane assessment process begins by identifying the airplane functions and determining which airplane functions are required for continued safe flight and landing. A Functional Hazard Assessment (FHA) is performed on the functions required for safe flight and landing to identify potentially catastrophic and hazardous failure conditions. For each failure condition, the airplane architecture (i.e. systems) which implements the function is identified and the high-level system failure conditions are determined. An engineering assessment is performed to verify system failure conditions are being addressed by the individual systems. The basic structure of a system development process can be represented by a V-diagram, where time is represented horizontally (left to right) and system hierarchy is represented 113 Aircraft Accident Investigation Bureau Interim report March, 2020 vertically (Reference Error! Reference source not found.). Initially (top left), the top-level esign requirements (payload, range, passenger capacity, performance, etc) for the aircraft are selected. The airplane requirements are then broken down into airplane-level functions (e.g. control airplane in the air); airplane-level functions to system functions (e.g. control pitch, yaw and roll); system-level functions to systems (e.g. stabilizer system control); systems to subsystems (e.g. MCAS) in a top-down process. Following this system development process, requirements for each part item or piece of equipment are identified with each level providing validation of the level above. Validation is the process of ensuring that the requirements are sufficiently correct and complete. The right side of the V diagram involves a series of bottomup evaluation activities to ensure the requirements are verified as met at each level in integration of the final product. Verification is the process of ensuring that the final product meets the design requirements. Verification activities may include analysis and testing the individual item of equipment (e.g. flight control computer software) and then progressively integrating the equipment into a complete system and even flight testing for verification of a fully integrated system on the aircraft. FIGURE 80: V-DIAGRAM FOR A SYSTEM DEVELOPMENT PROCESS Safety assessments are conducted by the applicant, and its suppliers, and are reviewed and approved by the FAA. The safety assessment process is outlined in AC 25.1309-1A and described in detail in SAE ARP4761. Although the safety assessment process outlined in the AC is not mandatory, the AC documents an established means, but not the only means, for an applicant to show compliance to the regulations. An applicant who chooses not to conduct safety assessments must demonstrate compliance in another way, which would have to be FAA-approved. 1.17.3.8 FUNCTIONAL HAZARD ASSESSMENT (FHA) 114 Aircraft Accident Investigation Bureau Interim report March, 2020 A functional hazard assessment (FHA) is a systematic examination of a system's functions and purpose, and it typically provides the initial, top-level assessment of a design and addresses the operational vulnerabilities of the system function. The FHA is therefore used to establish the safety requirements that guide system architecture design decisions. Performed independently of any specific design, an FHA evaluates what would occur if the function under question was lost or malfunctioned and classifies that effect to prioritize focus on the most serious outcomes. An FHA is conducted early in the design and development cycle to identify failure conditions and classify them by severity, beginning at the aircraft level and working down to individual systems. FAA Advisory Circular AC 25.1309-1A, dated June 21, 1988 and SAE ARP4761 define the severity classes that are used to classify the effect of loss or malfunction as part of an FHA. AC 25.1309-1A defines the following three severity classes: catastrophic, major and minor, with the respective likelihoods, of extremely improbable (one-in-a billion/10-9 or less), improbable (one-in-ten million/10-7 or less), or no worse than probable (one-in-hundred thousand/10-5). The differences among the classes are associated with effects on the aircraft, occupants, and crew. According to SAE ARP4761, the determination of the classification is accomplished by analyzing accident/incident data, reviewing regulatory guidance material, using previous design experience, and consulting with flight crews, if applicable. The failure condition severities classifications are provided in a table contained within this document and are defined as follows: • Catastrophic: All failure conditions which prevent continued safe flight and landing. • Severe-Major/Hazardous: Large reductions in safety margins or functional capabilities higher workload or physical distress such that the crew could not be relied upon to perform tasks accurately or completely • Major: Significant reduction in safety margins or functional capabilities Significant increase in crew workload or in conditions impairing crew efficiency • Minor:A slight reduction in safety margins, a slight increase in crew workload 1.17.3.9 SYSTEM SAFETY ASSESSMENTS Safety assessments are a primary means of compliance for systems (as opposed to identifying structures or aircraft performance characteristics) that are critical to safe flight and operation. Safety assessments proceed in a stepwise, data-driven fashion, analogous to the system development process described above. Starting with aircraft functions, functional hazard assessments are performed to identify the failure conditions associated with each function. Systems functional hazard analyses are performed for system level functions. Preliminary safety assessments are performed as the system is developed adding more specific design and implementation detail to address specific hazards. The bottom-up Safety assessments are conducted by the applicant, and its suppliers, and are reviewed and accepted by the FAA.The safety assessment process is outlined in AC 25.1309-1A and described in detail in SAE ARP4761. Although the safety assessment process outlined in the AC is not mandatory, 115 Aircraft Accident Investigation Bureau Interim report March, 2020 applicants who choose not to conduct safety assessments must demonstrate compliance in another, FAA-approved way (for example, by conducting ground or flight tests). 1.17.3.10 ORGANIZATION DESIGNATION AUTHORIZATION In title 14, Code of Federal Regulations (CFR) United States of America Part 183, the Federal Aviation Administration (FAA) may delegate the specified functions to an organization on behalf of the Administrator related to engineering, manufacturing, operations, airworthiness, or maintenance. In the Part 183 subpart D, the organization granted by the FAA for such delegation is referred as Organization Designation Authorization (ODA) which means the organization is authorized to perform certification functions on behalf of the FAA. FAA granted the Boeing Commercial Airplane (BCA) ODA in 2009. The delegated functions for a Type Certification ODA are: • establishing and determining conformity of parts, assemblies, installations, test setups, and products (aircraft); • finding compliance with airworthiness standards for new design, or major changes to design; • issuing special flight permits for operation of aircraft; • issuing issues airworthiness approvals for articles (Export), and aircraft (Standard or Export). 1.17.3.11 OVERSIGHT AND DELEGATION: INSPECTOR GENERAL AUDIT REPORT According to a 2011 Office of Inspector General audit report16, “the FAA is responsible for overseeing numerous aviation activities designed to ensure the safety of the flying public. Recognizing that it is not possible for FAA employees to personally oversee every facet of aviation, public law allows FAA to delegate certain functions, such as approving new aircraft designs, to private individuals or organizations (approved by the FAA). Designees perform a substantial amount of critical work on FAA’s behalf—for example, at one aircraft manufacturer, they made about 90 percent of the regulatory compliance determinations for a new aircraft design. FAA created the Organization Designation Authorization (ODA) program in 2005 to standardize its oversight of organizational designees.” According to FAA Order 8100.15A, 49 CFR 44702(d) allows the FAA to delegate to a qualified private person a matter related to issuing certificates, or related to the examination, testing, and inspection necessary to issue a certificate on behalf of the FAA Administrator as authorized by statute to issue under 49 CFR 44702(a). 16 Reference Office of Inspector General Audit Report, AV-2011-136, issued on June 29, 2011. 116 Aircraft Accident Investigation Bureau Interim report March, 2020 GUIDANCE FOR DELEGATION OF COMPLIANCE FINDINGS FAA Order 8110.4C, section 2.5, titled “Compliance Planning,” discusses the FAA’s involvement in a certification project, including providing guidance on oversight and delegation. According to the order, “For planning purposes, the FAA’s and the applicant’s certification teams need to know in which aspects of the project the FAA intends involvement and at what level. The heavy workloads for FAA personnel limit involvement in certification activities to a small fraction of the whole. FAA type certification team members must review the applicant’s design descriptions and project plans, determine where their attention will derive the most benefit, and coordinate their intentions with the applicant.” Paragraph (a)(1) of section 2.5 provides guidance to the FAA and applicant on the identification of critical safety items requiring direct FAA involvement in the findings of compliance. According to the paragraph, “When a particular decision or event is critical to the safety of the product or to the determination of compliance, the FAA must be directly involved (as opposed to indirect FAA involvement by, for example, DER). Project team members must build on their experience to identify critical issues. Some key issues that will always require direct FAA involvement include rulemaking (such as for special conditions), development of issue papers, and compliance findings considered unusual or typically reserved for the FAA. While these items establish the minimum direct FAA involvement, additional critical safety findings must also be identified based on the safety impact or the complexity of the requirement or the method of compliance. Additional factors to consider in determining the areas of direct FAA involvement include the FAA’s confidence in the applicant, the applicant’s experience, the applicant’s internal processes, and confidence in the designees.” Delegation of Deliverables CP13471 proposed delegation of all Flight Controls Primary & Secondary compliance findings. On April 14, 2015, the FAA approved the delegation of several deliverables; however, they indicated that the deliverable titled “737 Stabilizer System Description and Safety Analysis” (SSA) would be retained by the FAA and will not be proposed for delegation. In November 2016, Boeing submitted the 737 Stabilizer System Description and Safety Analysis (SSA), revision F, to the FAA for acceptance.” In December 2016, the FAA’s response to Boeing was to “accept” the submittal and with notation “delegated SSA approval to ODA.” Retention and delegation are accomplished with respect to compliance deliverables not to specific functions i.e., MCAS itself would not be delegated to the ODA.    Consistent with the FAA authorization, the FAA have discretionary authority as to what is reviewed, whether submitted directly to the FAA for review and approval by an applicant or submitted by a designee or ODA recommending approval. When delegating at the end of a program, there has been some level of FAA involvement and the delegation confirms that the designee should make the final approval. In all cases, delegation is not accomplished by a single individual but follows a structured review process. 117 Aircraft Accident Investigation Bureau Interim report March, 2020 1.17.4 MANEUVERING CHARACTERISTICS AUGMENTATION SYSTEM (MCAS) THE NEED FOR MCAS ON B737 MAX: The 737 MAX 8 is a derivative of the 737-800 model and is part of the 737 MAX family (737 MAX 7, 8, and 917). The 737MAX incorporated the CFM LEAP-1B engine, which has a larger fan diameter and redesigned engine nacelle compared to engines installed on the 737 Next Generation (NG) family. Because the 737-8 is a derivative of the 737-800 model, its certification basis, which was established per 14 CFR 21.101 Changed Product Rule, required Boeing to demonstrate compliance with Amendment 25-136 for significant areas of change at the product level and those areas affected by the significant product level change. During the preliminary design stage of the 737 MAX 8, Boeing tests and analysis revealed that the addition of the LEAP-1B engine and associated nacelle changesproduced an airplane nose-up pitching moment when the airplane was operating at high angles of attack (AOA) and mid Mach numbers. This nose-up pitching moment was deemed likely to affect the stick force per g (FS/g) characteristics required by FAR 25.255 and the controllability and maneuverability requirements of FAR 25.143(f). After the study of various options for addressing this issue, Boeing implemented aerodynamic changes as well as a stability augmentation function called the Maneuvering Characteristics Augmentation System (MCAS), as an extension of the existing Speed Trim System (STS), to improve aircraft handling characteristics and decrease pitch-up tendency at elevated angles of attack. As the development of the 737 MAX 8 progressed, the MCAS function was expanded to low Mach numbers.MCAS is designed to function only during manual flight (autopilot not engaged), with the airplane’s flaps up, at an elevated AOA. SPEED TRIM & MCAS DE SCRIPTION : To ensure that the 737-600/700/800/900 (737 NG) family of airplanes met the certification requirements for longitudinal static stability (speed stability), the airplanes incorporated a Speed Trim System (STS) to augment the basic airplane's speed stability during certain low speed, high thrust flight conditions by moving the horizontal stabilizer during manual flight (autopilot is not engaged). For the 737 NG family of airplanes, the Speed Trim System included the Speed Trim Function. The STS was carried over to the 737-7/-8/-9 (737 MAX) family of airplanes. Additionally, on 737 MAX airplanes, the MCAS function was added to the STS to address the pitch characteristics described above. SPEED TRIM FUNCTION: The Speed Trim function, which is implemented as a control law within the flight control computer (FCC18), commands incremental stabilizer trim through the automatic trim control system circuitry. There are two different stabilizer trim rates depending on whether position of the flaps19. A 17 Both the 737-8 and 737-9 were in service at the time of the accident. The 737-7 and 737-10 are planned future derivatives that have not yet entered service. 18 The flight control computers (FCC) are part of the digital flight control system. 19 When the flaps are down, the stabilizer rate is three times faster than when the flaps are up. 118 Aircraft Accident Investigation Bureau Interim report March, 2020 schedule determines the desired incremental stab deviation from the last trimmed position as a function of airspeed and flap position. According to the Enhanced Digital Flight Control System (EDFCS) system safety analysis (SSA), the worst-case failure mode of the Speed Trim function was considered to be a runaway of the horizontal stabilizer trim actuator (HSTA) as a result of sensor or FCC failures, or FCC-tostab trim motor (STM) wiring failures. The SSA indicated that during the runaway, the pilot is able to detect the fault by noticing the continuous running of the trim mechanical wheelsin the flight deck,or by the change in column force necessary to maintain pitch attitude, or through change in airplane pitch attitude. The SSA indicated that the pilot compensates for the runaway through:  column input in the direction opposing the uncommanded trim until activation of the column activated trim cutout switches, or  activation of the main electric trim by either pilot in a direction opposing the uncommanded motion, which overrides the FCC commanded trim runaway, or  moving the guarded stabilizer trim cutout switches20 located on the aisle stand to the CUTOUT position, orrestraining the stabilizer trim wheel,  Speed/ Stab Trim runaways are limited by the inherent stab trim motor rate and column actuated trim cut-out switches. Sufficient means are available for the pilot to maintain control and recover from the runaway21. MCASFUNCTIONAL – DETAILED DESCRIPTION: The MCAS is a function within the Speed Trim System and, when activated, moves the stabilizer during non-normal flaps up, high angle of attack maneuvers to provide a desirable increase in stick force gradient and a reduced pitch up tendency. Similar to the Speed Trim Function, the MCAS function is also a flight control law22 contained within each of the two FCCs. MCAS is only active in the master FCC for that flight. At airplane power-up, the master FCC defaults to the left side FCC; and will then alternate between the left and right FCC by flight. The master FCC is not affected by the position of the Flight Director switches. The FCCs receiveinputs from several systems including the air data inertial reference system (ADIRS). Reference Figure 1. Specific to the MCAS, the control law commands the stabilizer trim as a function of the following: Air/Ground, Flap position, Angle of attack, Pitch rate, True Airspeed and Mach. The AOA and Mach inputs are provided to each FCC by the associated air data inertial reference unit (ADIRU). Each ADIRU receives AOA information from one of the two resolvers contained within the associated AOA sensor (i.e. the Left ADIRU uses left AOA vane and the Right ADIRU uses the right AOA vane). Information from the other resolver contained within the AOA sensor, along with data from other sources, is provided to the stall management yaw damper computer (SMYD), which is 20 Two stabilizer trim cutout switches on the control stand can be used to stop the main electric and autopilot trim inputs to the stabilizer trim actuator. The switches can be set to NORMAL or CUTOUT. If either switch is moved to CUTOUT, both the electric and autopilot trim inputs are disconnected from the stabilizer trim motor.NORMAL is the default position to enable operation of the electric and autopilot trim. 21 MCAS failures do allow the stabilizer to move at the flaps down trim rate, even if the flaps are up, but even the flaps down trim rate is a limit, albeit faster than the normal flaps up rate. Column cutout is always available in the forward direction but may not be available in the aft direction for certain MCAS failures. 22 MCAS is an open loop flight control law. 119 Aircraft Accident Investigation Bureau Interim report March, 2020 used, along with data from other sources, for the purpose of calculating and sending commands to the Stall Warning System (SWS)23. As originally delivered, the MCAS became active during manual, flaps-up flight (autopilot not engaged) when the AOA value received by the master FCC exceeded a threshold based on Mach number. When activated, the MCAS provided a high rate automatic trim command to move the stabilizer AND. The magnitude of the AND command was based on the AOA and the Mach. After the non-normal maneuver that resulted in the high AOA, and once the AOA fell below a reset threshold, MCAS would move the stabilizer ANU to the original position and reset the system. At any time, the stabilizer inputs could be stopped or reversed by the pilots using their yoke-mounted electric stabilizer trim switches, which also reset the system after a 5 second delay. FIGURE 1 DIAGRAM SHOWING THE COMPONENTS OF MCAS 24 FIGURE 81: MCAS OVERVIEW The latter behavior is based on the assumption that flight crews use the trim switches to completely return the airplane to neutral trim. In the FCC software version current at the time of the accident, if the original elevated AOA condition persists for more than five seconds following an MCAS flight control law reset, the MCAS flight control law will command another stabilizer nose down trim input (with the magnitude based on the AOA and Mach sensed at that time). Boeing indicated to the NTSB that the reset functionality was adopted as part of a suite of design features to ensure that MCAS would be available to perform its intended function whenever the conditions required for MCAS activation existed. The reset functionality helped to ensure that the MCAS would be available whenan elevated angle of attack existed, and all other requirements were met. This functionality 23 The SWS operates the control column stick shakers to alertthe crew when the airplane is nearing an aerodynamic stall. 24 Reference Boeing 737 MAX MCAS briefing, dated March 25, 2019. 120 Aircraft Accident Investigation Bureau Interim report March, 2020 was validated in piloted cab sessions by momentarily interrupting MCAS at various points during the stall. On all 737 models, column cutout switches interrupt stabilizer commands, either from the autoflight system (e.g. FCC) or the electric trim switches in a direction opposite to elevator command. On the 737NG and MAX, two column cutout switching modules, one for each control column, are actuated when the control columns are pushed or pulled away from zero (hands off) column position. When actuated, the column cutout switching modules interrupt the electrical signals to the stabilizer trim motor that are in opposition to the elevator command. The MCAS function requires the stabilizer to move nose down in opposition to the column commands when approaching high angles of attack. To accommodate MCAS, the column cutout function in the first officer’s switching module was modified to inhibit the aft column cutout switch while MCAS is active, allowing aircraft nose-down(AND) stabilizer motion with aircraft nose-up (ANU) column input. Once MCAS is no longer active, the normal column cutout function in the stabilizer nose down direction is re-instated. FUNCTIONAL HAZARD ASSESSMENT, FLIGHT TESTING: FUNCTIONAL HAZARD ASSESSMENT: REQUIREMENTS GENERATION AND A functional hazard assessment (FHA) is a systematic examination of a system's functions and purpose, and it typically provides the initial, top-level assessment of a design and addresses the operational vulnerabilities of the system function. The FHA is therefore typically used to establish the safety requirements that guide system architecture design decisions. An FHA evaluates what would occur (the “hazard” in FHA) if the function under question was lost or malfunctioned and classifies the severity of that effect. An FHA is conducted early in the design and development cycle to identify hazards and classify them by severity, beginning at the airplane level and working down to individual systems. Federal Aviation Administration (FAA) Advisory Circular AC 25.1309-1A, dated June 21, 1988 and SAE ARP4761define the severity classes that are used to classify the effect of loss or malfunction as part of an FHA. AC 25.1309-1A defines the following three severity classes: catastrophic, major and minor, with corresponding acceptable probabilitiesof extremely improbable (1E-9) or less per flight hour), improbable (1E-5 or less), and no worse than probable (1E-3). European regulations (originally JAR and now EASA) include an additional category: hazardous, which falls between catastrophic and major and has an associated acceptable probability of 1E-7 or less. The differences among the classes are associated with effects on the airplane, occupants, and crew. To begin an FHA, engineering judgment is used to identify the failure conditions which require evaluation. According to the FHA sections25 of Boeing’s 737 NG/MAX Stabilizer Trim Control System Safety Analysis, (Reference section H.2.2 of this report), performance analyses and piloted simulations were accomplished as needed to help define the hazard categories for the identified conditions. Error! Reference source not found. shows the criticality categories used in eveloping the FHA and the corresponding minimum acceptable probabilities of occurrence. The 25 The safety analysis contained two sections that discussed hazard analysis; the first FHA was developed for the 737NG in the original release of the analysis (1997) and the second FHA was developed as part of the 737 MAX changes (2016). 121 Aircraft Accident Investigation Bureau Interim report March, 2020 failure conditions defined by the FHA provide the basis for the top-level events analyzed by the Fault Tree Analysis (FTA) to demonstrate compliance with FAR 25.671(c)(2) and 25.1309(b)(1). A fault tree analysis was performed on each failure condition determined to be either Catastrophic or Hazardous. Additionally, Major events are included in the FHA for reference, per FAA/JAA request. TABLE 21: FAILURE EFFECT CATEGORIES As part of the MCAS development phase, in late 2012, Boeing performed a preliminary functional hazard assessment26 of MCAS using piloted simulations in their full motion Engineering Flight Simulator; the results were documented in an internal Boeing document27 (an MCAS requirements 26 The hazard assessments were developed as part of aircraft certification and based on AC 25.1309-1A. requirements document, which defined the requirements for the MCAS function, formally conveyed the information regarding the safety impact of the design Change; it included documentation on the FHA and the results of that analysis. A March 30, 2016 revision to this document specifically reflects that the FHA was updated following the MCAS design change, and documents that the hazard classification categories for the expanded MCAS design satisfied all applicable regulatory and certification requirements. This document was circulated by Aerodynamics S&C to subject matter experts in the Primary Flight Controls, Autoflight and Flight Test (including the 737 Chief Pilot) and the Requirements groups. 27 This 122 Aircraft Accident Investigation Bureau Interim report March, 2020 document). Several hazards were assessed at that time, however, this section of the report will focus only on the following two hazards: uncommanded MCAS operation up to its maximum authority (0.6 degrees of airplane nose down stabilizer) and uncommanded MCAS operation equivalent to a three (3) second stabilizer trim runaway28. To perform these simulator tests, Boeing induced a stabilizer trim input that would simulate the stabilizer moving at a rate and duration consistent with the MCAS function. Using this method to induce the hazard resulted in the following: motion of the stabilizer trim wheel, increased column forces, and indication that the airplane was moving nose down. Boeing indicated to the NTSB that this evaluation was focused on the pilot response to uncommanded MCAS operation, regardless of underlying cause. Thus, the specific failure modes that could lead to uncommanded MCAS activation, such as an erroneous high AOA input to the MCAS, were not simulated as part of these functional hazard assessment validation tests. As a result, additional flight deck effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker activation) resulting from the same underlying failure (for example, erroneous AOA) were not simulated and were not documented in the stabilizer trim and autoflight safety assessment reports reviewed by the NTSB. Hazard Hazard classification Uncommanded MCAS operation up to its maximum authority Major Uncommanded MCAS function operation equivalent to a 3second mistrim Major TABLE22: ORIGINAL RESULTS OF PRELIMINARY HAZARD ASSESSMENT The FHA evaluations were conducted by Boeing in their Engineering Cab using FAA guidance regarding pilot response to flight control failures requiring trim input that is contained in FAA Advisory Circular AC25.7C29. In particular, Boeing uses the following assumptions in its flight controls FHAs:     Uncommanded system inputs are readily recognizable and can be counteracted by overriding the failure by movement of the flight controls in the normal sense by the flight crew and do not require specific procedures. Action to counter the failure shall not require exceptional piloting skill or strength. The pilot will take immediate action to reduce or eliminate increased control forces by retrimming or changing configuration or flight conditions. Trained flight crew memory procedures shall be followed to address and eliminate or mitigate the failure. Boeing advised that these assumptions are used across all Boeing models when performing functional hazard assessments of flight control systems and that these assumptions are consistent 28 The two events were assumed to start from a trimmed condition. Boeing also considered the hazard of uncommanded MCAS operation until pilot response. This condition had the same severity as the 3-second case. 29 FAA advisory circular (AC) 25-7C, titled, “Flight Test Guide for Certification of Transport Category Airplanes,” dated October 16, 2012, provides guidance for the flight test evaluation of transport category airplanes. 123 Aircraft Accident Investigation Bureau Interim report March, 2020 with the requirements contained in 14 CFR 25.671 & 25.672 and within the guidance contained in FAA Advisory Circular (AC) 25-7C for compliance evaluation of 14 CFR 25.14330. In March 2016, Boeing determined that MCAS should be revised to improve wings-level, flaps up, low Mach stall characteristics and identification.The MCAS was revised such that depending on AOA, it would be capable of commanding incremental stabilizer to a maximum of 2.5 degrees at low Mach decreasing to a maximum of 0.65 degrees at high Mach. Boeing’s requirements document indicated that the preliminary functional hazard assessments of MCAS were re-evaluated by pilot assessments in the motion simulatorand by engineering analysis and determined to have not changed in hazard classification as a result of the increase in MCAS authority to 2.5 degrees at low speed. Hazard Hazard classification Uncommanded MCAS function operation up to its maximum authority Major* Uncommanded MCAS function operation equivalent to a 3 second mistrim ** Major TABLE 13: RESULTS OF PRELIMINARY HAZARD ASSESSMENT FOR REVISED MCAS AUTHORITY *Major Classification: The uncommanded MCAS command to the maximum nose down authority at low Mach numbers was evaluated in the 737 MAX cab and rated as Minor. The high Mach uncommanded MCAS command and subsequent recovery is the critical flight phase in establishing the hazard rating for erroneous MCAS commands. According to Boeing, engineering analysis determined that the existing high Mach evaluations remain valid as the aerodynamic configuration had not changed significantly since the pre-flight evaluations, and the MCAS authority limit at high Mach did not change significantly in the flight test update. As the ratings for these high Mach evaluations were more severe than for low Mach, the overall flight envelope hazard ratings remain the same as the pre-flight evaluations. ** Piloted Simulation not Required: According to Boeing, Engineering analysis determined no low Mach piloted simulation to be required asthis failure is less critical than MCAS function operation to maximum authority. Stabilizer motion forthree seconds would not reach maximum authority in low Mach conditions. The existing high Machevaluations remain valid as the aerodynamic configuration has not changed significantly since the preflight evaluations, and the 3 second stabilizer motion is the same magnitude. When assessing unintended MCAS activation in the simulator for the FHAs, the function was allowed to perform to its authority and beyond before pilot action was taken to recover. Failures were able to be countered by using elevator alone. Stabilizer trim was available to offload column 30 FAR 25.143(g) Controllability and Maneuverability – General, requires that changes of gradient that occur with changes of load factor must not cause undue difficulty in maintaining control of the airplane, and local gradients must not be so low as to result in a danger of over-controlling. Reference is made to CFR amendment 25-129 for the described FAR 25.143(g) requirement. 124 Aircraft Accident Investigation Bureau Interim report March, 2020 forces, and stabilizer cutouts were available but not required to counter failures. This was true both for the preliminary FHAs performed in 2012 and for the reassessment of the FHAs in 2016. In a 2019 presentation to the NTSB, Boeing indicated that theMCAS hazard classification of “major” for uncommanded MCAS function (including up to the new authority limits) in the Normal flight envelopewere based on the following conclusions:    Unintended stabilizer trim inputs are readily recognized by movement of the stab trim wheel, flight path change or increased column forces. Aircraft can be returned to steady level flight using available column (elevator) alone or stabilizer trim. Continuous unintended nose down stabilizer trim inputs would be recognized as a Stab Trim or Stab Runaway failure and procedure for Stab Runaway would be followed. Boeing indicated that as part of the development process of MCAS, although not formally part of the FHA, engineering personnel and test pilots considered the scenario of multiple MCAS inputs due to pilot trim action following an erroneous AOA input. Their assessment was that each MCAS input could be controlled with column alone and subsequently re-trimmed to zero column force while maintaining the flight path. Five seconds after cessation of the pilot trim command, the subsequent MCAS command could be controlled in the same manner as the previous instance. Eventually, use of the stabilizer cutout switches would be an option to stop the uncommanded stabilizer motion per the runaway stabilizer procedure (which is a trained flight crew memory item). 1.17.5 ETHIOPIAN TYPE CERTIFICATE ACCEPTANCE PROCESS Referring to Ethiopian Civil Aviation Rules & Standards Part 5 – Airworthiness, section 5.2.1.5 Acceptance of Type Certificateevery aircraft, aircraft engine, and aircraft propeller designed and produced overseas and imported into Ethiopia must obtain a type certificate acceptance. The Civil Aviation Rules & Standards (ECARAS Part 5 – Airworthiness regulates the compliance procedure for the Ethiopian Civil Aviation Proclamation 616/2008 and it is outlined in the Ethiopian Civil Aviation Authority’s Airworthiness Inspector Handbook Part 2, Chapter 2-27 Type Certificate Acceptance process (Aircraft, Engine and Propeller). 1.17.6 AIRWORTHINESS REGULATIONS AIRWORTHINESS STANDARD FOR TYPE CERTIFICATE Aircraft type certificate is issued by civil aviation authority to ensure the aircraft is manufactured in accordance with approved design and a product meets its type design and is in a condition for safe operation. The airworthiness standards for the issue of type acceptance certificates, and changes to those certificates, for transport category airplanes in Ethiopia is described in the ECARAS PART 5 - Airworthiness: Transport Category and in the United States of America described in Federal Aviation Regulation (FAR) Part 25. Ethiopian Civil Aviation Rules and Standards Part 5 - Airworthiness section 5.2.1.2 states that Ethiopia accepts type certificates issued by Federal Aviation Administration (FAA) of the United States of America. 125 Aircraft Accident Investigation Bureau Interim report March, 2020 The relevant subparts in FAR related with aircraft certification requirements were as follows: 25.1 Applicability a. This part prescribes airworthiness standards for the issue of type certificates, and changes to those certificates, for transport category airplanes. b. ECARAS PART 5, Section 5.2.1.5 states that The Authority may accept a type certificate or equivalent document issued by a State of Design in respect of an aircraft or aircraft component if: The type certificate or equivalent document was issued based on an airworthiness code recognized by the Authority; 25.143 General. a. The airplane must be safely controllable and maneuverable during— 1. Takeoff; 2. Climb; 3. Level flight; 4. Descent; and 5. Landing. b. It must be possible to make a smooth transition from one flight condition to any other flight condition without exceptional piloting skill, alertness, or strength, and without danger of exceeding the airplane limit-load factor under any probable operating conditions, including— 1. The sudden failure of the critical engine; 2. For airplanes with three or more engines, the sudden failure of the second critical engine when the airplane is in the en route, approach, or landing configuration and is trimmed with the critical engine inoperative; and 3. Configuration changes, including deployment or retraction of deceleration devices. c. The airplane must be shown to be safely controllable and maneuverable with the critical ice accretion appropriate to the phase of flight defined in appendix C, and with the critical engine inoperative and its propeller (if applicable) in the minimum drag position: 1. At the minimum V2 for takeoff; 2. During an approach and go-around; and 3. During an approach and landing. d. The following table prescribes, for conventional wheel type controls, the maximum control forces permitted during the testing required by paragraphs (a) and (c) of this section: e. Approved operating procedures or conventional operating practices must be followed when demonstrating compliance with the control force limitations for short term application that are prescribed in paragraph (d) of this section. The airplane must be in trim, or as near to being in trim as practical, in the preceding steady flight condition. For the takeoff condition, the airplane must be trimmed according to the approved operating procedures. 25.255 Outof-trim characteristics. a. From an initial condition with the airplane trimmed at cruise speeds up to VMO/MMO, the air-plane must have satisfactory maneuvering stability and controllability with the degree of out-of-trim in both the airplane nose-up and nose-down directions, which results from the greater of — 126 Aircraft Accident Investigation Bureau Interim report March, 2020 A three-second movement of the longitudinal trim system at its normal rate for the particular flight condition with no aerodynamic load (or an equivalent degree of trim for airplanes that do not have a power-operated trim system), except as limited by stops in the trim system, including those required by §25.655(b) for adjustable stabilizers; or 2. The maximum mistrim that can be sustained by the autopilot while maintaining level flight in the high speed cruising condition. b. In the out-of-trim condition specified in paragraph (a) of this section, when the normal acceleration is varied from +1 g to the positive and negative values specified in paragraph c. of this section — 1. The stick force vs. g curve must have a positive slope at any speed up to and including VFC/MFC; and 2. At speeds between VFC/MFC and VDF/MDF the direction of the primary longitudinal control force may not reverse. c. Except as provided in paragraphs (d) and (e) of this section, compliance with the provisions of paragraph (a) of this section must be demonstrated in flight over the acceleration range — 1. 1. -1 g to +2.5 g; or 2. 0 g to 2.0 g, and extrapolating by an accept-able method to -1 g and +2.5 g d. If the procedure set forth in paragraph (c)(2)of this section is used to demonstrate compliance and marginal conditions exist during flight test with regard to reversal of primary longitudinal control force, flight tests must be accomplished from the normal acceleration at which a marginal condition is found to exist to the applicable limit specified in paragraph (b)(1) of this section. e. During flight tests required by paragraph (a)of this section, the limit maneuvering load factors prescribed in §§25.333(b) and 25.337, and the maneuvering load factors associated with probable inadvertent excursions beyond the boundaries of the buffet onset envelopes determined under§25.251(e), need not be exceeded. In addition, the entry speeds for flight test demonstrations at normal acceleration values less than 1 g must be limited to the extent necessary to accomplish a recovery without exceeding VDF/MDF.(f)In the out-of-trim condition specified in para-graph (a) of this section, it must be possible from an over speed condition at VDF/MDF to produce at least 1.5 g for recovery by applying not more than125 pounds of longitudinal control force using either the primary longitudinal control alone or the primary longitudinal control and the longitudinal trim system. If the longitudinal trim is used to assist in producing the required load factor, it must be shown at VDF/MDF that the longitudinal trim can be actuated in the airplane nose-up direction with the primary surface loaded to correspond to the least of the following airplane nose-up control forces: 1. The maximum control forces expected in service as specified in §§25.301 and 25.397. 2. The control force required to produce 1.5 g. 3. The control force corresponding to buffeting or other phenomena of such intensity that it is a strong deterrent to further application of primary longitudinal control force. 25.1309 Equipment, Systems, and Installations a. The equipment, systems, and installations whose functioning is required by this Decree, must be designed to ensure that they perform their intended functions under any foreseeable operating condition. 127 Aircraft Accident Investigation Bureau Interim report March, 2020 b. The airplane systems and associated components, considered separately and in relation to other systems, must be designed so that1. The occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane is extremely improbable, and 2. The occurrence of any other failure conditions which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions is improbable. c. Warning information must be provided to alert the crew to unsafe system operating conditions, and to enable them to take appropriate corrective action. Systems, controls, and associated monitoring and warning means must be designed to minimize crew errors which could create additional hazards. d. Compliance with the requirements of paragraph (b) of this section must be shown by analysis, and where necessary, by appropriate ground, flight, or simulator tests. The analysis must consider1. Possible modes of failure, including malfunctions and damage from external sources. 2. The probability of multiple failures and undetected failures. 3. The resulting effects on the airplane and occupants, considering the stage of flight and operating conditions, and 4. The crew warning cues, corrective action required, and the capability of detecting faults. e. In showing compliance with paragraphs (a) and (b) of this section with regard to the electrical system and equipment design and installation, critical environmental conditions must be considered. For electrical generation, distribution, and utilization equipment required by or used in complying with this chapter, except equipment covered by Approved Technical Specification or Technical Standard Orders containing environmental test procedures, the ability to provide continuous, safe service under foreseeable environmental conditions may be shown by environmental tests, design analysis, or reference to previous comparable service experience on other aircrafts f. EWIS must be assessed in accordance with the requirements of sec.25.1709. 25.1329 Flight guidance system. g. Under any condition of flight appropriate to its use, the flight guidance system may not produce hazardous loads on the airplane, nor create hazardous deviations in the flight path. This applies to both fault-free operation and in the event of a malfunction, and assumes that the pilot begins corrective action within a reasonable period of time. 25.1585 Operating Procedures a. Operating procedures must be furnished for— 1. Normal procedures peculiar to the particular type or model encountered in connection with routine operations; 2. Non-normal procedures for malfunction cases and failure conditions involving the use of special systems or the alternative use of regular systems; and 3. Emergency procedures for foreseeable but unusual situations in which immediate and precise action by the crew may be expected to substantially reduce the risk of catastrophe. b. Information or procedures not directly related to airworthiness or not under the control of the crew must not be included, nor must any procedure that is accepted as basic airmanship. c. Information identifying each operating condition in which the fuel system independence prescribed in Sec. 25.953 is necessary for safety must be furnished, together with instructions for placing the fuel system in a configuration used to show compliance with that section. 128 Aircraft Accident Investigation Bureau Interim report March, 2020 d. The buffet onset envelopes, determined under Sec. 25.251 must be furnished. The buffet onset envelopes presented may reflect the center of gravity at which the airplane is normally loaded during cruise if corrections for the effect of different center of gravity locations are furnished. THE RESPONSIBILITY FOR AIRWORTHINESS The Ethiopian Civil Aviation Rules and Standards (ECARAS) PART 9 — Air Operator Certification and Administrationare applicable for the operation of aircraft within Ethiopian territory. The Ethiopian Civil Aviation Rules and Standards (ECARAS) PART 9 subpart 9.2.3 describes: (a) No person may operate an aircraft in commercial air transport unless that aircraft has an appropriate current airworthiness certificate, is in an airworthy condition, and meets the applicable airworthiness requirements for these operations, including those related to identification and equipment. (b) The pilot in command of a civil aircraft is responsible for determining whether that aircraft is in condition for safe flight. The pilot in command shall discontinue the flight when unairworthy mechanical, electrical, or structural conditions occur. (a) Each certificate holder is primarily responsible for The Ethiopian Civil Aviation Rules and Standards (ECARAS) PART 9 — Air Operator Certification and Administrationrelated to regulation for aircraft maintenance responsibility is as follows: Ethiopian Civil Aviation Rules and Standards (ECARAS) Part 9 Maintenance Responsibilities (Responsibilities for Airworthiness): (1) (a) Each AOC holder shall ensure the airworthiness of the aircraft and the serviceability of both operational and emergency equipment by:(1) Assuring the accomplishment of preflight inspections; (2) Assuring the correction of any defect and/or damage affecting safe operation of an aircraft to an approved standard, taking into account the MEL and CDL if available for the aircraft type; (3) Assuring the accomplishment of all maintenance in accordance with the approved operator's aircraft maintenance program; (4) The analysis of the effectiveness of the AOC holder's approved aircraft maintenance program; (5) Assuring the accomplishment of any operational directive, airworthiness directive and any other continued airworthiness requirement made mandatory by the Authority; and (6) Assuring the accomplishment of modifications in accordance with an approved standard and, for non-mandatory modifications, the establishment of an embodiment policy. (b) Each AOC holder shall ensure that the Certificate of Airworthiness for each aircraft operated remains valid in respect to:(1) The requirements in paragraph (a); (2) The expiration date of the Certificate; and (3) Any other maintenance condition specified in the Certificate. (c) Each AOC holder shall ensure that the requirements specified in paragraph (a) are performed in accordance with procedures approved by or acceptable to the Authority. (d) Each AOC holder shall ensure that the maintenance, preventive maintenance, and modification of its aircraft/aeronautical products are performed in accordance with its 129 Aircraft Accident Investigation Bureau Interim report March, 2020 maintenance control manual and/or current instructions for continued airworthiness, and applicable aviation rules and standards. (e) Each AOC holder may make an arrangement with another person or entity for the performance of any maintenance, preventive maintenance, or modifications; but shall remain responsible of all work performed under such arrangement. (f) An operator shall not operate an aircraft unless it is maintained and released to service by either an AMO certificated under Part 6 or by an equivalent system of maintenance, either of which shall be acceptable to the Authority If an equivalent system to an AMO is used, the AOC holder shall ensure that the person signing the maintenance release is licensed in accordance with Part 2. (g) Each operator shall ensure that the maintenance of its aircraft is performed in accordance with the approved maintenance programme. (3) The operator of an aeroplane over 5,700 kg maximum certificated take-off mass and helicopter over 3175 kg maximum certificated take-off mass shall monitor and assess maintenance and operational experience with respect to continuing airworthiness and provide the information as prescribed by the Ethiopian Civil Aviation Authority through the system specified in ECARAS Part 5.5.1.5. (4) The operator an aeroplane over 5700 kg maximum certificated take-off mass and helicopter over 3175kg maximum certificated take-off mass shall obtain and assess continuing airworthiness information and recommendations available from the organization responsible for the type design and shall implement resulting actions considered necessary in accordance with a procedure acceptable to the Ethiopian Civil Aviation Authority. 2. ANALYSIS At the time of publication of this interim report the analysis is in progress and will be included in the final report. 3. CONCLUSIONS 3.1 FINDINGS Findings are statements of all significant conditions, events or circumstances in the accident sequence. The findings are significant steps in the accident sequence, but they are not always causal, or indicate deficiencies. Some findings point out the conditions that pre-existed the accident sequence, but they are usually essential to the understanding of the occurrence, usually in chronological order (ICAO Doc 9756 Part IV paragraph 3.1). 1. The aircraft has a valid certificate of airworthiness and maintained in accordance with applicable regulations and procedures; 130 Aircraft Accident Investigation Bureau Interim report March, 2020 2. There were no known technical problems before departure. 3. The aircraft weight and balance was within the operating limits. 4. The takeoff roll and lift-off was normal, including normal values of left and right angle-of-attack (AOA). During takeoff roll, the engines stabilized at about 94% N1. From this point for most of the flight, the N1 Reference remained about 94%. 5. Shortly after lift-off, the left and right recorded AOA values deviated. The left AOA values were erroneous and reached 74.5° while the right AOA reached a maximum value of 15.3°.The difference between the left and the right AOA values was 59° and remained as such until near the end of the recording. 6. Right after the deviation of the AOA the left stick shaker activated and remained active until the near end of the recording. The pitch Flight Director (F/D) bars disappeared on both left hand and right hand Primary Flight Displays (PFD). As the aircraft crossed 400 ft Radio Altitude the right and left pitch F/D bars appeared again. 7. Immediately after the LH AOA sensor failure, the left AOA erroneous values affected the LH FD pitch command, and the RH and LH Flight Director (FD) pitch bars started to display different guidance. 8. The Stall Management Yaw Damper Computer -1 (SMYDC 1) computed LH minimum operational speed and LH stick shaker speed greater than VMO (340 kt) without any alert or invalidity detection.Thus; the indicated LH airspeed was inside the minimum speed (red and black) band. 9. Approximately five seconds after the end of the crew manual electrical trim up inputs, a third automatic nose-down trim(MCAS) triggered. There was no corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches being in the ‘’cutout’’ position 10. The right hand over speed clacker sounded and it remained active until the end of the recording. The RH speed values varied between 360 kt and 375 kt (RH values). On the LH PFD, the LH computed airspeed oscillated between 335 kt and 350 kt. 11. Approximately five seconds after the last manual electric trim up input, a fourth automatic trim nose-down (MCAS) triggered. The stabilizer moved from 2.3 to 1 unit. The vertical speed decreased and became negative 3 s after the MCAS activation. 131 Aircraft Accident Investigation Bureau Interim report March, 2020 12. The difference training from B737NG to B737 MAX provided by the manufacturer was found to be inadequate. 13. The AOA Disagree message did not appear on the accident aircraft as per the design described on the flight crew operation manual. 14. AOA failure detection feature of the ADIRU did not detect the erroneous AOA from the left AOA sensor because it only considers the value to be erroneous when the AOA value is outside the physical range. Thus; SPD and ALT flag never appeared on the PFD. 15. MCAS design on single AOA inputs made it vulnerable to undesired activation. 16. The specific failure modes that could lead to uncommanded MCAS activation, such as an erroneous high AOA input to the MCAS, were not simulated as part of the functional hazard assessment validation tests. As a result, additional flight deck effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker activation) resulting from the same underlying failure (for example, erroneous AOA) were not simulated and were not documented in the stabilizer trim and auto flight safety assessment. 4. SAFETY RECOMMENDATIO NS 1. The design of MCAS should consider the use of data from both AOA and/or other independent systems for redundancy. 2. The regulator shall confirm all probable causes of failure have been considered during functional hazard assessment. 3. The manufacturer shall insure the minimum operational speedcomputed by the SMYD to be within logical value. There should also be logic to validate the computation. 4. The difference training should also include simulator sessions to familiarize with normal and non-normal MCAS operation. The Training simulators need to be capable of simulating AOA failure scenarios. 5. The manufacture should confirm the AOA DISAGREE alert is functional whether the optional angle of attack indicator is installed or not. 132 Aircraft Accident Investigation Bureau Interim report March, 2020 6. The EAIB endorses the NTSB safety recommendation A-19-10 found in appendix 1 5. APPENDICES Appendix 1 Previous Recommendations from the U.S National Transportation Safety Board (NTSB) ASR-19-01 On 19th September 2019, the U.S NTSB Board issued 7 Safety Recommendations during the course of the investigations led by Indonesia and Ethiopia on the B 737 MAX accidents. These recommendations mainly focused on the US design certification process used to approve the original design of the Maneuvering Characteristics Augmentation System (MCAS) on the Boeing 737 MAX. NTSB Recommendations to the Federal Aviation Administration - Require that Boeing (1) ensure that system safety assessments for the 737 MAX in which it assumed immediate and appropriate pilot corrective actions in response to 133 Aircraft Accident Investigation Bureau Interim report March, 2020 uncommanded flight control inputs , from systems such as the Maneuvering Characteristics Augmentation System, consider the effect of all possible flight deck alerts and indications on pilot recognition and response; and (2) incorporate design enhancements (including flight deck alerts and indications), pilot procedures, and/or training requirements, where needed, to minimize the potential for and safety impact of pilot actions that are inconsistent with manufacturer assumptions. (A-19-10) - Require that for all other US type -certificated transport-category airplanes, manufacturers (1) ensure that system safety assessments for which they assumed immediate and appropriate pilot corrective actions in response to uncommanded flight control inputs consider the effect of all possible flight deck alerts and indications on pilot recognition and response; and (2) incorporate design enhancements (including flight deck alerts and indications), pilot procedures, and/or training requirements, where needed, to minimize the potential for and safety impact of pilot actions that are inconsistent with manufacturer assumptions. (A-19-11) - Notify other international regulators that certify transport-category airplane type designs (for example, the European Union Aviation Safety Agency, Transport Canada, the National Civil Aviation Agency-Brazil, the Civil Aviation Administration of China, and the Russian Federal Air Transport Agency) of Recommendation A-19-11 and encourage them to evaluate its relevance to their processes and address any changes, if applicable. (A-19-12) - Develop robust tools and methods, with the input of industry and human actors experts, for use in validating assumptions about pilot recognition and response to safety significant failure conditions as part of the design certification process (A-19-13) - Once the tools and methods have been developed as recommended in Recommendation A-19-13, revise existing Federal Aviation Administration (FAA) regulations and guidance to incorporate their use and documentation as part of the design certification process, including re-examining the validity of pilot recognition and response assumptions permitted in existing FAA guidance. (A-19-14) - Develop design standards, with the input of industry and human factors experts, for aircraft system diagnostic tools that improve the prioritization and clarity of failure indications (direct and indirect) presented to pilots to improve the timeliness and effectiveness of their response. (A-19-15) - Once the design standards have been developed as recommended in Recommendation A-19-15, require implementation of system diagnostic tools on transport-category aircraft to improve the timeliness and effectiveness of pilots’ response when multiple flight deck alerts and indications are present.(A-19-16) 134 Aircraft Accident Investigation Bureau Interim report March, 2020 Appendix 2 135 Aircraft Accident Investigation Bureau Interim report March, 2020 ET302 Preliminary FDR Data 2 7 E- 2 Location. Date: Addie Ababn, Ethiopia. 10 March 2019 Accideniit: AI-MHS 3 1ww 3 3; unuuNu 3 a. a: ?3000' 5000 airspeed Comp-L 250 Alrgpeed Comp?R (MgSlick ShakerrL i Shake?; ?3 NOTALII NUIHL - Left 5 Ir Shaker TRIM . Ac va on omman Trim Lip-Man I ?'0me Trim Domean I LI fl Trim TRIM Trim 3 Automatic Trim Down Commands I I TRIM 10 Ki Automatic Trim Command With No Change In Pitch Trimi Fitch Trim 5 i E, g- 20 '0 .55. Pitch Auilude Disp A?cmumnln-uis .CMDA "5 nul hL -1 BAP- AP Warn Capt I i i. I nuvmnn . WAFN Master Caution r? NOWARN 02y Primary Am. Heat 1 ?Hi1 II TRUE FALSE 2.00? ?GVenAccal 3: ?gure 7-3 Tora- Revised: 23 March 2019 Ethiopian Airiines, Boeing E1302. ET-AVJ Ethiopian Accident investigation Bureau 136