What happened on ET302?

The preliminary report for ET302 reveals many details, but not enough to know exactly every and all aspects. The following is a look at what can be learned.

(excerpts from the preliminary report narrative are indented and italicized)

At 05:37:34, ATC issued take off clearance to ET-302 and to contact radar on 119.7 MHz. Takeoff roll began from runway 07R at approximately 05:38, with a flap setting of 5 degrees and a stabilizer setting of 5.6 units.

The takeoff weight was 71,896 kg.

Takeoff Center of Gravity (CG) was 23.12.

MET REPORT HAAB 100530Z
Wind - runway 25: 070 degrees 10kt, runway 07: 050 degrees, 10kt Visibility: 10km; few cloud 750 m; temperature: 170C; dew point: 090C QNH: 1029 hPa; QFE: 777 hPa

The elevation of the airport is 2333.5 m. The aircraft took off on runway 07R which was 3800 m long and 45 m wide.  The warm temperatures raised the density altitude. The headwind increased the takeoff runway to an equivalent 3900m length. The takeoff configuration was right at the limit for the runway.

The takeoff roll appeared normal, including normal values of left and right angle-of-attack (AOA). During takeoff roll, the engines stabilized at about 94% N1, which matched the N1 Reference recorded on the DFDR. From this point for most of the flight, the N1 Reference remained about 94% and the throttles did not move. According to the CVR data and the control column forces recorded in DFDR, captain was the pilot flying.

The takeoff rotation pitch attitude reached about 18 degrees. Liftoff speed was 155-160 knots. Normally the takeoff would proceed to 15 deg. Pitch attitude almost immediately was reduced. Climb speed to 1000 feet increased to over 200 knots with flaps constant at 5 degrees.

The power setting never changing throughout the flight led to much higher airspeed than would be expected, including overspeed, all below 10,000 AGL. Basic airmanship involves altitude, speed, and heading. The lack of speed control is very troubling and would seem to have fallen victim to inattention due to pilot distraction/workload.  The pilot not flying (pilot monitoring) should have been alerting the pilot flying repeatedly over the excessive speed, yet this report makes no mention of this advice, and even when overspeed.

The New York Times published data from flightradar24.com that they said showed evidence of MCAS actions.

I pointed out, right away, that flaps should be down at that point and that MCAS would not be active at that point. That was the case.

The data provided in the preliminary report does not show Vertical Speed.  I plotted Vertical Speed Vs. Altitude, and it appears the airplane did not climb out smoothly. The guidance on a normal takeoff is to climb at about V₂+15 at a stead pitch attitude of about 15 degrees, and surely to maintain positive rate of climb.

At 05:38:44, shortly after liftoff, the left and right recorded AOA values deviated. Left AOA decreased to 11.1° then increased to 35.7° while value of right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in 3⁄4 seconds while the right AOA reached a maximum value of 15.3°.

Clearly the AOA vane has suffered a failure. It is plainly obvious. Either the vane (the outside assembly) just fell off, or a bird strike took it off. If a bird strike, the CVR area mic might pick up the plunk.

Bjorn Fehrm suggested that if the vane broke off, the remainder would  act like a pendulum, with the remaining off-center weight.  Others have come to the same conclusion. However as pointed out in the comments, the angle for +75 degrees would be pointing down.

If the vane completely sheared off and the shaft were still rotating, then the internal counter weight would likely be the forcing factor, and this is in the right orientation.

The following is a similar vane.  The need for a counterweight is the same with any vane.

There have been numerous occasions for AOA vanes to fail.

The AOA step change to 75 degrees in about 2 seconds was fully accepted by all the systems onboard as valid data, and this set off the numerous flight deck effects related to stall warning and also the offset to airspeed and altitude from using erroneous AOA compensation.

Under what circumstance is AOA jumping about 60 degrees a reasonable response? Why is there no fault triggered by this obvious malfunction? How do you get to 75 degrees AOA in any flight profile anyway? Is this a reasonable value in any case?

For 737-900, the highest alpha trip point is 23.5 degrees. In the approach to stall, once you have gotten to the trip point, you trigger stall warning. There is nothing to do at higher alpha (maybe MCAS comes in a bit higher?). The pilot is expected to recover from the approach to stall, or a full stall.

Boeing lists all the flight deck effects possible with erroneous AOA. Notably, the stick shaker goes of incessantly, the airspeed and altitude are offset from valid values, and control column pressure aft (pulling) is increased significantly.

The influence of AOA correction to air data is modest at low speeds, but quite pronounced at high speeds. At the end of the flight, AOA swung around, and this caused airspeed and altitude to modulate, revealing the influence of AOA corrections.

At this time, the left stick shaker activated and remained active until near the end of the recording. Also, the airspeed, altitude and flight director pitch bar values from the left side noted deviating from the corresponding right side values. The left side values were lower than the right side values until near the end of the recording.

The captain drops the nose to less than eight degrees and airspeed increases steadily – all concurrent with the stick shaker activation. Is it possible the captain was unsure of being too slow and instinctively dropped the nose in response? Was the elevator feel shift module activation, at least doubling the aft feel forces, a factor in lowering the nose?

At 05:38:46 and about 200 ft radio altitude, the Master Caution parameter changed state. The First Officer called out Master Caution Anti-Ice on CVR. Four seconds later, the recorded Left AOA Heat parameter changed state.

The AOA vane is heated to prevent ice build-up. If it departed the aircraft, the electrical heating circuit would fail, and this was encountered.

Master Caution on the Glare Shield alerts the flight crew to refer to other (overhead) panel for further information, where in this case the L APHA VANE fault is annunciated.

At 05:38:58 and about 400 ft radio altitude, the flight director pitch mode changed to VNAV SPEED and Captain called out “Command” (standard call out for autopilot engagement) and an autopilot warning is recorded.

Autopilot apparently would not stay engaged, and the warning would alert the crew to it being disconnected. I am not sure what was keeping the autopilot from engaging, but it was a listed effect from AOA erroneous reading.

At 05:39:00, Captain called out “Command”.

At 05:39:01 and about 630 ft radio altitude, a second autopilot warning is recorded.

A second attempt to engage the autopilot was not successful, again triggering a warning when it disconnected.

At 05:39:06, Between liftoff and 1000 ft above ground level (AGL), the pitch trim position moved between 4.9 and 5.9 units in response to manual electric trim inputs. At 1000 ft AGL, the pitch trim position was at 5.6 units.

Stabilizer trim is operating normally when the pilot was flying with flaps down.

At 05:39:22 and about 1,000 feet the left autopilot (AP) was engaged (it disengaged about 33 seconds later), the flaps were retracted, and the pitch trim position decreased to 4.6 units. 

Six seconds after the autopilot engagement, there were small amplitude roll oscillations accompanied by lateral acceleration, rudder oscillations and slight heading changes. These oscillations continued also after the autopilot was disengaged.

The source of the roll and rudder oscillations was not revealed, nor was wheel or rudder control inputs. What factor this has is not known.

Autopilot stab trim would applied be to maintain an “in trim” condition as the airplane accelerated and flaps were raised. This is evident by three trim nose down commands as the airplane speed increases.

At 05:39:45, Captain requested flaps up and First-Officer acknowledged. One second later, flap handle moved from 5 to 0 degrees and flaps retraction began.

At 05:39:55, Autopilot disengaged,

It would appear Speed Trim System applies a nose up trim command to reflect the airplane accelerating.

At 05:40:00 shortly after the autopilot disengaged, the FDR recorded an automatic aircraft nose down (AND) activated for 9.0 seconds and pitch trim moved from 4.60 to 2.1 units. The climb was arrested, and the aircraft descended slightly.

With the flaps up and AOA erroneously high, it appears MCAS applied a significant 2.5 unit nose down command.

At 05:40:03 Ground Proximity Warning System (GPWS) “DON’T SINK” alerts occurred.

The column moved aft and a positive climb was re-established during the automatic AND motion.

The airplane lost altitude in the first MCAS command.

At 05:40:12, approximately three seconds after AND stabilizer motion ends, electric trim (from pilot activated switches on the yoke) in the Aircraft nose up (ANU) direction is recorded on the DFDR and the stabilizer moved in the ANU direction to 2.4 units. The Aircraft pitch attitude remained about the same as the back pressure on the column increased.

The captain appears to have trimmed slightly nose up in response. It is not clear why the captain did not apply more nose up trim to reduce column forces.

At 05:40:20, approximately five seconds after the end of the ANU stabilizer motion, a second instance of automatic AND stabilizer trim occurred and the stabilizer moved down and reached 0.4 units.

The manual trim command reset the MCAS logic, arming it for another command five seconds later. The second MCAS command takes the stabilizer to near the nose down limit.

The Boeing 737 flaps up stabilizer trim is limited in range to no less than about 4 units under pilot electric trim command. The pilot can use electric trim to as low as 0.05 units with flaps down. Boeing has concluded that there is NO REASON for trim to go less than about 4 units with flaps up. Apologies, I don’t have the 737 MAX values, but they should be similar. These limits are enforced by limit switches on the jackscrew.

The autopilot has the authority to operate down to 0.05 units without any limit switch. The autopilot normally only provides incremental adjustments to maintain an in-trim or stable trim, and therefore would naturally stay very close to the trim position.

EASA took note of the fact that it is possible more nose down trim might be needed under certain corner conditions than what is available to the pilot using electric trim and accepted the configuration anyway. Boeing provides manual trim as a means to achieve trim outside of the range allowed for under pilot electric trim control, or for the autopilot command mode.

When MCAS triggered, the stab trim was at about 4.60 units and it was ultimately driven down to 0.4 units. Any trim to less than about 4 units is going to guarantee a severe mis-trim situation. MCAS authority is not limited to prevent severe mis-trim in its normal mode of operation.  While MCAS provides a pitch down moment to offset aero pitch up, it leaves the airplane severely mis-trimmed nose down. There is nothing provided to help the pilot recover to an in-trim position, to restore the stab into a valid range for flaps up – incredibly it just dumps the stab and leaves it to the pilot to get it back.

From 05:40:23 to 05:40:31, three Ground Proximity Warning System (GPWS) “DON’T SINK” alerts occurred.

Pilots are ingrained to take immediate action when GPWS alerts. In this case, the imperative is to restore level or climbing flight.

At 05:40:27, the Captain advised the First-Officer to trim up with him.

At 05:40:28 Manual electric trim in the ANU direction was recorded and the stabilizer reversed moving in the ANU direction and then the trim reached 2.3 units.

I cannot understand the need for the captain to ask for help to trim up, he has a yoke switch. Maybe he was cradling the column and did not have his thumb in position?

In any case, what was most troubling is that they stopped trimming long before the column forces were relaxed.  Leaving the stab out of trim would create many issues for the crew. The advice from Boeing and the FAA should have been far more insistent on this point. Not “can be used” but rather: Electric trim must be used to neutralize control column pitch forces before cutout!

At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and First- Officer confirmed stab trim cut-out.

At 05:40:41, approximately five seconds after the end of the ANU stabilizer motion, a third instance of AND automatic trim command occurred without any corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches were in the ‘’cutout’’ position

It is apparent that the cutout has been switched in. MCAS sits idle after this command until the pilot applies manual electric trim near the end of the flight.

At 05:40:44, the Captain called out three times “Pull-up” and the First-Officer acknowledged.

Having left the severe mistrim in place, the captain is having difficulty keep the nose up. The elevator feel shift is adding considerable extra effort to hold the column back.

What also is clear, MCAS nose-down trim commands were not stopped, especially the second command, by the pilot pulling the column considerably aft – the aft column cutout was disabled.

The aft column cutout switch is designed to stop a nose-down stabilizer runaway. Human factors favor this feature, as the pilot will naturally pull back to stop the nose-down pitch moment. By stopping the stabilizer runaway, the pilot will have less mistrim to account for, and has opportunity to collect themselves and hit the cutout.

While the first MCAS command was largely offset by pilot elevator command, the second MCAS command was overwhelming.  In this case, the captain trimmed nose up, but stopping short of a reducing column forces.

From 05:40:42 to 05:43:11 (about two and a half minutes), the stabilizer position gradually moved in the AND direction from 2.3 units to 2.1 units. During this time, aft force was applied to the control columns which remained aft of neutral position.

The data indicates that aft force was applied to both columns simultaneously several times throughout the remainder of the recording.

At 05:41:30, the Captain requested the First-Officer to pitch up with him and the First-Officer acknowledged.

At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working.

The captain is pulling the column aft stabilize the pitch attitude. He desperately wants to trim the stabilizer nose up to offload the column and restore trimmed flight. By hitting the cutout switches, the flight crew must resort to manual trim wheel.

The cutout switch function was changed with the 737MAX from all prior 737 models. The legacy switch combination was one switch to cutout electric trim altogether, the other to cutout the autopilot trim commands. MCAS and Speed Trim System are both commands from the “autopilot”.  With the legacy switch configuration, the flight crew can disable the autopilot commands and retain electric trim.

With the 737MAX, the flight crew lose both electric trim and autopilot trim with the cutout switch.

 

The Flight Standardization Board (FSB) took notice of the nomenclature change of the cutout switches but did not make any mention of the difference in responding to autopilot stab trim runaway. On the 737NG, the flight crew retain electric trim; on the 737MAX the flight crew must use manual trim. It turns out, this is a significant difference in pilot workload and pilot capacity to fly the airplane.

 

Manual trim wheel is a cable driven function that mechanically turns the stabilizer jackscrew through a clutch and gearbox. The clutch ensure that the manual trim wheel has control in priority over the electric trim. The pilot turning the trim wheel must provide enough force to turn the jackscrew – there is no power-assist.

There is an issue with opposing loads on the stabilizer jack screw based on stabilizer angle of incidence and elevator deflection.  Notably, significant elevator deflection can become greater than what a pilot (or both) can apply at the wheel.

The stabilizer moves from 2.3 units to 2.1 units during this time. That would be likely if the pilot, unable to turn the wheel nose up, experiments to see if it is jammed by trimming nose down. With forces favoring nose down, the wheel effectively ratchets nose down.

The flight ops manual for the 737-100/200 makes mention of this phenomena.

Centauraus, on pprune.org, provided an interesting post:

After some research in my aviation library I think I have found the answer to my original questions of the meaning of the Boeing term "relieving aerodynamic loads." 

Extract from the Boeing 737-200 Pilot Training Manual February 1982 page 04.80.31. Edited for brevity. Runaway and Manual Stabiliser - Recovery from Severe Out-of-Trim 

"In an extreme nose-up out-of-trim condition, requiring almost full forward control column, decelerate, extend the flaps and/or reduce thrust to a minimum practical setting consistent with flight conditions until elevator control is established. Do not decrease airspeed below the minimum maneuvering speed for the flap configuration. A bank of 30 degrees or more will relieve some force on the control column. This, combined with flap extension and reduced speed should permit easier manual trimming. 

If other methods fail to relieve the elevator load and control column force, use the "roller coaster" technique. If nose-up trim is required, raise the nose well above the horizon with elevator control. Then slowly relax the control column pressure and manually trim nose-up. Allow the nose to drop below the horizon while trimming. Repeat this sequence until the airplane is trim. 

If nose-down trim is required, slowing down and extending the flaps will account for a large degree of nose-up pitch. If this does not allow manual trimming then the reverse "roller coaster" can be performed to permit manual trimming." (I read somewhere it was called the Yo Yo manoeuvre) 

Boeing "Airliner" magazine published in May 1961 discussed the above subject as it applied to the Boeing 707 by stating: "To trim the stabilizer manually while holding a high stick force on control column. As the airplane changes altitude, crank in the desired trim change. Correct airplane attitude after a few seconds with elevators. Relax stick force again and crank in more trim. Repeat this procedure as necessary until proper 'trim' position of stabilizer is established."

The reason is apparent by looking at the forces. With the control column in neutral, the forces all favor nose up trim.

for more background: Trim Cutout with Severe Out-of-Trim Stabilizer can be difficult to recover

The only advice in the training manual, the quick reference handbook, and the ops manual is that you can try as hard as you want without breaking anything, and you may need to “relieve aerodynamic forces”.

The left indicated airspeed increased from approximately 305 kt to approximately 340 kt (VMO). The right indicated airspeed was approximately 20-25 kt higher than the left.

At 05:41:20, the right overspeed clacker was recorded on CVR. It remained active until the end of the recording.

At 05:41:32, the left overspeed warning activated and was active intermittently until the end of the recording.

The horizontal stabilizer forces in a severe nose-down mistrim are increasing helpful with higher airspeed (see 737-100 advice above), but significant elevator nose up commands remain overwhelming.

At 05:42:10, the Captain asked and the First-Officer requested radar control a vector to return and ATC approved.

At 05:42:30, ATC instructed ET-302 to turn right heading 260 degrees and the First-Officer acknowledged.

At 05:42:43, the selected heading was changed to 262 degrees.

The captain begins a slow turn while still applying significant aft column command. The roll commands are choppy and not smooth. Bank angle extends to 30 degrees at the point when the final MCAS commands will come alive, making recovery more complicated by having to level the wings too.

At 05:42:51, the First-Officer mentioned Master Caution Anti-Ice. The Master Caution is recorded on DFDR.

At 05:42:54, both pilots called out “left alpha vane”.

For some reason the left alpha vane fault is retriggered.

At 05:43:04, the Captain asked the First Officer to pitch up together and said that pitch is not enough.

At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two momentary manual electric trim inputs are recorded in the ANU direction. The stabilizer moved in the ANU direction from 2.1 units to 2.3 units.

By virtue of the command and motion, it appears that the flight crew released the cutout, reactivated stabilizer trim. I would guess it was because they could not move the stab manually, and they could come up with no other option.

The airplane is flying at or above Vmo at this point. The stab trim manual inputs may have caused a bit of a shudder in the flight deck, which may have created some reluctance to trim aggressively. In any case, it is not clear what prevented the crew from continuing to trim airplane nose up to reduce column forces.

Bjorn Fehrm thoughts on this point.

At 05:43:20, approximately five seconds after the last manual electric trim input, an AND automatic trim command occurred, and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds. The aircraft began pitching nose down. Additional simultaneous aft column force was applied, but the nose down pitch continues, eventually reaching 40° nose down. The stabilizer position varied between 1.1 and 0.8 units for the remainder of the recording.

  

Activating MCAS at or above Vmo makes no sense at all. The highest speed one might expect MCAS is about 270 knots (highest stall speed of about 190 knots * 1.41 or 2g). (data shown for 737-900)

Applying massive stabilizer trim commands at this high a speed introduced an uncontrollable pitch over, in spite of full elevator command in opposition.

A rapid pitch over causes a large negative load in the flight deck due to the moment arm, and in combination to the negative g from the path change. Column forces initially are reduced, possibly because the flight crew were thrown upwards and lost their footing. Subsequently the column is pulled back massively, but it has no restoring effect. There is no evidence of any attempt to trim the stabilizer nose up using any form (electric or wheel) in the pitch over. It appears the pilots fixate solely on pulling the column back with all their strength.

The AOA vane, stubby, as suspected by the failure discussed earlier, acts like a pendulum, tracking the normal acceleration.

The airplane crashed and 149 passengers with 8 crew members perished.  Every life lost is a tragedy.

The greatest regret with aviation safety is to learn a lesson twice. I have faith that each issue will be addressed and suitable corrective action will be mandated. If anything, it is a big wake up call for the industry to not discard long held safety features without considerable and open analysis.

Human Factors is a science to understand what prevented a pilot from taking the expected action. It is easy to pontificate from a distance. Even the flight crews lost in these accidents would agree what they should have done in hindsight. The challenge is understanding why they made the choices they made and what would have directed them to a better outcome.

The entire series on 737 MCAS

Connecting the Dots: From Command to Action

Movable Stabilizer
737 Pitch Trim Incidents

The Beat Goes On

What Happened on ET302?
AoA Vane must have Failed, the Boeing Fix is In, Senate Grills FAA
How Did MCAS Get Here and What Hurdles Remain?
Taking the Next Steps while Awaiting on the Preliminary Report from ET302
Ethiopian ET302 similarities to Lion Air JT610
What have we learned this week?
Comparing Ethiopian ET302 to Lion Air JT043, JT610
Angle of Attack Vane Failure Modes
First Look at JT610 Flight Data
737 FCC Pitch Axis Augmentation - Command Integrity Mandate for Dual Channel, Fail-Safe
737 MCAS - Failure is an Option
Stabilizer Trim 

Stay tuned!

Peter Lemme

peter @ satcom.guru

Follow me on twitter: @Satcom_Guru

Copyright 2019 satcom.guru All Rights Reserved

RSS: http://satcomguru.blogspot.com/feeds/posts/default?alt=rss

Peter Lemme has been a leader in avionics engineering for 38 years. He offers independent consulting services largely focused on avionics and L, Ku, and Ka band satellite communications to aircraft. Peter chaired the SAE-ITC AEEC Ku/Ka-band satcom subcommittee for more than ten years, developing ARINC 791 and 792 characteristics, and continues as a member. He contributes to the Network Infrastructure and Interfaces (NIS) subcommittee developing Project Paper 848, standard for Media Independent Secure Offboard Network.

Peter was Boeing avionics supervisor for 767 and 747-400 data link recording, data link reporting, and satellite communications. He was an FAA designated engineering representative (DER) for ACARS, satellite communications, DFDAU, DFDR, ACMS and printers. Peter was lead engineer for Thrust Management System (757, 767, 747-400), also supervisor for satellite communications for 777, and was manager of terminal-area projects (GLS, MLS, enhanced vision).

An instrument-rated private pilot, single engine land and sea, Peter has enjoyed perspectives from both operating and designing airplanes. Hundreds of hours of flight test analysis and thousands of hours in simulators have given him an appreciation for the many aspects that drive aviation; whether tandem complexity, policy, human, or technical; and the difficulties and challenges to achieving success.