About Ethiopian Airlines flight 302

Ethiopian Airlines flight ET302, a Boeing 737 MAX 8, crashed shortly after takeoff from Addis Ababa-Bole Airport, Ethiopia. There were no survivors among the 157 occupants.

Takeoff roll began from runway 07R at 08:38 hours local time, with a flap setting of 5 degrees and a stabilizer setting of 5.6 units.
At 08:38:44, ten seconds after rotation, the left and right recorded Angle of Attack (AOA) values deviated. The left AOA decreased to 11.1° then increased to 35.7° while value of right AOA indicated 14.94°.
This resulted in the onset of the stick shaker followed by a master caution light. At the same time the captain?s primary flight display (PFD) showed a drop in indicated airspeed (IAS) from 170Kt to 156Kt.
The captain initially responded by reducing the pitch as a reaction to the stick shaker. This did not stop the stick shaker and the captain to stopped applying further nose down column input at a pitch angle of 7-8° above horizon
Approaching 400 ft, the captain attempted to engage the autopilot (AP) but it was not successful. A second attempt failed as well. Passing 1000 ft radio altitude, at the third attempt, the autopilot was successfully engaged.
The captain asked the first officer to advise ATC of the inability to follow the planned departure due to a flight control problem and to request runway heading and climb 14,000ft.
The left stall management yaw damper computer which was affected by inputs from a failed left AOA sensor calculated the left hand minimum operational airspeed erroneously above 340kt (VMO). This resulted in an overspeed warning.
At the same time, the auto throttle operation was affected by the erroneous left AOA sensor value and remained in the Arm mode and failed to transition to N1 mode, which would have reduced the take-off thrust to climb thrust automatically.
The auto throttle did not give a warning or a failure flag for the flight crew when its operation was affected by the failed AOA sensor value.
The first activation of the Maneuvering Characteristics Augmentation System (MCAS) system occurred within a second where the auto throttle was supposed to reduce from take-off thrust to climb trust. And in less than another second the GPWS aural alert "DON?T SINK" sounded twice.
The activation of MCAS followed by GPWS aural alert with already ongoing stick shaker coupled with no failure flag or warning from the auto throttle in an extremely high workload environment must have caused the auto throttle remaining in the ARM mode with take-off thrust set to remain unnoticed by the crew.
At 08:39:45, captain requested flaps up and the first officer moved the flap handle to position 0. The autopilot then disengaged and the flaps reached the up position.
At 08:40:00, because of the erroneous left AOA value, the MCAS activated the first automatic nose down trim for 9 seconds. At the end of the first MCAS activation the stabilizer position was 2.1 units with the captain pulling to pitch up the airplane, with a force of around 90 lbs (41 kg). At different times when the pilot applied electrical trim for short duration or longer duration the trim stopped at about 2.3 for unknown reasons.
At 08:40:20 the second MCAS activation, lasting 7 seconds, was interrupted by the captain?s electric trim up inputs. The captain applied a nine second electric trim-up input which fully counteracted the second MCAS input and stopped the GPWS warning but it did not bring the aircraft to a neutral trim condition.
When MCAS activated for the third time an automatic nose-down trim was commanded there was no corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches being in the ?cutout? position.
The captain repeatedly requested the first officer to pull up with him on the control column with pitch values oscillating between 7° nose up and -2° nose down. Pitch increased when both pilots applied forces, pitch decreased when a single pilot applied force (force oscillated between 80
lbs and 110 lbs (36-50 kg)). The vertical speed variations followed the variations of the pitch angle, with vertical speed was oscillating between -2,500 ft/min and 4,400 ft/min.
The captain requested the first officer to try the manual trim wheel, and after seconds of intense efforts, the first officer told the captain that it was not working. This was due to the amount of force required to turn the trim wheel. At this moment the stabilizer trim was at 2.3 units with the IAS at 340 Kts.
At 08:42:10 the captain asked and the first-officer to request radar control a vector to return. ATC instructed ET302 to turn right heading 260 degrees. During the radio communications with the ATC, the first officer?s action on the control column was released which increased forces on the captain?s control column. The captain then requested the first officer to check the Master Caution. Then, they both announced "left alpha vane".
At this time the airplane was almost reaching the minimum safe altitude. After about 10 seconds the captain then told the first officer that they should pitch up together. The captain then told the first officer "pitch is not enough" and "put them up". A sound similar to stab trim cut-out switches being returned to normal was recorded on the CVR, thus the stab trim cut out switches were most likely turned back on at that moment.
After a failed attempt to trim using the manual trim wheel as per the runaway stabilizer non-normal checklist and significant and unbearable amount of force on the control column, the flight crew were trying to find other means to relieve the force. The airplane was at 13800 ft; IAS was 367kt, pitch just below 1°, stabilizer at 2.3 units of trim, bank angle 21° right.
The crew was busy pulling on the controls with high muscular force trying to maintain airplane flight path control and reach 14000 ft, a target on which they remained focused. Trying to maintain flight path control was a very demanding task and represented here a high workload, physically and mentally, to the detriment of every other task.
An overspeed warning added another disruption and disturbance on board. The cockpit noise environment was unsettling and further impacted the flight crew?s concentration.
Immediately after the stab trim cut-out switches were put back in normal position, the crew attempted another unsuccessful autopilot engagement as the plane was approaching 14000 ft. At the same time, the captain applied two brief electric trim up inputs of 1 second each while pulling on the control with an average force of 100 Lbs (45 kg). The force on the controls remained between 75 and 100 Lbs.
At 08:43:20, five seconds after the trim-up inputs, the fourth MCAS triggered. The plane started to descend. During the 9-second MCAS activation, the stabilizer decreased from 2.3 units to 1 unit of trim. The captain repeatedly shouted to the first officer to pitch up. The forces were physically unmanageable by both flight crews. The aircraft began pitching nose down.
The airplane hit the ground eighteen seconds after the end of the 4th MCAS.

The investigation noted that intermittent flight control system abnormalities began well before the accident flight. Maintenance actions of relevance started occurring in December 2018 when the airplane was one month old and included several pilot write ups involving temporary fluctuations of vertical speed and altitude. There were also three reports of the airplane rolling during autopilot operation. Altitude and vertical speed indications on the PFD showed erratic and exaggerated indications.
From the maintenance log book report the airplane also suffered intermittent electrical/electronic anomalies in addition to the flight control system malfunctions. For example, three days before the crash the Auxiliary Power Unit (APU) Fault Light illuminated, and the APU had a protective shutdown. The onboard maintenance function computer message also indicated the Start Converter Unit (SCU) showed the APU?s start system was inoperative. The SCU is located in the electrical and electronics (E/E) compartment. The captain?s personal computer power outlet also had no power. The possibility of intermittent electrical/electronic system defects were an underlying issue.
The AOA sensor malfunction on the accident flight most likely occurred as the result of a power quality problem that resulted in the loss of power to the left AOA Sensor Heater. Evidence indicates the loss of power was likely due to a production related intermittent electrical/electronic failure involving the airplane?s Electrical Wiring Interconnection System (EWIS) and the AOA Sensor part.

Probably cause:

Probable cause of the accident
Repetitive and uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA input, and its unrecoverable activation system which made the airplane dive with the rate of -33,000 ft/min close to the ground was the most probable cause of the accident.

Contributing Factors
1. The MCAS design relied on a single AOA sensor, making it vulnerable to erroneous input from the sensor;
2. During the design process, Boeing failed to consider the potential for uncommanded activation of MCAS, but assumed that pilots would recognize and address it through normal use of the control column, manual electric trim, and the existing Runaway Stabilizer NNC. The OMB and Emergency AD issued after the Lion Air accident included additional guidance but did not have the intended effect of preventing another MCAS-related accident;
3. While Boeing considered the possibility of uncommanded MCAS activation as part of its FHA, it did not evaluate all the potential alerts and indications that could accompany a failure leading to an uncommanded MCAS;
4. The MCAS contribution to cumulative AOA effects was not assessed;
5. The combined effect of alerts and indications that impacted pilot?s recognition and procedure prioritization were not evaluated by the Manufacturer;
6. Absence of AOA DISAGREE warning flag on the flight display panels (PFD);
7. The B737 MAX Crew difference CBT training prepared by Boeing and delivered to Pilots did not cover the MCAS system;
8. Failure by the manufacturer to design simulator training for pilots with regards to safety critical systems like MCAS with catastrophic consquences during undesired activation.
9. The manufacturer failed to provide procedures regarding MCAS operation to the crew during training or in the FCOM;
10. Failure by the manufacturer to address the safety critical questions raised by the airline which would have cleared out crew confusion and task prioritization.