French aviation safety authorities this week joined U.S. investigators in a harsh critique of the final report by Ethiopian authorities into the March 2019 crash of a Boeing 737 Max.
The long-delayed Ethiopian government report into the crash of Ethiopian Airlines Flight 302 that killed all 157 people on board laid blame solely on Boeing.
"Repetitive and uncommanded airplane-nose-down inputs" from a new flight control system on the Max, triggered by a single faulty sensor, put the airplane in an "unrecoverable" dive, the Ethiopian report, released Dec. 23, concludes.
The subsequent French and American critiques — a rare fracture among the safety authorities participating in an air accident investigation — don't dispute Boeing's role, but present a fuller picture of the tragedy's cause.
Both the U.S. National Transportation Safety Board and the equivalent French agency identified pilot error as a critical contributing factor.
They also disputed the Ethiopian contention that the sensor that triggered the crash likely failed due to "production quality defects."
Instead, the two agencies said, all evidence points to a bird strike on the sensor vane.
Jeff Guzzetti, former FAA and NTSB investigator and now an aviation safety consultant, said he fully acknowledges Boeing's responsibility for the Max accidents, yet called the Ethiopian agency's report "deeply flawed."
He said "it smacks of their attempts to sweep under the carpet some clear deficiencies by the flight crew and the airline."
However, Javier de Luis, an Massachusetts Institute of Technology aerospace professor whose sister Graziella de Luis died on Flight ET302, expressed anguish that the accounts that dispute the agency's report could sow doubt about the primary cause of the two Max accidents just four months apart, which together killed 346 people in Indonesia and Ethiopia.
"Someone's going to say, well, those airplanes fell because a bird hit them. Or those airplanes fell because the pilots just didn't know what they were doing," said de Luis. "That's the message that will linger in the court of public opinion. It's very disappointing."
"The fact that this airplane was allowed to fly with a system, that if one sensor failed, would kill everybody on board — not once but twice — is a monumental failure not on Ethiopian but on Boeing and the FAA," de Luis added. "An airplane should not fall out of the sky because one sensor fails. End of story. Period."
Examining all factors to draw safety lessons
Both the NTSB and France's Bureau of Enquiry and Analysis agreed with the Ethiopian agency's conclusion that the design of Boeing's new flight control software that repeatedly pushed the jet's nose down — the Maneuvering Characteristics Augmentation System, or MCAS — was a major cause of the accident.
"Overall, the U.S. team concurs with the [Ethiopian] investigation of the MCAS and related systems and the roles that they played in the accident," the NTSB wrote.
But both the French and American agencies state that, in order to understand the full safety implications of the accident, it's important to list every causal factor.
"The crew's inadequate actions ... played a role in the chain of events that led to the accident, in particular during the first phase of the flight, before the first MCAS activation," the BEA wrote.
Both agencies suggest that Ethiopian Airlines failed to ensure its pilots were adequately trained in the measures that Boeing recommended to counter an erroneous MCAS activation after the first Max crash.
John Lauber, a former NTSB member and subsequently a senior safety executive at Delta Air Lines and then at Airbus, said that while "the plaintiffs' bar must be happy" with the Ethiopian report's focus on Boeing, ignoring other contributing factors means missing important safety lessons.
"There are a multitude of issues that should have been more fully explored to understand why the flight crew failed to take meaningful action," Lauber said.
Breaking international protocol
The purpose of aircraft accident investigations is not to allocate blame, but to identify the often complex factors that led to the accident in order to prevent another one.
The probe into the ET302 crash was led by Ethiopia's civil aviation accident investigation bureau, with assistance from experts at Boeing and its suppliers as well as NTSB investigators.
To ensure independence from the U.S. manufacturer, the Ethiopian agency sent the plane's black box to Paris, where the BEA performed the technical analysis on the jet's flight data and cockpit voice recorders.
The impact of the COVID-19 pandemic and the brutal civil war that erupted in 2020 in Ethiopia's Tigray region contributed to the long delay.
Pressure on the Ethiopian government to complete the investigation had mounted recently. One day before the report was released, the U.S. Export-Import Bank finalized $281 million in loan guarantees for state-owned Ethiopian Airlines to finance its purchase of several new Max aircraft.
The U.S. and French agencies expressed clear dissatisfaction with the outcome.
Both asserted that the exclusion of their comments from the final report violates international aviation investigation protocols and forced them to publish their comments independently.
The NTSB cites factual errors in the Ethiopian report, all of which appear aimed at piling blame on Boeing while denying any responsibility by Ethiopian Airlines, its pilots or the airport authority.
"There's no doubt in my mind MCAS played a major role in this accident," said Guzzetti, the former NTSB investigator. "In the public perception, Boeing got hammered because of these accidents, and they deserved to get hammered. I think the stain on Boeing is just as visible was it always was."
"But the other half of the equation was not adequately investigated" by the Ethiopian agency," Guzzetti added. "That is not the way to improve aviation safety in today's global environment."
Before MCAS activated, the pilots were in trouble
After takeoff, Flight ET302 was in the air for just 6 minutes before slamming into the earth. The BEA narrative lays out how the pilots' lack of control began during the first 2 minutes of the flight, before MCAS activated.
Upon liftoff, a key sensor on the left side of the fuselage failed. It measured the jet's angle of attack — the angle between the wing and the oncoming air, a data point that the flight computer uses to calculate speed and altitude.
The false angle of attack reading immediately initiated a "stick shaker" warning, a loud, heavy vibration of the control column, falsely alerting the pilots that the plane was flying too slowly and was about to stall.
It also prompted messages on the primary flight displays indicating to the pilots their speed and altitude readings were now unreliable.
Pilots are supposed to memorize the response to an "Airspeed Unreliable" message: Disengage the automatic systems that control flight position and speed, and fly manually.
The captain did not. The cockpit voice recording contains no exchange between the pilots recognizing the airspeed as an issue.
The BEA noted that "communication between the captain and the First Officer [was] very limited and insufficient. ... The situational awareness, problem-solving and decision-making were therefore deeply impacted."
The autopilot, fooled by the faulty sensor into believing the plane was moving too slowly, commanded the plane's nose down to gather speed.
Meanwhile the autothrottle was stuck at full takeoff thrust. Soon the jet was moving much too fast, beyond its Maximum design speed.
That a single faulty sensor led the flight computer to such a drastic misunderstanding of the airplane's situation even before MCAS activated is "a design issue," said Guzzetti.
But still, he said, it's crucial that pilots monitor their airspeed, and this crew missed multiple clues that they were moving too fast, not too slow.
At this point, the captain pulled the nose back up, but didn't reduce the engine thrust to moderate the speed. When MCAS kicked in, this would prove fatal.
The first officer, who should have been helping the captain figure out what was going on, had only 361 hours of total flying experience. He appeared "overwhelmed by the events on board from the moment the stick shaker triggered," the BEA said.
The NTSB and BEA criticize the Ethiopian report for removing key parts of the cockpit voice recorder transcript that would have made clear "the difficulties encountered by the first officer" in reacting to the emergency.
Still, Ralph Nader, the famed consumer activist whose grand-niece Samya Rose Stumo died on Flight ET302, said it's not acceptable to point at the crew without acknowledging the extreme stress and myriad distracting alerts inside the cockpit during those few minutes.
The crew was increasingly distracted by warning lights and messages on the instrument panel; the stick shaker, indicating the jet was too slow; a loud clacking noise indicating it was too fast; a robotic voice declaring "Don't sink! Don't sink!" which was a warning the jet was close to the ground.
Likewise, de Luis is loathe to pin much blame on the pilots.
"The procedures for flying this airplane are so complicated that it is impossible to not screw up something," de Luis said. "You can guarantee that if that results in an accident, that's what everybody's going to blame you for."
Inadequate pilot training
While the crew in the earlier Lion Air crash in Indonesia had never heard of MCAS — Boeing didn't put it in the pilot manuals — the pilots on ET302 knew about the new system from that accident.
A week after the Lion Air crash, Boeing issued a bulletin to airlines on how to handle an inadvertent MCAS activation. Its instructions, which later proved distressingly inadequate, expressed in spare terms how a standard pilot procedure could get the crew out of trouble.
"After a crash that just killed an entire planeload of people in Indonesia, you would think that they would offer a little bit more detail as to what to do if this were to happen again," said de Luis. "The procedures were clearly written to minimize any sort of liability."
The NTSB and BEA assert that Ethiopian Airlines didn't provide hands-on training to its pilots to execute Boeing's instructions.
Guzzetti agreed Boeing did not effectively communicate to airlines the danger posed by the MCAS system and that its bulletin should have been "much more clear and transparent and had a higher sense of urgency."
Still, Guzzetti said, "it's stunning to me" that Ethiopian Airlines did nothing more to make sure their crews had specific training on handling such an emergency.
Two minutes into the flight, the captain retracted the movable flaps on the wings, which is typical as a plane climbs away from an airport. This allowed MCAS to activate.
The Ethiopian report notes that Boeing's bulletin didn't mention that MCAS activates only when the flaps are retracted.
The system, initiated by that one sensor indicating — falsely — a very high angle of attack, immediately began swiveling the horizontal tail to push the jet's nose down.
The pilots strained to bring the nose up, pulling the control column back with a force between 100 and 125 pounds.
"The physical efforts applied by the crew on the column probably impacted their situational awareness and their cognitive resources and did not allow them to undertake the proper actions," the BEA concludes.
Still, with the Lion Air crash scenario surely at the forefront of their minds, the captain seems to have realized MCAS was the problem. Confused, he tried to execute Boeing's instructions, but messed up the sequence.
What the needed to do was to fly manually, use the electric thumb switches to pull the nose up again, and then hit two switches to cut power to the horizontal tail and stop the automatic nose down commands.
Theoretically, the pilots could then make further nose-up adjustments manually via a mechanical wheel in the cockpit.
But after the first MCAS activation pushed ET302's nose down, the captain barely flicked the thumb switches, not enough to pull it completely up again.
Perhaps panicking, he cut power to the horizontal tail prematurely, with the plane still in a nose-down posture.
Critically, the jet's speed was then so high that the air pressure jammed the horizontal tail surfaces, rendering them immovable. The pilots couldn't budge the manual wheel to bring the nose back up.
"The excessive speed basically precluded any recovery," said former NTSB member Lauber. "They were doomed from that point on."
Contrary to Boeing's instructions, perhaps in despair at their inability to move the horizontal tail manually, the pilots then turned the electric power to the tail back on, which only brought MCAS back to life.
MCAS pushed nose-down one more time. The pilots lost control and ET302 plowed deeply into the earth.
Why did the sensor fail?
What caused that initial sensor failure that started this awful sequence of events? The French and U.S. agencies differ with the Ethiopian authority, which suggested some quality problem.
The NTSB states flatly that there is zero evidence of that. Instead, the flight data analysis indicates the sensor did not fail internally. The BEA states that the "only possible scenario" was impact by an external object, almost certainly a bird strike that sheared off the sensor.
The NTSB pointedly notes an incident just over three months before the Max crash, when an eagle took out the engine of a Boeing 767 taking off from the Addis Ababa airport.
A later report by the same Ethiopian safety agency stated that eagles are common in the area and recommended "practical measures to minimize/eliminate bird hazards around the airport."
The Ethiopian investigators did not search for bird remains on the taxiway underneath where the sudden failure occurred, the NTSB stated.
Guzzetti said that although the NTSB, a U.S. government agency, is "somewhat compelled to at least look at the views of a U.S. manufacturer [in this case, Boeing] and consider possible mitigating factors," its conclusions are driven by facts and analysis.
In contrast, he described the Ethiopian report as a calculated effort to put out "a whitewashed version of this accident."
As part of a settlement in a civil lawsuit brought on behalf of the Ethiopian Airlines crash victims, Boeing in 2021 declared that it alone was liable for the ET302 accident and that neither the pilots nor the airline were at fault.
The NTSB and BEA additions to the final report on the ET302 crash reveal that as a legal fiction to arrive at a settlement.
Yet de Luis regrets how the competing accounts of the accident "elevate these secondary causes to the same level as the primary cause of this accident, which was Boeing's design of the MCAS system."
"It's upsetting," he said.
Boeing declined to comment on the crash investigation reports.
The Federal Aviation Administration on Thursday appointed de Luis to serve on a panel mandated by Congress that over the next nine months will review Boeing's safety practices.
