Automated control system caused Ethiopia crash, flight data suggests
- Written by Timothy Takahashi, Professor of Practice for Aerospace Engineering, Arizona State University
Emerging evidence from the recent crash in Ethiopia suggests that malfunctioning automatic control systems overwhelmed the crew and doomed the flight. Based on my analysis, it appears that the Ethiopian Airlines crew followed the standard procedures found in the Boeing 737 pilots operating handbook and flight crew operations manual[1].
A typical flight starts with manual control of the plane. The pilot and co-pilot will personally steer the aircraft onto the taxiway, configure the flaps for takeoff, actively control the aircraft as it accelerates down the runway, and smoothly pull back on the control yoke to lift the plane off the ground and into flight. The flight’s altitude and speed data, transmitted from the plane in real time[2] and made available to the public by FlightRadar24.com, shows that happened normally as Ethiopian Airlines Flight 302 left the runway.
Everything appears to have gone as usual on the initial climb away from the takeoff, too. Normally, the pilot will retract the landing gear and maintain a relatively steady speed as the aircraft climbs. The plane might accelerate slightly until it’s going fast enough that the flaps – extended to increase lift at lower speeds – can be safely retracted, letting the wings themselves generate the necessary lift. This process usually takes place in the first minute after takeoff. Once the aircraft has climbed to 1,000 feet above the ground, the pilot will engage the autopilot system.
That’s the point at which the computer takes over – and where, my analysis of the data suggests, things went wrong for Ethiopian Airlines Flight 302. A modern autopilot system gives the computer command of the engine throttles, rudder, elevators and ailerons – basically full control over the aircraft.
Simulating the expected flight
Using modeling tools developed by my research team[3], I recreated a hypothetical flight profile to simulate the Ethiopian Airlines 737 departure based on the handbook procedure for an identical plane carrying a similar amount of weight. The simulation timing, key speeds and altitudes all follow my best estimate of the procedure that a trained pilot would be expected to follow.
Comparing this data to the actual flight data, I was able to see where the ideal predicted performance differs from the actual motions of the lost flight. My simulation closely matches the actual speeds of the aircraft on its takeoff roll, and recreates its first few miles of airborne flight. The pilot let the aircraft accelerate gently during initial climb, which isn’t specifically called for or prohibited in the official manual.
The flight paths between a typical flight and the actual course sharply diverge only after the aircraft reached an altitude of 1,000 feet above the runway.
Immediately after flap retraction, the pilot should have engaged the autopilot, leaving the computer to command a climb at constant airspeed. Instead, the ill-fated flight began to dive and accelerate, losing altitude and gaining speed until it struck the ground a few miles away from the airport.
There are several possible reasons a plane could crash like this. One is that an engine could malfunction. But the telemetry data doesn’t indicate the loss of acceleration that an engine failure would cause. Another reason could be that some part of the fuselage, wings or tail broke or collapsed. The data doesn’t show the sort of change in speed or climb rate that would result from such a loss of stability.
The crash does not appear to be due to pilot error, either. I’ve studied pilot overreactions during developing emergencies[4], and see no evidence of that before the initial dive; the pilots seem to fly an otherwise typical takeoff. If there was some other mechanical failure, the pilots didn’t report it[5] to the control tower. There is no indication that they overreacted or overcompensated to some emergency: The radar track shows no evidence of a condition called “wallowing,” characterized by periodic fluctuations in speed and altitude, nor any accidental stall, where airspeed drops sharply before the plane loses altitude.
Key parts of an aircraft.
Dtom/Wikimedia Commons[6]
Therefore, it appears that the various automatic control systems conspired to prevent the pilots from asserting direct control over the ailerons[7], elevators[8] and rudder[9] that keep the aircraft aloft and on course.
How long on the ground?
More than 300[10] Boeing 737 Max aircraft have been flying since 2017[11], with thousands of safe takeoffs and landings. That suggests the problem for Ethiopian Airlines – and possibly the 2018 Lion Air crash[12] too – is one of the difficult sort of engineering troubles that happen intermittently, or even seemingly randomly, in very complex systems.
Boeing has already said it will update the aircraft’s software[13]. Any fixes will have to be checked not only to ensure that they handle whatever the exact problem is that’s identified by crash investigators, but also to make sure they don’t cause other unexpected errors. That will take its own amount of time. In the meantime, all the Boeing 737 Max aircraft in the world are on the ground, waiting.
References
- ^ Boeing 737 pilots operating handbook and flight crew operations manual (www.b737.org.uk)
- ^ transmitted from the plane in real time (www.flightradar24.com)
- ^ modeling tools developed by my research team (doi.org)
- ^ pilot overreactions during developing emergencies (doi.org)
- ^ pilots didn’t report it (www.nytimes.com)
- ^ Dtom/Wikimedia Commons (commons.wikimedia.org)
- ^ ailerons (www.grc.nasa.gov)
- ^ elevators (www.grc.nasa.gov)
- ^ rudder (www.grc.nasa.gov)
- ^ More than 300 (web.archive.org)
- ^ flying since 2017 (www.flightglobal.com)
- ^ 2018 Lion Air crash (qz.com)
- ^ update the aircraft’s software (www.nytimes.com)
Authors: Timothy Takahashi, Professor of Practice for Aerospace Engineering, Arizona State University
