Ethiopian Airlines Flight 302 — MCAS Again, Five Months Later

The Event

• Following Lion Air 610, Boeing issues an Emergency Airworthiness Directive and a Flight Crew Bulletin describing MCAS and the runaway trim procedure
• The 737 MAX continues to fly worldwide — no grounding is ordered by the FAA or major aviation authorities
• 10 March 2019: ET 302 departs Addis Ababa for Nairobi
• Apparent AoA sensor damage shortly after takeoff activates MCAS
• The crew apply the runaway stabiliser trim cutout procedure — as trained following Lion Air
• At the high airspeed reached by ET 302, manual trim is physically impossible after electric trim cutout
• The crew briefly re-engage electric trim to relieve the aerodynamic load — MCAS reactivates
• The stabiliser is driven to the full nose-down limit; the aircraft is unrecoverable
• The aircraft impacts at approximately 700 knots, 6 minutes after departure
• All 157 die; the crash site is a crater; nothing is recoverable

Following ET 302, global aviation authorities grounded the 737 MAX fleet within days — with the FAA, under significant political pressure, being among the last to act. The grounding lasted 20 months.

Systems Engineering Perspective

From a systems engineering perspective, Ethiopian 302 exposes the gap between identifying a failure mode and adequately mitigating it during the interim period before a permanent fix is available. The training bulletin issued after Lion Air 610 described the correct procedure for MCAS malfunction. It did not describe the aerodynamic limitation that made that procedure physically impossible at high airspeed.

An interim mitigation that does not address all aspects of the failure mode it is intended to mitigate is not adequate mitigation. It is the illusion of risk reduction.

The Interim Mitigation Gap — Procedure Without Physical Feasibility

The runaway stabiliser trim cutout procedure, taught as the response to MCAS malfunction after Lion Air 610, is correct in principle. After cutout, manual trim via the mechanical trim wheel provides stabiliser control without the autotrim system. This works when the aerodynamic forces on the stabiliser are manageable.

At the airspeeds reached by ET 302 — speeds that resulted from the crew following the emergency descent implicit in their failure management — the aerodynamic hinge moment on the horizontal stabiliser made the mechanical trim wheel physically unmoveable by hand. The procedure was correct. The physical scenario made it inapplicable.

Boeing and the FAA had not assessed this limitation when distributing the interim mitigation. The crew of ET 302 followed their training exactly. Their training did not cover the physical limits of the procedure.

An emergency procedure that cannot be physically executed in the specific scenario it is designed to address is not a procedure — it is a false safety instruction.

Continued Operations With a Known Lethal Failure Mode

Between Lion Air 610 (29 October 2018) and Ethiopian 302 (10 March 2019), 135 days passed. During those 135 days, thousands of 737 MAX flights operated worldwide. The MCAS failure mode was known. The single-sensor design was unchanged. The fix was under development. Crews had been given a training bulletin.

The 157 people on ET 302 were flying on an aircraft with a known, unrepaired, lethal failure mode, covered by an interim mitigation that was insufficient for the scenario it encountered.

Human Factors Perspective

The human factors dimension of Ethiopian 302 is primarily an organisational and regulatory decision-making case study. The crew performed correctly. The systems engineering failure and the regulatory decision not to ground the aircraft are the human factors that determined the outcome.

The Grounding Decision — Regulatory Risk Assessment

The decision of when to ground an aircraft with a known safety-critical defect requires a risk assessment that balances the probability and consequence of an in-service failure against the operational disruption and economic cost of grounding. Between Lion Air 610 and Ethiopian 302, that balance was assessed differently by different regulators.

Ethiopian 302 demonstrated that the assessed probability was too low and the available mitigation was insufficient. The grounding that followed proved the operational disruption was manageable. The cost-benefit assessment that left the aircraft flying for 135 days after its known fatal failure mode was demonstrated was wrong.

A risk assessment that continues operations with a known lethal failure mode on the basis of an interim mitigation must verify that the mitigation is adequate for the full scope of the failure mode. The ET 302 investigation showed it was not.

Crew Performance Under Unsurvivable Conditions

The ET 302 crew followed their training. Their training did not prepare them for the physical impossibility of manual trim at high airspeed. They made rational decisions with the information available to them. The system had given them an incomplete picture of the failure mode they were facing.

System Interaction Breakdown

1. Procedure Physically Impossible at High Airspeed

The trained procedure was physically impossible at the airspeed encountered. The training had not communicated this limitation.

2. Known Defect, Continuing Operations

135 days of global operations with a known lethal failure mode, mitigated by an insufficient training bulletin.

3. Global Grounding — 20 Months Late

The grounding that eventually occurred for 20 months demonstrated that the operational system could absorb the disruption of grounding the MAX fleet. That it did not happen between Lion Air and Ethiopian 302 is the regulatory failure.

The grounding of the 737 MAX after Ethiopian 302 was the correct decision. The question aviation asks is why it was not the correct decision after Lion Air 610.

Significance in Aviation Risk

1. Aircraft With Known Lethal Defects Require Grounding

Ethiopian 302 established — at the cost of 157 more lives — the principle that an aircraft with a known, unmitigated, lethal failure mode must be grounded until the failure mode is resolved, regardless of operational and commercial cost.

2. Interim Mitigations Must Cover All Failure Scenarios

Any interim mitigation issued for a known failure mode must be validated against all operationally-plausible failure scenarios — including scenarios where the standard procedure is physically impossible.

Related Aviation Risk Lab Content

Pillar Pages

Design and Certification: Design And Certification

Systems Engineering: Systems Engineering

Safety Engineering: Safety Engineering

Related Case Studies

Case Study 25: Lion Air 610 — MCAS and the Single Point of Failure: Lion Air 610

Case Study 5: American Airlines 96 — The Door That Nearly Did It First: AA 96 1972

Case Study 4: Turkish Airlines 981 — A Door That Was Never Safe: Turkish 981

Closing Perspective

Ethiopian Airlines 302 is the accident that should not have needed to happen. Its cause was known. Its failure mode was documented. Its aircraft was fixable. The only question was whether the fix would come before or after another accident.

The answer cost 157 lives. The global grounding of the 737 MAX that followed was the correct action — taken 135 days after the first accident that made it necessary.

The legacy of ET 302 is the principle that interim mitigation is not adequate risk management for a known lethal failure mode. When an aircraft kills people with a specific failure, that failure must be fixed — not managed with training bulletins — before the aircraft returns to service.

Ethiopian 302 answered the question Lion Air 610 posed: what does a known lethal failure mode in an operating fleet require? The answer is a grounding. Not a bulletin.