Boeing 737-800 MAX, il Final Report KNKT del volo Lion Air 610
Dopo 12 mesi dall'incidente l'analisi: in 322 pagine!
Il Final Report pubblicato dal Komite Nasional Keselamatan Transportasi (KNKT) Indonesiano evidenzia la serie dei riscontri che hanno determinato preceduto il crash in mare subito dopo il decollo del Lion Air, volo 610, del Boeing 737 MAX 8. Il volo decollato dal Jakarta-Soekarno-Hatta International Airport, Indonesia, con 189 occupanti e quello storico incidente sarebbe correlato al malfunzionamneto dell'aletta identificata nello SPEED TRIM FAIL e nell'illuminazione del segnale MACH TRIM FAIL.
Il Final Report in premessa sostiene:
“This Final Report is published by the Komite Nasional Keselamatan Transportasi (KNKT), Transportation Building, 3 rd Floor, Jalan Medan Merdeka Timur No. 5 Jakarta 10110, Indonesia. The report is based upon the investigation carried out by the KNKT in accordance with Annex 13 to the Convention on International Civil Aviation, the Indonesian Aviation Act (UU No. 1/2009) and Government Regulation (PP No. 62/2013). Readers are advised that the KNKT investigates for the sole purpose of enhancing aviation safety. Consequently, the KNKT reports are confined to matters of safety significance and may be misleading if used for any other purpose. As the KNKT believes that safety information is of greatest value if it is passed on for the use of others, readers are encouraged to copy or reprint for further distribution, acknowledging the KNKT as the source.”
Nelle conclusioni, dopo aver rilevato i seguenti 89 riscontri – Findings:
Findings are statements of all significant conditions, events or circumstances in the
accident sequence. The findings are significant steps in the accident sequence, but
they are not always causal, or indicate deficiencies. Some findings point out the
conditions that pre-existed the accident sequence, but they are usually essential to
the understanding of the occurrence, usually in chronological order.
The KNKT identified findings as follows:
1. MCAS is designed to function only during manual flight (autopilot not
engaged), with the aircraft’s flaps up, at an elevated AOA. As the
development of the 737-8 (MAX) progressed, the MCAS function was
expanded to low Mach numbers and increased to maximum MCAS command
limit of 2.5 of stabilizer movement.
2. During the Functional Hazard Analysis (FHA), unintended MCAScommanded stabilizer movement was considered a failure condition with
Major effect in the normal flight envelope. The assessment of Major did not
require Boeing to more rigorously analyze the failure condition in the safety
analysis using Failure Modes and Effects Analysis (FMEA) and Fault Tree
Analysis (FTA), as these are only required for Hazardous or Catastrophic
failure conditions.
3. Uncommanded MCAS function was considered Major during the FHA.
Boeing reasoned that such a failure could be countered by using elevator
alone. In addition, stabilizer trim is available to offload column forces, and
stabilizer cutout is also available but not required to counter failure.
4. FMEA would have been able to identify single-point and latent failures which
have significant effects as in the case of MCAS design. It also provides
significant insight into means for detecting identified failures, flight crew
impact on resolution of failure effect, maintenance impact on isolation of
failure and corresponding restitution of system.
5. Boeing conducted the FHA assessment based on the FAA guidance and was
also based on an assumption that the flight crew was highly reliable to
respond correctly and in time within 3 seconds. The assessment was that each
MCAS input could be controlled with control column alone and subsequently
re-trimmed to zero column force while maintaining flight path.
6. The flight crew did not react to MCAS activation but to the increasing force
on the control column. Since the flight crew initially countered the MCAS
command using control column, the longer response time for making electric
stabilizer trim inputs was understandable.
7. During the accident and previous LNI043 flights, the flight crew initially
responded by pulling back on the control column, however, they did not
consistently trim out the resulting column forces as had been assumed. As a
result the Boeing assumption was different from the flight crew behavior in
responding to MCAS activation.
8. During FHA, the simulator test had never considered a scenario in which the
MCAS activation allowed the stabilizer movement to reach the maximum
MCAS limit of 2.5 degrees. Repetitive MCAS activations without adequate
trim reaction by the flight crew would make the stabilizer move to maximum
deflection and escalate the flight crew workload and hence failure effects
should have been reconsidered. Therefore, their combined flight deck effects
were not evaluated.
9. In the event of multiple MCAS activations with repeated electric trim inputs
by flight crew without sufficient response to return the aircraft to a trimmed
state, the control column force to maintain level flight could eventually
increase to a level where control forces alone may not be adequate to control
the aircraft. The cumulative mis-trim could not be countered by using
elevator alone which is contrary to the Boeing assumption during FHA.
10. Any out of trim condition which is not properly corrected would lead the
flight crew into a situation that makes it more difficult for them to maintain
desired attitude of the aircraft. The flight crews in both the accident flight and
the previous flight had difficulty maintaining flight path during multiple
MCAS activations.
11. The procedure of runaway stabilizer was not reintroduced during transition
training and there was no immediate indication available to the flight crew to
be able to directly correlate the uncommanded nose down stabilizer to the
procedure. Therefore, the assumption of relying on trained crew procedures to
implement memory items was inappropriate
12. During the accident flight, multiple alerts and indications occurred which
increased flight crew’s workload. This obscured the problem and the flight
crew could not arrive at a solution during the initial or subsequent automatic
aircraft nose down stabilizer trim inputs, such as performing the runaway
stabilizer procedure or continuing to use electric trim to reduce column forces
and maintain level flight.
13. In the event of MCAS activation with manual electric trim inputs by the flight
crew, the MCAS function will reset which can lead to subsequent MCAS
activations. To recover, the flight crew has 3 options to respond, if one of
these 3 responses is not used, it may result in a miss-trimmed condition that
cannot be controlled.
14. The flight crew of LNI043 eventually observed and recognized the uncommanded stabilizer movement and moved the stabilizer trim cutout
switches to the cutout position. Stopping the stabilizer movement enabled the
flight crew to continue the flight using manual trim wheel to control stabilizer
position. On that flight, stabilizer cutout was used to counter the repetitive
MCAS-commanded stabilizer. Boeing reasoning that the stabilizer cutout is
available but not required is incorrect.
15. Boeing considered that the loss of one AOA and erroneous AOA as two
independent events with distinct probabilities. The combined failure event
probability was assessed as beyond extremely improbable, hence complying
with the safety requirements for the Air Data System. However, the design of
MCAS relying on input from a single AOA sensor, made this Flight Control
System susceptible to a single failure of AOA malfunction.
16. During the single and multiple failure analysis from the air data system worst
case scenario of “failure of one AOA followed by erroneous AOA”, Boeing
concluded that the effect would be hazardous until the flight crew recognized
the problem and took appropriate action to mitigate it. Since the training or
the guidance for actions taken in such situation were not provided, the effect
category should have remained hazardous.
17. Since the FCC controlling the MCAS is dependent on a single AOA source,
the MCAS contribution to cumulative AOA effects should have been
assessed.
18. The MCAS software uses input from a single AOA sensor only. Certain
failures or anomalies of the AOA sensor corresponding to the master FCC
controlling STS can generate an unintended activation of MCAS. Anticipated
flight crew response including aircraft nose up (ANU) electric trim
commands (which reset MCAS) may cause the flight crew difficultly in
controlling the aircraft.
19. The MCAS architecture with redundant AOA inputs for MCAS could have
been considered but was not required based on the FHA classification of
Major.
20. If the probability of an undesirable failure condition is not below the
maximum allowable probability for that category of hazard, redesign of the
system should be considered. If the uncommanded MCAS failure condition
had been assessed as more severe than Major, the decision to rely on single
AOA sensor should have been avoided.
21. The DFDR data indicated that during the last phase of the flight, the aircraft
descended and could not be controlled. Column forces exceeded 100 pounds,
which is more than the 75-pound limit set by the regulation (14 CFR 25.143).
22. Pulling back on the column normally interrupts any electric stabilizer aircraft
nose-down command, but for the 737-8 (MAX) with MCAS operating, that
control column cutout function is disabled.
23. During the accident flight erroneous inputs, as a result of the misaligned
resolvers, from the AOA sensor resulted in several fault messages (IAS
DISAGREE, ALT DISAGREE on the PFDs, and Feel Differential Pressure
light) and activation of MCAS that affected the flight crew’s understanding
and awareness of the situation.
24. The stick shaker activated continuously after lift-off and the noise could have
interfered with the flight crew hearing the sound of the stabilizer trim wheel
spinning during MCAS operations. Therefore, the movement of stabilizer
wheel might not have been recognized by the flight crew.
25. The aircraft design should provide the flight crew with information and alerts
to help them understand the system and know how to resolve potential issues.
26. Boeing did not submit the required documentation and the FAA did not
sufficiently oversee Boeing ODA. Without documenting the updated analysis
in the stabilizer SSA document, the FAA flight control systems specialists
may not have been aware of the design change.
27. Boeing considered that MCAS function is automatic, the procedure required
to respond to any MCAS function was no different than the existing
procedures and that crews were not expected to encounter MCAS in normal
operation therefor Boeing did not consider the failure scenario seen on the
accident flight. The investigation believes that the effect of erroneous MCAS
function was startling to the flight crews.
28. The investigation believes that flight crew should have been made aware of
MCAS which would have provided them with awareness of the system and
increase their chances of being able to mitigate the consequences of multiple
activations in the accident scenario.
29. Without understanding of MCAS and reactivation after release the electric
trim, the flight crew was running out of time to find a solution before the
repetitive MCAS activations without fully retrimming the aircraft placed the
aircraft into in an extreme nose-down attitude that the flight crew was unable
to recover from.
30. Flight crew training would have supported the recognition of abnormal
situations and appropriate flight crew action. Boeing did not provide
information and additional training requirements for the 737-8 (MAX) since
the condition was considered similar to previous 737 models.
31. The aircraft should have included the intended AOA DISAGREE alert
message functionally, which was installed on 737 NG aircraft. Boeing and the
FAA should ensure that new and changed aircraft design are properly
described, analyzed, and certified.
32. The absence of an AOA Disagree message made it more difficult for the
flight crew to diagnose the failure and for maintenance to diagnose and
correct the failure.
33. For the safety assessment of aircraft systems, the 14 FAR 25.1309 set the
requirements for the design and installation of systems which include analysis
of effects and probabilities of single, multiple and combined failures of
systems. It assumed that flight crew would correctly respond to flight
conditions in case of such failures. Human error is not included in the
probability analysis, even though the flight crew is often used as a means to
mitigate a failure condition.
34. When performing safety assessments to comply with 14 FAR 25.1309,
Boeing followed the procedures set in FAA AC 25.1309-1A and the SAE
ARP 4761 as the acceptable means of compliance. When doing the analysis,
Boeing assumed that the flight crew are completely reliable and would
respond correctly and appropriately to the situations in time. During the
accident and previous LNI043 flights, some of these assumptions were
incorrect, since the flight crew responded differently from what was expected.
35. 14 FAR 25.671 (c) requires that probable malfunctions of the flight control
system must be capable of being readily counteracted by the flight crew. This
necessitates that normal flight crew should be able to readily identify
problems and respond quickly to mitigate them. However, during the accident
flight multiple alerts and indications concealed the actual problem and made
it difficult for the flight crew to understand and mitigate it.
36. The Flight Standardization Board (FSB) process for the Boeing 737-8 (MAX)
utilized airline line pilots to help ensure the requirements are operationally
representative. The FAA and OEMs should re-evaluate their assumptions for
what constitutes an average flight crew’s basic skill and what level of systems
knowledge a ‘properly trained average pilot’ has when encountering failures.
37. In the accident flight, the system malfunction led to a series of aircraft and
flight crew interactions which the flight crew did not understand or know how
to resolve. It is the flight crew response assumptions in the initial design
process which, coupled with the repetitive MCAS activations, turned out to
be incorrect and inconsistent with the FHA classification of Major.
38. The first problem reported on PK-LQP aircraft of SPD and ALT flags
appeared on Captain’s PFD occurred on 26 October 2018 during the flight
from Tianjin to Manado and reappeared 3 times within 5 flight sectors.
209
39. The SPD and ALT flag did not occur on the flight from Denpasar to Lombok
and return. This was consistent with the result of AOA sensor examination
which indicated that the resolver 2 became unreliable during cold
temperature.
40. The engineer in Manado suggested to the flight crew to continue the flight as
problem rectification would be better to be performed in Denpasar and
considering that the SPD and ALT flags had no longer appeared on the
Captain’s PFD. This indicated that the aircraft was released with known
possible recurring problem.
41. On the flight from Manado to Denpasar on 28 October 2018, the DFDR
recorded the A/T disengaged on takeoff roll and the SPD and ALT flags on
the captain’s PFD most likely had appeared after the engine start. The
altimeter and speed indicator are airworthiness related instruments and must
be serviceable for dispatch. The decision to continue the flight was contrary
to the company procedure.
42. The engineer in Denpasar considered that the problem had appeared
repeatedly and decided to replace the left AOA sensor. Replacement of AOA
sensor proved to be the solution to rectify the SPD and ALT flags that were
reported to have appeared on the Captain’s PFD, however the installed AOA
sensor was misaligned by about 21° and resulted in different problems.
43. The Boeing test result indicated that a misaligned AOA sensor would not pass
the installation test as the AOA values shown on the SMYD computer were
out of tolerance and “AOA SENSR INVALID” message appeared in the
SMYD BITE module. This test and subsequent testing verified that the
alternate method of the installation test could identify a 20 or 21° bias in the
AOA sensor.
44. Comparing the results of the installation test in Denpasar and Boeing, the
investigation could not determine that the AOA sensor installation test
conducted in Denpasar with any certainty.
45. The BAT LMPM required the engineer to record the test values to ensure that
the test results were within tolerance. The engineer did not record the value of
the AOA angle deflection during the AOA sensor installation test. Therefore,
neither BAT nor Lion Air identified that the documentation had not been
filled out.
46. After LNI043 was airborne, the left control column stick shaker was active
and several messages appeared. The Captain of LNI043 was aware to the
aircraft condition after discussion with the engineer in Denpasar. This
awareness helped the Captain to make proper problem identification.
47. The Captain action of transferring the control prior to crosscheck of the
instruments may have indicated that the Captain generally was aware of the
repetitive previous problem of SPD and ALT flags and the replacement of the
left AOA sensor on this aircraft.
48. The LNI043 flight crew performed NNC of Runaway Stabilizer Trim by
selecting the STAB TRIM switches to cut-out, which resulted in termination
of AND activations by MCAS, and the aircraft became under control with
consequences of inability to engage the autopilot, and requirement for manual
operation of stabilizer trim by hand.
49. The Captain’s decision to continue to the destination was based on the fact
that a requirement to “land-at-the-nearest-suitable-airport” in the three NonNormal-Checklists was absent.
50. The Captain of LNI043 felt confident to continue the flight to the destination
because the aircraft was controllable and the expected weather along the route
and at the destination was good.
51. The LNI043 flight crew decision to continue with stick shaker active is not
common in comparison to previous events of erroneous stick shaker. When
combined with the runaway stabilizer situation recognized by the flight crew,
the decision to continue was highly unusual.
52. During the descent to destination they requested uninterrupted descent path
profile. This action suggested that the flight crew were aware of their existing
flight condition (continuous stick shaker, manual flying, manual trimming,
FO PFD was the primary instrument) required a simplified flight path
management until approach and landing.
53. During flight, the Captain of LNI043 kept the fasten seat belt sign on and
asked the deadheading flight crew to assist the cockpit tasks. These actions
indicated that the Captain was aware of the need to use all available resources
to alleviate the matter to complete the flight to the destination, despite the
increased workload and stressful situation.
54. The AFML entry for LNI043, which did not contain additional details about
what was experienced, was not in accordance with company guidance
provided in OM-Part A, Section 11.4.9 which lists reportable events to
include “Warning or alert, including flight control warnings, door warnings,
stall warning (stick-shaker), fire/smoke/fumes warning.”
55. The SS Directorate did not notice the occurrence since the report was filed
outside normal office hours and the report to SS Directorate was not
processed until the office hours on the following day.
56. The insufficient SMS training and inability of the employees to identify the
hazard might also be indicated by the incomplete post-flight report of the
problems that occurred on LNI043. The incomplete report became a hazard as
the known or suspected defects were not reported which might make the
engineer unable to properly maintain the airworthiness of the aircraft.
57. Content of the report did not trigger the Duty Management Pilot to assess this
as a Serious Incident and enable a safety investigation. The risk of the
problems that occurred on the flight LNI043 were not assessed to be
considered as a hazard on the subsequent flight.
58. The LNI043 flight that experienced multiple malfunctions were considered
caused or could have caused difficulties in controlling the aircraft. According
to the ICAO Annex 13, CASR part 830 and OM-part A, the flight is classified
as serious incident which required investigation by the KNKT in accordance
with the Aviation Law Number 1 of 2009 and Government Decree Number
62 of 2013.
59. The definition of an aircraft repetitive problem was different between Lion
Air CMM and BAT AMOQSM. This difference indicated that the Lion Air
did not monitor the repetitive problem policy of the BAT as a subcontracted
entity.
60. The requirement to report all known and suspected defects is very critical for
engineering to be able to maintain the airworthiness of the aircraft.
61. The fault code was not documented in the AFML. The engineer did not
record the maintenance message that appeared in the OMF in the AFML.
Being unaware of the maintenance message and the fault code, this would
increase the difficulty for trouble shooting by the engineer.
62. The IFIM tasks of “ALT DISAGREE” and “IAS DISAGREE” have
repetition on the leak test in steps (3) and (4) as they are referring to the same
AMM tasks. This repetition was inefficiency and does not contribute to the
problem solving.
63. The inhibited AOA DISAGREE message contributed to the inability of the
engineer to rectify the problems that occurred on the LNI043 flight which
were caused by AOA sensor bias.
64. The lack of an AOA DISAGREE message did not match the Boeing system
description that was the basis for certifying the aircraft design. The software
not having the intended functionality was not detected by Boeing nor the
FAA during development and certification of the 737-8 MAX before the
aircraft had entered service.
65. During the LNI610 flight preparation, the CVR did not record flight crew
discussion about previous aircraft problems recorded in the AFML. This
might have made the flight crew of LNI610 would not be aware of aircraft
problems that might reappear during flight, including the stick shaker
activation and uncommanded AND trim. This would lead to the inability of
the flight crew to predict and be prepared to mitigate the events that might
occur.
66. Just after liftoff, the left stick shaker activated and numerous messages on the
PFD were displayed, repetitive MCAS activation after the flaps were
retracted and the ATCo communication increased the flight crew workload.
67. The FO asked the controller of the aircraft altitude and the indicated speed on
the ATC radar display in an attempt to obtain another source of information.
However, the ATC radar receives altitude data transmitted by the aircraft
therefore, no additional data may be acquired. Being unable to determine
reliable altitude and airspeed might increase stress to the flight crew.
68. The inability for the FO to perform memory items and locate the checklist in
the QRH in a timely manner indicated that the FO was not familiar with the
NNC. This condition was reappearance of misidentifying NNC which showed
on the FO’s training records.
69. Despite the flight crew’s attempt to execute the NNC, due to increased
workload, and distractions from the ATC communication, the NNC was
unable to be completed in that situation. The unfinished NNC made it
difficult for the flight crew of LNI610 to understand the aircraft problem and
how to mitigate the problem.
70. The reappearance of difficulty in aircraft handling identified during training
in the accident flight indicated that the Lion Air training rehearsal was not
effective.
71. The controller provided eight heading instructions after the flight crew
reported that the aircraft was experiencing a flight control problem, which
was not considered as an emergency condition according to ATS SOP of
AirNav Indonesia branch JATSC. There was also no objection by the flight
crew to the heading instructions and the flight crew did not declare an
emergency. These conditions increased the flight crew workload.
72. The absence of a declaration of urgency (PAN PAN) or emergency
(MAYDAY), or asking for special handling, resulted in the ATCo not
prioritizing that flight. With priority, ATC would not require LNI610 to
maneuver repeatedly.
73. The AOA DISAGREE message was inhibited on the accident aircraft
therefore, flight crews would not be aware that this message would not appear
if the AOA DISAGREE conditions were met. This would contribute to flight
crew being denied valid information about abnormal conditions being faced
and lead to a significant reduction in situational awareness by the flight crew.
74. No information about MCAS was given in the flight crew manuals and
MCAS was not included in the flight crew training. These made the flight
crew unaware of the MCAS system and its effects. There were no procedures
for mitigation in response to erroneous AOA.
75. Both flight crew of LNI610 being preoccupied with individual tasks indicated
that the crew coordination was not well performed. The Captain and FO did
not have a shared mental model of the situation as exhibited by their lack of
clear and effective communication. Most of the components of effective crew
coordination were not achieved, resulting in failure to achieve the common
goal of flying the aircraft safely.
76. During the multiple MCAS activations, the Captain managed to control the
aircraft altitude. The Captain did not verbalize to the FO the difficulty in
controlling the aircraft and the need for repeated aircraft nose up trim. The
FO was preoccupied with completing the NNC and not monitoring the flight
progress. Subsequently, the FO did not provide adequate electric trim to
counter multiple MCAS activations.
77. The requirement to describe specific handling situation to the flight crew
receiving the control was not required per Lion Air procedure or Indonesia
requirement. The absence of Captain’s specific description contributed to the
FO’s difficulty to understand the situation and may have contributed to his
inability to mitigate the problem.
78. The content of the manual of Lion Air and BAT contain several
inconsistencies, incompleteness, and unsynchronized procedures.
79. The investigation found that the engineers were prone to entering the problem
symptom reported by the flight crew in the IFIM first instead of reviewing the
OMF maintenance message. Conducting this method might lead the engineers
into the inappropriate rectification task.
80. The investigation found that all AFML pages received by the investigation
did not contain fault codes. The absence of the fault code reported by the
flight crew may increase the workload of the engineer and prolong the
rectification process.
81. The investigation considered that the amount of time to cover the hazard
identification topic in the SMS training syllabus was insufficient. This may
reduce the ability of employees to define and report a hazard.
82. A subsequent comparison of the accuracy specifications found that the Peak
SRI-201B API accuracy met the requirement stated on the CMM revision 8.
The investigation did not find a written instruction to operate the Peak
Electronics SRI-201B API.
83. Despite the lack of API specific written instructions for the alternate
equipment, Xtra Aerospace nevertheless obtained acceptance of their API
equipment equivalency report from the FAA FSDO. The lack of an API
written procedure was not detected by the FAA’s FSDO. This indicates
inadequacy of FAA oversight.
84. The Xtra Aerospace visit concluded that performing the required testing and
calibration defined in CMM Revision 8 using the Peak API could potentially
introduce a bias into both resolvers if the REL/ABS (Relative/Absolute)
switch on the Peak Electronics API was inadvertently positioned to REL.
85. The OMF has the history page which contains record of the aircraft problems
which can be utilized as a source for aircraft problem monitoring. The BAT
has not utilized the OMF information as the source of aircraft problem
monitoring.
86. On the subsequent flight, a 21 difference between left and right AOA sensors
was recorded on the DFDR, commencing shortly after the takeoff roll was
initiated. This immediate 21 delta indicated that the AOA sensor was most
likely improperly calibrated at Xtra Aerospace.
87. As noted, utilization of the Peak Model SRI-201B API by Xtra Aerospace for
the test and calibration of the 0861FL1 AOA sensor should have required a
written procedure to specify the proper position of the REL/ABS switch.
88. The aircraft was equipped with an airframe-mounted low frequency
underwater locator beacon (ULB) which operated at a frequency of 8.8 kHz.
The beacon was mounted on the forward side of the nose pressure bulkhead.
During the search phase, multiple surveys were conducted to detect a signal at
8.8 kHz, however no such signals were detected in the area where wreckage
was recovered.
89. On 10 March 2019, an accident related to failure of an AOA sensor occurred
involving a Boeing 737-8 (MAX) registered ET-AVJ operated by Ethiopian
Airlines for scheduled passenger flight from Addis Ababa Bole International
Airport (HAAB), Ethiopia to Jomo Kenyatta International Airport (HKJK),
Kenya with flight number ET-302.
Ha riportato i seguenti “fattori rilevanti - Contributing Factors” che hanno determinato l'incidente:
“Contributing factors defines as actions, omissions, events, conditions, or a
combination thereof, which, if eliminated, avoided or absent, would have reduced
the probability of the accident or incident occurring, or mitigated the severity of the
consequences of the accident or incident. The presentation is based on
chronological order and not to show the degree of contribution.
1. During the design and certification of the Boeing 737-8 (MAX),
assumptions were made about flight crew response to malfunctions which,
even though consistent with current industry guidelines, turned out to be
incorrect.
2. Based on the incorrect assumptions about flight crew response and an
incomplete review of associated multiple flight deck effects, MCAS’s
reliance on a single sensor was deemed appropriate and met all certification
requirements.
3. MCAS was designed to rely on a single AOA sensor, making it vulnerable
to erroneous input from that sensor.
4. The absence of guidance on MCAS or more detailed use of trim in the flight
manuals and in flight crew training, made it more difficult for flight crews to
properly respond to uncommanded MCAS.
5. The AOA DISAGREE alert was not correctly enabled during Boeing 737-8
(MAX) development. As a result, it did not appear during flight with the
mis-calibrated AOA sensor, could not be documented by the flight crew and
was therefore not available to help maintenance identify the mis-calibrated
AOA sensor.
6. The replacement AOA sensor that was installed on the accident aircraft had
been mis-calibrated during an earlier repair. This mis-calibration was not
detected during the repair.
7. The investigation could not determine that the installation test of the AOA
sensor was performed properly. The mis-calibration was not detected.
8. Lack of documentation in the aircraft flight and maintenance log about the
continuous stick shaker and use of the Runaway Stabilizer NNC meant that
information was not available to the maintenance crew in Jakarta nor was it
available to the accident crew, making it more difficult for each to take the
appropriate actions.
9. The multiple alerts, repetitive MCAS activations, and distractions related to
numerous ATC communications were not able to be effectively managed.
This was caused by the difficulty of the situation and performance in manual
handling, NNC execution, and flight crew communication, leading to
ineffective CRM application and workload management. These
performances had previously been identified during training and reappeared
during the accident flight.