• Presentazione
• Collaborazioni/Convegni
• Archivio e Documenti AH
• Contatti

• ricordami

Boeing 737-800 MAX, il Final Report KNKT del volo Lion Air 610

Dopo 12 mesi dall'incidente l'analisi: in 322 pagine!

Il Final Report pubblicato dal Komite Nasional Keselamatan Transportasi (KNKT) Indonesiano evidenzia la serie dei riscontri che hanno determinato preceduto il crash in mare subito dopo il decollo del Lion Air, volo 610, del Boeing 737 MAX 8. Il volo decollato dal Jakarta-Soekarno-Hatta International Airport, Indonesia, con 189 occupanti e quello storico incidente sarebbe correlato al malfunzionamneto dell'aletta identificata nello SPEED TRIM FAIL e nell'illuminazione del segnale  MACH TRIM FAIL.

Il Final Report in premessa sostiene:

“This Final Report is published by the Komite Nasional Keselamatan Transportasi (KNKT), Transportation Building, 3 rd Floor, Jalan Medan Merdeka Timur No. 5 Jakarta 10110, Indonesia. The report is based upon the investigation carried out by the KNKT in accordance with Annex 13 to the Convention on International Civil Aviation, the Indonesian Aviation Act (UU No. 1/2009) and Government Regulation (PP No. 62/2013). Readers are advised that the KNKT investigates for the sole purpose of enhancing aviation safety. Consequently, the KNKT reports are confined to matters of safety significance and may be misleading if used for any other purpose. As the KNKT believes that safety information is of greatest value if it is passed on for the use of others, readers are encouraged to copy or reprint for further distribution, acknowledging the KNKT as the source.”

Nelle conclusioni, dopo aver rilevato i seguenti 89 riscontri – Findings:

Findings are statements of all significant conditions, events or circumstances in the

accident sequence. The findings are significant steps in the accident sequence, but

they are not always causal, or indicate deficiencies. Some findings point out the

conditions that pre-existed the accident sequence, but they are usually essential to

the understanding of the occurrence, usually in chronological order.

The KNKT identified findings as follows:

1. MCAS is designed to function only during manual flight (autopilot not

engaged), with the aircraft’s flaps up, at an elevated AOA. As the

development of the 737-8 (MAX) progressed, the MCAS function was

expanded to low Mach numbers and increased to maximum MCAS command

limit of 2.5 of stabilizer movement.

2. During the Functional Hazard Analysis (FHA), unintended MCAScommanded stabilizer movement was considered a failure condition with

Major effect in the normal flight envelope. The assessment of Major did not

require Boeing to more rigorously analyze the failure condition in the safety

analysis using Failure Modes and Effects Analysis (FMEA) and Fault Tree

Analysis (FTA), as these are only required for Hazardous or Catastrophic

failure conditions.

3. Uncommanded MCAS function was considered Major during the FHA.

Boeing reasoned that such a failure could be countered by using elevator

alone. In addition, stabilizer trim is available to offload column forces, and

stabilizer cutout is also available but not required to counter failure.

4. FMEA would have been able to identify single-point and latent failures which

have significant effects as in the case of MCAS design. It also provides

significant insight into means for detecting identified failures, flight crew

impact on resolution of failure effect, maintenance impact on isolation of

failure and corresponding restitution of system.

5. Boeing conducted the FHA assessment based on the FAA guidance and was

also based on an assumption that the flight crew was highly reliable to

respond correctly and in time within 3 seconds. The assessment was that each

MCAS input could be controlled with control column alone and subsequently

re-trimmed to zero column force while maintaining flight path.

6. The flight crew did not react to MCAS activation but to the increasing force

on the control column. Since the flight crew initially countered the MCAS

command using control column, the longer response time for making electric

stabilizer trim inputs was understandable.

7. During the accident and previous LNI043 flights, the flight crew initially

responded by pulling back on the control column, however, they did not

consistently trim out the resulting column forces as had been assumed. As a

result the Boeing assumption was different from the flight crew behavior in

responding to MCAS activation.

8. During FHA, the simulator test had never considered a scenario in which the

MCAS activation allowed the stabilizer movement to reach the maximum

MCAS limit of 2.5 degrees. Repetitive MCAS activations without adequate

trim reaction by the flight crew would make the stabilizer move to maximum

deflection and escalate the flight crew workload and hence failure effects

should have been reconsidered. Therefore, their combined flight deck effects

were not evaluated.

9. In the event of multiple MCAS activations with repeated electric trim inputs

by flight crew without sufficient response to return the aircraft to a trimmed

state, the control column force to maintain level flight could eventually

increase to a level where control forces alone may not be adequate to control

the aircraft. The cumulative mis-trim could not be countered by using

elevator alone which is contrary to the Boeing assumption during FHA.

10. Any out of trim condition which is not properly corrected would lead the

flight crew into a situation that makes it more difficult for them to maintain

desired attitude of the aircraft. The flight crews in both the accident flight and

the previous flight had difficulty maintaining flight path during multiple

MCAS activations.

11. The procedure of runaway stabilizer was not reintroduced during transition

training and there was no immediate indication available to the flight crew to

be able to directly correlate the uncommanded nose down stabilizer to the

procedure. Therefore, the assumption of relying on trained crew procedures to

implement memory items was inappropriate

12. During the accident flight, multiple alerts and indications occurred which

increased flight crew’s workload. This obscured the problem and the flight

crew could not arrive at a solution during the initial or subsequent automatic

aircraft nose down stabilizer trim inputs, such as performing the runaway

stabilizer procedure or continuing to use electric trim to reduce column forces

and maintain level flight.

13. In the event of MCAS activation with manual electric trim inputs by the flight

crew, the MCAS function will reset which can lead to subsequent MCAS

activations. To recover, the flight crew has 3 options to respond, if one of

these 3 responses is not used, it may result in a miss-trimmed condition that

cannot be controlled.

14. The flight crew of LNI043 eventually observed and recognized the uncommanded stabilizer movement and moved the stabilizer trim cutout

switches to the cutout position. Stopping the stabilizer movement enabled the

flight crew to continue the flight using manual trim wheel to control stabilizer

position. On that flight, stabilizer cutout was used to counter the repetitive

MCAS-commanded stabilizer. Boeing reasoning that the stabilizer cutout is

available but not required is incorrect.

15. Boeing considered that the loss of one AOA and erroneous AOA as two

independent events with distinct probabilities. The combined failure event

probability was assessed as beyond extremely improbable, hence complying

with the safety requirements for the Air Data System. However, the design of

MCAS relying on input from a single AOA sensor, made this Flight Control

System susceptible to a single failure of AOA malfunction.

16. During the single and multiple failure analysis from the air data system worst

case scenario of “failure of one AOA followed by erroneous AOA”, Boeing

concluded that the effect would be hazardous until the flight crew recognized

the problem and took appropriate action to mitigate it. Since the training or

the guidance for actions taken in such situation were not provided, the effect

category should have remained hazardous.

17. Since the FCC controlling the MCAS is dependent on a single AOA source,

the MCAS contribution to cumulative AOA effects should have been

assessed.

18. The MCAS software uses input from a single AOA sensor only. Certain

failures or anomalies of the AOA sensor corresponding to the master FCC

controlling STS can generate an unintended activation of MCAS. Anticipated

flight crew response including aircraft nose up (ANU) electric trim

commands (which reset MCAS) may cause the flight crew difficultly in

controlling the aircraft.

19. The MCAS architecture with redundant AOA inputs for MCAS could have

been considered but was not required based on the FHA classification of

Major.

20. If the probability of an undesirable failure condition is not below the

maximum allowable probability for that category of hazard, redesign of the

system should be considered. If the uncommanded MCAS failure condition

had been assessed as more severe than Major, the decision to rely on single

AOA sensor should have been avoided.

21. The DFDR data indicated that during the last phase of the flight, the aircraft

descended and could not be controlled. Column forces exceeded 100 pounds,

which is more than the 75-pound limit set by the regulation (14 CFR 25.143).

22. Pulling back on the column normally interrupts any electric stabilizer aircraft

nose-down command, but for the 737-8 (MAX) with MCAS operating, that

control column cutout function is disabled.

23. During the accident flight erroneous inputs, as a result of the misaligned

resolvers, from the AOA sensor resulted in several fault messages (IAS

DISAGREE, ALT DISAGREE on the PFDs, and Feel Differential Pressure

light) and activation of MCAS that affected the flight crew’s understanding

and awareness of the situation.

24. The stick shaker activated continuously after lift-off and the noise could have

interfered with the flight crew hearing the sound of the stabilizer trim wheel

spinning during MCAS operations. Therefore, the movement of stabilizer

wheel might not have been recognized by the flight crew.

25. The aircraft design should provide the flight crew with information and alerts

to help them understand the system and know how to resolve potential issues.

26. Boeing did not submit the required documentation and the FAA did not

sufficiently oversee Boeing ODA. Without documenting the updated analysis

in the stabilizer SSA document, the FAA flight control systems specialists

may not have been aware of the design change.

27. Boeing considered that MCAS function is automatic, the procedure required

to respond to any MCAS function was no different than the existing

procedures and that crews were not expected to encounter MCAS in normal

operation therefor Boeing did not consider the failure scenario seen on the

accident flight. The investigation believes that the effect of erroneous MCAS

function was startling to the flight crews.

28. The investigation believes that flight crew should have been made aware of

MCAS which would have provided them with awareness of the system and

increase their chances of being able to mitigate the consequences of multiple

activations in the accident scenario.

29. Without understanding of MCAS and reactivation after release the electric

trim, the flight crew was running out of time to find a solution before the

repetitive MCAS activations without fully retrimming the aircraft placed the

aircraft into in an extreme nose-down attitude that the flight crew was unable

to recover from.

30. Flight crew training would have supported the recognition of abnormal

situations and appropriate flight crew action. Boeing did not provide

information and additional training requirements for the 737-8 (MAX) since

the condition was considered similar to previous 737 models.

31. The aircraft should have included the intended AOA DISAGREE alert

message functionally, which was installed on 737 NG aircraft. Boeing and the

FAA should ensure that new and changed aircraft design are properly

described, analyzed, and certified.

32. The absence of an AOA Disagree message made it more difficult for the

flight crew to diagnose the failure and for maintenance to diagnose and

correct the failure.

33. For the safety assessment of aircraft systems, the 14 FAR 25.1309 set the

requirements for the design and installation of systems which include analysis

of effects and probabilities of single, multiple and combined failures of

systems. It assumed that flight crew would correctly respond to flight

conditions in case of such failures. Human error is not included in the

probability analysis, even though the flight crew is often used as a means to

mitigate a failure condition.

34. When performing safety assessments to comply with 14 FAR 25.1309,

Boeing followed the procedures set in FAA AC 25.1309-1A and the SAE

ARP 4761 as the acceptable means of compliance. When doing the analysis,

Boeing assumed that the flight crew are completely reliable and would

respond correctly and appropriately to the situations in time. During the

accident and previous LNI043 flights, some of these assumptions were

incorrect, since the flight crew responded differently from what was expected.

35. 14 FAR 25.671 (c) requires that probable malfunctions of the flight control

system must be capable of being readily counteracted by the flight crew. This

necessitates that normal flight crew should be able to readily identify

problems and respond quickly to mitigate them. However, during the accident

flight multiple alerts and indications concealed the actual problem and made

it difficult for the flight crew to understand and mitigate it.

36. The Flight Standardization Board (FSB) process for the Boeing 737-8 (MAX)

utilized airline line pilots to help ensure the requirements are operationally

representative. The FAA and OEMs should re-evaluate their assumptions for

what constitutes an average flight crew’s basic skill and what level of systems

knowledge a ‘properly trained average pilot’ has when encountering failures.

37. In the accident flight, the system malfunction led to a series of aircraft and

flight crew interactions which the flight crew did not understand or know how

to resolve. It is the flight crew response assumptions in the initial design

process which, coupled with the repetitive MCAS activations, turned out to

be incorrect and inconsistent with the FHA classification of Major.

38. The first problem reported on PK-LQP aircraft of SPD and ALT flags

appeared on Captain’s PFD occurred on 26 October 2018 during the flight

from Tianjin to Manado and reappeared 3 times within 5 flight sectors.

209

39. The SPD and ALT flag did not occur on the flight from Denpasar to Lombok

and return. This was consistent with the result of AOA sensor examination

which indicated that the resolver 2 became unreliable during cold

temperature.

40. The engineer in Manado suggested to the flight crew to continue the flight as

problem rectification would be better to be performed in Denpasar and

considering that the SPD and ALT flags had no longer appeared on the

Captain’s PFD. This indicated that the aircraft was released with known

possible recurring problem.

41. On the flight from Manado to Denpasar on 28 October 2018, the DFDR

recorded the A/T disengaged on takeoff roll and the SPD and ALT flags on

the captain’s PFD most likely had appeared after the engine start. The

altimeter and speed indicator are airworthiness related instruments and must

be serviceable for dispatch. The decision to continue the flight was contrary

to the company procedure.

42. The engineer in Denpasar considered that the problem had appeared

repeatedly and decided to replace the left AOA sensor. Replacement of AOA

sensor proved to be the solution to rectify the SPD and ALT flags that were

reported to have appeared on the Captain’s PFD, however the installed AOA

sensor was misaligned by about 21° and resulted in different problems.

43. The Boeing test result indicated that a misaligned AOA sensor would not pass

the installation test as the AOA values shown on the SMYD computer were

out of tolerance and “AOA SENSR INVALID” message appeared in the

SMYD BITE module. This test and subsequent testing verified that the

alternate method of the installation test could identify a 20 or 21° bias in the

AOA sensor.

44. Comparing the results of the installation test in Denpasar and Boeing, the

investigation could not determine that the AOA sensor installation test

conducted in Denpasar with any certainty.

45. The BAT LMPM required the engineer to record the test values to ensure that

the test results were within tolerance. The engineer did not record the value of

the AOA angle deflection during the AOA sensor installation test. Therefore,

neither BAT nor Lion Air identified that the documentation had not been

filled out.

46. After LNI043 was airborne, the left control column stick shaker was active

and several messages appeared. The Captain of LNI043 was aware to the

aircraft condition after discussion with the engineer in Denpasar. This

awareness helped the Captain to make proper problem identification.

47. The Captain action of transferring the control prior to crosscheck of the

instruments may have indicated that the Captain generally was aware of the

repetitive previous problem of SPD and ALT flags and the replacement of the

left AOA sensor on this aircraft.

48. The LNI043 flight crew performed NNC of Runaway Stabilizer Trim by

selecting the STAB TRIM switches to cut-out, which resulted in termination

of AND activations by MCAS, and the aircraft became under control with

consequences of inability to engage the autopilot, and requirement for manual

operation of stabilizer trim by hand.

49. The Captain’s decision to continue to the destination was based on the fact

that a requirement to “land-at-the-nearest-suitable-airport” in the three NonNormal-Checklists was absent.

50. The Captain of LNI043 felt confident to continue the flight to the destination

because the aircraft was controllable and the expected weather along the route

and at the destination was good.

51. The LNI043 flight crew decision to continue with stick shaker active is not

common in comparison to previous events of erroneous stick shaker. When

combined with the runaway stabilizer situation recognized by the flight crew,

the decision to continue was highly unusual.

52. During the descent to destination they requested uninterrupted descent path

profile. This action suggested that the flight crew were aware of their existing

flight condition (continuous stick shaker, manual flying, manual trimming,

FO PFD was the primary instrument) required a simplified flight path

management until approach and landing.

53. During flight, the Captain of LNI043 kept the fasten seat belt sign on and

asked the deadheading flight crew to assist the cockpit tasks. These actions

indicated that the Captain was aware of the need to use all available resources

to alleviate the matter to complete the flight to the destination, despite the

increased workload and stressful situation.

54. The AFML entry for LNI043, which did not contain additional details about

what was experienced, was not in accordance with company guidance

provided in OM-Part A, Section 11.4.9 which lists reportable events to

include “Warning or alert, including flight control warnings, door warnings,

stall warning (stick-shaker), fire/smoke/fumes warning.”

55. The SS Directorate did not notice the occurrence since the report was filed

outside normal office hours and the report to SS Directorate was not

processed until the office hours on the following day.

56. The insufficient SMS training and inability of the employees to identify the

hazard might also be indicated by the incomplete post-flight report of the

problems that occurred on LNI043. The incomplete report became a hazard as

the known or suspected defects were not reported which might make the

engineer unable to properly maintain the airworthiness of the aircraft.

57. Content of the report did not trigger the Duty Management Pilot to assess this

as a Serious Incident and enable a safety investigation. The risk of the

problems that occurred on the flight LNI043 were not assessed to be

considered as a hazard on the subsequent flight.

58. The LNI043 flight that experienced multiple malfunctions were considered

caused or could have caused difficulties in controlling the aircraft. According

to the ICAO Annex 13, CASR part 830 and OM-part A, the flight is classified

as serious incident which required investigation by the KNKT in accordance

with the Aviation Law Number 1 of 2009 and Government Decree Number

62 of 2013.

59. The definition of an aircraft repetitive problem was different between Lion

Air CMM and BAT AMOQSM. This difference indicated that the Lion Air

did not monitor the repetitive problem policy of the BAT as a subcontracted

entity.

60. The requirement to report all known and suspected defects is very critical for

engineering to be able to maintain the airworthiness of the aircraft.

61. The fault code was not documented in the AFML. The engineer did not

record the maintenance message that appeared in the OMF in the AFML.

Being unaware of the maintenance message and the fault code, this would

increase the difficulty for trouble shooting by the engineer.

62. The IFIM tasks of “ALT DISAGREE” and “IAS DISAGREE” have

repetition on the leak test in steps (3) and (4) as they are referring to the same

AMM tasks. This repetition was inefficiency and does not contribute to the

problem solving.

63. The inhibited AOA DISAGREE message contributed to the inability of the

engineer to rectify the problems that occurred on the LNI043 flight which

were caused by AOA sensor bias.

64. The lack of an AOA DISAGREE message did not match the Boeing system

description that was the basis for certifying the aircraft design. The software

not having the intended functionality was not detected by Boeing nor the

FAA during development and certification of the 737-8 MAX before the

aircraft had entered service.

65. During the LNI610 flight preparation, the CVR did not record flight crew

discussion about previous aircraft problems recorded in the AFML. This

might have made the flight crew of LNI610 would not be aware of aircraft

problems that might reappear during flight, including the stick shaker

activation and uncommanded AND trim. This would lead to the inability of

the flight crew to predict and be prepared to mitigate the events that might

occur.

66. Just after liftoff, the left stick shaker activated and numerous messages on the

PFD were displayed, repetitive MCAS activation after the flaps were

retracted and the ATCo communication increased the flight crew workload.

67. The FO asked the controller of the aircraft altitude and the indicated speed on

the ATC radar display in an attempt to obtain another source of information.

However, the ATC radar receives altitude data transmitted by the aircraft

therefore, no additional data may be acquired. Being unable to determine

reliable altitude and airspeed might increase stress to the flight crew.

68. The inability for the FO to perform memory items and locate the checklist in

the QRH in a timely manner indicated that the FO was not familiar with the

NNC. This condition was reappearance of misidentifying NNC which showed

on the FO’s training records.

69. Despite the flight crew’s attempt to execute the NNC, due to increased

workload, and distractions from the ATC communication, the NNC was

unable to be completed in that situation. The unfinished NNC made it

difficult for the flight crew of LNI610 to understand the aircraft problem and

how to mitigate the problem.

70. The reappearance of difficulty in aircraft handling identified during training

in the accident flight indicated that the Lion Air training rehearsal was not

effective.

71. The controller provided eight heading instructions after the flight crew

reported that the aircraft was experiencing a flight control problem, which

was not considered as an emergency condition according to ATS SOP of

AirNav Indonesia branch JATSC. There was also no objection by the flight

crew to the heading instructions and the flight crew did not declare an

emergency. These conditions increased the flight crew workload.

72. The absence of a declaration of urgency (PAN PAN) or emergency

(MAYDAY), or asking for special handling, resulted in the ATCo not

prioritizing that flight. With priority, ATC would not require LNI610 to

maneuver repeatedly.

73. The AOA DISAGREE message was inhibited on the accident aircraft

therefore, flight crews would not be aware that this message would not appear

if the AOA DISAGREE conditions were met. This would contribute to flight

crew being denied valid information about abnormal conditions being faced

and lead to a significant reduction in situational awareness by the flight crew.

74. No information about MCAS was given in the flight crew manuals and

MCAS was not included in the flight crew training. These made the flight

crew unaware of the MCAS system and its effects. There were no procedures

for mitigation in response to erroneous AOA.

75. Both flight crew of LNI610 being preoccupied with individual tasks indicated

that the crew coordination was not well performed. The Captain and FO did

not have a shared mental model of the situation as exhibited by their lack of

clear and effective communication. Most of the components of effective crew

coordination were not achieved, resulting in failure to achieve the common

goal of flying the aircraft safely.

76. During the multiple MCAS activations, the Captain managed to control the

aircraft altitude. The Captain did not verbalize to the FO the difficulty in

controlling the aircraft and the need for repeated aircraft nose up trim. The

FO was preoccupied with completing the NNC and not monitoring the flight

progress. Subsequently, the FO did not provide adequate electric trim to

counter multiple MCAS activations.

77. The requirement to describe specific handling situation to the flight crew

receiving the control was not required per Lion Air procedure or Indonesia

requirement. The absence of Captain’s specific description contributed to the

FO’s difficulty to understand the situation and may have contributed to his

inability to mitigate the problem.

78. The content of the manual of Lion Air and BAT contain several

inconsistencies, incompleteness, and unsynchronized procedures.

79. The investigation found that the engineers were prone to entering the problem

symptom reported by the flight crew in the IFIM first instead of reviewing the

OMF maintenance message. Conducting this method might lead the engineers

into the inappropriate rectification task.

80. The investigation found that all AFML pages received by the investigation

did not contain fault codes. The absence of the fault code reported by the

flight crew may increase the workload of the engineer and prolong the

rectification process.

81. The investigation considered that the amount of time to cover the hazard

identification topic in the SMS training syllabus was insufficient. This may

reduce the ability of employees to define and report a hazard.

82. A subsequent comparison of the accuracy specifications found that the Peak

SRI-201B API accuracy met the requirement stated on the CMM revision 8.

The investigation did not find a written instruction to operate the Peak

Electronics SRI-201B API.

83. Despite the lack of API specific written instructions for the alternate

equipment, Xtra Aerospace nevertheless obtained acceptance of their API

equipment equivalency report from the FAA FSDO. The lack of an API

written procedure was not detected by the FAA’s FSDO. This indicates

inadequacy of FAA oversight.

84. The Xtra Aerospace visit concluded that performing the required testing and

calibration defined in CMM Revision 8 using the Peak API could potentially

introduce a bias into both resolvers if the REL/ABS (Relative/Absolute)

switch on the Peak Electronics API was inadvertently positioned to REL.

85. The OMF has the history page which contains record of the aircraft problems

which can be utilized as a source for aircraft problem monitoring. The BAT

has not utilized the OMF information as the source of aircraft problem

monitoring.

86. On the subsequent flight, a 21 difference between left and right AOA sensors

was recorded on the DFDR, commencing shortly after the takeoff roll was

initiated. This immediate 21 delta indicated that the AOA sensor was most

likely improperly calibrated at Xtra Aerospace.

87. As noted, utilization of the Peak Model SRI-201B API by Xtra Aerospace for

the test and calibration of the 0861FL1 AOA sensor should have required a

written procedure to specify the proper position of the REL/ABS switch.

88. The aircraft was equipped with an airframe-mounted low frequency

underwater locator beacon (ULB) which operated at a frequency of 8.8 kHz.

The beacon was mounted on the forward side of the nose pressure bulkhead.

During the search phase, multiple surveys were conducted to detect a signal at

8.8 kHz, however no such signals were detected in the area where wreckage

was recovered.

89. On 10 March 2019, an accident related to failure of an AOA sensor occurred

involving a Boeing 737-8 (MAX) registered ET-AVJ operated by Ethiopian

Airlines for scheduled passenger flight from Addis Ababa Bole International

Airport (HAAB), Ethiopia to Jomo Kenyatta International Airport (HKJK),

Kenya with flight number ET-302.

Ha riportato i seguenti “fattori rilevanti - Contributing Factors” che hanno determinato l'incidente:

“Contributing factors defines as actions, omissions, events, conditions, or a

combination thereof, which, if eliminated, avoided or absent, would have reduced

the probability of the accident or incident occurring, or mitigated the severity of the

consequences of the accident or incident. The presentation is based on

chronological order and not to show the degree of contribution.

1. During the design and certification of the Boeing 737-8 (MAX),

assumptions were made about flight crew response to malfunctions which,

even though consistent with current industry guidelines, turned out to be

incorrect.

2. Based on the incorrect assumptions about flight crew response and an

incomplete review of associated multiple flight deck effects, MCAS’s

reliance on a single sensor was deemed appropriate and met all certification

requirements.

3. MCAS was designed to rely on a single AOA sensor, making it vulnerable

to erroneous input from that sensor.

4. The absence of guidance on MCAS or more detailed use of trim in the flight

manuals and in flight crew training, made it more difficult for flight crews to

properly respond to uncommanded MCAS.

5. The AOA DISAGREE alert was not correctly enabled during Boeing 737-8

(MAX) development. As a result, it did not appear during flight with the

mis-calibrated AOA sensor, could not be documented by the flight crew and

was therefore not available to help maintenance identify the mis-calibrated

AOA sensor.

6. The replacement AOA sensor that was installed on the accident aircraft had

been mis-calibrated during an earlier repair. This mis-calibration was not

detected during the repair.

7. The investigation could not determine that the installation test of the AOA

sensor was performed properly. The mis-calibration was not detected.

8. Lack of documentation in the aircraft flight and maintenance log about the

continuous stick shaker and use of the Runaway Stabilizer NNC meant that

information was not available to the maintenance crew in Jakarta nor was it

available to the accident crew, making it more difficult for each to take the

appropriate actions.

9. The multiple alerts, repetitive MCAS activations, and distractions related to

numerous ATC communications were not able to be effectively managed.

This was caused by the difficulty of the situation and performance in manual

handling, NNC execution, and flight crew communication, leading to

ineffective CRM application and workload management. These

performances had previously been identified during training and reappeared

during the accident flight.

data inserimento: Giovedì 31 Ottobre 2019

segnala agli amici