Indonesia report on Lion Air 737 MAX crash error Boeing design and FAA certification as well as airline maintenance and pilot failure

The final report of aviation accident investigators on the Lion Air crash in a 737 MAX in Indonesia that killed 189 people a year ago provides devastating criticism of the design and certification of Boe's new aircraft control system. [19659002] It also gives a detailed account of the deadly flight. And it blames Lion Air's maintenance work and its pilots, as well as a Florida company that supplied a component, according to an advance copy reviewed by The Seattle Times.

"The design and certification of the MCAS (Maneuvering Characteristics Augmentation System) did not adequately assess the likelihood of loss of control over the aircraft," the report states. "A flawless design concept and redundant system should have been necessary for MCAS."

The report would be released Friday in Indonesia, or around midnight Thursday in Seattle.

The report found that after Boeing changed the original MCAS design, and increased the authority to move the horizontal tail or stabilizer, from 0.6 degrees to 2.5 degrees, "the higher limit caused a much greater movement of the stabilizer than that was specified in the original security assessment document. "

Following that change, which was first reported in The Seattle Times in March, the company's Federal Aviation Administration (FAA) Stability System Assessment was not timely updated, with the result that "the FAA would not be able to re-evaluate the safety of the design change , "the report states.

It also criticizes Boeing's failure to detect a software malfunction that resulted in a warning light stating that MAX was not working and that the failed pilot did need information on the flight control system. Both errors contributed to the crew's inability to understand what was happening, the report states.

“The absence of information on MCAS in the flight manuals and pilot training made it difficult for the flight crew to diagnose problems and apply corrective procedures. "

The report also found that a critical sensor, a user manual repaired and supplied by a Florida company, was faulty, and it found strong indications that the device was not tested during installation by Lion Air maintenance personnel.

And although similar errors had occurred on the previous flight for the same aircraft, Lion Air's maintenance personnel failed to recover the aircraft, the report states.

The previous flight "which experienced multiple malfunctions, was classified as a serious incident and should have been investigated," the report states.

The report also failed the two pilots on the Lion Air JT61[ads1]0, especially the first officer , who was unfamiliar with procedures and had shown training to have trouble handling the aircraft, failed to follow a checklist procedure that could have stopped MCAS from functioning.

And the report found that the crew failed to coordinating his responses to several faults and alerts.

After the captain successfully counteracted the aircraft's nose-down movements more than 20 times, he surrendered to the first officer, who was under stress and failed to maintain control. after the dive aircraft in the Java Sea and killed everyone on board.

Lost opportunity to fix the jet

The flight history of MAX which crash recorded periodic technical problems in the days before This led to the installation of a faulty replacement component that would trigger the cascade of events that brought down the aircraft.

28. October, the day before the crash, after a series of cockpit and airspeed warnings, the Maintenance Engineer installed a new angle of attack.

Although he should perform an installation test to ensure it was properly calibrated and installed, the maintenance records show no such test, the report found. The engineer produced several images of the flight view, which he claimed showed that the test had been performed. But investigators could not confirm that the photos were taken in the plane that crashed and clearly suspected they were not.

"The investigation failed to establish with any certainty that the AOA sensor installation (was) successful," the report states. [19659007] The report also found that there were 31 pages missing in the aircraft maintenance logs in October.

The new AOA sensor was a secondary component supplied by a certified aviation workshop, Xtra Aerospace in Miramar, Florida.

The part was defective. On the flight just before the fatal flight, the replacement sensor was off by 21 degrees from the one on the other side of the plane.

The report states that this difference indicates that the sensor was "probably inadvertently calibrated". during testing and calibration in Florida. Xtra Aerospace's procedures did not include an additional check required to validate the calibration.

The report notes that the FAA, which is intended to oversee component supplier quality control, missed this, concluding that its "oversight was not effective." [19659002] On the flight on October 28, the failure of the 21-degree attack sensor set the same sequence of events that would reappear a day later on the accident escape. The captain's logs went off, the airspeed and altitude warnings appeared.

And after the pilot pulled back the flaps, MCAS activated – presumed the angle of attack was too high due to the input of one bad sensor – and began to push the nose of the aircraft.

Since Boeing had not informed airlines or pilots about MCAS, the captain and his first officer did not understand what was happening. But they were lucky enough that a third pilot, another first officer from Lion Air, joined the free ride and sat in the jump seat in the cockpit. The third set of eyes appears to have been crucial in helping the crew troubleshoot, stay calm, and find a way out of the situation.

After discussion among the three of them, the captain flipped a pair of switches that cut electric current to his tail. It allowed him to regain control. When he turned them back and the nose-down movements continued, he cut the current again.

According to procedures, the pilot must have turned the plane and landed as soon as possible. Instead, the crew flew to the destination.

On landing, the captain reported only the problems that had appeared on his flight view: the warnings of speed and altitude and a light indicating a difference in the feel of the control column. Unfortunately he did not report the activation of the cane crusher, the way the stabilizer had pressed his nose down or the use of the shut-off switches to solve the problem, resulting in an "incomplete report."

The omission, the report found, was crucial for the maintenance engineer not realizing how serious the condition of the aircraft was. It should have been grounded. But the next morning it would start on the next flight, with the same pattern of errors, another crew and a deadly outcome.

Boeing's fault assessment

The report confirms several errors in Boee's MCAS design as well as a separate problem with a warning light to tell the pilots that the AOA sensors disagreed.

Due to a software error, this light only worked on MAXs where the airline had installed its own optional feature. Lion Air had not bought this option.

The report concludes that this contributed to the crew being "denied valid information on abnormal conditions."

However, the biggest mistake found in designing MCAS. The report examined the safety assessment of the system, as it is fully delegated to Boeing by the FAA.

"The certification was conducted by Boeing … without due regard to the severity of the problem," the report states.

It found that when Boeing engineers considered possible failure scenarios, they did not consider "multiple faulty MCAS activations and only considered the activation of the MCAS function for three seconds (up to 0.81 degrees), not to the maximum authority of 2.5 degrees. ”

Boeing assumed in its safety assessment that pilots would respond to a system failure within three seconds. The report found that both on the previous flight, when the crew regained control, and on the accident escape, when they did not, it took both crews about 8 seconds to respond.

The report states that Boeing reasoned that the shutdown switch, while available to the pilots, would not be necessary and that an MCAS error could be countered by the pilot withdrawing on the control bar alone. But incidents and subsequent tests showed that MCAS could only be stopped by the circuit breakers.

In December 2018, investigators, together with Boeing, conducted tests in a simulator configured for 737 MAX and found that after just two activations of the MCAS, absent some counter counts from the pilot, the control column force became "too heavy" to move.

The report notes that flight control certification "must allow for initial countermeasure of failures without requiring exceptional pilot skill or strength."

on flight 610, Boeing's deficient system met a crew that lacked exceptional skill.

Crew deficiencies

Beyond the already well-known story of the flight – that the captain repeatedly fought MCAS to push his nose down, but after resisting it more than 20 times handed control to the co-pilot who failed to do so – the final report adds new detail.

The first officer on Flight 610, Harvino, a 41-year-old Indonesian who, like many Indonesians, used only one name, had not been scheduled for the flight, but had been awakened at 4am with a change of schedule.

And the captain, 31-year-old Indian national Bhavye Suneja, told Harvino that he had the flu and on the cockpit the tuner was heard coughing 15 times in one hour during preflight checks.

The report notes that during training at Lion Air, Harvino had shown unfamiliarity with standard procedures to be remembered and had shown poor skills in handling aircraft.

When the stick shaker went off and the various warnings appeared on the display, Suneja asked Harvino to perform the Airspeed Unreliable checklist. He had to be asked twice and it took him a full four minutes to find it in the Quick Reference Manual (QRH).

“The first officer was not aware of the memory element… (and) not familiar with the use of QRH. "

The procedure should have enabled him to cross between the air velocities shown on the captain's side and on his side and determine which one was correct. The checklist then states that when this is done, autopilot can be turned on. MCAS is disabled when autopilot is engaged.

Harvino was unable to do this.

Meanwhile, the captain, keen to counteract the nose-down movements, did not understand what was happening. The report speculates that he may have thought there was something wrong with another system, the Speed ​​Trim System, which would not have been nearly as aggressive in its actions. He did not use the cut-off switches.

The captain did not coordinate with Harvino as he fought against MCAS. Then, perhaps because he wanted a break to think about what was wrong, or because he was stressed, "he asked the first officer to take over flight control for a while." The report notes that Suneja did not communicate exactly to Harvino what he needed to do.

Harvino quickly lost control and the plane plunged into the sea.

The report concludes with a wide range of recommendations for all parties involved, including improved pilot training and maintenance procedures at Lion Air. [19659002] Among the Boeing recommendations:

• A faulty redesign of MCAS.
• Sufficient information on MCAS to be included in pilot manuals and training
• Further investigation into the future of any system that can take over primary flight control actions from the pilot.
• Design assessment of the effect of all possible flight deck alerts and indications of pilot recognition and response.
• Greater tolerance in Boeing's design to allow operations rationing from a diverse population of pilots.