A combination of human errors and technical problems that included the Maneuvering Characteristics Augmentation System (MCAS) led to the October 29, 2018, crash of Lion Air Flight 610, a Boeing 737 Max 8.

The plane crashed into the Java Sea 13 minutes after takeoff, killing all 189 people on board. On March 10 2019, a second Boeing 737 MAX 8 aircraft operating as Ethiopian Airlines Flight 302 crashed near the town of Bishoftu six minutes after takeoff, killing all 157 people aboard.

(Read "Boeing 737 Max: As automation proliferates, risk of human error persists.")

In a 322-page report, the Indonesian transportation agency Komite Nasional Keselamatan Transportasi (KNKT) said that in the Lion Air accident, the MCAS malfunction led to a "series of aircraft and flight crew interactions which the flight crew did not understand or know how to resolve."

The Lion Air Boeing 737 MAX was flying as LNI061. Source: WikipediaThe Lion Air Boeing 737 MAX was flying as LNI061. Source: WikipediaThe report also said that problems with the aircraft occurred as early as October 26, three days before the fatal flight. Events during those critical three days were marred by human errors and technical problems.

Earlier flights

The KNKT report said that during one flight on October 26, the aircraft's captain kept the fasten seat belt sign lit for the duration and asked deadheading flight crew members to help with cockpit tasks as he and the first officer worked to manage flight control problems that began on an earlier flight.

(Read "Citing Boeing accidents, NTSB calls on FAA to improve safety assessments.")

After that flight landed, an angle of attack (AOA) sensor on the aircraft was replaced. The sensor is considered integral to the MCAS operation. The replacement sensor that was installed on the Lion Air Boeing had been mis-calibrated during an earlier repair. That error was not detected when it was installed as a replacement part. Neither that repair nor the aircraft's earlier flight control problems were adequately documented, the report said.

Aircraft pitch angle, angle of attack (AOA) and flight path angle. Source: BoeingAircraft pitch angle, angle of attack (AOA) and flight path angle. Source: BoeingThe accident report also said that the flight crew was largely unaware of the MCAS and its operation. Analysis of the voice data recorder also suggested the flight crew did not communicate clearly with one another to effectively address the flight control problems that emerged almost immediately after takeoff. They also failed to declare an emergency or issue a mayday and so were distracted by air traffic controller communications.

Contributing factors

The report identified a sequence of nine contributing factors to the fatal crash, many of them finding fault with Boeing.

  • During the design and certification of the Boeing 737-8 MAX, assumptions were made about flight crew response to malfunctions, which, even though consistent with current industry guidelines, turned out to be incorrect.
  • Based on the incorrect assumptions and an incomplete review of associated multiple flight deck effects, MCAS’s reliance on a single sensor was deemed appropriate and met all certification requirements.
  • MCAS was designed to rely on a single AOA sensor, making it vulnerable to erroneous input from that sensor.
  • The absence of guidance on MCAS or more detailed use of trim in the flight manuals and in flight crew training, made it more difficult for flight crews to properly respond to uncommanded MCAS.
  • The AOA DISAGREE (angle of attack) alert was not correctly enabled during Boeing 737-8 Max development. As a result, it did not appear during flight with the mis-calibrated AOA sensor, could not be documented by the flight crew and was not available to help maintenance identify the mis-calibrated AOA sensor.
  • The replacement AOA sensor that was installed on the accident aircraft had been mis-calibrated during an earlier repair. This mis-calibration was not detected during the repair.
  • The investigation could not determine that the installation test of the AOA sensor was performed properly. The mis-calibration was not detected.
  • Lack of documentation in the aircraft flight and maintenance log about the continuous stick shaker and use of the Runaway Stabilizer NNC meant that information was not available to the maintenance crew in Jakarta nor was it available to the accident crew, making it more difficult for each to take the appropriate actions.
  • The multiple alerts, repetitive MCAS activations and distractions related to numerous air traffic control communications were not able to be effectively managed. This was caused by the difficulty of the situation and performance in manual handling, NNC execution and flight crew communication, leading to ineffective CRM application and workload management. These performances had previously been identified during training and reappeared during the accident flight.

Boeing response

In a statement, Boeing said it has redesigned the way angle of attack sensors work with MCAS. It said that going forward, MCAS will compare information from both angle of attack sensors before activating, adding a new layer of protection."

The aisle-stand controls in the cockpit of a Boeing 737 Max. If the two switches shown at the bottom right under the STAB TRIM label are flipped to the cutout position, all automated movement of the horizontal stabilizer is disabled, including MCAS. Source: Dimas Ardian/Bloomberg via Seattle TimesThe aisle-stand controls in the cockpit of a Boeing 737 Max. If the two switches shown at the bottom right under the STAB TRIM label are flipped to the cutout position, all automated movement of the horizontal stabilizer is disabled, including MCAS. Source: Dimas Ardian/Bloomberg via Seattle TimesIn addition, MCAS will now only turn on if both angle of attack sensors agree, will only activate once in response to erroneous angle of attack data, and will "always be subject to a maximum limit that can be overridden with the control column."

Early warnings

The report also detailed a series of errors leading up to the fatal October 29 flight of Lion Air 610:

The first problem of SPD (speed) and ALT (altitude) flags appeared on the flight deck's PFD (primary flight display) occurred on October 26 during a flight from Tianjin to Manado.

The SPD and ALT flag did not occur on a roundtrip flight from Denpasar to Lombok. The KNKT report said that was consistent with a finding that an angle of attack sensor became unreliable.

A maintenance engineer in Manado suggested to the flight crew that they continue the flight and have repairs made in Denpasar. The report said that the maintenance engineer's recommendation indicated that the aircraft was released with a "known possible recurring problem."

On the flight from Manado to Denpasar on October 28, the DFDR (digital flight data recorder) recorded the A/T (auto throttle) disengaged on the plane's takeoff roll and that the SPD and ALT flags on the captain’s PFD likely appeared after engine start. The report said that both the altimeter and speed indicators are "airworthiness related instruments" and must be serviceable for dispatch.

"The decision to continue the flight was contrary to the company procedure," the report said.

In addition, the maintenance engineer in Denpasar decided to replace the left AOA sensor in an effort to rectify the SPD and ALT flags. However, the newly installed AOA sensor was mis-calibrated by about 21° and resulted in different problems, the KNKT report said.

The report said that in a failure of process, the repair engineer did not record required test values that were made on the AOA to ensure that results were within tolerance.

Flight LNI043

After the AOA repairs were made and the Boeing 737 Max 8 was airborne, operating as LNI043, the left control column stick shaker activated and several messages appeared. The fact that the captain transferred control prior to instrument crosscheck may have indicated, the report said, that the flight crew "generally was aware" of the previous problem involving speed and altitude indicators as well as the replacement of the aircraft's left angle of attack sensor.

While in the air, the flight crew of LNI043 performed an NNC (non-normal checklist) of the Runaway Stabilizer Trim by setting the STAB TRIM switches to cut out. This resulted in termination of AND (aircraft nose down) activations by MCAS, the report said. This meant that the flight crew was unable to engage the autopilot and had to operate the plane's stabilizer trim by hand.

The accident report said that the flight crew's decision to proceed with the flight with the stick shaker active was "not common." That, combined with the runaway stabilizer situation left the decision to continue as "highly unusual," the report said.

Compounding the flight's unusual nature, the captain of LNI043 kept the fasten seat belt sign on for the duration and asked the deadheading flight crew to help with cockpit tasks.

"These actions indicated that the captain was aware of the need to use all available resources to alleviate the matter to complete the flight to the destination," the report said.

What's more, during the descent, the flight crew asked air traffic controllers for an uninterrupted descent path profile, an action that suggested the flight crew were aware of their existing flight condition (continuous stick shaker, manual flying, manual trimming and first officer primary flight display as the primary instrument) required a simplified flight path management.

In another human error, the post-flight report did not offer details into the problems that occurred on LNI043. The incomplete report became a "hazard," the report said, as the known or suspected defects were left unreported. The risk posed by the problems that occurred on flight LNI043 "were not assessed to be considered as a hazard on the subsequent flight," the report said.

Fatal flight

During flight preparation for LNI610, the cockpit voice recorder did not record a discussion about previous aircraft problems, suggesting that the flight crew was not aware of aircraft problems that might reappear during flight, including the stick shaker activation and uncommanded AND trim.

Just after liftoff, the left stick shaker activated and numerous messages on the PFD were displayed, repetitive MCAS activation occurred after the flaps were retracted and communication with air traffic controllers increased the flight crew workload.

The First Officer asked for altitude and indicated speed from the air traffic controller's radar display in an effort to obtain another source of information. However, the controller's radar receives altitude data transmitted by the aircraft, so no independent data was available.

The flight crew attempted to execute the non-normal checklist in an attempt to deal with the problems. However, due to increased workload and distractions from air traffic controller communication, the NNC was not completed. The report said the unfinished NNC "made it difficult for the flight crew of LNI610 to understand the aircraft problem and how to mitigate the problem."

The report said that no information about MCAS was given in the flight crew manuals and MCAS was not included in the flight crew training. These factors made the flight crew unaware of the MCAS system and its effects on flight conditions. In addition, there were no procedures to mitigate erroneous AOA data.

The report also said that the flight's captain and first officer did not have a "shared mental model of the situation" exhibited by their "lack of clear and effective communication."

The report said that "most of the components of effective crew coordination were not achieved, resulting in failure to achieve the common goal of flying the aircraft safely."

In particular, during the multiple MCAS activations, the captain managed to control the aircraft altitude. The captain, however, did not verbalize to the first officer the difficulty in controlling the aircraft and the need for repeated aircraft nose up trim. The first officer was occupied with completing the NNC and not monitoring the flight progress. As a result, he did not provide adequate electric trim to counter multiple MCAS activations.