Indonesian investigators have concluded that a series of factors, primarily the design of the Boeing 737 MAX 8’s flight-control system and inadequacies in pilot training and maintenance practices, combined to cause the crash of Lion Air flight 610 a year ago.

A report by the Indonesian National Transportation Safety Committee (KNKT) cited the maneuvering characteristics augmentation system (MCAS) flight-control law’s reliance on a single angle-of-attack (AOA) sensor as a redundancy weakness.

They also said the “absence of guidance on MCAS or more detailed use of trim in the flight manuals and in-flight crew training, made it more difficult for flight crews to properly respond to uncommanded MCAS.”

In the cockpit, the AOA disagree alert was not enabled because of a software-configuration error, and Boeing did not tell operators about the problem until after the Oct. 29, 2018, crash.

KNKT said when MCAS pushed the aircraft nose down, it required 103 pounds of force by the captain to counter the automated system. The first officer also failed to follow the Quick Reference Handbook instructions that could have deactivated MCAS.

The pilots were overwhelmed by repetitive MCAS activations, multiple alerts, air traffic control communications, and ineffective workload and crew resource management, compounded by the “difficulty of the situation and deficiencies in manual handling,” KTKT said.

After the captain successfully countered the airplane’s nose-down movements more than 20 times using manual electric trim inputs on the control column, he handed control to the first officer without properly briefing him. The first officer was seemingly under stress, did not sufficiently counter another MCAS activation and quickly lost control of the aircraft, investigators said.

The report also revealed that the first officer was not initially scheduled for the flight and was called in at 4 a.m. In addition, the captain had the flu, he told the first officer, according to the cockpit voice recorder.

The first officer’s training record also revealed numerous deficiencies, including “difficulties to control aircraft during manual flight” on a 2016 instrument-based landing system (ILS) approach proficiency check, and during a 2017 exercise demonstrated a lack of understanding of the basic principles of high- or low-level stall recovery.

Following a series of problems during four earlier flights, Lion Air replaced the AOA sensor on Oct. 28 with a used serviceable part. But the sensor was “was most likely improperly calibrated” by supplier Xtra Aerospace, and the issue went undiscovered by a Lion Air maintenance crewmember, investigators said. Maintenance records did not show that the crewmember performed installation and calibration tests after his work, the report said, adding that 31 pages of the October logbook was missing.

FAA said Oct. 25 it had revoked the repair station certificate of Florida-based Xtra Aerospace. The agency said the company “failed to comply with requirements to repair only aircraft parts on its list of parts acceptable to the FAA that it was capable of repairing. The company also failed to comply with procedures in its repair station manual for implementing a capability list in accordance with the Federal Aviation Regulations.”

A flight of the Lion Air aircraft the day before the crash had a similar occurrence of uncommanded MCAS activation pushing the aircraft nose-down and the stick-shaker activated. The issue was resolved by a third pilot in the cockpit who identified the problem as a runaway stabilizer and recommended toggling the stabilizer trim cutout switches, which de-powered the stabilizer trim motor. The crew continued the flight and only reported airspeed and altitude warnings, however, not the stick-shaker and how the issue was resolved.

“The … flight crew decision to continue with stick shaker active is not common in comparison to previous events of erroneous stick shaker. When combined with the runaway stabilizer situation recognized by the flight crew, the decision to continue was highly unusual,” the report says.

KNKT said the earlier faults should have been classified as serious incidents, and the aircraft should have been grounded until they were resolved.

It added that during the 737 MAX design and certification phase, incorrect assumptions were made about pilots’ responses to malfunctions, and an incomplete review was made of associated multiple flight deck effects, although the process is consistent with current industry guidelines.

Among KNKT’s recommendations to Boeing are to review a fail-safe redesign of the MCAS system. The manufacturer should also consider the effects of all possible flight deck alerts and indications on pilot recognition and responses, provide sufficient training and manual information on MCAS, and include a larger tolerance in designs to allow operation by a diverse population of pilots.

In response to the report, Boeing is addressing the KNKT’s safety recommendations and its engineers have been working with the US FAA and other regulators to make software updates and other changes.

Boeing said MCAS will now compare information from both AOA sensors before activating and will only be activated if both sensors agree. In addition, MCAS “will only activate once in response to erroneous AOA, and will always be subject to a maximum limit that can be overridden with the control column.”

FAA said it “[welcomes] the recommendations from this report and will carefully consider these and all other recommendations as we continue our review of the proposed changes to the Boeing 737 MAX.”

Chen Chuanren,