Post-crash analysis of the fatal Lion Air Boeing 737 Max flight from Jakarta sharply illustrated the contrast between a real-world cockpit and the scenario Boeing used when testing crew response to the aircraft's Manoeuvring Characteristics Augmentation System.
Indonesian investigation authority KNTK says Boeing's preliminary hazard assessment of MCAS, carried out on a full-flight simulator in 2012, examined crew responses to uncommanded MCAS activation "regardless of underlying cause".
This focus on the pilots' response to MCAS – rather than the reason MCAS might be triggered – meant that specific failure modes "were not simulated", says the inquiry, and therefore neither were the cockpit effects of those failure modes.
KNKT says a failure such as erroneous angle-of-attack sensor data, leading to unreliable airspeed alerts, stick-shaker activation, and other alarms in the cockpit were not part of the simulation.
Boeing concentrated on two particular uncommanded MCAS hazards: operation to MCAS's maximum authority of 0.6° nose-down stabiliser, and an MCAS activation which equated to a 3s stabiliser trim runaway.
It simulated the MCAS function by inducing stabiliser movement, which created increased control-column forces, indications of nose-down movement, and activation of the stabiliser trim wheel – enabling Boeing to study how pilots would react.
Additional cockpit effects were not simulated, says the inquiry, and were not documented in safety assessment reports reviewed by the US National Transportation Safety Board.
As the 737 Max evolved, Boeing opted to revise MCAS in 2016 to improve characteristics in certain configurations at low speed.
This revision enabled MCAS to command incremental stabiliser movement to a maximum of 0.65° at high Mach numbers but as much as 2.5° at low Mach.
Boeing used the full-flight simulator and engineering analysis to re-evaluate its earlier hazard assessment of MCAS, and determined that the risk classification had "not changed" as a result of this increase in MCAS authority.
The risk associated with uncommanded MCAS activation remained classified as 'major' – and therefore did not require further in-depth analysis – because Boeing believed unintended movement of the stabiliser would be "readily recognised", and that the crew would be quickly able to return the aircraft to level flight, either with elevator and trim or by using stabiliser runaway procedures.
But a simulation exercise conducted in December 2018, a few weeks after the Lion Air crash in October, revealed that the pilots were dealing not just with uncommanded MCAS activation – for which they were not prepared – but also the impact of additional cockpit effects associated with the same false angle-of-attack data that had triggered MCAS.
The simulations tested several scenarios to examine the aircraft's behaviour as well as theoretical crew responses.
But the exercise also replicated the likely cockpit conditions which emerged during the accident sequence.
Pilots participating in the simulation were instructed to clean the aircraft configuration after take-off, start carrying out non-normal checklists, and respond to air traffic control requests.
This exercise found that crews could not maintain altitude with control column force alone if short activation of electric trim resulted in an accumulating mis-trim from the MCAS nose-down commands.
"Repeated MCAS activations increased the flight crew workload and required more attention to counter it," says the inquiry. Communicating with air traffic control was "distracting", it adds, and crews found the non-normal checklist "hard to get through".
The crew of the ill-fated Lion Air aircraft attempted to run through the non-normal checklists while trying to maintain altitude against repetitive MCAS nose-down commands.
But the inquiry says execution of the checklists was "unable to be completed" owing to increased workload and distraction from air traffic communications. "The unfinished [checklists] made it difficult for the flight crew [of the Lion 737 Max] to understand the aircraft problem and how to mitigate the problem," it adds.
