Boeing incorrectly predicted the manner in which 737 Max pilots would respond to the activation of the Manoeuvring Characteristics Augmentation System, by assuming they would initially pull back on the control column and then trim out the force to maintain level flight.
But the investigation into the Lion Air 737 Max accident last October has revealed that assumption that crews would immediately trim the aircraft were wrong.
MCAS was designed to reduce nose-up attitude by automatically adjusting the horizontal stabiliser to reduce pitch.
Activation of MCAS on the Lion Air jet – a result of the inaccurate angle-of-attack sensor readings – did lead the crews to respond initially by pulling on the control column, says Indonesian investigation authority KNKT.
"However, they did not consistently trim out the resulting column forces as had been assumed," it states. "The Boeing assumption was different from the flight crew behaviour in responding to MCAS activation."
Failure to re-trim the aircraft during a series of repeated MCAS activations would result in the stabiliser gradually shifting to its maximum deflection, with the crew attempting to keep the nose up with increasing force on the control column.
When the 737 Max was being developed, simulator testing during functional hazard assessment "never considered" the scenario of repetitive MCAS activation incrementally driving the stabiliser to its maximum limit.
Boeing had believed repetitive MCAS activations to be "no worse" than a single activation, because of its assumption that the pilots would trim out the forces each time, says the inquiry. It had also assumed that the crew would respond correctly, and within 3s.
But an absence of this trimming would "escalate the flight crew workload", the inquiry states, and the effects of this failure to trim after each MCAS activation "should have been reconsidered".
Boeing had reasoned that unintended stabiliser deflection, triggered by MCAS, could be addressed by the use of elevator alone – through the crew's pulling on the control column.
But the Lion Air accident showed that, in an extreme case, repeated MCAS deflections without sufficient trim would result in a cumulative out-of-trim situation which "could not be countered" just with the elevator, says the inquiry.
This scenario was "contrary to the Boeing assumption" during the airframer's functional hazard assessment process, it adds.
"Any out-of-trim condition which is not properly corrected would lead the flight crew into a situation that makes it more difficult for them to maintain desired attitude of the aircraft," says the inquiry.
"The flight crews in both the accident flight and the previous flight had difficulty maintaining flightpath during multiple MCAS activations."
Boeing's functional hazard assessment played down the potential impact of unintended MCAS stabiliser deflection, classifying it as a 'major' failure condition rather than 'hazardous' or 'catastrophic' – which meant the company was not required to analyse this scenario more rigorously.
