FAILURE CHAIN · EP007 · SOURCES
Boeing 737 MAX
How to read this page. Each row is one claim. "Source and page" gives the document and the page in it. "Verbatim" is the exact text from that page. Status: VERIFIED and FINDING are stated by the official report; INFERENCE is the report's own reconstruction; TESTIMONY is attributed evidence; CONTESTED means the sources disagree.
Sources
| Key | Document | Public copy |
|---|---|---|
| knkt-jt610-final-report-2019.pdf | KNKT (Indonesia) final report KNKT.18.10.35.04, Lion Air JT610, PK-LQP. Controlling investigation for accident 1. | open |
| eaib-et302-final-report-2022.pdf | Ethiopian AIB final report, ET302, ET-AVJ, December 2022. Controlling investigation for accident 2. | open |
| ntsb-response-to-eaib-final-2022.pdf | NTSB formal comments on the EAIB final report. Accredited-representative dissent. | open |
| bea-comment-on-eaib-final-2022.pdf | BEA (France) comment on the EAIB final report. | open |
| ntsb-asr-19-01.pdf | NTSB Safety Recommendation Report ASR-19-01, Sept 2019: safety-assessment assumptions and multiple alerts. | open |
| faa-jatr-2019.pdf | Joint Authorities Technical Review, Oct 2019: flight control system certification findings. | open |
| house-ti-737max-final-report-2020.pdf | US House T&I Committee final report, Sept 2020 (majority staff). Later analysis, not an accident investigation. | open |
| easa-737max-rts-report-2021.pdf | EASA return-to-service report. Later analysis: what changed before the MAX flew again. | open |
| faa-737-rts-summary-2020.pdf | FAA Summary of the FAA's Review of the Boeing 737 MAX, Nov 2020. The corrective actions: both AOA inputs, one activation per event, maximum command limit. | open |
| faa-ad-2020-24-02-final-rule.pdf | FAA final Airworthiness Directive rule mandating the corrective actions. | open |
A · KNKT final report, Lion Air JT610 (controlling, accident 1) · 80 rows
| ID | Claim | Source and page | Verbatim | Status |
|---|---|---|---|---|
| A-001 | Aircraft was a Lion Air Boeing 737-8 (MAX), registration PK-LQP, on a scheduled passenger flight (LNI610) from Soekarno-Hatta, Jakarta to Depati Amir, Pangkal Pinang. | knkt-jt610-final-report-2019.pdf, PDF p.20, printed p.xviii | "a PT Lion Mentari Airlines (Lion Air) Boeing 737-8 (MAX) aircraft registered PK-LQP, was being operated as a scheduled passenger flight from Soekarno-Hatta International Airport (WIII), Jakarta" | VERIFIED |
| A-002 | Accident occurred at about 0632 local time on 29 October 2018 (23:32 UTC on 28 October 2018). | knkt-jt610-final-report-2019.pdf, PDF p.20, printed p.xviii | "On 29 October 2018, at about 0632 Local Time (23:32 UTC 28 October 2018)" | VERIFIED |
| A-003 | 189 persons were on board: two pilots, six flight attendants and 181 passengers, including one engineer. The weight and balance sheet showed 188. | knkt-jt610-final-report-2019.pdf, PDF p.21, printed p.19 | "The number of persons onboard the aircraft was 189 consisted of two pilots, six flight attendants, and 181 passengers including one engineer. The weight and balance sheet showed the total person onboard was 188." | VERIFIED |
| A-004 | All persons on board died and the aircraft was destroyed on impact with the water off Tanjung Karawang, West Java. | knkt-jt610-final-report-2019.pdf, PDF p.20, printed p.xviii | "The aircraft impacted the water in Tanjung Karawang, West Java, all person on board perished and the aircraft destroyed." | VERIFIED |
| A-005 | The SPD and ALT flags first appeared on the Captain's PFD on 26 October 2018 on flight LNI2748 from Tianjin, China to Manado. | knkt-jt610-final-report-2019.pdf, PDF p.35, printed p.33 | "The AFML entry states the SPD (Speed) and ALT (Altitude) Flags appeared on Captain’s PFD" | VERIFIED |
| A-006 | On the Manado to Denpasar flight of 28 October, the crew continued with an unserviceable airspeed indicator and altimeter, which KNKT found contrary to company procedure. | knkt-jt610-final-report-2019.pdf, PDF p.211, printed p.209 | "The altimeter and speed indicator are airworthiness related instruments and must be serviceable for dispatch. The decision to continue the flight was contrary to the company procedure." | VERIFIED |
| A-007 | The replacement sensor (S/N 14488) had come from a Malindo Air Boeing 737-900ER (9M-LNF), removed in August 2017 for SPD/ALT flags, then repaired at Xtra Aerospace in Miramar, Florida. | knkt-jt610-final-report-2019.pdf, PDF p.39, printed p.37 | "This AOA sensor was previously installed on the right side of the fuselage of a Boeing 737-900ER aircraft, Malaysian registration 9M-LNF, which was operated by Malindo Air." | VERIFIED |
| A-008 | At Xtra the eroded vane was replaced, and the unit was calibrated and tested to CMM Revision 8. The work order recorded the tests as satisfactory, and Xtra approved it for return to service on 3 November 2017. | knkt-jt610-final-report-2019.pdf, PDF p.40, printed p.38 | "After vane replacement and reassembly the unit was calibrated and tested to the requirements of the CMM Revision 8 (current at the time of the repair). The work order stated that the results for the required tests were satisfactory." | VERIFIED |
| A-009 | The sensor was flown from Batam and installed in the left position on PK-LQP at Denpasar on 28 October 2018. | knkt-jt610-final-report-2019.pdf, PDF p.40, printed p.38 | "On 28 October 2018, the AOA sensor sent from Batam at 0900 LT (0200 UTC) and received at Denpasar station about 1830 LT (1030 UTC) where it was installed on the left position of PK-LQP aircraft." | VERIFIED |
| A-010 | The recommended test fixture (SPL-1917) was not available in Denpasar, so the engineer used the AMM's alternative installation test (SMYD BITE). He did not record the SMYD readings. | knkt-jt610-final-report-2019.pdf, PDF p.38, printed p.36 | "The test equipment (AOA test fixture SPL-1917) was not available in Denpasar therefore, the engineer in Denpasar used the alternative method." | VERIFIED |
| A-011 | Photos the Denpasar engineer gave the investigation as evidence of the test were not valid. The PFD photo was timed before the part arrived, and the SMYD photos were not of the accident aircraft. | knkt-jt610-final-report-2019.pdf, PDF p.38, printed p.36 | "the investigation confirmed that the SMYD photos were not of the accident aircraft." | VERIFIED |
| A-012 | The installed left AOA sensor had a 21° bias that the Denpasar installation test did not detect. | knkt-jt610-final-report-2019.pdf, PDF p.20, printed p.xviii | "The installed left AOA sensor had a 21° bias which was undetected during the installation test in Denpasar." | VERIFIED |
| A-013 | In a Boeing/NTSB test on 15 November 2018 using a sensor with a 33° induced bias, the AMM alternative installation test detected the mis-calibration (SMYD showed -31.9° and 'AOA SENSR INVALID'). | knkt-jt610-final-report-2019.pdf, PDF p.91, printed p.89 | "The alternative method of the installation test in the AMM will successfully detect a mis-calibrated AOA sensor." | VERIFIED |
| A-014 | Contributing factor 7 (verbatim): KNKT could not determine whether the Denpasar installation test was performed properly. | knkt-jt610-final-report-2019.pdf, PDF p.217, printed p.215 | "The investigation could not determine that the installation test of the AOA sensor was performed properly. The mis-calibration was not detected." | VERIFIED |
| A-015 | A demonstration at Xtra (December 2018) showed that calibrating with a Peak SRI-201B API in 'relative' mode could put an equal bias into both resolvers, and CMM return-to-service tests would not catch it. | knkt-jt610-final-report-2019.pdf, PDF p.93, printed p.91 | "The test demonstrated that an AOA sensor calibrated and tested with a Peak API in relative mode could result in an equal bias introduced into both resolvers." | VERIFIED-POSSIBLE |
| A-016 | KNKT concluded the 21° difference, present from the takeoff roll, indicated the sensor was most likely improperly calibrated at Xtra Aerospace. | knkt-jt610-final-report-2019.pdf, PDF p.205, printed p.203 | "This immediate 21° delta indicated that the AOA sensor was most likely improperly calibrated at Xtra Aerospace." | VERIFIED-POSSIBLE |
| A-017 | Contributing factor 6 (verbatim): the replacement sensor had been mis-calibrated during an earlier repair and this was not detected during the repair. | knkt-jt610-final-report-2019.pdf, PDF p.217, printed p.215 | "The replacement AOA sensor that was installed on the accident aircraft had been mis-calibrated during an earlier repair. This mis-calibration was not detected during the repair." | VERIFIED |
| A-018 | KNKT found the lack of a written procedure for the Peak API went undetected by the FAA FSDO, which it said indicated inadequate FAA oversight. | knkt-jt610-final-report-2019.pdf, PDF p.216, printed p.214 | "The lack of an API written procedure was not detected by the FAA’s FSDO. This indicates inadequacy of FAA oversight." | VERIFIED |
| A-019 | Boeing's requirements called for AOA DISAGREE as standard, but the delivered display software only enabled it when the airline bought the optional AOA indicator. | knkt-jt610-final-report-2019.pdf, PDF p.47, printed p.45 | "The software delivered to Boeing, however, linked the AOA DISAGREE alert to the AOA position indicator, which is an optional feature on the Boeing 737 (MAX) series." | VERIFIED |
| A-020 | Boeing's position was that AOA DISAGREE is not a safety feature and not necessary to operate the aircraft safely. | knkt-jt610-final-report-2019.pdf, PDF p.47, printed p.45 | "The AOA DISAGREE alert has not been considered as a safety feature by Boeing, and is not necessary to safely operate the aircraft." | ATTRIBUTED |
| A-021 | After finding the software gap in 2017, Boeing decided it could wait for a display software upgrade scheduled for the third quarter of 2020. | knkt-jt610-final-report-2019.pdf, PDF p.48, printed p.46 | "Boeing concluded that the existing functionality was acceptable until the originally intended functionality could be implemented in a display system software upgrade, scheduled for the third quarter of 2020." | ATTRIBUTED |
| A-022 | Lion Air did not buy the optional AOA indicator, so AOA DISAGREE never appeared on PK-LQP even though its conditions were met. | knkt-jt610-final-report-2019.pdf, PDF p.48, printed p.46 | "As a result, the AOA DISAGREE did not appear on PK-LQP aircraft, even though the necessary conditions were met." | VERIFIED |
| A-023 | Neither Boeing nor the FAA detected the missing AOA DISAGREE function during development and certification. | knkt-jt610-final-report-2019.pdf, PDF p.213, printed p.211 | "The software not having the intended functionality was not detected by Boeing nor the FAA during development and certification of the 737-8 MAX before the aircraft had entered service." | VERIFIED |
| A-024 | Contributing factor 5 (verbatim): AOA DISAGREE was not correctly enabled during development, did not appear, and so could not be documented or help maintenance. | knkt-jt610-final-report-2019.pdf, PDF p.217, printed p.215 | "The AOA DISAGREE alert was not correctly enabled during Boeing 737-8 (MAX) development. As a result, it did not appear during flight with the mis-calibrated AOA sensor, could not be documented by the flight crew and" | VERIFIED |
| A-025 | On LNI043 (Denpasar to Jakarta, 28 October 2018) the left stick shaker came on just after takeoff and stayed on for about 96 minutes until landing. | knkt-jt610-final-report-2019.pdf, PDF p.168, printed p.166 | "The stick shaker remained active throughout the flight for about 96 minutes until landing." | VERIFIED |
| A-026 | On LNI043 the deadheading pilot told the Captain the aircraft was diving. The FO reported the control column was heavy. | knkt-jt610-final-report-2019.pdf, PDF p.168, printed p.166 | "the dead heading pilot informed to the Captain that the aircraft was diving down." | VERIFIED |
| A-027 | The LNI043 Captain treated the automatic nose-down trim as a runaway stabilizer and set STAB TRIM CUTOUT. The DFDR shows trim movement stopping at 14:28:08 UTC. | knkt-jt610-final-report-2019.pdf, PDF p.169, printed p.167 | "and positioned the STAB TRIM CUTOUT switches in the Cut-Out position. The DFDR recorded at 14:28:08 UTC the automatic trim and manual trim movement stopped." | VERIFIED |
| A-028 | The LNI043 crew took about 3 minutes 40 seconds and 12 MCAS activations to reach the stabilizer trim cutout solution. | knkt-jt610-final-report-2019.pdf, PDF p.201, printed p.199 | "The flight crew of the previous LNI043 flight took around 3 minutes and 40 seconds after 12 MCAS activations to come up to the solution of the problem by performing stabilizer trim cut-out" | VERIFIED |
| A-029 | LNI043 Captain continued to Jakarta partly because none of the three NNCs used said to land at the nearest suitable airport. | knkt-jt610-final-report-2019.pdf, PDF p.169, printed p.167 | "None of the NNCs performed contained the instruction “Plan to land at the nearest suitable airport”." | VERIFIED |
| A-030 | In the AFML the LNI043 Captain reported IAS and ALT DISAGREE and the FEEL DIFF PRESS light, but not the stick shaker, which he believed was a result of those problems. | knkt-jt610-final-report-2019.pdf, PDF p.170, printed p.168 | "The Captain did not mention the activation of stick shaker to the engineer as he believed that the activation was an outcome from the mentioned problems." | VERIFIED |
| A-031 | The LNI043 Captain did not report that the STAB TRIM CUTOUT switches had been used in flight and returned to NORMAL after landing. | knkt-jt610-final-report-2019.pdf, PDF p.170, printed p.168 | "The Captain did not report that the STAB TRIM CUTOUT guarded switches were positioned to CUTOUT during flight and after landing returned to the NORMAL position." | VERIFIED |
| A-032 | The LNI043 Captain's Air Safety Report said the STS was 'running to the wrong direction'. That was a partial reference to trim behaviour. | knkt-jt610-final-report-2019.pdf, PDF p.170, printed p.168 | "Airspeed unreliable and ALT Disagree shown after takeoff, STS* also running to the wrong direction, suspected because of speed difference, identified that CAPT instrument was unreliable and handover control to FO." | ATTRIBUTED |
| A-033 | KNKT found the IAS/ALT DISAGREE troubleshooting tasks the Jakarta engineer followed could not have fixed an AOA sensor bias. The aircraft was released at 1930 UTC on 28 October (0230 LT on 29 October). | knkt-jt610-final-report-2019.pdf, PDF p.179, printed p.177 | "The IAS and ALT disagree reported which occurred on the LNI043 flight which was caused by AOA sensor bias, would not be able to solve by both IFIM tasks" | VERIFIED |
| A-034 | Contributing factor 8 (verbatim, excerpt): missing AFML documentation of the stick shaker and Runaway Stabilizer NNC left both the Jakarta maintenance crew and the accident crew without the information. | knkt-jt610-final-report-2019.pdf, PDF p.217, printed p.215 | "about the continuous stick shaker and use of the Runaway Stabilizer NNC meant that information was not available to the maintenance crew in Jakarta nor was it available to the accident crew," | VERIFIED |
| A-035 | KNKT describes MCAS as a function within the Speed Trim System. With flaps up and at high angle of attack, it moves the stabilizer to increase stick force gradient and reduce pitch-up tendency. | knkt-jt610-final-report-2019.pdf, PDF p.50, printed p.48 | "The MCAS is a function within the Speed Trim System and, when activated, moves the stabilizer during non-normal flaps up, high angle of attack maneuvers to provide a desirable increase in stick force gradient and a reduced pitch up tendency." | VERIFIED |
| A-036 | KNKT states MCAS was needed so the MAX handled like the NG closely enough that no simulator training was needed for the type rating. | knkt-jt610-final-report-2019.pdf, PDF p.191, printed p.189 | "The MCAS was needed in order to make the Boeing 737-8 (MAX) handling characteristics so similar to the NG versions that no simulator training was needed for type rating." | VERIFIED |
| A-037 | MCAS authority was raised in March 2016 to a maximum of 2.5° of stabilizer at low Mach, falling to 0.65° at high Mach. The original limit was 0.6°. | knkt-jt610-final-report-2019.pdf, PDF p.156, printed p.154 | "The MCAS was revised such that depending on AOA, it would be capable of commanding incremental stabilizer to a maximum of 2.5 degrees at low Mach decreasing to a maximum of 0.65 degrees at high Mach." | VERIFIED |
| A-038 | Contributing factor 3 (verbatim): MCAS relied on a single AOA sensor, making it vulnerable to erroneous input from that sensor. | knkt-jt610-final-report-2019.pdf, PDF p.217, printed p.215 | "MCAS was designed to rely on a single AOA sensor, making it vulnerable to erroneous input from that sensor." | VERIFIED |
| A-039 | Pilot electric trim resets MCAS. If the high AOA persists for more than 5 seconds after the reset, MCAS commands another nose-down input. | knkt-jt610-final-report-2019.pdf, PDF p.51, printed p.49 | "if the original elevated AOA condition persists for more than 5 seconds following an MCAS flight control law reset, the MCAS flight control law will command another stabilizer nose down trim input" | VERIFIED |
| A-040 | With MCAS active, the normal column-cutout function (pulling back stops nose-down trim) was disabled. | knkt-jt610-final-report-2019.pdf, PDF p.209, printed p.207 | "Pulling back on the column normally interrupts any electric stabilizer aircraft nose-down command, but for the 737-8 (MAX) with MCAS operating, that control column cutout function is disabled." | VERIFIED |
| A-041 | Uncommanded MCAS was classified 'Major' in the FHA, so FMEA and Fault Tree Analysis were not required. | knkt-jt610-final-report-2019.pdf, PDF p.206, printed p.204 | "The assessment of Major did not require Boeing to more rigorously analyze the failure condition in the safety analysis using Failure Modes and Effects Analysis (FMEA) and Fault Tree Analysis (FTA)" | VERIFIED |
| A-042 | Boeing's FHA assumed the flight crew would respond correctly within 3 seconds and that each MCAS input could be handled with the column and then re-trimmed. | knkt-jt610-final-report-2019.pdf, PDF p.206, printed p.204 | "also based on an assumption that the flight crew was highly reliable to respond correctly and in time within 3 seconds." | VERIFIED |
| A-043 | Boeing's FHA simulator tests induced stabilizer motion directly. They did not simulate erroneous AOA, so the stick shaker and IAS/ALT DISAGREE effects were not simulated. | knkt-jt610-final-report-2019.pdf, PDF p.155, printed p.153 | "additional flight deck effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker activation) resulting from the same underlying failure (for example, erroneous AOA) were not simulated" | VERIFIED |
| A-044 | Uncommanded MCAS to maximum authority was simulated only to the 0.6° high-speed limit, not the 2.5° low-speed limit. | knkt-jt610-final-report-2019.pdf, PDF p.192, printed p.190 | "the uncommanded MCAS function to maximum authority was only flight simulated to high speed maximum limit of 0.6°, but not to low speed maximum limit of 2.5° of stabilizer movement." | VERIFIED |
| A-045 | Boeing engineers and test pilots judged repeated MCAS activation no worse than a single one, assuming pilots would trim out each input. | knkt-jt610-final-report-2019.pdf, PDF p.192, printed p.190 | "deemed it no worse than single uncommanded MCAS activation because it was assumed that the pilots would trim out uncommanded trim inputs to maintain control of the aircraft." | ATTRIBUTED |
| A-046 | KNKT found Boeing's view that stabilizer cutout was 'available but not required' to counter MCAS was incorrect. | knkt-jt610-final-report-2019.pdf, PDF p.208, printed p.206 | "Boeing reasoning that the stabilizer cutout is available but not required is incorrect." | VERIFIED |
| A-047 | After the authority change, the Stabilizer System Safety Assessment was not updated. KNKT says FAA flight-control specialists 'may not have been aware' of the design change. | knkt-jt610-final-report-2019.pdf, PDF p.200, printed p.198 | "Without documenting the updated analysis in the stabilizer SSA document, the FAA flight control systems specialists may not have been aware of the design change." | VERIFIED-POSSIBLE |
| A-048 | KNKT found Boeing did not submit the required documentation and the FAA did not sufficiently oversee Boeing's ODA. | knkt-jt610-final-report-2019.pdf, PDF p.209, printed p.207 | "Boeing did not submit the required documentation and the FAA did not sufficiently oversee Boeing ODA." | VERIFIED |
| A-049 | Boeing proposed removing MCAS from the FCOM and differences tables starting in March 2016. The FAA accepted this, but the acceptance was not formally minuted. | knkt-jt610-final-report-2019.pdf, PDF p.200, printed p.198 | "Boeing proposed removing MCAS from the FCOM and differences tables. The supporting rationale was discussed between Boeing and FAA and accepted by FAA, but not formally documented in meeting minutes." | VERIFIED |
| A-050 | No information about MCAS was in the flight crew manuals or training, and there was no procedure for erroneous AOA. | knkt-jt610-final-report-2019.pdf, PDF p.215, printed p.213 | "No information about MCAS was given in the flight crew manuals and MCAS was not included in the flight crew training." | VERIFIED |
| A-051 | The runaway stabilizer procedure was not re-covered in transition training, and nothing linked uncommanded nose-down trim to it. KNKT found relying on memory items inappropriate. | knkt-jt610-final-report-2019.pdf, PDF p.207, printed p.205 | "The procedure of runaway stabilizer was not reintroduced during transition training and there was no immediate indication available to the flight crew to be able to directly correlate the uncommanded nose down stabilizer to the procedure." | VERIFIED |
| A-052 | KNKT considered the design and certification of MCAS inadequate. | knkt-jt610-final-report-2019.pdf, PDF p.20, printed p.xviii | "The investigation considered that the design and certification of this feature was inadequate." | VERIFIED |
| A-053 | Contributing factor 1 (verbatim): design-stage assumptions about crew response were consistent with industry guidelines but turned out to be incorrect. | knkt-jt610-final-report-2019.pdf, PDF p.217, printed p.215 | "During the design and certification of the Boeing 737-8 (MAX), assumptions were made about flight crew response to malfunctions which, even though consistent with current industry guidelines, turned out to be incorrect." | VERIFIED |
| A-054 | Contributing factor 2 (verbatim): on those assumptions and an incomplete review of flight-deck effects, single-sensor MCAS was deemed appropriate and met all certification requirements. | knkt-jt610-final-report-2019.pdf, PDF p.217, printed p.215 | "Based on the incorrect assumptions about flight crew response and an incomplete review of associated multiple flight deck effects, MCAS’s reliance on a single sensor was deemed appropriate and met all certification requirements." | VERIFIED |
| A-055 | Contributing factor 4 (verbatim): no guidance on MCAS or more detailed trim use in manuals and training made it harder for crews to respond to uncommanded MCAS. | knkt-jt610-final-report-2019.pdf, PDF p.217, printed p.215 | "The absence of guidance on MCAS or more detailed use of trim in the flight manuals and in flight crew training, made it more difficult for flight crews to properly respond to uncommanded MCAS." | VERIFIED |
| A-056 | The LNI610 crew's preflight discussion, as recorded on the CVR, did not cover the previous problems recorded in the AFML. | knkt-jt610-final-report-2019.pdf, PDF p.21, printed p.19 | "The CVR did not record the flight crew discussion related to the previous aircraft problem recorded in the Aircraft Flight and Maintenance Log (AFML)." | VERIFIED |
| A-057 | TO/GA pressed at 23:20:01 UTC. By 23:20:16 (80-knot call) the DFDR showed a left-right AOA difference of about 21°, which lasted to end of recording. Nothing about it was displayed in the cockpit. | knkt-jt610-final-report-2019.pdf, PDF p.21, printed p.19 | "At 23:20:01 UTC, the DFDR recorded Takeoff/Go-around (TO/GA) button was pressed and the engines spooled up to takeoff thrust." | VERIFIED |
| A-058 | At rotation (23:20:33 UTC) the FO called 'rotate'. Two seconds later, as the nose gear lifted off, the left stick shaker activated. | knkt-jt610-final-report-2019.pdf, PDF p.22, printed p.20 | "At 23:20:33 UTC, the FO called “rotate” and 2 seconds later as the nose gear lifted off the runway, the DFDR recorded left control column stick" | VERIFIED |
| A-059 | At 23:20:44 UTC the FO called auto brake disarm and 'Indicated Airspeed Disagree'. IAS DISAGREE stayed on to the end of the recording. | knkt-jt610-final-report-2019.pdf, PDF p.22, printed p.20 | "At 23:20:44 UTC, the FO called “Auto Brake Disarm” and advised the Captain of “Indicated Airspeed Disagree”." | VERIFIED |
| A-060 | At 23:22:33 UTC the flaps reached fully up and automatic nose-down trim (the first MCAS activation) ran for about 10 seconds, taking trim from 6.1 to 3.8 units. | knkt-jt610-final-report-2019.pdf, PDF p.23, printed p.21 | "At 23:22:33 UTC, the flaps reached the fully retracted position and the automatic AND trim was active for about 10 seconds, during which the horizontal stabilizer pitch trim decreased from 6.1 to 3.8 units." | VERIFIED |
| A-061 | On the first MCAS activation the Captain responded with the column in under 2 seconds, but MCAS ran for 10 seconds before he used electric trim. | knkt-jt610-final-report-2019.pdf, PDF p.193, printed p.191 | "For the first MCAS activation in the accident flight, the Captain responded less than 2 seconds, with aft control column but MCAS continued to move the horizontal stabilizer AND for a total of 10 seconds" | VERIFIED |
| A-062 | The FO could not find the Airspeed Unreliable checklist at first. He began reading it at 23:25:17 UTC (QRH page 10.1). | knkt-jt610-final-report-2019.pdf, PDF p.25, printed p.23 | "At 23:25:17 UTC, the FO stated “10.1” and began reading the Airspeed Unreliable checklist." | VERIFIED |
| A-063 | From final flap retraction to end of recording, the DFDR shows at least 26 automatic nose-down trim commands and at least 34 manual electric nose-up inputs. | knkt-jt610-final-report-2019.pdf, PDF p.80, printed p.78 | "there were at least 26 automatic trim down commands and at least 34 manual electric trim up inputs." | VERIFIED |
| A-064 | The controller gave eight heading instructions after the crew reported a flight control problem. The crew did not object and did not declare an emergency. | knkt-jt610-final-report-2019.pdf, PDF p.214, printed p.212 | "The controller provided eight heading instructions after the flight crew reported that the aircraft was experiencing a flight control problem" | VERIFIED |
| A-065 | When he handed over control (23:30:48 UTC), the Captain did not tell the FO about the difficulty or the need for repeated nose-up trim. | knkt-jt610-final-report-2019.pdf, PDF p.215, printed p.213 | "The Captain did not verbalize to the FO the difficulty in controlling the aircraft and the need for repeated aircraft nose up trim." | VERIFIED |
| A-066 | At 23:31:00 UTC, right after the handover, automatic nose-down trim ran for 8 seconds and pitch trim went from 5.4 to 3.4 units. | knkt-jt610-final-report-2019.pdf, PDF p.28, printed p.26 | "At 23:31:00 UTC, the automatic AND trim activated for 8 seconds, the pitch trim changed from 5.4 to 3.4 units." | VERIFIED |
| A-067 | After the handover, the FO's nose-up trim inputs were too short to counter repeated MCAS, so mis-trim built up. | knkt-jt610-final-report-2019.pdf, PDF p.181, printed p.179 | "The FO was unable to control the aircraft as the repetitive MCAS activations were not countered by adequate trim up input." | VERIFIED |
| A-068 | KNKT found column forces went over 100 lb, beyond the 75-lb regulatory limit, and the aircraft descended out of control. | knkt-jt610-final-report-2019.pdf, PDF p.208, printed p.206 | "Column forces exceeded 100 pounds, which is more than the 75-pound limit set by the regulation (14 CFR 25.143)." | VERIFIED |
| A-069 | A final MCAS activation began at 23:31:53 UTC. The DFDR stopped at 23:31:54 UTC and the CVR one second later. | knkt-jt610-final-report-2019.pdf, PDF p.29, printed p.27 | "At 23:31:53 UTC, MCAS activated until the DFDR stopped recording at 23:31:54 UTC and the CVR stopped recording 1 second later." | VERIFIED |
| A-070 | The crew never recognised the uncommanded stabilizer movement as a runaway stabilizer, so the runaway stabilizer procedure (and STAB TRIM CUTOUT) was never used. | knkt-jt610-final-report-2019.pdf, PDF p.195, printed p.193 | "During the accident flight, recognition of the uncommanded stabilizer movement as a runaway stabilizer condition did not occur thereby, the execution of the non-normal procedure did not occur." | VERIFIED |
| A-071 | KNKT considered that the continuous stick shaker noise may have kept the crew from hearing the trim wheel. | knkt-jt610-final-report-2019.pdf, PDF p.209, printed p.207 | "the noise could have interfered with the flight crew hearing the sound of the stabilizer trim wheel spinning during MCAS operations." | VERIFIED-POSSIBLE |
| A-072 | Contributing factor 9 (verbatim, first part): the multiple alerts, repeated MCAS and ATC distractions were not managed effectively, due to the situation's difficulty and crew performance. | knkt-jt610-final-report-2019.pdf, PDF p.217, printed p.215 | "The multiple alerts, repetitive MCAS activations, and distractions related to numerous ATC communications were not able to be effectively managed. This was caused by the difficulty of the situation and performance in manual handling, NNC execution, and flight crew communication," | VERIFIED |
| A-073 | KNKT recommendation 04.M-2018-35.11 to Boeing: consider the effect of all possible flight deck alerts on crew recognition and response, and change design, procedures or training where needed. | knkt-jt610-final-report-2019.pdf, PDF p.230, printed p.228 | "KNKT recommends that the aircraft manufacture to consider the effect of all possible flight deck alerts and indications on flight crew recognition and response" | VERIFIED |
| A-074 | KNKT recommendations 04.M-2018-35.13 and 04.R-2018-35.23: Boeing and the FAA should more closely scrutinise systems whose malfunction can lead to loss of control. | knkt-jt610-final-report-2019.pdf, PDF p.230, printed p.228 | "KNKT recommends that Boeing and the FAA more closely scrutinize the development and certification process for systems whose malfunction has the ability to lead to loss of control of the airplane." | VERIFIED |
| A-075 | KNKT recommendations 04.M-2018-35.15 and 04.R-2018-35.26: certified and delivered aircraft must have their intended system functionality (the AOA DISAGREE lesson). | knkt-jt610-final-report-2019.pdf, PDF p.231, printed p.229 | "KNKT recommends to Boeing that they ensure that certified and delivered airplanes have intended system functionality." | VERIFIED |
| A-076 | KNKT recommendation 04.R-2018-35.21 to FAA: review how it sets its level of involvement (degree of delegation) and how design changes are communicated to it. | knkt-jt610-final-report-2019.pdf, PDF p.232, printed p.230 | "KNKT recommends that the FAA review their processes for determining their level of involvement (degree of delegation) and how changes in the design are communicated to the FAA to ensure an appropriate level of review." | VERIFIED |
| A-077 | KNKT recommendation 04.R-2018-35.24 to FAA: work with international regulators to validate the crew-behaviour assumptions used in design. | knkt-jt610-final-report-2019.pdf, PDF p.233, printed p.231 | "KNKT recommends that the FAA work with international regulatory authorities to review assumptions on flight crew behavior used during design and revise certification processes to ensure assumptions used during the design process are validated." | VERIFIED |
| A-078 | KNKT recommendation 04.R-2018-35.22 to FAA: improve oversight of approved maintenance organizations after the Xtra equivalency/procedure gap went undetected. | knkt-jt610-final-report-2019.pdf, PDF p.232, printed p.230 | "KNKT recommends that the FAA improves the oversight to Approved Maintenance Organization (AMO) to ensure the processes within the AMO are conducted in accordance with the requirements." | VERIFIED |
| A-079 | KNKT recommendation 04.O-2018-35.5 to Lion Air: improve hazard report management, since LNI043 was a serious incident. | knkt-jt610-final-report-2019.pdf, PDF p.228, printed p.226 | "Therefore, KNKT recommends that Lion Air improve their hazard report management enabling identifying the hazard and provides proper mitigation." | VERIFIED |
| A-080 | KNKT's report records (finding 89) that another 737-8 (MAX) accident related to AOA sensor failure happened on 10 March 2019 (ET-AVJ, ET-302). | knkt-jt610-final-report-2019.pdf, PDF p.216, printed p.214 | "On 10 March 2019, an accident related to failure of an AOA sensor occurred involving a Boeing 737-8 (MAX) registered ET-AVJ operated by Ethiopian Airlines" | ATTRIBUTED |
B · EAIB final report, Ethiopian ET302, with NTSB and BEA dissent (controlling, accident 2) · 80 rows
| ID | Claim | Source and page | Verbatim | Status |
|---|---|---|---|---|
| B-001 | The aircraft was a Boeing 737-8 (MAX), registration ET-AVJ. The synopsis gives the accident date and time as 10 March 2019 at 05:44 UTC. | eaib-et302-final-report-2022.pdf, PDF p.17, printed p.17 | "Airplane Boeing 737-MAX8 registered ET-AVJ Date and time 10 March 2019 at 05:44 UTC" | VERIFIED |
| B-002 | All 157 people on board (149 passengers and 8 crew, including the IFSO) died, and the aircraft was destroyed. Scheduled flight ET302 from Addis Ababa to Nairobi. | eaib-et302-final-report-2022.pdf, PDF p.20, printed p.20 | "There were 149 passengers and 8 crews on board. All were fatally injured, and the Airplane was destroyed." | VERIFIED |
| B-003 | The captain (pilot flying) was 29 years old, had 8,122 total hours, and had 103 hours on the 737-8 MAX. | eaib-et302-final-report-2022.pdf, PDF p.33, printed p.33 | "Total Flying Hours 8122:00 hrs B737-700/800 4017:00 hrs B737-700/800/as PIC 1417:00 hrs B737-8 MAX 103:00" | VERIFIED |
| B-004 | The first officer was 25 years old and had 361 total hours, 207:26 of them on the 737-700/800/MAX. | eaib-et302-final-report-2022.pdf, PDF p.34, printed p.34 | "Total Flying Hours 361:00hrs B737-700/800/MAX 207:26 hrs" | VERIFIED |
| B-005 | At 05:36:12 the aircraft lined up on runway 07R (field elevation 7,656 ft) with flaps 5 and stabilizer trim at 5.6 units. | eaib-et302-final-report-2022.pdf, PDF p.20, printed p.20 | "At 5:36:12 the Airplane lined up on runway 07R at field elevation of 7,656ft with a flap setting of 5 degrees and a stabilizer trim setting of 5.6 units" | VERIFIED |
| B-006 | During the takeoff roll the engines stabilized at about 94% N1, and the N1 reference stayed at about 94% for most of the flight. | eaib-et302-final-report-2022.pdf, PDF p.20, printed p.20 | "During takeoff roll, the engines stabilized at about 94% N1. From this point for most of the flight, the N1 Reference remained about 94%." | VERIFIED |
| B-007 | At 05:38:44, shortly after liftoff, the left and right AOA values began to diverge. The left fell to 11.1 degrees and then rose to 35.7 degrees, while the right read 14.94 degrees. | eaib-et302-final-report-2022.pdf, PDF p.21, printed p.21 | "At 05:38:44, shortly after liftoff, the left and right recorded AOA values began deviating. Left AOA decreased to 11.1° then increased to 35.7° while value of right AOA indicated 14.94°" | VERIFIED |
| B-008 | Because of the erroneous left AOA, the captain's stick shaker activated and stayed active until near the end of the recording. | eaib-et302-final-report-2022.pdf, PDF p.21, printed p.21 | "As a result of the erroneous left AOA value, the left stick shaker activated and the red and black stripe band exceeded the displayed LH airspeed. The left stick shaker remained active until near the end of the recording." | VERIFIED |
| B-009 | The FDR recorded the left AOA vane heater as failed, with the first OFF value at 05:38:51. The parameter is sampled at 0.25 Hz. | eaib-et302-final-report-2022.pdf, PDF p.126, printed p.126 | "the primary AOA heat LH recorded values underlined a failure of the vane heating (first recorded OFF value at 5 h 38 min 51s, sampling rate of the parameter: 0.25 Hz)." | VERIFIED |
| B-010 | The IAS DISAGREE and ALT DISAGREE alerts were not recorded. By computation, IAS DISAGREE should have appeared at 05:38:49 and ALT DISAGREE at 05:38:51. | eaib-et302-final-report-2022.pdf, PDF p.247, printed p.247 | "IAS, ALT DISAGREE alerts were not recorded in the FDR, but the time of appearance has been computed, as per computation, the IAS disagree alert should normally have triggered at 5 h 38 min 49 s" | VERIFIED-POSSIBLE |
| B-011 | The EAIB says this leaves it uncertain whether the alerts appeared. The crew did not apply the Airspeed Unreliable checklist. | eaib-et302-final-report-2022.pdf, PDF p.247, printed p.247 | "This has led to uncertainty about the appearance of alerts and the crew who thus did not apply the Airspeed Unreliable Non-Normal Check-list" | VERIFIED |
| B-012 | BEA: computation, later confirmed in Boeing's engineering simulator, established that the IAS DISAGREE and ALT DISAGREE messages appeared on both PFDs. | bea-comment-on-eaib-final-2022.pdf, PDF p.1, printed p.unnumbered | "it has been established, by computations and later confirmed at the Boeing engineering simulator (eCAB), that they appeared on both PFDs." | ATTRIBUTED |
| B-013 | BEA: the lack of any crew discussion on the CVR suggests the crew most probably never saw the IAS/ALT DISAGREE messages. | bea-comment-on-eaib-final-2022.pdf, PDF p.2, printed p.unnumbered | "which supports the conclusion that the IAS DISAGREE and ALT DISAGREE messages were most probably not seen by the crew throughout the flight." | ATTRIBUTED |
| B-014 | The AOA DISAGREE alert did not appear on ET-AVJ even though its conditions were met, because Ethiopian had not bought the optional AOA indicator and the display software tied the alert to that option. | eaib-et302-final-report-2022.pdf, PDF p.54, printed p.54 | "Ethiopian Airlines did not select the optional AOA indicator feature on the PFD of their 737-MAX8 Airplane; thereforeas a result, the AOA DISAGREE did not appear on ET-AVJ Airplane, even though the necessary conditions were met." | VERIFIED |
| B-015 | At 05:38:56 the captain called 'command' to engage the autopilot. It did not engage, and the disconnect warning sounded for 2 seconds. | eaib-et302-final-report-2022.pdf, PDF p.22, printed p.22 | "At 05:38:56, the captain stated “command” to engage the autopilot (A/P). A/P disconnect warning sounded for 2 seconds." | VERIFIED |
| B-016 | EAIB: trying to engage the autopilot with the stick shaker active did not match the procedure. | eaib-et302-final-report-2022.pdf, PDF p.221, printed p.221 | "At that time the FD pitch bars were out of view, this action, was not consistent with the procedure to be used with an ongoing stick shaker." | VERIFIED |
| B-017 | EAIB (possibility): the captain may have read the post-Lion Air bulletin as meaning the problem would go away once the autopilot was engaged. | eaib-et302-final-report-2022.pdf, PDF p.222, printed p.222 | "There might be a chance that the pilot perceived the bulletin in the above discussed manner and believed the problem would disappear given he engages the autopilot" | VERIFIED-POSSIBLE |
| B-018 | BEA: of the Approach to Stall recovery steps, the crew performed only the nose-down input. The autothrottle stayed engaged and the captain later insisted on engaging the autopilot. | bea-comment-on-eaib-final-2022.pdf, PDF p.1, printed p.unnumbered | "Only the nose down input was performed by the flight crew. The autothrottle remained engaged and the pilot later insisted on engaging the A/P." | ATTRIBUTED |
| B-019 | At 05:39:23, at about 1,000 ft radio altitude, the third attempt engaged the autopilot (CMD A). Fed by the erroneous left AOA, it then pitched down towards a false minimum speed. | eaib-et302-final-report-2022.pdf, PDF p.23, printed p.23 | "At 05:39:23, at about 1,000 feet Radio Altitude, the crew attempted a third auto-pilot engagement (point C). CMD A (LH autopilot) engaged in HDG/VNAV modes." | VERIFIED |
| B-020 | EAIB: the autothrottle stayed in ARM, never reduced to climb thrust, and gave no failure flag. The EAIB says the high workload must have kept the crew from noticing. | eaib-et302-final-report-2022.pdf, PDF p.223, printed p.223 | "in an extremely high workload environment must have caused the auto throttle remaining in the ARM mode with take-off thrust set to remain unnoticed by the crew." | VERIFIED |
| B-021 | BEA: the crew never called out the ARM mode and very probably did not notice it. The lack of thrust reduction made the aircraft harder to control for the rest of the flight. | bea-comment-on-eaib-final-2022.pdf, PDF p.2, printed p.unnumbered | "The ARM mode was never verbalised. It is highly probable that it was not identified by the crew." | ATTRIBUTED |
| B-022 | At 05:40:00, with the flaps up and the autopilot off, the first MCAS nose-down activation began and ran for 9 seconds. | eaib-et302-final-report-2022.pdf, PDF p.25, printed p.25 | "At 5:40:00: As the flaps reached the up position with the autopilot OFF and because of the erroneous left AOA value, the FCC activated the 1st automatic nose down trim (MCAS) during 9 seconds." | VERIFIED |
| B-023 | At 05:40:14 the captain made a roughly 2-second electric trim-up input. The EAIB says it was not enough to trim out MCAS. | eaib-et302-final-report-2022.pdf, PDF p.224, printed p.224 | "only a brief electric trim up input of 2 seconds was recorded, which was insufficient to trim out the MCAS inputs and to relieve the aerodynamic loads." | VERIFIED |
| B-024 | At 05:40:22, five seconds after the captain's trim input, MCAS activated a second time. The GPWS DON'T SINK alert sounded, PULL UP was shown, and the captain said 'cut it'. | eaib-et302-final-report-2022.pdf, PDF p.26, printed p.26 | "Duringthe nose-down trim activation, GPWS DON’T SINK sounded and PULL UP was displayed on the PFDs. The Captain said “cut it”." | VERIFIED |
| B-025 | From 05:40:28 the captain made a 9-second electric trim-up input, which stopped MCAS 2 about two seconds early. | eaib-et302-final-report-2022.pdf, PDF p.26, printed p.26 | "Manual electric trim up inputs started at 5h 40min 28s for 9s, which stopped the second automatic nose-downtrim activation two seconds before its expected end" | VERIFIED |
| B-026 | EAIB: whenever the pilot trimmed electrically, the trim stopped at about 2.3 units, and the report says it does not know why. | eaib-et302-final-report-2022.pdf, PDF p.248, printed p.248 | "At different times when the pilot applied electrical trim for short duration or longer duration the trim stopped at about 2.3 for unknown reason;" | VERIFIED |
| B-027 | The F/O twice suggested 'stab trim cut out?'. The captain said 'yes yes do it', and the cutout switches were most likely set to CUTOUT at about 05:40:38. | eaib-et302-final-report-2022.pdf, PDF p.26, printed p.26 | "The F/Othen twice suggested “stab trim cut out?” The Captain replied “yes yes do it”. The stab trim cut-out switches were most likely put in the cut-out positionat about 5 h 40 min 38 s" | VERIFIED |
| B-028 | At 05:40:43 MCAS commanded a third time, but the stabilizer did not move, which is consistent with the cutout switches being in CUTOUT. | eaib-et302-final-report-2022.pdf, PDF p.27, printed p.27 | "At 05:40:43: approximately five seconds after the end of crew manual electrical trim up inputs, a third automatic nose-down trim (MCAS) triggered." | VERIFIED |
| B-029 | At 05:41:21 the right-side overspeed warning started and stayed on to the end. Right airspeed held around 360 to 375 kt, above Vmo of 340 kt. | eaib-et302-final-report-2022.pdf, PDF p.152, printed p.152 | "Over speed warning RH side triggered at 5 h 41 min 21 s and stayed engaged until the end of the recording." | VERIFIED |
| B-030 | BEA: the crew's surprise at the overspeed warning may mean they had lost track of airspeed after flap retraction, and no thrust reduction was made. | bea-comment-on-eaib-final-2022.pdf, PDF p.3, printed p.unnumbered | "The crew expressed their surprise. This may indicate that after retracting the flaps, the crew lost track of the IAS values. No thrust reduction was however performed." | ATTRIBUTED |
| B-031 | At 05:41:47 the F/O was told to try the manual trim wheel. At 05:41:56 he said 'It is not working'. Airspeed was about 340 kt. | eaib-et302-final-report-2022.pdf, PDF p.28, printed p.28 | "At 5:41:56 the F/O stated “It is not working”" | VERIFIED |
| B-032 | EAIB: the force needed to correct the -2.7 mistrim with the manual wheel was beyond what the crew could do. | eaib-et302-final-report-2022.pdf, PDF p.233, printed p.233 | "Therefore, the force required to correct the mis-trim of -2.7 was out of the acceptable capability of the crew." | VERIFIED |
| B-033 | EAIB: the high wheel force came from airload on the stabilizer caused by the column force being held, rather than from airspeed. | eaib-et302-final-report-2022.pdf, PDF p.227, printed p.227 | "The significant amount of force required to turn the manual trim wheel was found to be the excessive airload on the stabilizer attributed to the force held on the control column" | VERIFIED |
| B-034 | Electric stabilizer trim was re-engaged: by 05:43:11 the FDR shows the cutout switches back in NORMAL, with two brief trim-up inputs at a stabilizer position of 2.3 units. | eaib-et302-final-report-2022.pdf, PDF p.30, printed p.30 | "2 short-time manual electrical trim up inputs were recorded, which confirms that the stabilizer cutout switches had been restored to the normal position" | VERIFIED |
| B-035 | EAIB (possibility): the crew most likely re-engaged electric trim to find another way to relieve the column force. | eaib-et302-final-report-2022.pdf, PDF p.228, printed p.228 | "It most likely appears that the flight crew were trying to find other means to relieve the force." | VERIFIED-POSSIBLE |
| B-036 | At 05:43:21 MCAS activated a fourth time for about 5 seconds and moved the stabilizer from 2.3 to 1 unit. The aircraft began to descend. | eaib-et302-final-report-2022.pdf, PDF p.30, printed p.30 | "At 05:43:21, approximately five seconds after the last main electric trim up input, an automatic nose-down trim (4th MCAS) triggered for about 5s (point L). The stabilizer moved from 2.3 to 1 unit." | VERIFIED |
| B-037 | Near the end of MCAS 4, the crew's average column force fell from 100 lb to 78 lb in 3.5 seconds. Pitch went from +0.5 to -7.8 degrees and descent passed 5,000 ft/min. | eaib-et302-final-report-2022.pdf, PDF p.30, printed p.30 | "One second before the end of the automatic trim nose-down activation, the average force applied by the crew decreased from 100 lbs to 78 lbs in 3.5 seconds." | VERIFIED |
| B-038 | At the end of the recording, computed airspeed reached 500 kt, pitch was more than 40 degrees nose-down, and descent rate was more than 33,000 ft/min. | eaib-et302-final-report-2022.pdf, PDF p.30, printed p.30 | "- Computed airspeed values reached 500Kt - Pitch values were greater than 40° nose down - Vertical speed values were greater than 33,000 ft/min." | VERIFIED |
| B-039 | EAIB: flight-control write-ups on ET-AVJ began on 3 December 2018, eighteen days after delivery. | eaib-et302-final-report-2022.pdf, PDF p.37, printed p.37 | "Flight control problems started occurring on the ET302 airplane on Dec 3, 2018, eighteen days after delivery." | ATTRIBUTED |
| B-040 | EAIB Finding 65: the AOA malfunction likely came from a power-quality problem that cut power to the left AOA heater, likely a production-related intermittent electrical fault. | eaib-et302-final-report-2022.pdf, PDF p.252, printed p.252 | "The AOA Sensor malfunction likely occurred as the result of power quality problem that resulted in the loss of power to the left AOA Sensor Heater." | DISPUTED (dissent: B-044, B-045, B-046, B-047, B-048, B-050) |
| B-041 | EAIB Finding 50: neither MCAS nor the lack of training triggered the accident. The EAIB says the trigger was sensor failure from production quality defects. | eaib-et302-final-report-2022.pdf, PDF p.250, printed p.250 | "MCAS and the lack of pilot training did not trigger the accident; however it was the failure of the sensors due to the production quality defects." | DISPUTED (dissent: B-044, B-045, B-050) |
| B-042 | EAIB: a runway walk found no bird remains and no AOA vane parts. The FDR shows the left AOA deviation began over taxiway D. | eaib-et302-final-report-2022.pdf, PDF p.83, printed p.83 | "The investigation team confirmed that there was no evidence of a bird and AOA vane remains in the highlighted search area." | DISPUTED (dissent: B-049) |
| B-043 | EAIB: it cannot comment on or verify the conclusions of Collins' laboratory analysis, which it says did not analyse power-quality problems. It says Collins did not evaluate Boeing's electrical installation and testing. | eaib-et302-final-report-2022.pdf, PDF p.84, printed p.84 | "Hence, the investigation team cannot comment and verify on the conclusions noted in Collin’s report." | DISPUTED (dissent: B-048, B-080, B-050) |
| B-044 | NTSB: the final report gives no details to support its statements that there was an electrical problem with the left AOA sensor. | ntsb-response-to-eaib-final-2022.pdf, PDF p.2, printed p.2 | "However, the final report does not provide any details to support the EAIB’s statements about the existence of an electrical problem related to the left AOA sensor." | ATTRIBUTED |
| B-045 | NTSB: the erroneous AOA output came from the vane separating after impact with a foreign object, most likely a bird. | ntsb-response-to-eaib-final-2022.pdf, PDF p.2, printed p.2 | "The US team found that the erroneous AOA sensor output was caused by the separation of the AOA sensor vane due to impact with a foreign object, which was most likely a bird." | ATTRIBUTED |
| B-046 | NTSB: it was above freezing with no moisture, so losing heater current could not by itself have changed the AOA output. | ntsb-response-to-eaib-final-2022.pdf, PDF p.3, printed p.3 | "Thus, a loss of electrical current through the vane heater at any time during the accident flight would not explain the event because the loss of electrical current would have had no effect on the AOA sensor output." | ATTRIBUTED |
| B-047 | NTSB: the FDR showed no electrical problem with the AOA resolvers, and both resolvers shifted instantly and together. | ntsb-response-to-eaib-final-2022.pdf, PDF p.4, printed p.4 | "both internal resolvers for the left AOA sensor had an instantaneous, simultaneous, and common shift in output signal." | ATTRIBUTED |
| B-048 | NTSB: according to Collins' fault tree, only foreign-object impact separating the vane could explain both the heater current loss and the shift in both resolvers. | ntsb-response-to-eaib-final-2022.pdf, PDF p.5, printed p.5 | "Only one failure mode—a foreign object impact leading to an AOA vane separation—could result in a simultaneous loss of electrical current through the vane heater and a common shift in both resolver output values" | ATTRIBUTED |
| B-049 | NTSB: the bird-remains search took place 8 days after the accident and did not cover the area around taxiway D. | ntsb-response-to-eaib-final-2022.pdf, PDF p.4, printed p.4 | "the search for bird remains occurred 8 days after the accident and did not include the area surrounding taxiway D, where the airplane would have been positioned when the left AOA sensor output became erroneous." | ATTRIBUTED |
| B-050 | BEA: the AOA manufacturer's testing and analysis concluded that the only possible scenario was a foreign-object impact, most likely a bird. This was presented to the EAIB in September 2019. | bea-comment-on-eaib-final-2022.pdf, PDF p.1, printed p.unnumbered | "concluded that the only possible scenario for the AOA sensor erroneous data was a foreign object impact, most likely a bird, causing separation of the vane at the hub and breaking of the vane heater wires." | ATTRIBUTED |
| B-051 | NTSB: overall, it agrees with the EAIB's investigation of MCAS and related systems and their role in the accident. | ntsb-response-to-eaib-final-2022.pdf, PDF p.1, printed p.unnumbered | "Overall, the NTSB concurs with the EAIB’s investigation of the Maneuvering Characteristics Augmentation System (MCAS) and related systems and the roles that they played in the accident." | ATTRIBUTED |
| B-052 | NTSB: its May 2022 comments were not appended to the final report, which linked to an earlier, outdated version. The final report also contained new information the NTSB had not reviewed. | ntsb-response-to-eaib-final-2022.pdf, PDF p.1, printed p.unnumbered | "the NTSB’s comments (dated May 12, 2022) on the EAIB’s last draft report (dated March 30, 2022) were not appended to the final report, as requested by the NTSB and provided by section 6.3 of Annex 13." | ATTRIBUTED |
| B-053 | EAIB Finding 80: Boeing issued FCOM bulletin ETH-12 on 6 November 2018 and the FAA issued Emergency AD 2018-23-51 on 7 November 2018. Both were incorporated into Ethiopian's FCOM and AFM. | eaib-et302-final-report-2022.pdf, PDF p.254, printed p.254 | "Boeing and FAA released FCOM bulletin ETH-12 on November 6, 2018 and FAA AD# 2018-23-51 on November 7, 2018 respectively. Both documents were incorporated in the Ethiopian airlines FCOM and AFM per the instruction therein;" | VERIFIED |
| B-054 | Ethiopian's flight operations uploaded the AD and bulletin to Logipad, emailed them to every 737 pilot, and added runaway stabilizer practice to recurrent training. | eaib-et302-final-report-2022.pdf, PDF p.187, printed p.187 | "ensured that all crew members have received the AD and OMB by uploading them on Logipad. Furthermore, the documents were also sent to each B737 flight crew by email." | VERIFIED |
| B-055 | BEA proposed contributing factor: relying on Logipad alone to distribute the post-Lion Air MCAS information meant the airline could not confirm that crews had read and understood it. | bea-comment-on-eaib-final-2022.pdf, PDF p.3, printed p.unnumbered | "This system was used to disseminate the information related to the MCAS system issued following the previous 737 Max accident and did not allow the airline to ensure that the crews had read and correctly understood this information." | ATTRIBUTED |
| B-056 | The bulletin as quoted by the EAIB: repeated nose-down trim continues unless both STAB TRIM CUTOUT switches are used per the runaway stabilizer checklist. | eaib-et302-final-report-2022.pdf, PDF p.237, printed p.237 | "Repetitive cycles of commanded nose down stabilizer continue to occur unless the stabilizer trim system is deactivated through the use of both STAB TRIM CUTOUT switches in accordance with the existing procedure in the runaway stabilizer NNC." | VERIFIED |
| B-057 | EAIB Finding 83: the emergency AD procedures were inadequate and unverified, and did not mention possible autothrottle malfunction from erroneous AOA. | eaib-et302-final-report-2022.pdf, PDF p.254, printed p.254 | "The emergency AD pilot procedures were inadequate and unverified. AD 2018-23-51 does not mention the possibility of an auto throttle malfunction due to an erroneous AOA input;" | VERIFIED |
| B-058 | EAIB Finding 78: MCAS would never have activated with flaps down, and this was not in the FCOM bulletin or the AD. | eaib-et302-final-report-2022.pdf, PDF p.253, printed p.253 | "MCAS would never have activated repeated nose down trim if the flaps were still left down, even in the presence of erroneous AOA. This critical information was not included in the FCOM bulletin or in the airworthiness directive;" | DISPUTED (dissent: B-059, B-060) |
| B-059 | NTSB: Boeing's multi-operator message of 10 November 2018 included the flap condition. The EAIB appended it without saying so, which makes Finding 78 misleading. | ntsb-response-to-eaib-final-2022.pdf, PDF p.6, printed p.6 | "Although the EAIB appended Boeing’s multi-operator message to the final report, the EAIB failed to mention that the flaps information appeared in that document; thus, this finding is misleading." | ATTRIBUTED |
| B-060 | The Boeing message appended to the EAIB report states that MCAS operates only in manual, flaps-up flight. | eaib-et302-final-report-2022.pdf, PDF p.277, printed p.277 | "MCAS is activated without pilot input and onlyoperates in manual, flaps up flight." | VERIFIED |
| B-061 | EAIB Finding 87: after Lion Air, Ethiopian's training department asked Boeing about MCAS and checklist priority. Boeing did not answer all the questions, citing the Lion Air investigation. | eaib-et302-final-report-2022.pdf, PDF p.254, printed p.254 | "In its reply, Boeing did not answer all asked questions made by Ethiopian airlines training department, indicating that it was related to an ongoing Lion Air accident investigation;" | VERIFIED |
| B-062 | EAIB Finding 88: if Boeing had answered, it would have significantly altered the outcome. | eaib-et302-final-report-2022.pdf, PDF p.255, printed p.255 | "if Boeing had answered the questions raised by the training department either directly or indirectly through a revision of the FCOM bulletin or a suggested training, it would have significantly altered the outcome." | VERIFIED-POSSIBLE |
| B-063 | EAIB Finding 49: the few hours of MAX differences CBT contained nothing describing MCAS. | eaib-et302-final-report-2022.pdf, PDF p.250, printed p.250 | "There was CBT training for a few hours long which was supposed to cover the difference between MAX and NG but there was no information related to MCAS description in the CBT;" | VERIFIED |
| B-064 | EAIB Finding 19: relying on a single AOA input left MCAS open to unwanted activation, and its repeated nose-down trim made the aircraft uncontrollable. | eaib-et302-final-report-2022.pdf, PDF p.248, printed p.248 | "MCAS design on a single AOA inputs made it vulnerable to undesired activation. Its repetitive activation of nose down stabilizer trim made the aircraft uncontrollable;" | VERIFIED |
| B-065 | EAIB Finding 57: the captain's priority stayed on controlling the aircraft, in line with the FCTM and Ethiopian training. | eaib-et302-final-report-2022.pdf, PDF p.251, printed p.251 | "The Captain’s priority remained to control the Airplane, which is in line with flight crew training manual (FCTM) guideline and training at Ethiopian Airlines regarding the prioritization of tasks in case of failure on board;" | DISPUTED (dissent: B-069, B-072, B-073) |
| B-066 | EAIB PROBABLE CAUSE (Section 3.2): repeated uncommanded nose-down inputs from MCAS due to erroneous AOA input. | eaib-et302-final-report-2022.pdf, PDF p.255, printed p.255 | "Repetitive and uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA input, and its unrecoverable activation system which made the airplane dive with the rate of -33,000 ft/min close to the ground was the most probable cause" | DISPUTED (dissent: B-068, B-072, B-073, B-074, B-075, B-076, B-055) |
| B-067 | EAIB Contributing Factor 2: Boeing assumed pilots would recognise and handle uncommanded MCAS, and the post-Lion Air bulletin and AD did not prevent another MCAS-related accident. | eaib-et302-final-report-2022.pdf, PDF p.255, printed p.255 | "The OMB and Emergency AD issued after the Lion Air accident included additional guidance but did not have the intended effect of preventing another MCAS-related accident;" | VERIFIED |
| B-068 | BEA: the EAIB report does not deal adequately with operational and crew-performance issues, especially before the first MCAS activation. | bea-comment-on-eaib-final-2022.pdf, PDF p.1, printed p.unnumbered | "The BEA considers that the operational and crew performance aspects are insufficiently addressed in the EAIB final report, in particular with regard to the sequence of events that occurred before the activation of the 1st MCAS." | ATTRIBUTED |
| B-069 | BEA: coordination and communication between the captain and F/O were very limited, and there was no discussion or diagnosis of what was happening. | bea-comment-on-eaib-final-2022.pdf, PDF p.2, printed p.unnumbered | "coordination and communication between the Captain and the F/O were very limited and insufficient. There was no discussion or diagnosis with respect to the nature of the events on board." | ATTRIBUTED |
| B-070 | BEA: the F/O seemed overwhelmed from the moment the stick shaker started, and his low experience ('300 hours total') may explain this. | bea-comment-on-eaib-final-2022.pdf, PDF p.2, printed p.unnumbered | "His low flight experience (300 hours total) may have accounted for this situation." | ATTRIBUTED |
| B-071 | BEA: the parts of the CVR transcript showing the F/O's difficulties were removed from the extracts in the report. | bea-comment-on-eaib-final-2022.pdf, PDF p.2, printed p.unnumbered | "The BEA regrets that the parts of the CVR transcript which show the difficulties encountered by the FO have been removed from the extracts of the CVR transcript published in the report." | ATTRIBUTED |
| B-072 | BEA on the probable cause: the EAIB names only MCAS, but crew actions and CRM also played a role, especially before the first MCAS. | bea-comment-on-eaib-final-2022.pdf, PDF p.3, printed p.unnumbered | "The BEA believes that the crew’s inadequate actions and the insufficient Cockpit Resource Management (CRM) played a role in the chain of events that led to the accident," | ATTRIBUTED |
| B-073 | BEA proposed contributing factor: the crew did not apply the Approach to Stall recovery or the Airspeed Unreliable checklist after takeoff and before the first MCAS. | bea-comment-on-eaib-final-2022.pdf, PDF p.3, printed p.unnumbered | "The flight crew’s failure to apply, immediately after take-off and before the first MCAS activation, the Approach to Stall or Stall Recovery Manoeuvre and the Airspeed Unreliable Non-Normal Check-list;" | ATTRIBUTED |
| B-074 | BEA proposed contributing factor: the captain insisted on engaging the autopilot, contrary to the stall recovery procedure. | bea-comment-on-eaib-final-2022.pdf, PDF p.3, printed p.unnumbered | "The Captain’s insistence on engaging the AP, contrary to the Approach to Stall or Stall Recovery manoeuvre procedure;" | ATTRIBUTED |
| B-075 | BEA proposed contributing factor: not enough electric trim was used to relieve column forces after the MCAS nose-down commands. | bea-comment-on-eaib-final-2022.pdf, PDF p.3, printed p.unnumbered | "Insufficient use of the electric trim to relieve the high control column forces after the MCAS nose down orders;" | ATTRIBUTED |
| B-076 | BEA proposed contributing factor: the captain did not reduce thrust as speed became excessive, which together with insufficient trim made the column and trim-wheel forces unmanageable. | bea-comment-on-eaib-final-2022.pdf, PDF p.3, printed p.unnumbered | "The Captain’s lack of thrust reduction when the speed became excessive, which in combination with insufficient trim, caused an increase of the forces which became unmanageable on both the control column and the manual trim wheel." | ATTRIBUTED |
| B-077 | EAIB: after ET302 Boeing told the NTSB of an 'engineering design error' in its AOA sensor hazard analysis, and nobody told the Ethiopian authorities. | eaib-et302-final-report-2022.pdf, PDF p.244, printed p.244 | "Neither Boeing, the NTSB, nor the FAA informed Ethiopian authorities about this critical error that was communicated to the NTSB by Boeing seven months earlier." | DISPUTED (dissent: B-078, B-079) |
| B-078 | NTSB: the 'engineering design error' was a fault-tree error for the ADIRS. It was covered in an NTSB report the EAIB received on 2 December 2019, and was made public. | ntsb-response-to-eaib-final-2022.pdf, PDF p.6, printed p.6 | "The NTSB notes that the “engineering design error” was an error in a fault tree that was developed for the Boeing 737 MAX air data inertial reference system." | ATTRIBUTED |
| B-079 | NTSB: the investigation found no design or testing errors in the AOA sensor hardware itself. | ntsb-response-to-eaib-final-2022.pdf, PDF p.6, printed p.6 | "The intent of this sentence is unclear given that the investigation found no design or testing errors with the AOA sensor hardware itself." | ATTRIBUTED |
| B-080 | NTSB: the EAIB's criticism that Collins did not evaluate Boeing's electrical installation and testing was not appropriate for a supplier. | ntsb-response-to-eaib-final-2022.pdf, PDF p.2, printed p.2 | "This criticism was not appropriate given that Collins, as a supplier of the AOA sensors, does not evaluate electrical installation and test procedures for any aircraft original equipment manufacturer customer" | ATTRIBUTED |
F · Lion Air formal comments on KNKT (operator dissent) · 5 rows
| ID | Claim | Source and page | Verbatim | Status |
|---|---|---|---|---|
| F-001 | Lion Air disputes KNKT contributing factor 8: the previous crew's post-flight report should not be a contributing factor. | knkt, PDF p.320, printed p.318 | "The Flight JT43 crew's post-flight report to maintenance personnel should not be a contributing factor." | ATTRIBUTED — OPERATOR DISSENT |
| F-002 | Lion Air says the AOA DISAGREE alert did not appear because of a software error Boeing knew of. | knkt, PDF p.320, printed p.318 | "the AOA DISAGREE Alert did not appear on the captain's PFD due to a software error, known to Boeing but concealed from operators." | ATTRIBUTED-CHARACTERISATION |
| F-003 | Lion Air says the previous-flight captain reported every alert that appeared on his display. | knkt, PDF p.320, printed p.318 | "The Flight JT43 captain reported all alerts that appeared on his PFD." | ATTRIBUTED — OPERATOR DISSENT |
| F-004 | Lion Air says neither crew had knowledge, guidance or training on MCAS. | knkt, PDF p.320, printed p.318 | "Neither the Flight JT43 crew nor the Flight JT610 crew had any knowledge, guidance, or training on MCAS." | ATTRIBUTED |
| F-005 | Lion Air's own contributing-factor list leads with Boeing's design and self-certification permitting a single-point failure. | knkt, PDF p.315, printed p.313 | "Boeing's design and self-certification of MCAS did not comply with applicable safety and airworthiness standards and permitted a single-point failure" | ATTRIBUTED-CHARACTERISATION |
C · House T&I Committee report (later analysis, attributed) · 80 rows
| ID | Claim | Source and page | Verbatim | Status |
|---|---|---|---|---|
| C-001 | Report provenance: the Committee says the report was produced by Democratic (majority) staff, not by an accident investigation body. | house-ti-737max-final-report-2020.pdf, PDF p.13, printed p.6 | "This report was produced by Democratic staff of the Committee" | ATTRIBUTED-FINDING |
| C-002 | Committee's headline conclusion: design flaws, faulty assumptions about pilot response, and management failures at Boeing and the FAA played 'instrumental and causative roles' in the chain of errors. | house-ti-737max-final-report-2020.pdf, PDF p.12, printed p.5 | "Technical design flaws, faulty assumptions about pilot responses, and management failures by both The Boeing Company (Boeing) and the Federal Aviation Administration (FAA) played instrumental and causative roles in the chain of errors" | ATTRIBUTED-FINDING |
| C-003 | Committee characterises FAA oversight as the result of 'regulatory capture'. | house-ti-737max-final-report-2020.pdf, PDF p.13, printed p.6 | "the pernicious result of regulatory capture on the part of the FAA" | ATTRIBUTED-CHARACTERISATION |
| C-004 | Theme 3: 'Culture of Concealment': Boeing withheld crucial information from the FAA, customers and pilots. | house-ti-737max-final-report-2020.pdf, PDF p.20, printed p.13 | "3) Culture of Concealment. In several critical instances, Boeing withheld crucial information from the FAA, its customers, and 737 MAX pilots." | ATTRIBUTED-CHARACTERISATION |
| C-005 | Post-accident category headline. The Committee links the post-Lion Air response to the 157 deaths on ET302. | house-ti-737max-final-report-2020.pdf, PDF p.35, printed p.28 | "Both Boeing and the FAA gambled with the public’s safety in the aftermath of the Lion Air crash, resulting in the death of 157 more individuals on Ethiopian Airlines flight 302" | ATTRIBUTED-CHARACTERISATION |
| C-006 | Committee: Boeing did not hide MCAS from regulators or some airlines, but appears to have downplayed it and deflected attention from it. | house-ti-737max-final-report-2020.pdf, PDF p.99, printed p.92 | "While Boeing did not hide MCAS from regulators, or even some airlines, it appears Boeing took efforts over the lifespan of the MAX program to downplay and deflect attention away from MCAS" | ATTRIBUTED-CHARACTERISATION |
| C-007 | Original MCAS was designed to activate only at higher speeds, above certain G and AOA thresholds. | house-ti-737max-final-report-2020.pdf, PDF p.110, printed p.103 | "Initially, MCAS on the MAX was designed to activate only at higher speeds and in conditions not normally experienced in commercial flight." | ATTRIBUTED-FINDING |
| C-008 | Original MCAS authority: a maximum of 0.6 degrees of horizontal-stabilizer movement. | house-ti-737max-final-report-2020.pdf, PDF p.110, printed p.103 | "As originally designed, MCAS was only capable of moving the horizontal stabilizer a maximum of 0.6 degrees." | ATTRIBUTED-FINDING |
| C-009 | In March 2016, after test pilots found poor handling near the stall at lower speeds, Boeing redesigned MCAS to activate at lower speeds. | house-ti-737max-final-report-2020.pdf, PDF p.110, printed p.103 | "when Boeing test pilots found the MAX was not handling well when nearing stalls at lower speeds, Boeing redesigned MCAS to enable it to activate at lower speeds." | ATTRIBUTED-FINDING |
| C-010 | Redesigned MCAS authority: a maximum of 2.5 degrees of stabilizer movement, up from 0.6. | house-ti-737max-final-report-2020.pdf, PDF p.110, printed p.103 | "the new version of MCAS was capable of moving the horizontal stabilizer a maximum of 2.5 degrees (as opposed to 0.6 degrees as originally designed)." | ATTRIBUTED-FINDING |
| C-011 | Leverkuhn (VP/GM) and Teal (Chief Project Engineer) approved the March 2016 redesign to increase MCAS low-speed authority for certification stall requirements. | house-ti-737max-final-report-2020.pdf, PDF p.27, printed p.20 | "approved a redesign of MCAS to increase its authority to move the aircraft’s stabilizer at low speed, in order to address “stall characteristics” requirements necessary for FAA certification." | ATTRIBUTED-FINDING |
| C-012 | Boeing's position: it told the FAA on 'numerous occasions' that the MCAS operating range had expanded to low speed. FAA personnel observed expanded MCAS in certification flight tests. | house-ti-737max-final-report-2020.pdf, PDF p.111, printed p.104 | "On numerous occasions, Boeing shared with the FAA and international regulators that MCAS’s final design had changed from its earlier parameters, and that its operating range had expanded to include low-speed conditions." | ATTRIBUTED-DOCUMENT |
| C-013 | JATR (as quoted by the Committee): certification plans and deliverables were not updated to describe the low-Mach expansion of MCAS. | house-ti-737max-final-report-2020.pdf, PDF p.112, printed p.105 | "the certification plans and some certification deliverables (e.g., the preliminary system safety assessment (PSSA)) were not updated to describe the expansion of the MCAS function for the low Mach portion of the flight envelope" | ATTRIBUTED-DOCUMENT |
| C-014 | After the 2016 redesign, Boeing did not reevaluate the system or redo single- or multiple-failure analyses. | house-ti-737max-final-report-2020.pdf, PDF p.28, printed p.21 | "After Boeing redesigned MCAS in 2016 to increase its authority to move the aircraft’s stabilizer at lower speeds, Boeing failed to reevaluate the system or perform single- or multiple-failure analyses of MCAS." | ATTRIBUTED-FINDING |
| C-015 | Both Boeing and the FAA failed to designate MCAS safety-critical. Acting Administrator Elwell agreed at the May 15, 2019 hearing that it seemed to be. | house-ti-737max-final-report-2020.pdf, PDF p.113, printed p.106 | "Mr. ELWELL. I didn’t make that designation, but it seems to me that, yes, it is." | ATTRIBUTED-DOCUMENT |
| C-016 | A May 21, 2013 ITRACS item frames MCAS nomenclature as a cost driver and recommends covering it as 'revised speed trim'. | house-ti-737max-final-report-2020.pdf, PDF p.102, printed p.95 | "Every new buzzword represents a company and airline cost via changed manuals, changed training, changed maintenance manuals." | ATTRIBUTED-DOCUMENT |
| C-017 | A June 7, 2013 Boeing email summarising the meeting minutes says emphasising MCAS as new could bring greater certification and training impact. | house-ti-737max-final-report-2020.pdf, PDF p.99, printed p.92 | "If we emphasize MCAS is a new function there may be greater certification and training impact," | ATTRIBUTED-DOCUMENT |
| C-018 | The plan was to describe MCAS externally as an addition to Speed Trim and keep the name internally. A Boeing AR concurred. | house-ti-737max-final-report-2020.pdf, PDF p.101, printed p.94 | "Externally we would communicate it as an addition to Speed Trim. Internally continue using the acronym MCAS." | ATTRIBUTED-DOCUMENT |
| C-019 | Boeing's rebuttal: the team manager accepted the team's analysis to keep the MCAS nomenclature and the item was closed. | house-ti-737max-final-report-2020.pdf, PDF p.102, printed p.95 | "In other words, after reviewing the issue, the team recommended, and their manager agreed, to continue to refer to MCAS by that name." | ATTRIBUTED-DOCUMENT |
| C-020 | MCAS relied on one AOA sensor at a time, although the aircraft has two. | house-ti-737max-final-report-2020.pdf, PDF p.114, printed p.107 | "MCAS was designed to rely on data from only one AOA sensor at a time to determine whether to push the plane’s nose downward." | ATTRIBUTED-FINDING |
| C-021 | December 17, 2015: a Boeing engineer who was also an AR asked whether MCAS was vulnerable to single AOA sensor failures. | house-ti-737max-final-report-2020.pdf, PDF p.115, printed p.108 | "Are we vulnerable to single AOA sensor failures with the MCAS implementation or is there some checking that occurs?" | ATTRIBUTED-DOCUMENT |
| C-022 | Boeing's Functional Hazard Assessment did not rate MCAS failure as hazardous enough to require redundancy such as multiple AOA sensors. | house-ti-737max-final-report-2020.pdf, PDF p.114, printed p.107 | "Boeing’s Functional Hazard Assessment regarding pilot reaction to uncommanded MCAS function did not rate the system as being hazardous enough to require redundant features, such as multiple AOA sensors." | ATTRIBUTED-FINDING |
| C-023 | Boeing's Dec 2018 presentation to the FAA: loss of one AOA followed by erroneous data from the second was not simulated and was deemed extremely improbable. | house-ti-737max-final-report-2020.pdf, PDF p.216, printed p.209 | "was not evaluated in the simulator but deemed acceptable as failure was found to be extremely improbable." | ATTRIBUTED-DOCUMENT |
| C-024 | June 15, 2016: a colleague answers the question about faulty AOA or Mach by saying MCAS 'shuts down immediately'. | house-ti-737max-final-report-2020.pdf, PDF p.117, printed p.110 | "As for faulty AOA and/or Mach number … if they are faulty then MCAS shuts down immediately." | ATTRIBUTED-DOCUMENT |
| C-025 | June 20, 2016: asked whether repetitive MCAS activation was a safety or certification issue, an engineer replied it was not safety other than possible large mistrim. | house-ti-737max-final-report-2020.pdf, PDF p.28, printed p.21 | "I don’t think this is safety, other then (sic) the pilot could fight the MCAS input and over time find themselves in a large mistrim." | ATTRIBUTED-DOCUMENT |
| C-026 | The June 22, 2016 MCAS Review minutes say no redesign was needed for fail-high AOA/Mach and no additional flight testing was needed. | house-ti-737max-final-report-2020.pdf, PDF p.118, printed p.111 | "Conclusion: other systems will be reacting to the failure such as March trim or stick shaker, MCAS is small in comparison. No need to redesign to address this." | ATTRIBUTED-DOCUMENT |
| C-027 | Boeing's Dec 2018 presentation: repeated unintended activation had been deemed no worse than a single one. The rationale was not in formal certification records. | house-ti-737max-final-report-2020.pdf, PDF p.123, printed p.116 | "and deemed [it] no worse than single unintended MCAS activation." | ATTRIBUTED-DOCUMENT |
| C-028 | Teal said that when he approved the redesign he did not know of the single-sensor reliance, the repeated activation, or the 10-second test result. | house-ti-737max-final-report-2020.pdf, PDF p.28, printed p.21 | "acknowledged that when he approved the MCAS redesign in March 2016 he was unaware: 1) that MCAS operated from a single AOA sensor, 2) that MCAS could activate repeatedly," | ATTRIBUTED-FINDING |
| C-029 | Boeing's internal MCAS design requirements: no objectionable interaction with piloting and no interference with dive recovery. The Committee finds both unmet in the accidents. | house-ti-737max-final-report-2020.pdf, PDF p.127, printed p.120 | "“MCAS shall not have any objectionable interaction with the piloting of the airplane.”708 “MCAS shall not interfere with dive recovery.”" | ATTRIBUTED-DOCUMENT |
| C-030 | Nov 1, 2012 hazard-assessment email: one test pilot took more than 10 s to use the stab cutout in a simulated stab-trim runaway during a wind-up turn. That pilot found it catastrophic. | house-ti-737max-final-report-2020.pdf, PDF p.120, printed p.113 | "The reaction time was long (>10 second) to use the aislestand (sic) stab cutout switch and there was less teamwork with applying the nose up mechanical trim," | ATTRIBUTED-DOCUMENT |
| C-031 | Coordination Sheet language, repeated in six revisions from July 2015 to June 2018: typical reaction about 4 s, slow reaction (>10 s) catastrophic. | house-ti-737max-final-report-2020.pdf, PDF p.122, printed p.115 | "A typical reaction time was observed to be approximately 4 seconds. A slow reaction time scenario (>10 seconds) found the failure to be catastrophic due to the inability to arrest the airplane overspeed." | ATTRIBUTED-DOCUMENT |
| C-032 | Boeing told the Committee it could find no record that these coordination sheets were shared with the FAA. At least four ARs saw them. | house-ti-737max-final-report-2020.pdf, PDF p.122, printed p.115 | "Boeing has informed the Committee that it has been unable to locate any record showing that any of these coordination sheets were shared with the FAA." | ATTRIBUTED-FINDING |
| C-033 | Boeing assumed pilots would treat unexpected MCAS activation as a runaway stabilizer and respond within four seconds, as FAA guidance presumes. | house-ti-737max-final-report-2020.pdf, PDF p.118, printed p.111 | "Boeing assumed that pilots would respond to an unexpected MCAS activation as it if were a runaway stabilizer trim event, within four seconds." | ATTRIBUTED-FINDING |
| C-034 | NTSB (quoted): Boeing did not evaluate all the alerts and indications that could accompany uncommanded MCAS operation. | house-ti-737max-final-report-2020.pdf, PDF p.120, printed p.113 | "While Boeing considered the possibility of uncommanded MCAS operation as part of its functional hazard assessment, it did not evaluate all the potential alerts and indications that could accompany a failure that also resulted in uncommanded MCAS operation." | ATTRIBUTED-DOCUMENT |
| C-035 | March 30, 2016: hours after the redesign approval, Forkner asked the FAA (Seattle AEG) to remove MCAS from the FCOM, calling it transparent and 'WAY outside' the normal envelope. | house-ti-737max-final-report-2020.pdf, PDF p.126, printed p.119 | "completely transparent to the flight crew and only operates WAY outside of the normal operating envelope." | ATTRIBUTED-DOCUMENT |
| C-036 | The Committee could not determine whether Forkner knew of the redesign. The FAA official who approved the removal did not know of it. | house-ti-737max-final-report-2020.pdf, PDF p.107, printed p.100 | "Unaware of the MCAS redesign, the FAA official grants this request. The Committee has been unable to determine if Mr. Forkner was aware that Boeing had approved a design change to MCAS" | ATTRIBUTED-FINDING |
| C-037 | The FAA AEG officials stayed unaware of the March 2016 MCAS redesign until after Lion Air. | house-ti-737max-final-report-2020.pdf, PDF p.158, printed p.151 | "They remained unaware of Boeing’s dramatic redesign of MCAS in March 2016 that gave the system much greater authority to control the aircraft until after the Lion Air crash." | ATTRIBUTED-FINDING |
| C-038 | JATR (quoted): the FAA was not completely unaware of MCAS, but information was so fragmented that its implications were hard to recognise. | house-ti-737max-final-report-2020.pdf, PDF p.100, printed p.93 | "The FAA was not completely unaware of MCAS; however, because the information and discussions about MCAS were so fragmented and were delivered to disconnected groups within the process, it was difficult to recognize the impacts and implications of this system." | ATTRIBUTED-DOCUMENT |
| C-039 | July 2014: Boeing's presentation to Southwest described MCAS (purpose, envelope). This was before the 2016 redesign. | house-ti-737max-final-report-2020.pdf, PDF p.125, printed p.118 | "the Committee’s investigation discovered that Southwest Airlines was made aware of the existence, and purpose of, MCAS on the 737 MAX." | ATTRIBUTED-FINDING |
| C-040 | MCAS references were removed from the FCOM (Mar 2016) and the FAA FSB report (Jan 2017) at Boeing's request, with FAA approval. | house-ti-737max-final-report-2020.pdf, PDF p.208, printed p.201 | "Boeing had requested, and the FAA had approved, removal of references to MCAS from Boeing’s Flight Crew Operations Manual (FCOM)" | ATTRIBUTED-FINDING |
| C-041 | Delegation to Boeing rose from 28 of 87 tasks (2013) to 79 of 91 by November 2016. | house-ti-737max-final-report-2020.pdf, PDF p.67, printed p.60 | "this number rose to 79 of 91 activities by November 2016, four months prior to final certification of the 737 MAX aircraft." | ATTRIBUTED-FINDING |
| C-042 | JATR: BASOO had 45 staff (24 engineers, 6 senior) overseeing about 1,500 Boeing ODA members. DOT OIG gives 42 staff. | house-ti-737max-final-report-2020.pdf, PDF p.72, printed p.65 | "was comprised of 45 FAA employees, including 24 total engineers, only 6 of whom were senior engineers, who oversaw the 1,500 Boeing-designated ODA unit members, or authorized representatives." | ATTRIBUTED-DOCUMENT |
| C-043 | 2016 Boeing internal AR survey: 39% perceived 'undue pressure' and 29% feared consequences of reporting it. | house-ti-737max-final-report-2020.pdf, PDF p.22, printed p.15 | "found that 39 percent of Boeing ARs that responded perceived “undue pressure” and 29 percent were concerned about consequences if they reported potential “undue pressure.”" | ATTRIBUTED-DOCUMENT |
| C-044 | The Committee says not every instance of ARs not relaying information violated FAA rules. | house-ti-737max-final-report-2020.pdf, PDF p.23, printed p.16 | "Not all of these instances violated FAA regulations or guidance." | ATTRIBUTED-FINDING |
| C-045 | Definition: the AOA Disagree alert shows when the left and right AOA disagree by more than 10° for more than 10 continuous seconds. | house-ti-737max-final-report-2020.pdf, PDF p.132, printed p.125 | "illuminates if the left or right angle of attack sensors disagreed by more than 10 degrees, for more than 10 continuous seconds." | ATTRIBUTED-DOCUMENT |
| C-046 | July 2015: a Collins fix for the AOA Fail Flag tied the standard AOA Disagree alert to the optional AOA Indicator. Boeing retested and accepted it (closed July 29, 2015). | house-ti-737max-final-report-2020.pdf, PDF p.135, printed p.128 | "This meant that the AOA Disagree alert, although installed in every Boeing 737 MAX airplane, would function only on the airplanes that were equipped with the optional AOA Indicator." | ATTRIBUTED-FINDING |
| C-047 | Fewer than 20% of MAX airplanes delivered before Lion Air had the optional AOA Indicator, so the alert worked on fewer than 20%. | house-ti-737max-final-report-2020.pdf, PDF p.133, printed p.126 | "less than 20 percent of MAX airplanes delivered before the Lion Air crash had an AOA Indicator installed." | ATTRIBUTED-DOCUMENT |
| C-048 | August 2017: Boeing learned through its own tests that the alert was not working on most MAX aircraft. | house-ti-737max-final-report-2020.pdf, PDF p.135, printed p.128 | "Boeing learned through tests it was conducting that the AOA Disagree alert was not functioning on the vast majority of MAX aircraft." | ATTRIBUTED-FINDING |
| C-049 | Boeing's internal review found the missing alert did not adversely affect safety and deferred the fix to 2020 (MAX-10). A Boeing AR concurred. | house-ti-737max-final-report-2020.pdf, PDF p.138, printed p.131 | "Boeing’s internal review determined that the absence of a functioning AOA Disagree alert did not adversely impact safety, and because of that, a fix could be deferred until the next software update which was scheduled to occur in 2020" | ATTRIBUTED-FINDING |
| C-050 | October 5, 2017: a Boeing employee argued for a bulletin to pilots. A colleague suggested a Fleet Team Digest instead. Neither was sent. | house-ti-737max-final-report-2020.pdf, PDF p.137, printed p.130 | "I still think we need a bulletin to let them [the pilots] know what they may be missing…." | ATTRIBUTED-DOCUMENT |
| C-051 | Boeing's Aug 16, 2018 FCOM for Lion Air still described a functioning AOA Disagree alert. | house-ti-737max-final-report-2020.pdf, PDF p.139, printed p.132 | "Yet the FCOM still contained a description of a functioning AOA Disagree alert." | ATTRIBUTED-FINDING |
| C-052 | Committee characterisation: 'Boeing knowingly deceived these pilots and its customer airlines.' | house-ti-737max-final-report-2020.pdf, PDF p.30, printed p.23 | "Boeing knowingly deceived these pilots and its customer airlines." | ATTRIBUTED-CHARACTERISATION |
| C-053 | About 200 MAX aircraft were flying with non-functioning alerts at the time of Lion Air (the Committee's estimate: ~250 delivered × >80%). | house-ti-737max-final-report-2020.pdf, PDF p.140, printed p.133 | "approximately 200 MAX aircraft were flying at the time with non-functioning AOA Disagree alerts." | ATTRIBUTED-FINDING |
| C-054 | Acting Administrator Elwell (July 11, 2019): the alert was not required by safety regulation but, once in the type design, had to work on every MAX. | house-ti-737max-final-report-2020.pdf, PDF p.138, printed p.131 | "Although an AOA disagree message was not necessary to meet FAA safety regulations, once it was made part of the approved type design, it was required to be installed and functional on all 737 MAX airplanes Boeing produced." | ATTRIBUTED-DOCUMENT |
| C-055 | Committee limiter: Boeing's handling of the AOA Disagree alert may not have directly jeopardised safety but harmed its reputation. | house-ti-737max-final-report-2020.pdf, PDF p.144, printed p.137 | "Boeing’s actions may not have directly jeopardized the safety of any aircraft, but the way Boeing handled this issue endangered the reputation of the company." | ATTRIBUTED-CHARACTERISATION |
| C-056 | Committee (summarising KNKT): a working AOA Disagree alert was one of three missed opportunities to catch the faulty Lion Air sensor before flight 610. | house-ti-737max-final-report-2020.pdf, PDF p.144, printed p.137 | "a properly functioning AOA Disagree alert could have alerted the Jakarta- bound flight crew, and ultimately aircraft maintenance, that there was a potential problem with an AOA sensor." | ATTRIBUTED-DOCUMENT |
| C-057 | Avoiding simulator training for NG-to-MAX pilots was a key program objective, with differences training capped at 16 hours or less of Level B. | house-ti-737max-final-report-2020.pdf, PDF p.146, printed p.139 | "Guaranteeing that the 737 MAX did not require simulator training for pilots transitioning from the 737 NG to the 737 MAX was a key Boeing objective of the 737 MAX program." | ATTRIBUTED-FINDING |
| C-058 | Southwest contract (Dec 2011): $1M per aircraft if pilots could not fly NG and MAX interchangeably, plus reimbursement if training exceeded 10 hours. | house-ti-737max-final-report-2020.pdf, PDF p.146, printed p.139 | "In December 2011, Boeing agreed to pay Southwest Airlines $1 million per MAX airplane that Boeing delivered to Southwest if its pilots were unable to operate the 737 NG and 737 MAX interchangeably due to any reason." | ATTRIBUTED-FINDING |
| C-059 | Committee estimate: exposure of $200 million to nearly $400 million if Level B was not obtained. | house-ti-737max-final-report-2020.pdf, PDF p.31, printed p.24 | "it would have owed Southwest between $200 to nearly $400 million." | ATTRIBUTED-FINDING |
| C-060 | FAA Seattle AEG memo (May 10, 2015): Boeing had for 3 years argued it could not meet the latest rules because of the training impact. MCAS was not listed among the six systems of concern. | house-ti-737max-final-report-2020.pdf, PDF p.159, printed p.152 | "Boeing has continually argued with the BASOO that they cannot meet the latest amendments to aircraft certification regulations due to the impact on flight crew training," | ATTRIBUTED-DOCUMENT |
| C-061 | Aug 2016: the FAA provisionally approved Level B. It estimated the computer-based training at about two hours (Boeing had expected 16). | house-ti-737max-final-report-2020.pdf, PDF p.33, printed p.26 | "The FAA estimated that its approved computer-based training for the MAX could be completed in approximately two hours, a drastic reduction from the 16 hours Boeing was anticipating." | ATTRIBUTED-FINDING |
| C-062 | March 28, 2017 Forkner email on the prospect of simulator training. | house-ti-737max-final-report-2020.pdf, PDF p.33, printed p.26 | "Boeing will not allow that to happen. We’ll go face to face with any regulator who tries to make that a requirement." | ATTRIBUTED-DOCUMENT |
| C-063 | June 2017 Forkner instant message after Lion Air raised simulator training. | house-ti-737max-final-report-2020.pdf, PDF p.163, printed p.156 | "Now friggin Lion Air might need a sim to fly the MAX, and maybe because of their own stupidity." | ATTRIBUTED-DOCUMENT |
| C-064 | Jan 7, 2020: Boeing reversed course and recommended simulator training for all MAX pilots. | house-ti-737max-final-report-2020.pdf, PDF p.39, printed p.32 | "In January 2020, Boeing dramatically reversed course yet again, by recommending that pilots undergo simulator training on the 737 MAX once the airplane returns to service." | ATTRIBUTED-FINDING |
| C-065 | Nov 6, 2018 Boeing Operations Manual Bulletin: no mention of MCAS by name. | house-ti-737max-final-report-2020.pdf, PDF p.201, printed p.194 | "Noticeably absent from the Boeing bulletin was any reference to the “Maneuvering Characteristics Augmentation System” or “MCAS.”" | ATTRIBUTED-FINDING |
| C-066 | Nov 7, 2018 FAA Emergency AD 2018-23-51: potential for repeated nose-down trim from a single erroneous high AOA input. | house-ti-737max-final-report-2020.pdf, PDF p.204, printed p.197 | "if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer." | ATTRIBUTED-DOCUMENT |
| C-067 | The FAA drafted, then removed, the MCAS reference in the Emergency AD so crews would focus on runaway-stabilizer recognition (Dickson QFR). | house-ti-737max-final-report-2020.pdf, PDF p.206, printed p.199 | "The FAA therefore decided to remove the MCAS reference from the draft AD so that flight crews would focus on runaway stabilizer recognition" | ATTRIBUTED-DOCUMENT |
| C-068 | Nov 10, 2018 Boeing Multi Operator Message described MCAS. The Committee says it was the first time most crews and operators learned of it. | house-ti-737max-final-report-2020.pdf, PDF p.208, printed p.201 | "For the vast majority of 737 MAX flight crews and operators, this was the first time they learned of the existence of MCAS on the 737 MAX and any details of its operation." | ATTRIBUTED-FINDING |
| C-069 | The TARAM result: without an MCAS fix, even with the AD, more than 15 fatal crashes and over 2,900 deaths over a 30-year fleet life of 4,800 aircraft. | house-ti-737max-final-report-2020.pdf, PDF p.217, printed p.210 | "there could be more than 15 fatal 737 MAX crashes over the estimated 30-year lifetime of the fleet, then estimated to be 4,800 aircraft, resulting in over 2,900 deaths." | ATTRIBUTED-DOCUMENT |
| C-070 | The TARAM assumed that 1 in 100 pilots would fail to respond properly. The Committee calls this a gross overestimate of pilot performance. | house-ti-737max-final-report-2020.pdf, PDF p.217, printed p.210 | "The analysis was based on the assumption that only one out of 100 pilots would fail to react properly to uncommanded MCAS activation resulting in Stabilizer Trim Runaway." | ATTRIBUTED-DOCUMENT |
| C-071 | Despite TARAM, the FAA let the MAX keep flying. Boeing delivered nearly 150 more aircraft between the crashes (fleet 387). | house-ti-737max-final-report-2020.pdf, PDF p.218, printed p.211 | "Despite the TARAM analysis, the FAA permitted the 737 MAX aircraft to continue flying." | ATTRIBUTED-FINDING |
| C-072 | The Committee could not establish which FAA senior leaders knew of the TARAM result. | house-ti-737max-final-report-2020.pdf, PDF p.219, printed p.212 | "we remain unaware of who within FAA’s senior leadership was aware of the fact that the FAA had conducted an internal statistical analysis" | ATTRIBUTED-FINDING |
| C-073 | Bahrami (FAA Associate Administrator for Aviation Safety) on letting the MAX fly: pilots are part of the system. | house-ti-737max-final-report-2020.pdf, PDF p.220, printed p.213 | "Pilots are part of the system, and we rely on the pilots to do certain things." | ATTRIBUTED-DOCUMENT |
| C-074 | Jan 30, 2019 Boeing letter (ODA Deputy Lead Administrator) to FAA AEG: the rationale for leaving MCAS out of the manuals remains valid. Proposed Level A training. | house-ti-737max-final-report-2020.pdf, PDF p.223, printed p.216 | "Boeing believes that the rationale supporting that decision remains valid." | ATTRIBUTED-DOCUMENT |
| C-075 | March 1, 2019 FAA FSB Chair to Boeing: FCC 12.1 may not meet Level A. The evaluation is 'proceeding at risk'. | house-ti-737max-final-report-2020.pdf, PDF p.224, printed p.217 | "The FAA is willing to evaluate Boeing’s proposal for Level A training; however, we are advising the Boeing Company that the evaluation is proceeding at risk." | ATTRIBUTED-DOCUMENT |
| C-076 | The FAA BASOO's post-Lion Air MCAS review (started Jan 9, 2019; draft Feb 8, 2019) found no non-compliance. It was never finalised. | house-ti-737max-final-report-2020.pdf, PDF p.225, printed p.218 | "The [FAA’s] oversight activity did not reveal any noncompliance [by Boeing], but did observe some assumptions used by the Applicant and accepted by the FAA." | ATTRIBUTED-DOCUMENT |
| C-077 | March 13, 2019: after Boeing showed superimposed Lion Air and ET302 traces and site evidence (flap actuator retracted), Bahrami told Elwell to ground. Grounding at 3:00 p.m. | house-ti-737max-final-report-2020.pdf, PDF p.228, printed p.221 | "At 3:00 p.m. on March 13, 2019, the FAA grounded the 737 MAX fleet." | ATTRIBUTED-FINDING |
| C-078 | Post-accident fixes per the Committee: two AOA sensors feeding MCAS and no repeated activation. | house-ti-737max-final-report-2020.pdf, PDF p.39, printed p.32 | "Boeing now plans to have two AOA sensors feed into MCAS." | ATTRIBUTED-FINDING |
| C-079 | Committee summary of KNKT: on JT610 MCAS activated more than 20 times as the pilots fought it. | house-ti-737max-final-report-2020.pdf, PDF p.16, printed p.9 | "This occurred more than 20 times as the pilots fought MCAS while struggling to maintain control of the aircraft." | ATTRIBUTED-DOCUMENT |
| C-080 | Committee summary of EAIB interim: on ET302 MCAS triggered four times. | house-ti-737max-final-report-2020.pdf, PDF p.16, printed p.9 | "MCAS triggered four times as a result of the false AOA readings" | ATTRIBUTED-DOCUMENT |
Committee's main conclusions, verbatim
| ID | Verbatim |
|---|---|
| 1 | "Technical design flaws, faulty assumptions about pilot responses, and management failures by both The Boeing Company (Boeing) and the Federal Aviation Administration (FAA) played instrumental and causative roles in the chain of errors" |
| 2 | "The MAX crashes were not the result of a singular failure, technical mistake, or mismanaged event." |
| 3 | "1) Production Pressures. There was tremendous financial pressure on Boeing and the 737 MAX program to compete with Airbus’ new A320neo aircraft." |
| 4 | "2) Faulty Design and Performance Assumptions. Boeing made fundamentally faulty assumptions about critical technologies on the 737 MAX, most notably with MCAS." |
| 5 | "3) Culture of Concealment. In several critical instances, Boeing withheld crucial information from the FAA, its customers, and 737 MAX pilots." |
| 6 | "4) Conflicted Representation. The Committee found that the FAA’s current oversight structure with respect to Boeing creates inherent conflicts of interest that have jeopardized the safety of the flying public." |
| 7 | "5) Boeing’s Influence Over the FAA’s Oversight Structure. Multiple career FAA officials have documented examples where FAA management overruled a determination of the FAA’s own technical experts at the behest of Boeing." |
| 8 | "FAA Oversight –The FAA failed to ensure the safety of the traveling public." |
| 9 | "Boeing Production Pressure – Costs, schedule, and production pressures at Boeing undermined safety of the 737 MAX." |
| 10 | "Boeing failed to appropriately classify MCAS as a safety-critical system, concealed critical information about MCAS from pilots, and sought to diminish focus on MCAS as a “new function”" |
| 11 | "AOA Disagree Alert – Boeing concealed information from the FAA, its customers, and pilots that the AOA Disagree alerts were inoperable on most of the 737 MAX fleet" |
| 12 | "737 MAX Pilot Training – Boeing’s economic incentives led the company to a significant lack of transparency with the FAA, its customers, and 737 MAX pilots regarding pilot training requirements and negatively compromised safety." |
| 13 | "Both Boeing and the FAA gambled with the public’s safety in the aftermath of the Lion Air crash, resulting in the death of 157 more individuals on Ethiopian Airlines flight 302" |
| 14 | "Boeing’s design and development of the 737 MAX was marred by technical design failures, lack of transparency with both regulators and customers, and efforts to downplay or disregard concerns about the operation of the aircraft." |
| 15 | "the FAA’s certification review of Boeing’s 737 MAX was grossly insufficient and that the FAA failed in its duty to identify key safety problems" |
| 16 | "The combination of these problems doomed the Lion Air and Ethiopian Airlines flights." |
| 17 | "producing a compliant aircraft that proved unsafe should have been an immediate wake-up call to both Boeing and the FAA that the current regulatory system that certified the MAX is broken." |
| 18 | "This report’s main investigative findings point to a company culture that is in serious need of a safety reset." |
D · NTSB ASR-19-01, JATR, EASA (later analysis) · 60 rows
| ID | Claim | Source and page | Verbatim | Status |
|---|---|---|---|---|
| D-001 | As originally delivered, MCAS activated in manual flight with flaps up when AOA from either single sensor exceeded a Mach-based threshold. | ntsb-asr-19-01.pdf, PDF p.4, printed p.4 | “the MCAS became active during manual flight (autopilot not engaged) when the flaps were fully retracted and the airplane’s AOA value (as measured by either AOA sensor) exceeded a threshold based on Mach number.” | VERIFIED-FINDING |
| D-002 | If pilots used the trim switches and high AOA persisted, original MCAS would command another nose-down input after 5 seconds. | ntsb-asr-19-01.pdf, PDF p.4, printed p.4 | “If the stabilizer trim switches were used by the pilots and the elevated AOA condition persisted, the MCAS would command another stabilizer AND trim input after 5 seconds.” | VERIFIED-FINDING |
| D-003 | For the normal flight envelope, Boeing classified the uncommanded-MCAS hazards (including operation to maximum authority) as 'major'. | ntsb-asr-19-01.pdf, PDF p.5, printed p.5 | “For the normal flight envelope, Boeing identified and classified two hazards associated with “uncommanded MCAS” activation as “major.”” | VERIFIED-FINDING |
| D-004 | Boeing's simulator validation induced a trim runaway without simulating the underlying failure, so accompanying erroneous-AOA flight deck effects were never simulated. | ntsb-asr-19-01.pdf, PDF p.5, printed p.5 | “additional flight deck effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker activation) resulting from the same underlying failure (for example, erroneous AOA) were not simulated” | VERIFIED-FINDING |
| D-005 | Boeing assumption 1 (Boeing said it was based on FAA guidance): uncommanded inputs are readily recognizable and can be countered in the normal sense, with no specific procedures needed. | ntsb-asr-19-01.pdf, PDF p.6, printed p.6 | “Uncommanded system inputs are readily recognizable and can be counteracted by overriding the failure by movement of the flight controls “in the normal sense” by the flight crew and do not require specific procedures.” | VERIFIED-FINDING |
| D-006 | Boeing assumption 3: the pilot takes immediate action to reduce or eliminate increased control forces by re-trimming. | ntsb-asr-19-01.pdf, PDF p.6, printed p.6 | “The pilot will take immediate action to reduce or eliminate increased control forces by re-trimming or changing configuration or flight conditions.” | VERIFIED-FINDING |
| D-007 | The 'immediate action' assumption traces to FAA flight-test guidance AC 25-7C, which treats short-term forces as not lasting for any significant duration. | ntsb-asr-19-01.pdf, PDF p.6, printed p.6 | “It is assumed that the pilot will take immediate action to reduce or eliminate such forces by re-trimming or changing configuration or flight conditions, and consequently short-term forces are not considered to exist for any significant duration” | VERIFIED-FINDING |
| D-008 | Boeing told NTSB in 2019 that the 'major' rating rested partly on crews recognising continuous nose-down trim as a runaway and following that procedure. | ntsb-asr-19-01.pdf, PDF p.6, printed p.6 | “Continuous unintended nose-down stabilizer trim inputs would be recognized as a stabilizer trim or stabilizer runaway failure and the procedure for stabilizer runaway would be followed.” | VERIFIED-FINDING |
| D-009 | NTSB: on all three flights, pilot responses did not match the pilot-response assumptions behind Boeing's hazard classification, which the FAA approved. | ntsb-asr-19-01.pdf, PDF p.7, printed p.7 | “In all three flights, the pilot responses differed and did not match the assumptions of pilot responses to unintended MCAS operation on which Boeing based its hazard classifications within the safety assessment” | VERIFIED-FINDING |
| D-010 | NTSB: multiple alerts and indications can raise workload, and their combination did not prompt the pilots to perform the runaway stabilizer procedure immediately. | ntsb-asr-19-01.pdf, PDF p.7, printed p.7 | “Multiple alerts and indications can increase pilots’ workload, and the combination of the alerts and indications did not trigger the accident pilots to immediately perform the runaway stabilizer procedure during the initial automatic AND stabilizer trim input.” | VERIFIED-FINDING |
| D-011 | Design principle cited by NTSB: systems should be designed so that the consequences of any human error are limited. | ntsb-asr-19-01.pdf, PDF p.7, printed p.7 | “industry experts generally recognize that an aircraft system should be designed such that the consequences of any human error are limited.” | VERIFIED-FINDING |
| D-012 | NTSB conclusion: Boeing's FHA assumptions for uncommanded MCAS did not adequately account for the effect of multiple alerts on pilot response. | ntsb-asr-19-01.pdf, PDF p.8, printed p.8 | “did not adequately consider and account for the impact that multiple flight deck alerts and indications could have on pilots’ responses to the hazard.” | VERIFIED-FINDING |
| D-013 | A-19-10 (part 1): FAA should require that Boeing's 737 MAX safety assessments that assumed immediate, appropriate pilot action consider all possible flight deck alerts. | ntsb-asr-19-01.pdf, PDF p.12, printed p.12 | “ensure that system safety assessments for the 737 MAX in which it assumed immediate and appropriate pilot corrective actions in response to uncommanded flight control inputs, from systems such as the Maneuvering Characteristics Augmentation System, consider the effect” | RECOMMENDATION |
| D-014 | A-19-10 (part 2): add design enhancements, procedures and/or training to minimise pilot actions that are inconsistent with manufacturer assumptions. Part 2 of A-19-11 is word-for-word identical. | ntsb-asr-19-01.pdf, PDF p.12, printed p.12 | “incorporate design enhancements (including flight deck alerts and indications), pilot procedures, and/or training requirements, where needed, to minimize the potential for and safety impact of pilot actions that are inconsistent with manufacturer assumptions. (A-19-10)” | RECOMMENDATION |
| D-015 | A-19-11: extend the same safety-assessment review to all other US type-certificated transport-category airplanes. | ntsb-asr-19-01.pdf, PDF p.12, printed p.12 | “Require that for all other US type-certificated transport-category airplanes, manufacturers (1) ensure that system safety assessments for which they assumed immediate and appropriate pilot corrective actions in response to uncommanded flight control inputs consider the effect” | RECOMMENDATION |
| D-016 | A-19-12: FAA should notify other regulators (EASA, Transport Canada, ANAC, CAAC and the Russian agency) of A-19-11 and encourage them to evaluate its relevance. | ntsb-asr-19-01.pdf, PDF p.12, printed p.12 | “of Recommendation A-19-11 and encourage them to evaluate its relevance to their processes and address any changes, if applicable. (A-19-12)” | RECOMMENDATION |
| D-017 | A-19-13: develop robust tools and methods to validate pilot recognition-and-response assumptions during design certification. | ntsb-asr-19-01.pdf, PDF p.12, printed p.12 | “Develop robust tools and methods, with the input of industry and human factors experts, for use in validating assumptions about pilot recognition and response to safety-significant failure conditions as part of the design certification process. (A-19-13)” | RECOMMENDATION |
| D-018 | A-19-14: once those tools exist, revise FAA regulations and guidance to use them, re-examining the pilot recognition and response assumptions in existing guidance. | ntsb-asr-19-01.pdf, PDF p.12, printed p.12 | “revise existing Federal Aviation Administration (FAA) regulations and guidance to incorporate their use and documentation as part of the design certification process, including re-examining the validity of pilot recognition and response assumptions permitted in existing FAA guidance. (A-19-14)” | RECOMMENDATION |
| D-019 | A-19-15: develop design standards for system diagnostic tools that make failure indications to pilots clearer and better prioritised. | ntsb-asr-19-01.pdf, PDF p.13, printed p.13 | “Develop design standards, with the input of industry and human factors experts, for aircraft system diagnostic tools that improve the prioritization and clarity of failure indications (direct and indirect) presented to pilots” | RECOMMENDATION |
| D-020 | A-19-16: once the standards exist, require system diagnostic tools on transport-category aircraft for situations with multiple alerts. | ntsb-asr-19-01.pdf, PDF p.13, printed p.13 | “require implementation of system diagnostic tools on transport-category aircraft to improve the timeliness and effectiveness of pilots’ response when multiple flight deck alerts and indications are present. (A-19-16)” | RECOMMENDATION |
| D-021 | JATR: the Changed Product Rule was followed and handled discrete changes, but did not adequately address cumulative effects, integration or human factors. | faa-jatr-2019.pdf, PDF p.10, printed p.IV | “However, the team determined that the process did not adequately address cumulative effects, system integration, and human factors issues.” | VERIFIED-FINDING |
| D-022 | R1: revise the Changed Product Rules and guidance to require a top-down, whole-aircraft evaluation of every change. | faa-jatr-2019.pdf, PDF p.10, printed p.IV | “should be revised to require a top-down approach whereby every change is evaluated from an integrated whole aircraft system perspective.” | RECOMMENDATION |
| D-023 | JATR: the FAA was not completely unaware of MCAS, but the information was fragmented across disconnected groups, which made its implications hard to recognise. | faa-jatr-2019.pdf, PDF p.33, printed p.13 | “The FAA was not completely unaware of MCAS; however, because the information and discussions about MCAS were so fragmented and were delivered to disconnected groups within the process, it was difficult to recognize the impacts and implications of this system.” | VERIFIED-FINDING |
| D-024 | JATR believes that requiring an issue paper would likely have identified the potential for the stabilizer to overpower the elevator. | faa-jatr-2019.pdf, PDF p.34, printed p.14 | “If an issue paper had been required, the JATR team believes it likely would have identified the potential for the stabilizer to overpower the elevator.” | VERIFIED-FINDING |
| D-025 | FAA test-flight guidance often assumes 1 s recognition plus 3 s reaction; recovery action is not started until 3 s after the recognition point. | faa-jatr-2019.pdf, PDF p.34, printed p.14 | “Often, recognition time is assumed to be 1 second, and reaction time is assumed to be 3 seconds. Thus, test pilots are told that “Recovery action should not be initiated until 3 seconds after the recognition point” (AC 25.1329-1C).” | VERIFIED-FINDING |
| D-026 | For the MAX, it was assumed that at MCAS's 0.27 deg/s rate, a pilot's 4-second response would allow only a little over 1 degree of stabilizer movement. | faa-jatr-2019.pdf, PDF p.34, printed p.14 | “since MCAS activation rate is 0.27 degrees of horizontal stabilizer movement per second, during the 4 seconds that it would take a pilot to respond to an erroneous activation, the stabilizer will only move a little over 1 degree” | VERIFIED-FINDING |
| D-027 | R3.10: FAA should review Boeing's assumed 4-second pilot reaction time to stabilizer runaway and make sure a conservative value is used. | faa-jatr-2019.pdf, PDF p.40, printed p.20 | “The FAA should review the Boeing assumption of a 4-second pilot reaction time to stabilizer runaway failures to ensure that a conservative value is used, since pilot action is required to counter these failures.” | RECOMMENDATION |
| D-028 | JATR: the certification deliverables would not have told FAA technical staff about MCAS architecture, signal inputs or limits of authority. | faa-jatr-2019.pdf, PDF p.44, printed p.24 | “the content of certification deliverables would not have provided FAA technical staff with awareness of key details of the MCAS function on the B737 MAX, including architecture, signal inputs, and limits of authority.” | VERIFIED-FINDING |
| D-029 | FHA/PSSA information reached the FAA much too late (at type inspection authorization) to influence the MCAS design. | faa-jatr-2019.pdf, PDF p.44, printed p.24 | “The FAA certification process resulted in FHA/ PSSA information being submitted much too late (at type inspection authorization) for the FAA to have any influence on the proposed MCAS design” | VERIFIED-FINDING |
| D-030 | JATR: the FAA's inadequate awareness of MCAS, together with limited involvement, left it unable to independently assess Boeing's proposed MCAS certification activities. | faa-jatr-2019.pdf, PDF p.13, printed p.VII | “the FAA had inadequate awareness of the MCAS function which, coupled with limited involvement, resulted in an inability of the FAA to provide an independent assessment of the adequacy of the Boeing proposed certification activities associated with MCAS.” | VERIFIED-FINDING |
| D-031 | Safety-critical areas, including MCAS system safety documents, were first retained by the FAA and later delegated to the Boeing ODA. | faa-jatr-2019.pdf, PDF p.46, printed p.26 | “Safety critical areas, including system safety documents related to MCAS, were initially retained by the FAA and then delegated to the Boeing ODA.” | VERIFIED-FINDING |
| D-032 | JATR believes FAA involvement in MCAS certification would likely have produced design changes that improved safety. | faa-jatr-2019.pdf, PDF p.47, printed p.27 | “The JATR team’s belief is that FAA involvement in the certification of MCAS would likely have resulted in design changes that would have improved safety.” | VERIFIED-FINDING |
| D-033 | Boeing's ODA had about 1,500 people, compared with 45 in the FAA's BASOO. | faa-jatr-2019.pdf, PDF p.47, printed p.27 | “The Boeing ODA organization is staffed by approximately 1,500 people, whereas the FAA’s BASOO is staffed by 45 people.” | VERIFIED-FINDING |
| D-034 | R5: review BASOO engineer staffing so there are enough experienced specialists for certification and oversight work. | faa-jatr-2019.pdf, PDF p.14, printed p.VIII | “conduct a workforce review of the BASOO engineer staffing level to ensure there is a sufficient number of experienced specialists to adequately perform certification and oversight duties, commensurate with the extent of work being performed by Boeing.” | RECOMMENDATION |
| D-035 | JATR: as part of the single-channel speed trim system, MCAS had no fault-tolerant features such as sensor voting or limits of authority. | faa-jatr-2019.pdf, PDF p.50, printed p.30 | “As part of the single-channel speed trim system, the MCAS function did not include fault tolerant features, such as sensors voting or limits of authority, to limit failure effects consistent with the hazard classification.” | VERIFIED-FINDING |
| D-036 | Relying on pilot action as the primary MCAS mitigation, before design features or warnings, did not follow Boeing's own safe-design process instructions. | faa-jatr-2019.pdf, PDF p.51, printed p.31 | “The use of pilot action as a primary mitigation means for MCAS hazards, before considering eliminating such hazards or providing design features or warnings to mitigate them, is not in accordance with Boeing’s process instructions for safe design” | VERIFIED-FINDING |
| D-037 | R6.3: flight-critical system functions should have more fault tolerance, such as signal health monitoring, voting and failure annunciation. | faa-jatr-2019.pdf, PDF p.51, printed p.31 | “The FAA should implement policies and further guidance to reinforce that all system functions that are used in flight critical functions should implement means for increased fault tolerance, such as signal health monitoring, voting means, and failure annunciation.” | RECOMMENDATION |
| D-038 | Once all flight deck effects are counted, MCAS invalidated the aircraft-level crew-response assumptions for erroneous AOA, and those assumptions were carried over without formal validation. | faa-jatr-2019.pdf, PDF p.51, printed p.31 | “When all flight deck effects are considered, the introduction of the MCAS function invalidated aircraft-level assumptions for flight crew responses related to erroneous AOA failures under certain conditions.” | VERIFIED-FINDING |
| D-039 | The SSA was not updated beyond MCAS requirements Revision C (high-speed only), although the MAX was certified with Revision E. | faa-jatr-2019.pdf, PDF p.54, printed p.34 | “The SSA was not updated beyond Revision C of the STS requirements for MCAS. The JATR team observed no documented risk, failure, or safety analyses conducted on the MCAS software beyond Revision C.” | VERIFIED-FINDING |
| D-040 | Boeing concluded that multiple erroneous MCAS activations were no worse than one, assuming the crew re-trimmed after each activation. | faa-jatr-2019.pdf, PDF p.54, printed p.34 | “Boeing concluded that multiple erroneous MCAS activations were not worse than a single erroneous activation, based on the assumption that the crew would return the aircraft to a trimmed state (consistent with AC 25-7C guidance) following each activation.” | VERIFIED-FINDING |
| D-041 | R8.8: robustness testing should cover cases where pilots do not follow the assumptions, such as not trimming out the failure. | faa-jatr-2019.pdf, PDF p.60, printed p.40 | “the process should account for evaluation of cases where pilots do not follow the assumptions (e.g., not trimming out the failure).” | RECOMMENDATION |
| D-042 | MCAS information was in the draft FCOM and was removed around MCAS Revision D (early 2016) without a formal process for agreement across disciplines. | faa-jatr-2019.pdf, PDF p.67, printed p.47 | “Information related to the MCAS functionality within the FCC originally was in the draft FCOM and was subsequently removed (around the time of MCAS Revision D, in early 2016), but without a formal process in place” | VERIFIED-FINDING |
| D-043 | R10: FAA should require a documented process for deciding AFM/FCOM/FCTM content, and review training so crews are competent in mis-trim events. | faa-jatr-2019.pdf, PDF p.66, printed p.46 | “The FAA should review training programs to ensure flight crews are competent in the handling of mis-trim events.” | RECOMMENDATION |
| D-044 | JATR: flight crew procedural changes (the kind of interim action often used after a first accident) can be ineffective. | faa-jatr-2019.pdf, PDF p.70, printed p.50 | “Flight crew procedural changes can be ineffective.” | VERIFIED-FINDING |
| D-045 | EASA: process weaknesses meant Boeing failed to identify the risk of relying on single-source AOA data, which allowed an unsafe flight controls architecture. | easa-737max-rts-report-2021.pdf, PDF p.5, printed p.5 | “These process-related weaknesses resulted in Boeing failing to identify the risks associated with the reliance on single-source Angle of Attack (AOA) data, and thus allowed the design of an unsafe flight controls system architecture.” | VERIFIED-FINDING |
| D-046 | The changed stabilizer trim system has a vastly modified cross-channel control architecture and new AOA processing algorithms (FCC software P12.1.2). | easa-737max-rts-report-2021.pdf, PDF p.6, printed p.6 | “The resulting changed stabilizer trim control system features a vastly modified cross-channel control architecture and AOA processing algorithms.” | VERIFIED-FINDING |
| D-047 | New design: any unintended nose-down trim command that the crew cannot easily recover manually is stopped automatically by the monitoring system. | easa-737max-rts-report-2021.pdf, PDF p.6, printed p.6 | “The new design ensures that any unintended nose-down trim command that cannot be easily recovered manually by the crew is stopped automatically by the monitoring system.” | VERIFIED-FINDING |
| D-048 | EASA: no stabilizer runaway like those in the accidents can result from a single failure in the flight control system or its signals, including an AOA probe. | easa-737max-rts-report-2021.pdf, PDF p.6, printed p.6 | “no stabilizer runaway like the ones seen in the accidents may result from single failures in the flight control system or its source signals, including those of an AOA probe.” | VERIFIED-FINDING |
| D-049 | EASA's review found that a wire-bundle failure could cause an uncommanded runaway; a wiring separation modification was required before RTS. | easa-737max-rts-report-2021.pdf, PDF p.6, printed p.6 | “a wiring separation modification was defined to remove this risk and bring the system back to compliance before RTS.” | REQUIREMENT |
| D-050 | EASA found no unreasonable crew-reaction assumptions for the new architecture and judged the maximum trim wheel forces acceptable, provided the updated procedures and training are used. | easa-737max-rts-report-2021.pdf, PDF p.7, printed p.7 | “did not identify any unreasonable assumptions and found the maximum required trim wheel forces to be acceptable” | VERIFIED-FINDING |
| D-051 | EASA: crew reactions were not consistent with Boeing's assumptions about managing an unintended MCAS activation, and crews were not adequately trained on MCAS behaviour. | easa-737max-rts-report-2021.pdf, PDF p.7, printed p.7 | “Additionally, the flight crew reactions were not consistent with the assumptions made by Boeing regarding their capabilities to manage an unintended MCAS activation. Moreover, the flight crew were not adequately trained on the behaviour of the MCAS.” | VERIFIED-FINDING |
| D-052 | EASA: in the accident scenarios, an error that made the AOA disagree alert unavailable on certain configurations further aggravated the issue. | easa-737max-rts-report-2021.pdf, PDF p.8, printed p.8 | “The issue was further aggravated in the accident scenarios by the error that led to the unavailability of the “AOA disagree” alert for certain aircraft configurations.” | VERIFIED-FINDING |
| D-053 | EASA simulator evaluation confirmed excessive workload in the original Unreliable Airspeed procedure, which was redefined, including an option to deactivate the stick shaker by circuit breaker. | easa-737max-rts-report-2021.pdf, PDF p.8, printed p.8 | “confirmed the excessive flight crew workload level associated with the Unreliable Airspeed procedure defined at the time of the original 737 MAX validation” | REQUIREMENT |
| D-054 | Under the Changed Product Rule, the legacy 737 alerting system was not brought up to the latest standard, which would have meant a modern centralised alerting system. | easa-737max-rts-report-2021.pdf, PDF p.8, printed p.8 | “rather than applying the latest standard, which in this case would have led to the implementation of a modern centralized alerting system.” | VERIFIED-FINDING |
| D-055 | RTS requirement: install FCC software P12.1.2, which implements the new stabilizer trim architecture and new MCAS activation logics. | easa-737max-rts-report-2021.pdf, PDF p.10, printed p.10 | “the installation of the FCC P12.1.2 software standard (implementing the new stabilizer trim control architecture and new MCAS activation logics);” | REQUIREMENT |
| D-056 | RTS requirement: a MAX Display System software update that makes the AOA Disagree annunciation work on all aircraft. | easa-737max-rts-report-2021.pdf, PDF p.10, printed p.10 | “the installation of the MAX Display System (MDS) software update to fully require on all aircraft the “AOA Disagree” annunciation functionality;” | REQUIREMENT |
| D-057 | RTS requirement: updated AFM procedures (including Runaway Stabilizer and AOA/ALT/IAS Disagree), general alert-management procedures and additional limitations. | easa-737max-rts-report-2021.pdf, PDF p.10, printed p.10 | “the update of the AFM including changed operating procedures (Airspeed Unreliable, Runaway Stabilizer, Stabilizer Trim Inoperative, Speed Trim Fail, Stabilizer out of Trim, AOA Disagree, ALT Disagree, IAS Disagree), general procedures for the management of alerts, and additional limitations;” | REQUIREMENT |
| D-058 | RTS requirement: five new Training Areas of Special Emphasis and a one-time mandatory pre-RTS crew exercise. | easa-737max-rts-report-2021.pdf, PDF p.10, printed p.10 | “the update of the OSD-FC training requirements including five new TASEs requiring practical training and a one-time pre-RTS flight crew mandatory exercise covering these areas;” | REQUIREMENT |
| D-059 | EASA AFM limitation: Minimum Use Height recalculated with a 1-second recognition time instead of the original 0.5 second. | easa-737max-rts-report-2021.pdf, PDF p.9, printed p.9 | “the EASA RTS AFM was modified to reflect an MUH corresponding to a recognition time of one second instead of the 0.5 second figure used at the time of the original 737 MAX validation.” | REQUIREMENT |
| D-060 | Post-RTS action agreed with Boeing (not a pre-RTS condition): an AOA Integrity Enhancement for the 737-10, to be retrofitted; plus a crew alerting human factors evaluation within 12 months. | easa-737max-rts-report-2021.pdf, PDF p.11, printed p.11 | “737 MAX AOA Integrity Enhancement (to be developed and certified for the 737-10 validation);” | VERIFIED-FINDING |
E · FAA return-to-service summary (corrective action) · 8 rows
| ID | Claim | Source and page | Verbatim | Status |
|---|---|---|---|---|
| E-001 | The original design let erroneous data from a single AOA sensor activate MCAS and trim the stabilizer nose down. | faa-737-rts-summary-2020.pdf, PDF p.8, printed p.— | "Erroneous data from a single AOA sensor activated MCAS and subsequently caused airplane nose- down trim of the horizontal stabilizer." | REQUIREMENT |
| E-002 | The fix makes MCAS use both AOA sensor inputs instead of one. | faa-737-rts-summary-2020.pdf, PDF p.8, printed p.— | "Boeing updated the Flight Control Computer (FCC) software to eliminate MCAS reliance on a single AOA sensor signal by using both AOA sensor inputs" | REQUIREMENT |
| E-003 | The revised control laws permit only one MCAS activation per sensed high-AOA event. | faa-737-rts-summary-2020.pdf, PDF p.8, printed p.— | "The revised flight control laws permit only one activation of MCAS per sensed high-AOA event." | REQUIREMENT |
| E-004 | MCAS will no longer command repeated stabilizer movements. | faa-737-rts-summary-2020.pdf, PDF p.8, printed p.— | "Boeing changed flight control laws to ensure that MCAS will not command repeated movements of the horizontal stabilizer." | REQUIREMENT |
| E-005 | A monitor now stops MCAS using an AOA input that differs from the other by more than 5.5 degrees. | faa-737-rts-summary-2020.pdf, PDF p.11, printed p.— | "An AOA sensor monitor was added to prevent MCAS from using an AOA input if it differs from the other AOA input by more than 5.5 degrees." | REQUIREMENT |
| E-006 | A maximum command limit disables MCAS and speed trim beyond a reference stabilizer position, preserving control-column authority. | faa-737-rts-summary-2020.pdf, PDF p.11, printed p.— | "Boeing incorporated a maximum command limit to disable the MCAS and speed trim operations if the stabilizer position exceeds a reference position." | REQUIREMENT |
| E-007 | The limit is set to preserve maneuver capability with the control column alone, and needs no crew action. | faa-737-rts-summary-2020.pdf, PDF p.28, printed p.— | "Flightcrew intervention is not required to activate the MCAS Maximum Command Limit or to disable the MCAS and Speed Trim operations." | REQUIREMENT |
| E-008 | The FAA listed the MCAS reset behaviour, which generated repetitive commands, as a separate safety item. | faa-737-rts-summary-2020.pdf, PDF p.8, printed p.— | "Safety Item #2: MCAS RESET GENERATES REPETITIVE MCAS COMMANDS" | REQUIREMENT |