The Federal Aviation Administration is not ensuring Boeing is thoroughly evaluating how airline pilots will react when flight control systems fail on the planes they fly, the National Transportation Safety Board says.
The NTSB released recommendations Thursday after its investigation into the certification of the 737 Max. The agency specifically scrutinized the evaluation process for the Boeing 737 Max’s Maneuvering Characteristics Augmentation System (MCAS), a critical system at the center of two catastrophic crashes that left more than 300 people dead.
The NTSB believes variances in pilot behavior are not being fully considered when the FAA evaluates an aircraft for certification.
“Human factors need to have better consideration in the certification process, which will inherently affect the design, procedures and the training,” said Dana Schultz, director of NTSB’s Aviation Safety division.
The NTSB is pressing the FAA to look more carefully at how pilots interface with increasingly complex and advanced aircraft. The safety board specifically found fault with the assumptions Boeing made about how pilots would react to problems when it designed flight controls, namely the MCAS system, on the 737 Max aircraft.
In a statement Thursday morning, the FAA said its “first priority is safety” and that it welcomed the recommendations.
“The agency will carefully review these and all other recommendations as we continue our review of the proposed changes to the Boeing 737 Max,” the FAA said. “The FAA is committed to a philosophy of continuous improvement. The lessons learned from the investigations into the tragic accidents of Lion Air Flight 610 and Ethiopian Airlines Flight 302 will be a springboard to an even greater level of safety.”
Boeing said it was “committed to working with the FAA” in reviewing the NTSB’s recommendations.
Although assumptions are expected and allowed when manufacturers are designing an aircraft, the NTSB found that Boeing’s assumption that pilots would quickly identify an MCAS malfunction and react properly did not consider all the potential scenarios that might cause the MCAS to malfunction and all the flight deck alerts pilots might face In a crisis.
The highly interconnected system can mean multiple alarms are set off as one failure creates a domino effect of other failures on the plane.
The NTSB said Boeing test pilots never ran a scenario in the simulator that involved a situation where a false angle-of-attack reading triggered the MCAS system, which is what investigators believe happened in both 737 Max crashes.
In both the Lion Air and Ethiopian Air crashes, the pilots faced a cascade of flight warning alerts, and it’s believed the multiple alerts made it difficult for the pilots to quickly identify the problem.
“As automation continues to evolve and aviation does become more automated, the interface issues with the pilots, become more and more important,” Schulz added.
“So we need to get there with the tools and techniques to make sure they are data-based.”
By “data-based,” the NTSB means not solely relying on the predictions of veteran Boeing test pilots about how airline pilots will react to airplane system failures. The safety agency favors a more science-based approach, including bringing in actual airline pilots for simulator testing to observe how they react to these failures.
The NTSB is also concerned about how alerts are presented to the pilots and that too many alerts at once could paralyze a pilot’s judgment at a time when he or she is overwhelmed.
Now, the NTSB says, when designing aircraft systems, both the manufacturer and the regulator need to make sure system failure indications are prioritized better for pilots in the cockpit with the hope it would “improve the timeliness and effectiveness of their response.”
The NTSB says if the same sort of assumptions were made in the evaluation of systems on other Boeing aircraft, these recommendations extend to those aircraft as well. It also wants the FAA to encourage international regulators to make these changes.
The NTSB would like these recommendations considered before the aircraft FAA makes the decision to unground the Max. The FAA will have 90 days to respond.
As part of its evaluation, NTSB did not analyze pilot actions, only the US process for certifying the MCAS system on the plane. The agency says there will potentially be more recommendations that come down the line as more is learned from the ongoing crash investigations.