REUTERS/Beawiharta/File Phot
- A new NTSB report suggests that the FAA and Boeing's flawed assumptions about how pilots would react during an emergency contributed to the two fatal 737 Max crashes.
- The report argues that while the FAA certified that pilots could disable the automated system blamed for the crashes if the system activated unintentionally, it did not consider the affects of multiple cockpit alarms and warnings, some accurate but some faulty, if the system activated and impacted flight control.
- The report offers recommendations for how the FAA can better assess pilots' actions in real-world scenarios, and ensure that future planes are designed around more realistic behavioral assumptions.
- Visit Business Insider's homepage for more stories.
The National
In a report issuing seven new safety recommendations to the FAA, the NTSB noted that a major contributor to the crashes was that pilots reacted differently to multiple alarms and alert indications than Boeing and the FAA assumed they would.
"We saw in these two accidents that the crews did not react in the ways Boeing and the FAA assumed they would," NTSB Chairman Robert Sumwalt said. "Those assumptions were used in the design of the airplane and we have found a gap between the assumptions used to certify the Max and the real-world experiences of these crews, where pilots were faced with multiple alarms and alerts at the same time."
Preliminary reports into the deadly crashes of Lion Air Flight 610 in October 2018 and Ethiopian Airlines Flight 302 five months later indicate that an automated system erroneously engaged after being triggered by a faulty AoA vane, and forced the planes' noses to point down. Pilots were unable to regain control of the aircraft, which crashed, killing everyone on board the two flights, a total of 346 passengers and crew.
Read more: The complete history of the 737 Max, Boeing's promising yet problematic workhorse jet
An aspect of the design flaw that Boeing has been working to fix is the fact that the automated tool, the Maneuvering Characteristics Augmentation System (MCAS), could be activated by a single sensor reading, meaning that one damaged or faulty AoA vane was enough to trigger the system, leading to the crashes.
MCAS was designed to compensate for the 737 Max's engines, which are larger than previous 737 generations. The larger engines could cause the plane's nose to tip upward, leading to a stall. In that situation, MCAS could automatically point the nose downward to negate the effect of the engine size.
Pilots' experience and real-world reactions
However, recent reports and conversations have begun to shift towards pilots' inexperience, as well as a lack of training standards, as a contributor to the crashes.
The NTSB report is consistent with that assessment, although it stopped short of assigning blame to the pilots.
"It is important to note that our safety recommendation report addresses that issue and does not analyze the actions of the pilots involved in the Lion Air and Ethiopian Airlines accidents," Sumwalt said. "That analysis is part of the ongoing accident investigations by the respective authorities."
The NTSB report suggests that Boeing's designs and the FAA's approval of them assumed that pilots - regardless of quality of training - would behave one way during a crisis, when in reality the pilots involved in the crashes behaved differently.
Although Boeing proved to the FAA during certification test flights that MCAS could be disabled safely should it unintentionally activate, the NTSB report says that the test scenarios - which met FAA requirements - did not reflect the real-world scenario of multiple conflicting and confusing alarms, and did not account for the fact that that scenario could lead to pilots responding and behaving differently.
"The NTSB notes in the report that it is concerned that the accident pilots' responses to unintended MCAS operation were not consistent with the underlying assumptions about pilot recognition and response that were used for flight control system functional hazard assessments as part of the Boeing 737 MAX design," the NTSB said in a press release.
The report also suggests that the underlying assumptions by the FAA and Boeing didn't consider the effects of multiple compounding alarms, which the pilots experienced due to the faulty sensor.
"The NTSB's report further notes that FAA guidance allows such assumptions to be made in certification analyses without providing clear direction about the consideration of multiple, flight-deck alerts and indications in evaluating pilot recognition and response. The NTSB's report states that more robust tools and methods need to be used for validating assumptions about pilot response to airplane failures in safety assessments developed as part of the U.S. design certification process."
Recommendations to prevent future issues
The report recommends that the FAA consider how multiple cockpit alerts could confuse or affect pilots when certifying new planes in the future, and to ensure that the plane's design accounts for that.
It also suggests that the FAA develop a way to validate any assumptions about pilot behavior - this could include more simulator test flights with pilots who have not been briefed on the scenario.
Finally, it suggests incorporating better diagnostic tools to help pilots decide which alert to address first.
The 737 Max has been grounded worldwide since the days following the second crash, as Boeing prepares a software fix to prevent similar incidents. The fix is expected to be approved after new certification test flights, allowing the planes back in the air, by the end of this year or early 2020.
Get the latest Boeing stock price here.