An underlying problem was Boeing’s misreading of the potential dangers of an automated anti-stall feature implicated in both crashes, the NTSB found.
The company assumed the feature in certain circumstances could pose a “major” hazard, but not a “catastrophic” one, according to the NTSB. Boeing underestimated the risk and overestimated pilots’ ability to handle any problems with the feature.
“Their assumptions were inaccurate, and did not portray how reality actually played out,” NTSB Chairman Robert L. Sumwalt said in an interview.
The NTSB described how besieged pilots struggled with Boeing’s automated feature, known as the Maneuvering Characteristics Augmentation System (MCAS), recounting how in the run-up to the Oct. 29 crash in Indonesia, MCAS automatically pushed the plane’s nose down “more than 20 times” in a six-minute stretch before the 737 and its 189 passengers and crew plunged into the Java Sea.
The Federal Aviation Administration should require Boeing to make a more rigorous analysis of how its warning systems might overwhelm pilots, the NTSB said. The safety board also said the same problem could affect other passenger planes beyond the Max and recommended that the FAA address such shortcomings broadly.
“They’re getting all these different alerts. That’s the actual scenario that never got evaluated in the simulator,” said Dana Schulze, director of the NTSB’s Office of Aviation Safety.
The FAA should require that safety assessments consider the effect of multiple alerts, she said.
“Clearly, if the underlying process has a deficiency, it’s going to affect more than just potentially one aircraft,” she added. “What we’re not saying is that there’s broadly a safety issue in all these airplanes. We’re saying, ‘This is an opportunity to improve the process to ensure that the human aspect is considered,’ ” Schulze said.
The two crashes killed 346 people and left the management and safety practices of Boeing and the FAA under intense scrutiny and the subject of numerous inquiries. The company and regulator have both said they followed the same safety practices for the Max that have for years produced trustworthy airplanes.
Boeing declined to answer questions about the NTSB findings and was noncommittal about what actions it will take to address them, saying it will work with the FAA to review the recommendations. “The safety of our airplanes, our customers’ passengers and crews is always our top priority,” the company said in a statement.
The company’s board of directors on Wednesday recommended a number of actions to “bolster the safety policies and procedures” of the company. They included the creation of a “Product and Services Safety organization” that would report to senior company leaders and would review “all aspects of product safety, including investigating cases of undue pressure and anonymous product and service safety concerns raised by employees.”
Boeing’s board also recommended that the company “re-examine assumptions around flight deck design and operation . . . to anticipate the needs of the changing demographics and future pilot populations.” And it called for more pilot training where needed.
The FAA said in a statement that it appreciates the NTSB recommendations, which it will review, and that the agency is “committed to a philosophy of continuous improvement.” Lessons learned from crashes “will be a springboard to an even greater level of safety,” it said.
The NTSB outlined several concerns about “human factors,” a broad area that covers the interface of person and machine.
“The lessons of the past need to be plowed into the designs of the future,” said Evan Byrne, who heads the NTSB’s Human Performance and Survival Factors Division that focuses on aviation safety. “This isn’t necessarily a new airplane problem. The concept of saturation, in terms of alarms, warnings and crews maybe going down the wrong path for troubleshooting, has occurred with very simple airplanes. Research at NASA shows that crew response to abnormal situations can not be perfect.”
The NTSB recounted how pilots who a day earlier had flown the same 737 Max that crashed in Indonesia managed to essentially cut power to the errant system when problems arose and then land safely.
But their colleagues the next day, and months later in Ethiopia, had different, tragic results. That raised questions about Boeing’s assumptions and, the NTSB said, underscores the need to ensure systems are designed in ways people can readily understand.
In building its original safety assessment for the Max, Boeing had assumed that “the pilots would immediately identify” that the plane was being pushed downward without their input, she said.
Boeing also assumed that “after immediately identifying these control forces, they would immediately take action,” and if problems persisted, they would resort to an existing emergency checklist on how to deal with a “runaway” horizontal stabilizer on the plane’s tail, which makes the aircraft climb or descend, Schulze said.
But Schulze said that when NTSB investigators delved into the details, they found that Boeing’s assumptions did not reflect the type of failure that eventually occurred with MCAS.
When Boeing had test pilots face an “unintended MCAS activation,” the simulator pushed the plane’s nose down by 2.5 degrees, she said. The pilots were able to handle that situation safely.
But in the Indonesia and Ethiopia crashes, there was “a deeper failure” — an external probe provided faulty information to MCAS. That added to the series of competing alerts, even as MCAS repeatedly pushed the nose down. And Boeing “did not look at all the potential flight deck alerts and indications the pilots might face when this specific failure” happened, she said.
In comments to Congress earlier this year, Capt. Chesley B. “Sully” Sullenberger III said he thought it was “unlikely that other crews would have had very different experiences or performed very differently than these crews did on their accident flights. . . . I can tell you firsthand that the startle factor is real, and huge.”
Among its recommendations, the NTSB called on the FAA to:
●Guarantee that Boeing has reexamined certain safety assessments for the Max. In cases where the company “assumed immediate and appropriate pilot corrective actions” in response to “uncommanded” movements of the plane, the FAA should ensure that Boeing “consider the effect of all possible flight deck alerts and indications on pilot recognition and response.” Boeing also should be required to “incorporate design enhancements (including flight deck alerts and indications)” and/or new procedures and training to minimize the “safety impact of pilot actions that are inconsistent with manufacturer assumptions,” the NTSB said.
● Require similar reassessments and improvements on most other passenger planes.
●Come up with standards for diagnostic tools that will be required on passenger planes to improve the “prioritization and clarity” of warnings for pilots, with an eye toward improving the “timeliness and effectiveness” of their response.