In wake of MAX, U.S. investigators warn of faulty assumptions in safety assessment process

By Cat Hofacker|September 26, 2019

Testing must gauge pilot responses to flight deck alerts

The barrage of warning lights and tactile feedback in the cockpit of a modern airliner have one purpose: to prompt the pilot to take the correct action to save the plane and its passengers.

That did not happen in the case of the October 2018 Lion Air crash and a similar Ethiopian Airlines accident that followed in March. The two crashes killed 346 people and prompted a worldwide grounding of the Boeing 737 MAX. Today, the U.S. National Transportation Safety Board published a report recommending that Boeing reassess how it predicts pilot responses to such emergencies, a lesson that might be applied to all U.S. passenger aircraft.

In each crash, the plane’s Maneuvering Characteristics Augmentation System, or MCAS, anti-stall software pushed the nose of the plane down repeatedly after faulty readings from angle-of-attack sensors on the fuselage incorrectly reported the position of the plane’s wings relative to the air flow, local investigators have said. Along with activating MCAS, the AoA sensors set off a deluge of alerts in the cockpit, including a flashing AoA disagree light and a vibrating stick shaker, the mechanical device inside an aircraft’s control column that warns of an imminent stall.

“Multiple alerts and indications can increase pilots’ workload, and the combination of the alerts and indications did not trigger the accident pilots to immediately perform” the correct procedure for overriding MCAS, according to the report.

In the report, titled “Assumptions Used in the Safety Assessment Process and the Effects of Multiple Alerts and Indications on Pilot Performance,” the NTSB made seven recommendations for revising aircraft system testing to consider how the average pilot might react when software like MCAS puts a plane in danger. These tests, which would “consider the effect of all possible flight deck alerts and indications on pilot recognition and response,” should be conducted on the MAX before it returns to service — something Boeing didn’t do the first time around.

In 2016 simulator tests that emulated an erroneous MCAS activation, Boeing test pilots practiced overriding MCAS, which pushes the nose of the aircraft down by commanding the horizontal stabilizer on the aircraft’s tail to swivel upward. According to the NTSB report, Boeing assumed that “the pilot will take immediate action” to override MCAS by flipping the thumb switches on the control column to pull the nose back up. But in the Lion Air and Ethiopian crashes, “the crews did not react in the ways Boeing and the FAA assumed they would,” said NTSB Chairman Robert Sumwalt in a press release accompanying the report.

In another stark difference to the crashes, the simulator tests did not include flight deck alerts like the vibrating stick shaker and AoA disagree light because the tests focused on “pilot response to uncommanded MCAS operation, regardless of underlying cause,” the report reads.

Expressing concern that “similar assumptions and procedures for their validation” may have been used in certifying software in other passenger aircraft, the NTSB report recommends that the FAA require all aircraft manufacturers to redo all “system safety assessments for which they assumed immediate and appropriate pilot corrective actions.”

As for conflicting cockpit alerts that may distract pilots from taking the correct course of action, the NTSB recommended that the FAA create design standards for “aircraft systems that can more clearly and concisely inform pilots of the highest priority actions” when they receive multiple alerts in the cockpit.

An FAA spokesman said the agency welcomes the NTSB recommendations and will “review these and all other recommendations as we continue our review of the proposed changes to the Boeing 737 MAX.”

As investigations into the crashes continue by the Indonesian and Ethiopian civil aviation authorities, the FAA is conducting its own review of the certification of the MAX. The aircraft will not return to service until the FAA recertifies MCAS, for which Boeing will submit a software update.

But as the grounding continues, pressure is growing on the FAA and Boeing to recertify the entire 737 MAX design, which would trigger a more extensive review process that includes examining the plane’s entire design and conducting additional ground and flight tests. The MAX’s original certification in 2017 took about five years.

While U.S. lawmakers have stopped short of advocating for a total recertification, members of the House Transportation Committee’s aviation subcommittee have held a series of hearings on the MAX to examine the original certification process.

“The process that was used to certify this aircraft will not in any way be used to unground this aircraft,” said the top Republican on the panel, Rep. Garret Graves of Louisiana, during a July hearing.

For now, hundreds of MAX jets around the world remain grounded, with no firm date for return to service.