https://www.washingtonpost.com/local/trafficandcommuting/ntsb-cites-competing-pilot-warnings-and-flawed-safety-assumptions-on-boeing-737-max/2019/09/25/72291a2e-dfa6-11e9-be96-6adb81821e90_story.html

NTSB cites competing pilot warnings and flawed safety assumptions on Boeing 737 Max
Michael Laris

An aerial photo shows Boeing 737 MAX aircraft at Boeing facilities at the Grant County International Airport in Moses Lake, Wash., on Sept. 16. (Lindsey Wasson/Reuters)
September 26 at 10:40 AM
After an automated feature on a Boeing 737 Max failed in the skies above Ethiopia in March, repeatedly forcing the plane’s nose downward, the pilots were bombarded with a cacophony of alarms that shook, clacked and lit up throughout the cockpit.

Boeing did not sufficiently consider the effect that such a barrage would have on those flying the plane when it designed the Max, according to the National Transportation Safety Board, which released its first wave of recommendations Thursday in response to the crash in Ethiopia and one in Indonesia under similar circumstances in October.

The Federal Aviation Administration should require Boeing to make a more rigorous analysis of how its warning systems might overwhelm pilots, the NTSB said. The safety board also said the same problem could affect other passenger planes beyond the Max, and recommended that the FAA address such shortcomings broadly.

“They’re getting all these different alerts. That’s the actual scenario that never got evaluated in the simulator,” said Dana Schulze, director of the NTSB’s Office of Aviation Safety.

The FAA should require that safety assessments consider the effect of multiple alerts, she said, adding, “Clearly, if the underlying process has a deficiency, it’s going to affect more than just potentially one aircraft.

“What we’re not saying is that there’s broadly a safety issue in all these airplanes. We’re saying, ‘This is an opportunity to improve the process to ensure that the human aspect is considered,’ ” Schulze said.

Paul Njoroge, 35, of Toronto — who lost his wife, Carolyne Karanja, his three young children and his mother-in-law in the Ethiopian Airlines crash — holds photos during a vigil in front of the Transportation Department headquarters in Washington on Sept. 10, six months after the crash. (Sarah L. Voisin/The Washington Post)
The two crashes killed 346 people and left the management and safety practices of both Boeing and the FAA under intense scrutiny and the subject of numerous inquiries. The company and regulator have both said they followed the same safety practices for the Max that have for years produced trustworthy airplanes.

Boeing declined to answer questions about the NTSB findings, and was noncommittal about what actions it will take to address them, saying it will work with the FAA to review the recommendations. “The safety of our airplanes, our customers’ passengers and crews is always our top priority,” the company said in a statement Thursday.

The company’s board of directors on Wednesday recommended a number of actions to “bolster the safety policies and procedures” of the company. They included the creation of a “Product and Services Safety organization” that would report to senior company leaders and would review “all aspects of product safety, including investigating cases of undue pressure and anonymous product and service safety concerns raised by employees.”

Boeing’s board also recommended that the company “re-examine assumptions around flight deck design and operation . . . to anticipate the needs of the changing demographics and future pilot populations.” And it called for more pilot training where needed.

The FAA said in a statement that it appreciates the recommendations, which it will review, and that the agency is “committed to a philosophy of continuous improvement.” Lessons learned from crashes “will be a springboard to an even greater level of safety,” it said.

The NTSB is participating in ongoing investigations of the two crashes led by aviation authorities in Jakarta and Addis Ababa. NTSB investigators delayed making other recommendations until those inquiries are completed, leaving many key questions unaddressed for now.

The safety board, for instance, did not publicly describe which Boeing failures led to the design and sale of the automated feature implicated in both crashes, known as the Maneuvering Characteristics Augmentation System (MCAS). The feature was designed to work based on data from a single sensor, and was given the power to push the plane’s nose down, again and again, which essentially overpowered pilots who struggled to regain control before the Indonesia and Ethi*o*pia crashes.

Nor did the NTSB recommend how Boeing should fix flaws in its operations or how the FAA might reform its controversial Organization Designation Authorization program, which gives Boeing broad power to oversee its own safety. And the NTSB investigators, Schulze said, did not “address specific issues looking at the pilot performance in these particular accidents.”

[Long before the Max disasters, Boeing had a history of failing to fix safety problems]

But the safety board outlined several concerns about “human factors,” a broad area that covers the interface of person and machine.

“The lessons of the past need to be plowed into the designs of the future,” said Evan Byrne, who heads the NTSB’s Human Performance and Survival Factors division focused on aviation safety. “This isn’t necessarily a new airplane problem. The concept of saturation, in terms of alarms, warnings and crews maybe going down the wrong path for troubleshooting, has occurred with very simple airplanes. Research at NASA shows that crew response to abnormal situations can not be perfect.”

Byrne said the goal now is to take what has been learned in crashes regarding “how pilots actually perform” and make sure those lessons are reflected in the way airplanes are certified in the future.

NTSB officials said Boeing made assumptions in its safety analysis of a potential failure of the MCAS system that proved off base.

“Every design you need to make assumptions, but you want to validate that that’s going to work,” Schulze said.

In building its original safety assessment for the Max, Boeing had assumed that “the pilots would immediately identify” that the plane was being pushed downward without their input, she said.

Boeing also assumed that “after immediately identifying these control forces, they would immediately take action,” and if problems persisted, they would resort to an existing emergency checklist on how to deal with a “runaway” horizontal stabilizer on the plane’s tail, which makes the aircraft climb or descend, Schulze said.

But Schulze said that when NTSB investigators delved into the details, they found that Boeing’s assumptions did not reflect the type of failure that eventually occurred with MCAS.

When Boeing had test pilots face an “unintended MCAS activation,” the simulator pushed the plane’s nose down by 2.5 degrees at a certain speed, she said. The pilots were able to handle that situation safely.

[With its ties in Washington, Boeing has taken over more and more of the FAA’s job]

But in Indonesia and Ethiopia, there was “a deeper failure” — an external probe provided faulty information to MCAS. That added to the series of competing alerts, even as MCAS repeatedly pushed the nose down. And Boeing “did not look at all the potential flight deck alerts and indications the pilots might face when this specific failure” happened, she said.

In comments to Congress earlier this year, Capt. Chesley B. “Sully” Sullenberger III said he thought it was “unlikely that other crews would have had very different experiences or performed very differently than these crews did on their accident flights. . . . I can tell you firsthand that the startle factor is real, and huge.”

The NTSB made seven recommendations Thursday to address certification and safety issues, and investigators expect to add more later. They called on the FAA to:

●Guarantee that Boeing has reexamined certain safety assessments for the Max. In cases where the company “assumed immediate and appropriate pilot corrective actions” in response to “uncommanded” movements of the plane, the FAA should ensure that Boeing “consider the effect of all possible flight deck alerts and indications on pilot recognition and response.”

Boeing also should be required to “incorporate design enhancements (including flight deck alerts and indications), pilot procedures, and/or training requirements, where needed, to minimize the potential for and safety impact of pilot actions that are inconsistent with manufacturer assumptions,” the NTSB said.

●Require that similar reassessments and improvements be done on most other passenger planes.

●Notify international authorities that they should consider the same issues.

●Develop “robust tools and methods” for “validating assumptions” used during the certification process, specifically assumptions on how pilots will handle dangerous failures of airplanes’ systems.

● Revise FAA regulations and guidance to use those new tools for certifying the design of airplanes, and to reexamine the “validity” of assumptions the FAA allows regarding how pilots will recognize and respond to problems.

●Develop design standards, with help from experts and industry, for diagnostic tools that will improve the “prioritization and clarity” of the various warnings and indications pilots are subjected to, with an eye toward improving the “timeliness and effectiveness” of their response.

●Require that those diagnostic tools are installed on passenger planes to help pilots better deal with multiple alerts.