Pilots flying the two Boeing 737 Max jets that crashed in the past year were bombarded by multiple warnings that the flights were going dangerously wrong.
Boeing has said the pilots should have been able to swiftly diagnose the problem and follow a longstanding procedure to fix it.
But a report Thursday from federal accident investigators questions whether Boeing and the Federal Aviation Administration underestimated how a blizzard of visual and auditory warnings would slow the pilots’ ability to respond quickly enough to avoid disaster.
The National Transportation Safety Board issued seven recommendations stemming from its role as an adviser to investigations of the crashes in Indonesia and Ethiopia, which together killed 346 people.
It will be up to investigators in those countries to determine what caused the accidents. Preliminary reports have pointed to an anti-stall system that kicked in based on faulty sensor readings and pushed the noses of the planes down.
The NTSB said Boeing assumed that pilots flying the Max would respond to an automated nose-down push by taking “immediate and appropriate” steps. Federal regulations allow manufacturers to make such assumptions, and Boeing even used test pilots in flight simulators to check its assumptions.
Boeing presented highly trained test pilots only with a single alert indicating a condition known as runaway stabilizer trim, which can be triggered by an anti-stall system called MCAS, safety board officials said. They said Boeing failed to consider that an underlying problem like sensor failures - which triggered MCAS in both Max crashes - would set off several alarms.
In the Lion Air and Ethiopian Airlines crashes , signs of trouble showed up early and often.
Shortly after Lion Air Flight 610 took off from Jakarta on Oct. 29, stick shakers on the pilots’ control columns vibrated to warn of an impending stall. Other alerts - some visual, some sound - would have gone off because altitude and speed readings were unreliable.
The crew of Ethiopian Airlines Flight 302 on March 10 would have gotten similar alerts, plus a loud voice recording that warned, “Don’t sink” - they were flying too close to the ground - adding to the cacophony and confusion.
“That’s the actual scenario that never got evaluated in the simulator,” said Dana Schulze, the NTSB’s director of aviation safety.
Schulze said years of research have shown that when multiple alarms compete for the attention of pilots, it can lead to a situation in which “pilots will not respond as perhaps you might have intended.”
The safety board will recommend that the FAA, which certified the Max, evaluate the effect that all possible cockpit alerts might have on pilot response. The board also recommended that FAA require Boeing to include changes in cockpit design or pilot training to help pilots follow proper procedures when responding to the Max’s automated control systems.
Schulze told reporters that the board wants FAA to take those steps before it lets the Max fly again, although the board did not put a timetable in its formal recommendations. She suggested that tests should include regular airline pilots, not just highly experienced test pilots.
The safety board also recommended that FAA examine whether other aircraft besides the Max might have been approved without considering how multiple alarms could distract pilots. And it said that FAA should encourage regulators in Canada, Europe and elsewhere to do the same thing.
The FAA said it will review the NTSB recommendations as it continues to evaluate changes that will be made to the Max.
Boeing issued a short statement saying it would work with FAA in reviewing the recommendations.
An independent safety expert said better testing could help account for varying skill and experience among airline pilots.
Clint Balog, an expert on human performance in aviation who teaches at Embry-Riddle Aeronautical University, said cascading alerts increase the load on pilots during an emergency.
“With some pilots, you can throw almost unlimited warnings and cautions at them and they remain focused and safely recover the aircraft,” Balog said. “Some pilots - a few (warning) lights and they just shut down.”
The Max has been grounded worldwide since March, shortly after the second crash. Boeing is nearing completion of changes that will make MCAS less powerful and tie it to a second sensor measuring the plane’s pitch instead of just one sensor.
Boeing expects that airlines will be able to fly the plane later this year, although many analysts think early 2020 is more likely.
___
David Koenig reported from Dallas, and Tom Krisher reported from Detroit.
Please read our comment policy before commenting.