The National Transportation Safety Board is urging the Federal Aviation Administration to review pilot-related assumptions that Boeing and other manufacturers use when designing aircraft.
The board issued a 13-page report on 26 September recommending the agency review not only aspects of the 737 Max’s certification, but also those of other US-made transport aircraft.
It urges the FAA to develop broad standards to make cockpit alerts clearer and to help pilots better prioritise cockpit warnings.
“We are concerned that the process used to evaluate the original design needs improvement because that process is still in use to certify current and future aircraft and system designs,” writes the NTSB.
“We welcome and appreciate the NTSB’s recommendations,” says the FAA. “The agency will carefully review these and all other recommendations as we continue our review of the proposed changes to the Boeing 737 Max. The FAA is committed to a philosophy of continuous improvement.”
“Safety is a core value for everyone at Boeing,” the airframer says. “We value the role of the NTSB in promoting aviation safety. We are committed to working with the FAA in reviewing the NTSB recommendations.”
The NTSB’s report follows the board’s investigation into design and certification of the 737 Max’s Maneuvering Characteristics Augmentation System (MCAS). Investigators say MCAS contributed to two 737 Max crashes that killed 346 people.
The NTSB finds Boeing’s design was based on inadequate assumptions about how 737 Max pilots might react to the many cockpit alerts that accompany MCAS failures.
“The accident pilots’ responses to unintended MCAS operation were not consistent with the underlying assumptions about pilot recognition and response that Boeing used, based on FAA guidance”, the NTSB says.
“We saw in these two accidents that the crews did not react in the ways Boeing and the FAA assumed they would,” adds NTSB chair Robert Sumwalt. “We have found a gap between the assumptions used to certify the Max and the real-world experiences of these crews.”
Sumwalt has previously stressed his belief that cockpits and flight systems should be designed for operation by pilots with skill levels actually found at the world’s airlines, what he called the “lowest common denominator”.
But former NTSB John Goglia, now an aerospace safety consultant, believes the NTSB has taken the wrong tack, leaving unaddressed what he sees as the real problem: deficient pilot training.
Making cockpits simpler may only leave pilots less prepared to cope when systems fail, he says.
“We are asking Boeing to dumb down their cockpit for all users to meet the lowest standard around the world,” Goglia says.
“It’s lowering the professionalism in the cockpit,” he adds. “We are turning it into Microsoft Flight Simulator.”
PILOT ASSUMPTIONS
The NTSB’s report focuses acutely on pilot-response assessments that aircraft manufacturers make when considering the safety of their designs, and related certification requirements.
It recommends the FAA require Boeing to ensure 737 Max safety assessments “consider the effect of all possible flightdeck alerts and indications”.
Boeing should make design changes to minimise risks that could arise if pilots do not react as Boeing assumes they will, the report says.
The NTSB also reaches more broadly, urging the FAA to ensure assumptions used to validate “all other US-type-certificated transport-category airplanes” account for how multiple cockpit alerts will affect pilots.
Manufacturers should be required to make design changes as needed, and the FAA should change regulations as needed, it says.
Additionally, the FAA should develop design standards to improve the clarity and prioritisation of cockpit alerts, the report says.
BOEING’S MCAS DESIGN
The NTSB notes Boeing added MCAS to the 737 Max because its larger CFM International Leap-1B powerplants produced aircraft-nose-up pitch when flying at high angles of attack (AOA) and at “mid-Mach numbers”, says the report.
Boeing therefore added MCAS, which applies nose-down stabiliser movement when the aircraft’s AOA passes a threshold.
The MCAS system in both crashed aircraft activated following AOA sensor failures, investigators have said. MCAS failures usually coincide with a bevy of cockpit alerts, such as airspeed and altitude disagree warnings and stick shake, the NTSB notes.
Regulations require cockpit alerts “be readily and easily detectable and intelligible by all the flightcrew under all foreseeable operating conditions, including conditions where multiple alerts are provided”, the NTSB notes.
To demonstrate the Max’s regulatory compliance, Boeing performed several airplane and system safety assessments. In doing so, it classified the hazard of an extreme MCAS-induced stabiliser movement as a “major” hazard.
Boeing conducted flight simulator tests to analyze pilot responses to MCAS activation, but those tests did not produce the many cockpit alerts that accompany MCAS failures, the NTSB notes.
“While Boeing considered the possibility of uncommanded MCAS operation as part of its functional hazard assessment, it did not evaluate all the potential alerts and indications that could accompany a failure,” writes the NTSB. “The assumptions that Boeing used in its functional hazard assessment of uncommanded MCAS function for the 737 Max did not adequately consider and account for the impact that multiple flightdeck alerts and indications could have on pilots’ responses.”
Source: FlightGlobal.com
