Federal safety officials say Boeing should consider how cockpit confusion can slow the response of pilots who are dealing with the kind of problem that likely caused two airliners to crash in the past year.
They suggest that Boeing underestimated the time it takes — measured in precious seconds — for pilots to diagnose and react when they are being bombarded by multiple, cascading warning alerts.
The National Transportation Safety Board issued several recommendations Thursday after taking part in investigations into two crashes of Boeing 737 Max jets that killed 346 people.
It will be up to investigators in Indonesia and Ethiopia to determine what caused the accidents in those countries. Preliminary reports have pointed to an anti-stall system that kicked in based on faulty sensor readings and pushed the noses of the planes down.
Boeing officials have said the pilots didn't follow known procedures for stopping a sudden nose-down pitch or, in the case of the Ethiopian crash, followed the procedures only briefly.
The safety board said Boeing assumed that pilots flying the Max would respond to an automated nose-down push by taking "immediate and appropriate" steps. Federal regulations allow manufacturers to make such assumptions, and Boeing even used test pilots in flight simulators to check its assumptions.
Boeing presented highly trained test pilots only with a single alert indicating a condition known as runaway stabilizer trim, which can be triggered by the MCAS anti-stall system, safety board officials said. They said Boeing failed to consider that an underlying problem like sensor failures — which triggered MCAS in both Max crashes — would set off several alarms.
In the Lion Air and Ethiopian Airlines crashes , they said, the pilots' control columns would have shaken to warn of an impending stall, they would have gotten several visual and sound alerts about things like altitude and speed.
"That's the actual scenario that never got evaluated in the simulator," said Dana Schulze, the board's director of aviation safety.
Schulze said years of research have shown that when multiple alarms compete for the attention of pilots, it can lead to a situation in which "pilots will not respond as perhaps you might have intended."
The safety board will recommend that the Federal Aviation Administration, which certified the Max to fly in 2017, evaluate the effect that all possible cockpit alerts might have on pilot response. The board also recommended that FAA require Boeing to include changes in cockpit design or pilot training to help pilots follow proper procedures when responding to the Max's automated control systems.
Schulze told reporters that the board wants FAA to take those steps before it lets the Max fly again, although the board did not put a timetable in its formal recommendations.
The safety board recommended that FAA examine whether other aircraft besides the Max might have been approved without considering how multiple alarms could distract pilots. They also said FAA should encourage other regulators in Canada, Europe and elsewhere to do the same thing.
In a statement Thursday, the FAA said it will review the NTSB's recommendations as it continues to evaluate changes that will be made to the Max.
"The FAA is committed to a philosophy of continuous improvement," the statement said.
Boeing issued a short statement saying it would work with FAA in reviewing the recommendations.
The Max has been grounded worldwide since March, shortly after the second crash. Boeing is nearing completion of changes that will make MCAS less powerful and tie it to a second sensor measuring the plane's pitch instead of just one sensor.
Boeing expects that airlines will be able to fly the plane later this year, although many analysts think early 2020 is more likely.
___
David Koenig reported from Dallas, and Tom Krisher reported from Detroit.