The National Transportation Safety Board (NTSB) issued seven safety recommendations to the Federal Aviation Administration (FAA), calling upon the agency to address concerns about how multiple alerts and indications are considered when making assumptions as part of design safety assessments.

Aviation Safety Recommendation Report 19-01 was issued stemming from the NTSB’s ongoing support under International Civil Aviation Organization Annex 13 to Indonesia’s Komite Nasional Keselamatan Transportasi (KNKT) investigation of the Oct. 29, 2018, crash of Lion Air flight 610 in the Java Se.a and the Aircraft Accident Investigation Bureau of Ethiopia’s investigation of the crash of Ethiopian Airlines flight 302 near Ejere, Ethiopia.

All passengers and crew on board both aircraft — 346 people in all — died in the accidents. Both crashes involved a Boeing 737 Max airplane.

(Read Boeing 737 Max: As automation proliferates, risk of human error persists)

The seven safety recommendations are derived from the NTSB’s examination of the safety assessments conducted as part of the original design of Boeing’s maneuvering characteristics augmentation system (MCAS) on the 737 Max. The NTSB said it is concerned that the process "needs improvement" given its ongoing use in certifying current and future aircraft and system designs.

“We saw in these two accidents that the crews did not react in the ways Boeing and the FAA assumed they would,” said NTSB chairman Robert Sumwalt. “Those assumptions were used in the design of the airplane and we have found a gap between the assumptions used to certify the MAX and the real-world experiences of these crews, where pilots were faced with multiple alarms and alerts at the same time.”

The NTSB said it is concerned that the accident pilots’ responses to "unintended MCAS operation" were not consistent with the underlying assumptions about pilot recognition and response that were used for flight control system functional hazard assessments as part of the Boeing 737 Max design.

The report further notes that FAA guidance allows such assumptions to be made in certification analyses without providing "clear direction about the consideration of multiple, flight-deck alerts and indications in evaluating pilot recognition and response." The report states that more robust tools and methods need to be used for validating assumptions about pilot response to airplane failures in safety assessments developed as part of the U.S. design certification process.

The seven recommendations issued to the FAA urge action in three areas to improve flight safety.

  • Ensure system safety assessments for the 737 Max (and other transport-category airplanes) that used certain assumptions about pilot response to uncommanded flight control inputs, consider the effect of alerts and indications on pilot response and address any gaps in design, procedures or training.
  • Develop and incorporate the use of robust tools and methods for validating assumptions about pilot response to airplane failures as part of design certification.
  • Incorporate system diagnostic tools to improve prioritization and more clearly present failure indications to pilots to improve the timeliness and effectiveness of their response.

The NTSB's Lion Air accident report is expected to be released in the coming months, and its analysis may generate additional findings and recommendations.

To contact the author of this article, email