Download the testimony and attachment
Good afternoon, Chairman Wicker, Ranking Member Cantwell, and Members of the Committee. Thank you for inviting the National Transportation Safety Board (NTSB) to testify before you today.
The NTSB is an independent federal agency charged by Congress with investigating every civil aviation accident in the United States and significant accidents in other modes of transportation – highway, rail, marine, and pipeline. We determine the probable cause of the accidents we investigate, and we issue safety recommendations aimed at preventing future accidents. In addition, we conduct special transportation safety studies and special investigations and coordinate the resources of the federal government and other organizations to assist victims and their family members who have been impacted by major transportation disasters. The NTSB is not a regulatory agency – we do not promulgate operating standards, nor do we certificate organizations, individuals, or equipment. The goal of our work is to foster safety improvements, through safety recommendations, for the traveling public.
Today I will address NTSB’s recent recommendation report, “Assumptions Used in the Safety Assessment Process and the Effects of Multiple Alerts and Indications on Pilot Performance,” issued on September 26, 2019, which contained seven recommendations to the Federal Aviation Administration (FAA). These recommendations resulted from our examination of relevant factors in the US design certification process following two crashes of Boeing 737 MAX 8 aircraft.
NTSB’s Role in Boeing 737-MAX 8 Crashes
On October 29, 2018, a Boeing 737 MAX 8, operated by Lion Air, crashed into the Java Sea shortly after takeoff from Soekarno-Hatta International Airport, in Jakarta, Indonesia, killing all 189 passengers and crew on board. The Komite Nasional Keselamatan Transportasi (KNKT) of Indonesia, investigated the accident and released the final report on October 25, 2019. On March 10, 2019, a Boeing 737 MAX 8, operated by Ethiopian Airlines, crashed after takeoff from Addis Ababa Bole International Airport in Ethiopia, killing all 157 passengers and crew, including eight American citizens. The investigation is being led by the Ethiopia Accident Investigation Bureau (EAIB), which released a preliminary report on April 4, 2019.
The NTSB participated in these foreign investigations in accordance with the Chicago Convention of the International Civil Aviation Organization (ICAO) and the Standards and Recommended Practices provided in Annex 13 to the Convention because these accidents involved the Boeing 737 MAX 8, a US-designed, certified and manufactured airplane. Because both Indonesia and Ethiopia are signatories to the ICAO Convention, they are each responsible for the investigation in their state and control the release of all information regarding the investigation.
Following the Lion Air crash, the NTSB appointed a US accredited representative and immediately dispatched investigators to Indonesia to participate in the KNKT investigation. NTSB investigators had access to all investigative data and participated in all aspects of the investigation, including: download and analysis of the flight data recorder (FDR) and cockpit voice recorder (CVR); teardown and examination of airplane components such as the angle of attack sensor that was removed prior to the accident flight; airplane performance analysis and simulation sessions; airplane system and certification analysis; interviews of airline and maintenance personnel; and review of the KNKT draft final report. The final report released by the KNKT on October 25, 2019, reiterated the seven NTSB recommendations and also included an additional 25 recommendations to seven organizations, including Lion Air, Boeing, Indonesian Directorate General of Civil Aviation, and the FAA.
In response to the Ethiopian Airlines crash, the NTSB also appointed an accredited representative, who we dispatched to Ethiopia with a team of investigators. NTSB investigators continue to take part in this ongoing investigation and have had access to all investigative data, including taking part in the download and analysis of the CVR and FDR.
In accordance with ICAO Annex 13, technical advisors from the FAA, Boeing, and General Electric have accompanied NTSB investigators to the Lion Air and Ethiopian Airlines accident sites to provide their specialized technical knowledge regarding the aircraft and its systems.
ICAO Annex 13 provides for other involved states to gain timely access to investigative information for the purposes of continued operational safety. As a result, NTSB participation in the foreign accident investigations enabled safety deficiencies to be promptly addressed by the FAA and the manufacturer and through NTSB safety recommendations. Because the United States is the state of design and manufacturer of the aircraft involved in these accidents, we examined relevant factors in the US design certification process to ensure deficiencies were identified and addressed.
Design Certification of the 737 MAX 8 and Safety Assessment of the Maneuvering Characteristics Augmentation System (MCAS)
The 737 MAX 8 is a derivative of the 737-800 Next Generation (NG) model and is part of the 737 MAX family (737 MAX 7, 8, and 9). The 737 MAX incorporated a new engine (CFM LEAP-1B) and nacelle, which produced an airplane-nose-up pitching moment when the airplane was operating at high angle of attack (AOA) and mid-Mach numbers. After studying various options for addressing this issue, Boeing implemented aerodynamic changes as well as a stability augmentation function, Maneuvering Characteristics Augmentation System (MCAS), as an extension of the existing speed trim system to improve aircraft handling characteristics and decrease pitch-up tendency at elevated AOA. As the development of the 737 MAX progressed, the MCAS function was expanded to low Mach numbers.
As originally delivered, the MCAS became active during manual flight (autopilot not engaged) when the flaps were fully retracted and the airplane’s AOA value (as measured by either AOA sensor) exceeded a threshold based on Mach number. When activated, the MCAS provided automatic trim commands to move the stabilizer airplane nose down. Once the AOA fell below the threshold, the MCAS would move the stabilizer to the original position. At any time, the stabilizer inputs could be stopped or reversed by the pilots using their stabilizer trim switches. If the stabilizer trim switches were used by the pilots and the elevated AOA condition persisted, the MCAS would command another stabilizer airplane nose down trim input after five seconds.
In each of the accident flights, the MCAS activated in response to erroneous AOA inputs, resulting in continuous command of airplane nose down stabilizer trim input as well as other alerts and indications. Multiple alerts and indications can increase pilots’ workload, and the combination of the alerts and indications did not trigger the accident pilots to immediately perform the runaway stabilizer trim procedure during the MCAS-activated airplane-nose-down stabilizer trim input. The pilots’ responses did not match the assumptions of the pilot responses to unintended MCAS operation on which Boeing based its hazard classifications within the safety assessment and that the FAA approved and used to ensure the design safely accommodates failures. Thus, the NTSB concluded that Boeing’s functional hazard assessment of uncommanded MCAS function for the 737 MAX did not adequately consider and account for the impact that multiple flight deck alerts and indications could have on pilots’ responses to the hazard.
We further concluded that a standardized methodology and/or tools for manufacturers’ use in evaluating and validating assumptions about pilot recognition and response to failure condition(s), would help ensure that system designs adequately and consistently minimize the potential for pilot actions that are inconsistent with manufacturer assumptions. Lastly, because the pilots were uncertain how to prioritize and respond to the multiple alerts and indications that they received, we concluded that aircraft systems that can more clearly and concisely inform pilots of the highest priority actions when multiple flight deck alerts and indications are present would minimize confusion and help pilots respond most effectively.
Since the Lion Air accident in October 2018, Boeing has developed a software update to provide additional layers of protection to the MCAS and is working on updated procedures and training. However, we are concerned that the process used to evaluate the original design needs improvement because that process is still in use to certify current and future aircraft and system designs. Therefore, in accordance with our responsibilities as the accredited representative of the state of design and manufacture of the 737, we felt it necessary to issue safety recommendations.
On September 26, 2019, the NTSB issued seven safety recommendations to the FAA as a result of our examination of the US design certification process used to approve the original design of the MCAS system on the Boeing 737 MAX.
The NTSB found that the accident pilots’ responses to the unintended MCAS operation were not consistent with the underlying assumptions about pilot recognition and response that Boeing used, based on FAA guidance, for flight control system functional hazard assessments, including for MCAS, as part of the 737 MAX design. We issued these recommendations to address assumptions about pilot recognition and response to failure conditions used during the design certification process as well as diagnostic tools to improve the prioritization and clarity of failure indications presented to pilots.
As a result of the NTSB’s in-depth examination of the US design certification process and assumptions used to approve the original design of the MCAS system on the Boeing 737 MAX, the NTSB issued the following seven recommendations to the FAA:
Require that Boeing (1) ensure that system safety assessments for the 737 MAX in which it assumed immediate and appropriate pilot corrective actions in response to uncommanded flight control inputs, from systems such as the Maneuvering Characteristics Augmentation System, consider the effect of all possible flight deck alerts and indications on pilot recognition and response; and (2) incorporate design enhancements (including flight deck alerts and indications), pilot procedures, and/or training requirements, where needed, to minimize the potential for and safety impact of pilot actions that are inconsistent with manufacturer assumptions. (A-19-10)
Require that for all other US type-certificated transport-category airplanes, manufacturers (1) ensure that system safety assessments for which they assumed immediate and appropriate pilot corrective actions in response to uncommanded flight control inputs consider the effect of all possible flight deck alerts and indications on pilot recognition and response; and (2) incorporate design enhancements (including flight deck alerts and indications), pilot procedures, and/or training requirements, where needed, to minimize the potential for and safety impact of pilot actions that are inconsistent with manufacturer assumptions. (A-19-11)
Notify other international regulators that certify transport-category airplane type designs (for example, the European Union Aviation Safety Agency, Transport Canada, the National Civil Aviation Agency-Brazil, the Civil Aviation Administration of China, and the Russian Federal Air Transport Agency) of Recommendation A-19-11 and encourage them to evaluate its relevance to their processes and address any changes, if applicable. (A-19-12)
Develop robust tools and methods, with the input of industry and human factors experts, for use in validating assumptions about pilot recognition and response to safety-significant failure conditions as part of the design certification process. (A-19-13)
Once the tools and methods have been developed as recommended in Recommendation A-19-13, revise existing Federal Aviation Administration (FAA) regulations and guidance to incorporate their use and documentation as part of the design certification process, including re-examining the validity of pilot recognition and response assumptions permitted in existing FAA guidance. (A-19-14)
Develop design standards, with the input of industry and human factors experts, for aircraft system diagnostic tools that improve the prioritization and clarity of failure indications (direct and indirect) presented to pilots to improve the timeliness and effectiveness of their response. (A-19-15)
Once the design standards have been developed as recommended in Recommendation A-19-15, require implementation of system diagnostic tools on transport-category aircraft to improve the timeliness and effectiveness of pilots’ response when multiple flight deck alerts and indications are present. (A-19-16)
The complete safety recommendation report is attached to this testimony.
Finally, it should be noted that NTSB investigators continue to examine the safety assessment and design certification processes and the NTSB may issue additional recommendations in this area in the future if such recommendations are warranted.
Thank you again for the opportunity to be here today to discuss the NTSB’s role in these important international aviation accident investigations and to highlight our recent recommendations to FAA regarding the safety assessment process. I will be happy to answer any questions.
The 737-600, -700, and -800, and -900 airplanes are part of the 737 NG family.