A monthslong federal investigation into Boeing’s 737 Max plane has called into question some of the most fundamental assumptions used by manufacturers and regulators when certifying aircraft, and challenged Boeing’s repeated assertions that pilots should have been able to easily handle a malfunction on its jet.

The National Transportation Safety Board, which released the results of its review of potential lapses in the design and approval of the 737 Max on Thursday, faulted the company for making erroneous assumptions during the development of the jet and pushed for broader changes in the way airplanes are certified.

The agency said Boeing had underestimated the effect that a malfunction of new automated software in the aircraft could have on the environment in the cockpit. When activated, the system, known as MCAS, automatically moves the Max’s tail and pushes its nose down. The system contributed to two crashes in less than five months that killed 346 people and caused regulators around the world to ground the plane. Boeing did not fully inform pilots about how MCAS functioned until after the first accident.

The safety board calls for Boeing and federal regulators to revamp the way they assess the risk of key systems on airplanes, by giving more weight to how a cacophony of alerts could affect pilots’ responses to emergencies. The safety board’s suggestions are not binding, but the Federal Aviation Administration has accepted the vast majority of its recommendations in the past.