【英文】波音737MAX空难调查报告（246页）

英文研究报告 2020年09月21日 10:13 管理员

Aside from the concerns raised by Boeing engineers about the impact of faulty AOA data on MCAS and the ability of MAX pilots to be able to counteract repetitive MCAS activation, Boeing also had evidence from its own test results showing that a test pilot took more than 10 seconds to respond to uncommanded MCAS activation, a condition the pilot found to be “catastrophic[.]” In the event that MCAS activated unexpectedly Boeing assumed that such a situation would look and feel to pilots like a condition known as runaway stabilizer trim—a condition that involves the electric trim motor suddenly moving the horizontal stabilizer toward the full nose-up or nose-down stop. Stabilizer trim runaway is well known to pilots, and FAA guidance presumes pilots will recognize the condition and complete the procedure to counteract it within four seconds.. 659 But stabilizer trim runaway does not provoke the multitude of simultaneous and seemingly unrelated cautions and warnings that accompany erroneous MCAS activation when triggered by a failure of an AOA sensor.660 Yet, Boeing assumed that pilots would respond to an unexpected MCAS activation as it if were a runaway stabilizer trim event, within four seconds.

The NTSB report also found: “While Boeing considered the possibility of uncommanded MCAS operation as part of its functional hazard assessment, it did not evaluate all the potential alerts and indications that could accompany a failure that also resulted in uncommanded MCAS operation. Therefore, neither Boeing’s system safety assessment nor its simulator tests evaluated how the combined effect of alerts and indications might impact pilots’ recognition of which procedure(s) to prioritize in responding to an unintended MCAS operation caused by an erroneous AOA input.”667 NTSB pointed out that according to Federal regulations under 14 CFR 25.1309(d)(4), “compliance demonstration as part of aircraft certification must include analysis that considers the crew warning cues, corrective action required, and the capability of detecting faults.