2018年10月29日,印尼狮航一架新波音737 Max 8在雅加达起飞,十几分钟后就坠进了爪哇海。机上无一人幸存。
8天后,这家飞机制造商向全球飞行员发出警告,介绍了引发空难的故障。
波音的这一公告列出了驾驶舱机组人员在此类紧急情况下所面临的故障特征,并给出了应对举措。此公告一出,美国监管方几乎立即发布了一则类似通知,新闻也对这个问题进行了报道。
然而在不到5个月的时间里,2019年3月10日,第二架737 Max出现了同样的故障,坠毁在埃塞俄比亚野外。
事故发生当天,埃塞俄比亚航空公司就停飞了其所有737 Max飞机。世界各地的监管机构紧随其后,在3月11日和12日停飞了机队中的737 Max飞机。美国联邦航空管理局于3月13日下令该飞机停飞。自那以后,所有737 Max都处于停飞状态,波音公司则在努力完成软件的重新设计。
随着该机型停飞一周年的临近,有关为什么这两位飞行员会失去对飞机的控制,人们依然存在很多疑问。
波音公告的专业术语足够清晰吗?签发这一警告的波音和监管方是否低估了驾驶舱警报所能引发的混乱局面?飞行员是否存在疲劳飞行或带病飞行问题?有人曾暗示,如果埃塞俄比亚飞行员获得了相关故障处理的更多培训,结局会不同吗?
美国联邦航空管理局空难调查局前负责人杰弗瑞•古泽提说:“‘为什么?’依然是个核心问题。这里存在着各种潜在的线索。”
人们已经确认,737 Max的设计缺陷是狮航飞机在雅加达附近坠毁的主要原因。埃塞俄比亚空难调查局并未公布其发现,但去年4月的初步报道显示该飞机也出现了类似的故障。
埃塞俄比亚调查员将在未来几天发布3月10日事故的中期报告。一位看过报告的人士透露,该报告的一份草稿重点提及了波音的设计缺陷。
埃塞俄比亚政府官员和航空公司则坚定地站在自家飞行员这一边。交通部长达格马维特•莫吉斯在去年四月表示,飞行员“反复执行了所有的流程”。埃航首席执行官高天德则在采访中对机组人员存在操作不当的暗示表示了愤怒。
美国国会的一个委员会周五发布了其有关Max机型的初步调查结果,称其存在“技术设计缺陷、向监管方和客户隐瞒实情,以及试图混淆飞机操作信息的情况。”
波音添加了一个飞行控制功能,名为“机动特性增强系统”,简称MCAS。印尼国家交通安全委员会在10月总结道,该系统用于在某些情况下自动下沉机头,但波音并未充分评估该操作的风险。
该调查发现,波音认为飞行员会在4秒内对MCAS故障做出反应,但狮航飞机空难和该飞机空难前一天出现的事故显示,这种设想并不现实。
波音2018年11月6日的公告以及美国联邦航空管理局并未特别点名MCAS系统,但数天之内该系统的名字已经出现在了各大新闻报道中。
波音公告列出了出现这种故障后9种可能的特征。如果出现其中任何一个特征时,飞机机头会开始自行下俯,该指令说:“执行失控稳定器非正常检查单操作,以确保“安定面配平切断”电门开关位于“切断”位置,并在后面的飞行中一直保持该位置不变。”
在航空术语表中,这项操作意味着执行紧急情况检查清单,切断驱动飞机机头下俯的电机的电源,并保持该电源处于关闭状态。
该指令已经写入了埃塞俄比亚航空公司的手册。经彭博新闻审核的记录称,在波音发出公告两天之后,埃塞俄比亚航空公司的一名资深飞行员向公司机组人员发送了邮件,以重申这一警告。
多位前空难调查员和安全专家称,弄清楚为什么机长雅瑞德·格塔楚和副驾驶阿哈默德·默罕默德在当时如此行事的原因异常重要。他们说,此举不仅能帮助揭示已停飞737 Max机型存在哪些缺陷,波音最初发布的警告是否充分,同时还关系到飞行员培训和胜任能力等更广泛的话题。
埃塞俄比亚初步的报告称,飞行员采取了多个令人迷惑不解的举措。
他们执行了广播音推荐的故障应急响应手册中所列的一个重要步骤:切断推动机头朝下的电机的电源。但他们随后在失控不久前又恢复了电源。
他们还让飞机的油门处于起飞状态,从而让飞机的飞行速度超过最大允许速度,但也会让其变得更难以控制。其他的举措,例如尝试启动自动驾驶,似乎都与飞行员在紧急情况下应该采取的措施背道而驰。
前航空公司飞行员兼咨询公司Safety Operating Systems总裁约翰·考克斯说,要指责飞行员并非是件难事,但前提是我们得先看看驾驶舱内不幸的环境。
一个出故障的感应器将引发多个错误和警告,包括机长驾驶杆发出的巨大的砰砰声(事实上这是错误信号)——警告飞机处于几近失速的状态。此外,仪表显示的飞行速度和高度数据也会变得不可靠。
考克斯称,“坐在办公室里说飞行员们应该知道如何反应”是不公平的。他说,调查人员应检查这种混乱局面对飞行员的操作有什么样的影响。
考克斯指出,调查员应评估的另一个领域在于波音警告的充分度。他说,尽管波音提到了同时可能出现的多个故障,但它并未明确告诉飞行员这些故障到底有多么混乱。
古泽提说,在此前的事故中,有人曾批评此类飞行员警告并不充分。
例如,美国国家运输安全委员会曾批评过联邦航空管理局在1994年针对早期737机型在匹兹堡附近坠毁一事签发的类似警告。
古泽提说:“这一点是他们应该调查的内容,也就是警告措辞、呈现方式和优先次序能起到多大的效果?”
尽管我们无法知道格塔楚和努尔在令人发疯的五分钟飞行过程中到底都在想些什么,但空难调查通常在寻找线索时会遵循一个基本的步骤。
他们会仔细审查飞行员在事故之前数天的生活,寻找可能影响其行为的疾病、疲劳以及其他个人因素。
在狮航空难中,调查人员发现机长带病飞行,而副驾驶则是早上4点被叫起来,充当原定机组人员的替补。
飞行员接受的培训内容以及他们在其职业生涯中的表现亦有助于调查员了解空难的起因。
25岁的埃塞俄比亚副驾驶员努尔基本上是一名新手,这一点可能会引起调查员的注意。他在其短暂的职业生涯中仅有361个小时的飞行经验,在737上的飞行经验更少:在Max上有56个小时,其他机型共计151个小时。他驾驶该飞机还不到90天的时间。
飞行员的培训和技能与此前多个事故有关联。
印尼调查员发现,狮航的这两名飞行员在这些领域也都存在问题。最为严重的一个问题在于,副驾驶在紧急情况下难以找到手册所放的位置并进行相应操作。
去年从埃塞俄比亚航空公司辞职的彭德•凯•冯•候伊斯林称,他曾在空难之前警告该航空公司,机组人员在这一方面存在能力不足的问题。
在狮航空难数月之后,冯•候伊斯林在参加彭博新闻的多次采访中表示,他经常盘问共事的副驾驶有关MCAS警告的相关内容,但大多数都无法给出详细的答案。
埃塞俄比亚航空公司则将冯•候伊斯林称为一名牢骚满腹的前雇员,而且对其在声明中的指控表示质疑。该航空公司在去年发布的一则推文中说,公司“严格遵守所有全球安全标准和监管要求”。
冯•候伊斯林在邮件中写道,他向参加了这一调查的美国国家运输安全委员会提交了记录,但埃塞俄比亚调查员并未与他联络。
美国国家运输安全委员会前调查员兼航空公司飞行员罗杰•考克斯说,航空公司的培训质量也是调查的内容之一。
航空公司的代表并未回复对本文置评的请求。
员工是否得到了充分的培训,以便能够在紧急情况下可以从容地手动操控飞机?培训内容是否包括,要求新飞行员在机长犯错时直言不讳地指出?他们在培训时是否接受过真实紧急情况的训练?
考克斯说,这些问题不仅有助于解释埃塞俄比亚飞行员失去对飞机控制的原因,同时,寻求这些问题的答案也有助于改善全球的飞行安全性。
他说:“在确保这些飞行员有充足的能力来应对紧急事件方面,航空公司是否已经做足了功课?这是一个至关重要的问题。”(财富中文网)
本文编辑对原文有修改
译者:Feb
2018年10月29日,印尼狮航一架新波音737 Max 8在雅加达起飞,十几分钟后就坠进了爪哇海。机上无一人幸存。
8天后,这家飞机制造商向全球飞行员发出警告,介绍了引发空难的故障。
波音的这一公告列出了驾驶舱机组人员在此类紧急情况下所面临的故障特征,并给出了应对举措。此公告一出,美国监管方几乎立即发布了一则类似通知,新闻也对这个问题进行了报道。
然而在不到5个月的时间里,2019年3月10日,第二架737 Max出现了同样的故障,坠毁在埃塞俄比亚野外。
事故发生当天,埃塞俄比亚航空公司就停飞了其所有737 Max飞机。世界各地的监管机构紧随其后,在3月11日和12日停飞了机队中的737 Max飞机。美国联邦航空管理局于3月13日下令该飞机停飞。自那以后,所有737 Max都处于停飞状态,波音公司则在努力完成软件的重新设计。
随着该机型停飞一周年的临近,有关为什么这两位飞行员会失去对飞机的控制,人们依然存在很多疑问。
波音公告的专业术语足够清晰吗?签发这一警告的波音和监管方是否低估了驾驶舱警报所能引发的混乱局面?飞行员是否存在疲劳飞行或带病飞行问题?有人曾暗示,如果埃塞俄比亚飞行员获得了相关故障处理的更多培训,结局会不同吗?
美国联邦航空管理局空难调查局前负责人杰弗瑞•古泽提说:“‘为什么?’依然是个核心问题。这里存在着各种潜在的线索。”
人们已经确认,737 Max的设计缺陷是狮航飞机在雅加达附近坠毁的主要原因。埃塞俄比亚空难调查局并未公布其发现,但去年4月的初步报道显示该飞机也出现了类似的故障。
埃塞俄比亚调查员将在未来几天发布3月10日事故的中期报告。一位看过报告的人士透露,该报告的一份草稿重点提及了波音的设计缺陷。
埃塞俄比亚政府官员和航空公司则坚定地站在自家飞行员这一边。交通部长达格马维特•莫吉斯在去年四月表示,飞行员“反复执行了所有的流程”。埃航首席执行官高天德则在采访中对机组人员存在操作不当的暗示表示了愤怒。
美国国会的一个委员会周五发布了其有关Max机型的初步调查结果,称其存在“技术设计缺陷、向监管方和客户隐瞒实情,以及试图混淆飞机操作信息的情况。”
波音添加了一个飞行控制功能,名为“机动特性增强系统”,简称MCAS。印尼国家交通安全委员会在10月总结道,该系统用于在某些情况下自动下沉机头,但波音并未充分评估该操作的风险。
该调查发现,波音认为飞行员会在4秒内对MCAS故障做出反应,但狮航飞机空难和该飞机空难前一天出现的事故显示,这种设想并不现实。
波音2018年11月6日的公告以及美国联邦航空管理局并未特别点名MCAS系统,但数天之内该系统的名字已经出现在了各大新闻报道中。
波音公告列出了出现这种故障后9种可能的特征。如果出现其中任何一个特征时,飞机机头会开始自行下俯,该指令说:“执行失控稳定器非正常检查单操作,以确保“安定面配平切断”电门开关位于“切断”位置,并在后面的飞行中一直保持该位置不变。”
在航空术语表中,这项操作意味着执行紧急情况检查清单,切断驱动飞机机头下俯的电机的电源,并保持该电源处于关闭状态。
该指令已经写入了埃塞俄比亚航空公司的手册。经彭博新闻审核的记录称,在波音发出公告两天之后,埃塞俄比亚航空公司的一名资深飞行员向公司机组人员发送了邮件,以重申这一警告。
多位前空难调查员和安全专家称,弄清楚为什么机长雅瑞德·格塔楚和副驾驶阿哈默德·默罕默德在当时如此行事的原因异常重要。他们说,此举不仅能帮助揭示已停飞737 Max机型存在哪些缺陷,波音最初发布的警告是否充分,同时还关系到飞行员培训和胜任能力等更广泛的话题。
埃塞俄比亚初步的报告称,飞行员采取了多个令人迷惑不解的举措。
他们执行了广播音推荐的故障应急响应手册中所列的一个重要步骤:切断推动机头朝下的电机的电源。但他们随后在失控不久前又恢复了电源。
他们还让飞机的油门处于起飞状态,从而让飞机的飞行速度超过最大允许速度,但也会让其变得更难以控制。其他的举措,例如尝试启动自动驾驶,似乎都与飞行员在紧急情况下应该采取的措施背道而驰。
前航空公司飞行员兼咨询公司Safety Operating Systems总裁约翰·考克斯说,要指责飞行员并非是件难事,但前提是我们得先看看驾驶舱内不幸的环境。
一个出故障的感应器将引发多个错误和警告,包括机长驾驶杆发出的巨大的砰砰声(事实上这是错误信号)——警告飞机处于几近失速的状态。此外,仪表显示的飞行速度和高度数据也会变得不可靠。
考克斯称,“坐在办公室里说飞行员们应该知道如何反应”是不公平的。他说,调查人员应检查这种混乱局面对飞行员的操作有什么样的影响。
考克斯指出,调查员应评估的另一个领域在于波音警告的充分度。他说,尽管波音提到了同时可能出现的多个故障,但它并未明确告诉飞行员这些故障到底有多么混乱。
古泽提说,在此前的事故中,有人曾批评此类飞行员警告并不充分。
例如,美国国家运输安全委员会曾批评过联邦航空管理局在1994年针对早期737机型在匹兹堡附近坠毁一事签发的类似警告。
古泽提说:“这一点是他们应该调查的内容,也就是警告措辞、呈现方式和优先次序能起到多大的效果?”
尽管我们无法知道格塔楚和努尔在令人发疯的五分钟飞行过程中到底都在想些什么,但空难调查通常在寻找线索时会遵循一个基本的步骤。
他们会仔细审查飞行员在事故之前数天的生活,寻找可能影响其行为的疾病、疲劳以及其他个人因素。
在狮航空难中,调查人员发现机长带病飞行,而副驾驶则是早上4点被叫起来,充当原定机组人员的替补。
飞行员接受的培训内容以及他们在其职业生涯中的表现亦有助于调查员了解空难的起因。
25岁的埃塞俄比亚副驾驶员努尔基本上是一名新手,这一点可能会引起调查员的注意。他在其短暂的职业生涯中仅有361个小时的飞行经验,在737上的飞行经验更少:在Max上有56个小时,其他机型共计151个小时。他驾驶该飞机还不到90天的时间。
飞行员的培训和技能与此前多个事故有关联。
印尼调查员发现,狮航的这两名飞行员在这些领域也都存在问题。最为严重的一个问题在于,副驾驶在紧急情况下难以找到手册所放的位置并进行相应操作。
去年从埃塞俄比亚航空公司辞职的彭德•凯•冯•候伊斯林称,他曾在空难之前警告该航空公司,机组人员在这一方面存在能力不足的问题。
在狮航空难数月之后,冯•候伊斯林在参加彭博新闻的多次采访中表示,他经常盘问共事的副驾驶有关MCAS警告的相关内容,但大多数都无法给出详细的答案。
埃塞俄比亚航空公司则将冯•候伊斯林称为一名牢骚满腹的前雇员,而且对其在声明中的指控表示质疑。该航空公司在去年发布的一则推文中说,公司“严格遵守所有全球安全标准和监管要求”。
冯•候伊斯林在邮件中写道,他向参加了这一调查的美国国家运输安全委员会提交了记录,但埃塞俄比亚调查员并未与他联络。
美国国家运输安全委员会前调查员兼航空公司飞行员罗杰•考克斯说,航空公司的培训质量也是调查的内容之一。
航空公司的代表并未回复对本文置评的请求。
员工是否得到了充分的培训,以便能够在紧急情况下可以从容地手动操控飞机?培训内容是否包括,要求新飞行员在机长犯错时直言不讳地指出?他们在培训时是否接受过真实紧急情况的训练?
考克斯说,这些问题不仅有助于解释埃塞俄比亚飞行员失去对飞机控制的原因,同时,寻求这些问题的答案也有助于改善全球的飞行安全性。
他说:“在确保这些飞行员有充足的能力来应对紧急事件方面,航空公司是否已经做足了功课?这是一个至关重要的问题。”(财富中文网)
本文编辑对原文有修改
译者:Feb
Eight days after a Boeing Co. 737 Max went down in the Java Sea, killing all aboard, the planemaker issued a worldwide warning to pilots identifying the malfunction that triggered the crash.
The bulletin, which was followed almost immediately by a similar notice from U.S. regulators, listed the symptoms cockpit crews faced in such an emergency and explained how to counteract it. News reports described the problem.
Yet less than five months later a second 737 Max went down, slamming into a field in Ethiopia, after suffering the same malfunction. As the one-year anniversary of that crash approaches, many questions remain about why the two pilots lost control.
Was the bulletin’s technical language clear enough? Did Boeing and the regulators who signed off on the warning underestimate the chaos of alarms blaring in the cockpit of the doomed jet? Could the pilots have been fatigued or sick? Should, as one whistle-blower has suggested, Ethiopian pilots have gotten more training on the malfunction?
“I think that’s a central question: Why?” said Jeffrey Guzzetti, the former head of the FAA’s accident investigation bureau. “There’s all kind of potential underlying threads.”
A flaw in the design of the 737 Max has already been identified as a main reason for the crash of a Lion Air plane near Jakarta. The Ethiopian Aircraft Accident Investigation Bureau hasn’t released its findings but a preliminary report out last April showed a similar malfunction also occurred on that flight.
The Ethiopian investigators are poised to release an interim report on the March 10 crash in coming days. A draft of the report focuses on Boeing’s flawed design according to people who have seen it.
Ethiopian government officials and the airline have steadfastly defended the pilots. Transport Minister Dagmawit Moges in April said they followed “all the procedures repeatedly.” Airline Chief Executive Officer Tewolde GebreMariam has bristled in interviews over implications that the crew didn’t perform properly.
A committee of the U.S. Congress on Friday issued its own preliminary findings on the Max and said its design and development “was marred by technical design failures, lack of transparency with both regulators and customers, and efforts to obfuscate information about the operation of the aircraft.”
Boeing added a flight-control feature called the Maneuvering Characteristics Augmentation System, or MCAS, which was programmed to automatically drive down the nose in some circumstances, without adequately assessing its risks, Indonesia’s National Transportation Safety Committee concluded in October.
The company assumed pilots would respond to a malfunction of MCAS within four seconds, but the Lion Air crash and an incident on the same plane a day earlier showed that wasn’t realistic, the investigation found.
Boeing’s bulletin on Nov. 6, 2018, and an emergency directive by the U.S. Federal Aviation Administration didn’t specifically name MCAS, but the system was widely identified in news reports within days.
The bulletin listed nine possible symptoms in such a failure. If any of them occurred while the plane tried to nose down on its own, the directive said: “do the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight.”
In the nomenclature of aviation, that meant perform an emergency checklist shutting off power to the motor driving down the nose and keep it off.
The directive was made a part of the Ethiopian carrier’s manuals. Within two days of Boeing’s notice, a senior Ethiopian Airlines pilot had emailed the company’s crews to reiterate the warning, according to records reviewed by Bloomberg News.
Teasing out clues for why Captain Yared Getachew and copilot Ahmed Nur Mohammod reacted the way they did is critical, according to several former crash investigators and safety experts. Not only will it help shed light on the grounded 737 Max’s flaws and whether initial warnings were adequate, but it also is relevant to broad issues of pilot training and competency, they said.
According to the Ethiopian preliminary report, the pilots took several vexing actions.
They performed an important step in Boeing’s recommended emergency response to the malfunction: shutting off power to the electric motor that was driving down their nose. But they then restored power shortly before losing control.
They also left the plane’s throttle set to takeoff power, which prompted it to fly faster than its maximum allowable speed and made it far more difficult to control. Other actions, such as trying to activate the autopilot, appear to have been opposite of what they should have done in the emergency.
It would be easy to simply point the finger at the pilots, but that doesn’t take into account the calamitous conditions in the cockpit, said John Cox, a former airline pilot and president of the consulting company Safety Operating Systems.
A failed sensor was triggering multiple errors and warnings, including a loud thumping noise on the captain’s control column signaling -- falsely, it turned out -- the plane was nearing an aerodynamic stall. They also had unreliable airspeed and altitude readings.
It’s unfair “sitting in an office saying they should have known” how to respond, Cox said. Investigators should examine how the chaos would have impacted the pilots’ performance, he said.
Another area investigators should review is the adequacy of the Boeing bulletin, Cox said. While it mentioned the multiple failures that could occur at the same time, it didn’t expressly warn crews about how chaotic they could be, he said.
Such pilot warnings have been criticized as inadequate in previous accidents, Guzzetti said.
The U.S. National Transportation Safety Board, for example, criticized the FAA for a similar type of warning it issued to pilots after an earlier model of the 737 crashed near Pittsburgh in 1994.
“It should be something they are looking at,” Guzzetti said. “How effective was the wording, the presentation and the prioritization?”
While it will be impossible to know exactly what Getachew and Nur were thinking during the frantic five-minute flight, crash investigations typically follow a basic script to get clues.
They take a close look at pilots’ lives in the days prior to the crash for signs of illness, fatigue or other personal factors that could affect their actions.
In the Lion Air crash, investigators found that the captain was sick and the copilot had been called in at 4 a.m. as a substitute for the scheduled crew member.
The type of training that pilots received and how well they performed in their careers are also areas that can help investigators understand accidents.
Nur, the 25-year-old Ethiopian copilot who was almost new to the plane, might get attention from investigators. He had only 361 hours of flying experience in his brief career and less in the 737: 56 hours in the Max and 151 hours in other models of the plane. He had been flying the aircraft for less than 90 days.
Pilots’ training and skills have been relevant in multiple previous accidents.
Both of the Lion Air pilots had exhibited problems in those areas, Indonesian investigators found. Most significantly, the copilot had had difficulty locating checklists and performing in emergency scenarios.
A Canadian man who was a pilot for Ethiopian Airlines before resigning last year said he tried before the crash to warn the carrier that crews weren’t adequately prepared.
In the months after the Lion Air accident, Bernd Kai von Hoesslin frequently quizzed copilots he worked alongside about the MCAS bulletin and most of them couldn’t answer detailed questions, he said in multiple interviews with Bloomberg News.
The airline called von Hoesslin a disgruntled former employee and disputed his allegations in statements. The airline “strictly complies with all global safety standards and regulatory requirements,” it said in a Twitter post last year.
Von Hoesslin submitted records to the U.S. NTSB, which is participating in the probe, but hasn’t been contacted by Ethiopian investigators, he said in an email.
The quality of training at the airline should also be a part of the investigation, said Roger Cox, a former NTSB investigator and airline pilot.
Representatives of the airline didn’t respond to requests for comment on this story.
Were crews adequately taught to be comfortable flying a plane manually during an emergency? Were junior pilots coached to speak up when a captain made a mistake? Were they given realistic emergency scenarios during training?
These are not just questions that could help explain why the Ethiopian crew lost control, but probing them for answers could help improve safety across the world, Cox said.
“Have you done enough to ensure that those guys together have an adequate ability to handle an emergency?” he said. “It’s an extremely important question to ask.”