昨天，虽然很多媒体都在报道狮航JT610空难的事故报告已经出炉，但是真正的报告刚刚才向外界公布。

 

最开始大家可能见到的是这个：

 

 

而真正的报告目录如下：

 

报告分为六大部分，分别是

 

一 事实信息：介绍空难的航班的基本情况，比如航班的经历、遇难人员、飞机的受损情况、其他的损害、机组和ATC相关人员信息、飞机的信息、气象信息、导航设施、机场信息、飞行记录器、残害信息、以及营运人等等的信息

 

二 分析：空难前一航班机组的处置、在雅加达的维修、空难机组的处置、组织原因、MCAS的认证问题

 

三 结论：发现的问题、归因

 

四 安全措施：狮航、机务维修、波音、柯林斯（设备制造商）、通讯导航机构、FAA、NTSB、印尼民航局

 

五 对各个机构的安全建议：狮航、机务维护、通讯导航机构、维修机、波音、印尼民航局、FAA

 

六 附件

 

报告一共322页，对于报告，交通部主席声明，此报告按照国际民航组织公约附件13的要求，仅用于加强航空安全，并不用于任何指责和追责。

 

在最终报道中，负责调查的KNKT指出事故可能有以下的原因：

 

3 CONCLUSIONS

 

3.1 Findings

 

Findings are statements of all significant conditions, events or circumstances in the accident sequence. The findings are significant steps in the accident sequence, but they are not always causal, or indicate deficiencies. Some findings point out the conditions that pre-existed the accident sequence, but they are usually essential to the understanding of the occurrence, usually in chronological order.

 

The KNKT identified findings as follows:

 

MCAS is designed to function only during manual flight (autopilot not engaged), with the aircraft’s flaps up, at an elevated AOA. As the development of the 737-8 (MAX) progressed, the MCAS function was expanded to low Mach numbers and increased to maximum MCAS command limit of 2.5 of stabilizer movement.

 

During the Functional Hazard Analysis (FHA), unintended MCAS- commanded stabilizer movement was considered a failure condition with Major effect in the normal flight envelope. The assessment of Major did not require Boeing to more rigorously analyze the failure condition in the safety analysis using Failure Modes and Effects Analysis (FMEA) and Fault Tree Analysis (FTA), as these are only required for Hazardous or Catastrophic failure conditions.

 

Uncommanded MCAS function was considered Major during the FHA. Boeing reasoned that such a failure could be countered by using elevator alone. In addition, stabilizer trim is available to offload column forces, and stabilizer cutout is also available but not required to counter failure.

 

FMEA would have been able to identify single-point and latent failures which have significant effects as in the case of MCAS design. It also provides significant insight into means for detecting identified failures, flight crew impact on resolution of failure effect, maintenance impact on isolation of failure and corresponding restitution ofsystem.

 

Boeing conducted the FHA assessment based on the FAA guidance and was also based on an assumption that the flight crew was highly reliable to respond correctly and in time within 3 seconds. The assessment was that each MCAS input could be controlled with control column alone and subsequently re-trimmed to zero column force while maintaining flight path.

 

The flight crew did not react to MCAS activation but to the increasing force on the control column. Since the flight crew initially countered the MCAS command using control column, the longer response time for making electric stabilizer trim inputs wasunderstandable.

 

During the accident and previous LNI043 flights, the flight crew initially responded by pulling back on the control column, however, they did not。。。。

 

一共有89条，这里就不一一列出。

 

3.1问题

 

调查结果是对事故中所有重要条件，事件或情况的陈述。这些问题是事故中的重要步骤，但并不总是因果关系或表明存在缺陷。一些问题指出了事故的先决条件，但对于它们的发生通常是按时间顺序排列的，对于了解事故的发生也常常是必不可少的。

 

KNKT确定的调查的问题如下：

 

MCAS设计为仅在手动飞行期间（未使用自动驾驶仪）工作，且飞机襟翼收上时AOA处于较大的角度。随着737-8（MAX）的发展进程，MCAS功能扩展到低马赫数，并增加到MCAS可以每次最大移动安定面配平到2.5个单位。

 

在功能性危险源分析（FHA）中，意外的MCAS命令的安定面移动被认为是一种故障情况，对正常飞行包线有“重大”影响。“重大”的评估不需要波音公司在安全分析中使用“Failure Modes”和Effects Analysis （FMEA）和Fault Tree Analysis（FTA）来更严格地分析失效条件，因为这些仅在“危险或灾难性”（Hazardous or Catastrophic ）失效条件下才需要。

在FHA期间，非指令MCAS功能被认为是“Major”。波音公司认为仅通过使用升降舵（操纵）就足以解决这种故障。此外，安定面配平是用来减轻驾驶杆杆力，还可以使用安定面切断电门，但不是消除故障所需。

 

3.2 Contributing Factors

 

Contributing factors defines as actions, omissions, events, conditions, or a combination thereof, which, if eliminated, avoided or absent, would have reduced the probability of the accident or incident occurring, or mitigated the severity of the consequences of the accident or incident. The presentation is based on chronological order and not to show the degree ofcontribution.

 

During the design and certification of the Boeing 737-8 (MAX), assumptions were made about flight crew response to malfunctions which, even though consistent with current industry guidelines, turned out to be incorrect.

 

Based on the incorrect assumptions about flight crew response and an incomplete review of associated multiple flight deck effects, MCAS’s reliance on a single sensor was deemed appropriate and met all certification requirements.

 

MCAS was designed to rely on a single AOA sensor, making it vulnerable to erroneous input from that sensor.

 

The absence of guidance on MCAS or more detailed use of trim in the flight manuals and in flight crew training, made it more difficult for flight crews to properly respond to uncommanded MCAS.

 

The AOA DISAGREE alert was not correctly enabled during Boeing 737-8 (MAX) development. As a result, it did not appear during flight with the mis-calibrated AOA sensor, could not be documented by the flight crew and was therefore not available to help maintenance identify the mis-calibrated AOA sensor.

 

The replacement AOA sensor that was installed on the accident aircraft had been mis-calibrated during an earlier repair. This mis-calibration was not detected during the repair.

 

The investigation could not determine that the installation test of the AOA sensor was performed properly. The mis-calibration was not detected.

 

Lack of documentation in the aircraft flight and maintenance log about the continuous stick shaker and use of the Runaway Stabilizer NNC meant that information was not available to the maintenance crew in Jakarta nor was it available to the accident crew, making it more difficult for each to take the appropriate actions.

 

The multiple alerts, repetitive MCAS activations, and distractions related to numerous ATC communications were not able to be effectively managed. This was caused by the difficulty of the situation and performance in manual handling, NNC execution, and flight crew communication, leading to ineffective CRM application and workload management. These performances had previously been identified during training and reappeared during the accident flight.

 

3 归因

 

归因定义为行动，疏忽，事件，条件或其组合，如果消除，避免或不存在，将减少事故或事故发生的可能性，或减轻事故或事故后果的严重性。该演示文稿是按时间顺序排列的，并不表示其对事件影响的程度。

 

在波音737-8（MAX）的设计和认证过程中，做出了有关机组人员对故障做出反应的假设，尽管这些故障与当前的行业准则相符，但事实证明是不正确的。

 

基于对机组人员反应的错误假设以及对相关的多个飞行驾驶舱效果的不完全审查，MCAS依赖单个传感器被认为是适当的，并且满足了所有认证要求。

 

MCAS设计为依靠单个AOA传感器，因此很容易受到该传感器错误输入的影响。

 

由于缺乏有关MCAS的指导，或者飞行手册和飞行机组培训中没有更详细地使用配平，这使得飞行机组更难于正确响应非指令的MCAS动作。

 

在开发波音737-8（MAX）时未正确启用AOA DISAGREE（迎角不一致）警报。结果，它在飞行过程中没有出现带有错误校准的AOA传感器的信息，无法被飞行机组记录下来，因此无法用于帮助维护人员识别错误校准的AOA传感器。

 

在较早的维修过程中，事故飞机机上安装的AOA传感器校准错误。在维修过程中未检测到此校准错误。

 

调查无法确定AOA传感器的安装测试是否正确执行。在维修时未检测到校准错误。

 

飞机飞行和维修记录本中缺少有关“连续抖杆信号”以及使用“安定面失控”NNC（非正常检查单）的记录信息，这意味着在雅加达的维修人员无法获取这些信息，事故人员也无法获取这些信息，这使得维修人员更加困难。每个人都要采取适当的行动。（该机之前航班。已发生过类似的故障。但没有被完整记录下来）

 

无法有效管理与大量ATC通信有关的多重警报，重复的MCAS激活和干扰。这是由于手动飞行，执行NNC（非正常检查单）和机组人员沟通中的情况和能力困难所致，导致不能有效实施CRM（机组资源管理）和工作负载管理。这些表现在之前的训练中发现，并在事故飞行中再次出现。

 

事故第五部分提出了很多安全建议

 

分别对，狮航、机务维护、通讯导航、维修机构、波音、印尼民航局、FAA提出很多安全的建议。

 

5 SAFETY RECOMMENDATIONS

 

The KNKT acknowledges the safety actions taken by Lion Air, Batam Aero Technic, FAA, and DGCA. KNKT considered that the safety actions were relevant to improve safety, and encourage the implementation of these safety actions.

 

KNKT identified safety issue remains to be considered therefore, the KNKT issued safety recommendations to address safety issues identified in this report.

 

5.1 Lion Air

 

04.O-2018-35.3

 

The investigation found Lion Air manuals did not updated in timely manner and the content have several inconsistencies, incompleteness, and unsynchronized procedures.

 

Therefore, KNKT recommends establishing system to ensure the company manuals are updated in timely manner.

 

04.O-2018-35.4

 

The investigation considered that the duration of hazard identification topic on the SMS training syllabus was insufficient. This may reduce the ability of employees to define and report a hazard. Consistently, the Lion Air safety report on December 2018 mostly consisted of occurrence report and only about five percent of hazard report.

 

Therefore, KNKT recommends that Lion Air review the SMS training material and the duration of training.

 

04.O-2018-35.5

 

The LNI043 flight that experienced multiple malfunctions were considered caused or could have caused difficulties in controlling the aircraft. According to the ICAO Annex 13, CASR part 830 and OM-part A, the flight is classified as serious incident which required investigation by the KNKT in accordance with the Aviation Law Number 1 of 2009 and Government Decree Number 62 of 2013.

 

Therefore, KNKT recommends that Lion Air improve their hazard report management enabling identifying the hazard and provides proper mitigation.

 

5.2 Batam Aero Technic

 

04.O-2018-35.6

 

The AOA installation test was performed by the engineer in Denpasar using the alternative method as described in the Boeing AMM. The AOA values indicated on the SMYD computer during the test were not recorded as required by the BAT LMPM. Without the recorded value, the success of the installation test could not be determined.

 

Therefore, KNKT recommends emphasizing engineers to record test values as required by the BAT LMPM.

 

04.O-2018-35.7

 

The investigation found BAT manuals did not updated in timely manner and the content have several inconsistencies, incompleteness, and unsynchronized procedures.

 

Therefore, KNKT recommends establishing system to ensure the company manuals are updated in timely manner.

 

04.O-2018-35.8

 

The OMF has the history page which contains record of the aircraft problems which can be utilized as a source for aircraft problem monitoring. The BAT has not utilized the OMF information as the source of aircraft problem monitoring.

 

Therefore, KNKT recommends that Batam Aero Technic establish policy and procedure of handling OMF.

 

5.3 AirNav Indonesia

 

04.A-2018-35.9

 

The flight crew of LNI610 asked to the TE controller of the aircraft altitude detected on the ATC radar display which might be an effort to obtain other source of information. The asking of aircraft altitude to the controller will not get any additional information as the ATC radar display is received data from aircraft transponder which transmitting the cockpitindications.

 

Therefore, KNKT recommends providing information to the flight crew that the altitude indication on the ATC radar display was repeating data from the aircraft.

 

2.4 Xtra Aerospace

 

04.O-2018-35.10

 

After Xtra Aerospace repair of the accident AOA sensor in November of 2017, the sensor was installed on the PK-LQP aircraft on left side position during the maintenance activity in Denpasar on 28 October 2018. On the subsequent flight, a 21-degree difference between left and right AOA sensors was recorded on the DFDR, commencing shortly after the takeoff roll was initiated. This immediate 21- degree delta indicated that the AOA sensor was most likely improperly calibrated at Xtra.

 

As noted, utilization of the Peak Model SRI-201B API by Xtra Aerospace for the test and calibration of the 0861FL1 AOA sensor should have required a written procedure to specify the proper position of the REL/ABS switch.

 

Therefore, KNKT recommends emphasizing the implementation of a company manual including equivalency assessment, training and written procedure, to ensure component being repaired are properly maintained.

 

2.5 Boeing Company

 

04.M-2018-35.11

 

During the accident, multiple alerts and indications occurred which increased flight crew’s workload. This obscured the problem and the flight crew could not arrive at a solution during the initial or subsequent automatic AND stabilizer trim input, such

 

as performing the runaway stabilizer procedure or continuing to use electric trim to reduce column forces and maintain level flight.

 

Therefore, KNKT recommends that the aircraft manufacture to consider the effect of all possible flight deck alerts and indications on flight crew recognition and response; and incorporate design, flight crew procedures, and/or training requirements where needed to minimize the potential for flight crew actions that are inconsistent with manufacturer assumptions.

 

04.M-2018-35.12

 

During certification phase, compliance was demonstrated by flight test pilots which normally have exceptional skill and experience. Flight test pilots generally have more knowledge about the aircraft design characteristics than normal pilots. This level of competence usually cannot be translated to most pilots. However, test pilots are trained to replicate the average flight crew. The Aircraft Evaluation Group pilots, who have an operational flying background, also evaluate the aircraft during the certification phase. These pilots establish the pilot type rating, training, checking and currency requirements as part of the Flight Standardization Board (FSB) process. The FSB process also utilizes airline line pilots to help ensure the requirements are operationally representative. The FAA and OEMs should re- evaluate their assumptions for what constitutes an average flight crew’s basic skill and what level of systems knowledge a ‘properly trained average flight crew’ has when encounteringfailures.

 

Therefore, KNKT recommends that Boeing include a larger tolerance in the design is required to allow operability by a larger population of flight-rated pilots.

 

04.M-2018-35.13

 

During the accident flight, the DFDR recorded a control force of 103 lbs., after repetitive MCAS activation was responded with the FO had responded with inadequate trim to counter MCAS. At this point, the flight crew was unable to maintain altitude.

 

Therefore, KNKT recommends that Boeing and the FAA more closely scrutinize the development and certification process for systems whose malfunction has the ability to lead to loss of control of the airplane.

 

04.M-2018-35.14

 

The flight crew should have been provided with information and alerts to help them understand the system and know how to resolve potential issues. Flight crew procedures and training should be appropriate.

 

Therefore, KNKT recommends to Boeing to develop the guidance for the criteria of information which should be included in flight crew and engineer’s manuals.

 

04.M-2018-35.15

 

The aircraft should have included the intended AOA DISAGREE alert message functionally, which was installed on 737 NG aircraft. Boeing and the FAA should ensure that new and changed aircraft design are properly described, analyzed, and certified.

 

Therefore, KNKT recommends to Boeing that they ensure that certified and delivered airplanes have intended system functionality.

 

04.M-2018-35.16

 

The IFIM tasks of “ALT DISAGREE” and “IAS DISAGREE” are duplicated on the leak test in step (3) and (4) as they are referring to the same AMM tasks. This repetition was inefficient and did not contribute to problem solving.

 

Therefore, KNKT recommends the IFIM tasks sequence are reviewed to ensure they areeffective.

 

2.6 Directorate General of Civil Aviation (DGCA)

 

04.R-2018-35.17

 

The investigation revealed several deviations from standard procedures such as departure with unserviceable airworthiness items and inappropriate implementation of maintenance procedure.

 

Therefore, KNKT recommends improving oversight to ensure implementation of the standard procedure.

 

04.R-2018-35.18

 

Several manuals were found inconsistence, inapplicable, the content did not include duty and responsibility of significant personnel and not updated in timely manner.

 

Therefore, KNKT recommends improving the oversight of the manual to ensure the manuals are conform to the standard and updated in timely manner.

 

04.R-2018-35.19

 

The investigation considered that the duration of hazard identification topic on the SMS training syllabus was insufficient. This may reduce the ability of employees to define and report a hazard. Consistently, the Lion Air safety report on December 2018 mostly consisted of occurrence report and only about five percent of hazard report.

 

Therefore, KNKT recommends that the Directorate General of Civil Aviation review operators SMS training material and the duration of training to ensure adequacy of SMS implementation.

 

2.7 Federal Aviation Administration (FAA)

 

04.R-2018-35.20

 

In the accident flight, the system malfunction led to erroneous information that initiated a series of events that were not correctly recognized and responded to by the flight crew.

 

This exposed issues that were not identified if FAR 25.1302 and 25.1309 were each considered separately in which system malfunction was followed by flight crew limitation in identifying and mitigating the problem. There could be a potential gap between the two requirements when system malfunction is followed by crew fallibility.

 

Therefore, KNKT recommends to review the requirements of the applicable FARs to consider any issue that may be overlooked when the requirements are considered separately.

 

04.R-2018-35.21

 

In the accident flight, the system malfunction led to a series of aircraft and flight crew interactions which the flight crew did not understand or know how to resolve. It is the flight crew response assumptions in the initial design process which, coupled with the repetitive MCAS activations, turned out to be incorrect and inconsistent with the FHA classification of Major.

 

Therefore, the KNKT recommends that the FAA review their processes for determining their level of involvement (degree of delegation) and how changes in the design are communicated to the FAA to ensure an appropriate level of review.

 

04.R-2018-35.22

 

The absence of equivalency assessment required by Xtra Aerospace procedure and unavailability of procedure was not detected by the FAA. This indicated inadequacy of the FAA oversight.

 

Therefore, KNKT recommends that the FAA improves the oversight to Approved Maintenance Organization (AMO) to ensure the processes within the AMO are conducted in accordance with the requirements.

 

04.R-2018-35.23

 

During the accident flight, the DFDR recorded a control force of 103 lbs., after repetitive MCAS activation was responded with the FO had responded with inadequate trim to counter MCAS. At this point, the flight crew was unable to maintain altitude.

 

Therefore, KNKT recommends that Boeing and the FAA more closely scrutinize the development and certification process for systems whose malfunction has the ability to lead to loss of control of the airplane.

 

04.R-2018-35.24

 

During the accident and previous LNI043 flights, the flight crew initially responded in the same way, by pulling back on the control column. However, they did not consistently trim out the resulting column forces as had been assumed. As a result Boeing assumption was different from the flight crew behavior and reaction time in responding to MCAS activation.

 

Therefore, the KNKT recommends that the FAA work with international regulatory authorities to review assumptions on flight crew behavior used during design and revise certification processes to ensure assumptions used during the design process are validated.

 

04.R-2018-35.25

 

The flight crew should have been provided with information and alerts to help them understand the system and know how to resolve potential issues. Flight crew procedures and training should be appropriate.

 

Therefore, KNKT recommends to the FAA work with international regulatory authorities to review the guidance for the criteria of information which should be included in flight crew and engineer’s manuals.

 

04.R-2018-35.26

 

The aircraft should have included the intended AOA DISAGREE alert message functionally, which was installed on 737 NG aircraft. Boeing and the FAA should ensure that new and changed aircraft design are properly described, analyzed, and certified.

 

Therefore, KNKT recommends to Boeing and the FAA that they ensure that certified and delivered airplanes have intended system functionality.

 

04.R-2018-35.27

 

The aircraft was equipped with an airframe-mounted low frequency underwater locator beacon (ULB) which operated at a frequency of 8.8 kHz. The beacon is included in ICAO standards. The purpose of the beacon is to aid in the location of submerged aircraft. During the search phase, multiple surveys were conducted to detect a signal at 8.8 kHz, however no such signals were detected in the area where wreckage was recovered.

 

The beacon was mounted on the forward side of the nose pressure bulkhead. Most of the preferred installation locations could not be used because they proved to be incompatible with EASA and FAA Non-Rechargeable Lithium Battery certification requirements or they did not meet the ICAO empennage and wings exclusion.

 

Therefore, KNKT recommends to the FAA work with international regulatory authorities to review the requirements for installation of Non-Rechargeable Lithium Battery certification requirements.

 

报告的全文我已全部上传到共享文件，有需要的可以自己下载：

 

https://documentcloud.adobe.com/link/track?uri=urn%3Aaaid%3Ascds%3AUS%3A51eef0fa-11cc-4e75-a958-e06ec5246e0e

编者意见：

 

基本上事故报告客观的分析了事件的原因，简单的说：事故的原因是因为一个错误的AOA（迎角信号）引发了一个被错误安全评估的MCAS系统开始工作，而该MCAS系统的权限超出初始适航认证申请的权限，在其极限位置也超出了飞行员可以操纵控制飞机的能力。

 

而飞行员在没有被告知也未经过任何有关MCAS的任何信息和培训的情况下，机组在驾驶舱多重警告信息情况下，进行多次安定面处置非指令性作动之后，机长进行通话等工作而将飞机交由副驾驶操纵后不到一分钟飞机坠毁。

 

此事件以及之后的埃塞航空难导致全球近400架737MAX全部停飞，也导致之后生产的MAX无法交付。

 

而从事后的调查中发现了波音公司在737MAX设计、风险评估、适航认证过程中存在一定的问题。