#62 1935 · Boeing · Aerospace / aviation safety
After its own best test pilots crashed a plane by forgetting a single step, Boeing didn't train pilots harder — it wrote the steps down.
问题
an operation has grown too complex for even a skilled, experienced operator to reliably execute from memory alone
背景
By 1935, Boeing's Model 299 prototype — four engines, retractable landing gear, controllable-pitch propellers, electric trim and multiple hydraulic systems — was by far the most complex aircraft the US Army Air Corps had ever evaluated, competing for a bomber contract against far simpler biplane designs. Test pilots flying it were among the most experienced aviators in the country, and the assumption going into the competition was that flying it safely was purely a matter of pilot skill and experience: put good enough pilots in the cockpit and the complexity would be managed.
On October 30, 1935, the Model 299 took off at Wright Field, climbed briefly, then stalled and crashed, killing two of the five people aboard. The investigation found the cause wasn't a mechanical failure or bad piloting in the usual sense — the flight crew had simply forgotten to release a newly added elevator control lock before takeoff, one step buried among dozens across systems no earlier aircraft had combined. The Army's initial conclusion was that the Model 299 was 'too much airplane for one man to fly,' threatening to end the program outright.
换别人会怎么做
The Army's initial conclusion was that the Model 299 was simply 'too much airplane for one man to fly,' implying the fix was better, more experienced pilots, or accepting that the aircraft's complexity had exceeded what any human operator could reliably manage from memory alone, threatening to end the program.
他们看到了什么
Boeing's engineers and test pilots saw that the crash wasn't caused by insufficient skill, since the crew were among the most experienced aviators in the country, it was caused by relying on memory for one step buried among dozens across systems no earlier aircraft had combined. The fix wasn't retraining pilots to remember more reliably, it was recognizing that the aircraft's complexity had genuinely exceeded what memory alone could safely manage, and externalizing the critical steps into a checklist read aloud and physically checked off, rather than recalled, before each flight phase.
那一手
Instead of accepting that verdict or trying to retrain pilots to simply remember more reliably, a group of Boeing engineers and test pilots concluded the aircraft wasn't too difficult to fly, only too complex to trust to memory — and wrote a short, plain checklist of critical steps for taxi, takeoff, flight and landing, to be read aloud and physically checked off before each phase rather than recalled.
为什么管用
Writing critical steps into a short, plain checklist to be read aloud and physically checked off removed reliance on memory specifically for the steps whose omission was catastrophic, addressing the actual failure mode, a forgotten step under normal, non-emergency conditions, rather than trying to make already-skilled pilots somehow more reliable at recall. Because the fix didn't require redesigning the aircraft or retraining anyone in new skills, only requiring the existing crew to follow an external prompt for steps they already knew how to execute, it was disproportionately cheap relative to the problem it solved: the same aircraft type went on to log about 1.8 million accident-free miles and became the B-17, one of the most produced bombers in history, after nearly having its program cancelled. The logic proved general enough to transfer directly to other high-complexity, high-stakes fields decades later, most directly the WHO Surgical Safety Checklist, because the underlying diagnosis, that expert operators in sufficiently complex procedures fail from memory limits rather than skill limits, applies well beyond aviation.
值了多少
Flying with the checklist in hand, the same aircraft type went on to log about 1.8 million accident-free miles across its early production run, and the Army ultimately ordered it into service as the B-17. The checklist became mandatory standard procedure across Boeing's fleet, then all of military aviation, then commercial aviation — the same aircraft whose complexity had nearly killed the program became one of the most produced bombers in history.
什么时候会失灵
The mechanism depends on the actual failure being a memory or procedural-omission problem rather than a genuine skill or judgment gap — a checklist does nothing to fix an operator who lacks the underlying competence to execute a step correctly even when reminded to do so, meaning the diagnosis has to be right before the fix can help. It also depends on the checklist actually being followed in practice under real operational pressure, since a checklist that exists on paper but gets skipped or rushed during time-critical moments provides no more protection than the unaided memory it was meant to replace. And a checklist only guards against known, previously identified failure points; it does nothing to catch novel failure modes nobody has yet encountered or written into the list, meaning the approach requires ongoing revision as new failure patterns are discovered, not a one-time fix that covers every future risk.
后来呢
The Model 299 checklist is the acknowledged origin of the modern pre-flight and cockpit checklist used industry-wide in aviation today, and its logic was deliberately carried across into other high-complexity fields decades later — most directly the WHO Surgical Safety Checklist, adapted from aviation practice in 2008 to cut surgical complications by treating operating-room error the same way Boeing treated cockpit error: not a training problem, a memory problem.
资料来源
- [1]Did you know the pre-flight checklist was first introduced by Boeing following the 1935 crash of the prototype B-17 (then known as the Model 299)?The Aviation Geek Club, 2021theaviationgeekclub.com
- [2]Model 299 CrashNational Museum of the United States Air Force, 2015nationalmuseum.af.mil