This mishap should serve as a wake up call to all pilots, training vendors, and safety system auditors that procedural noncompliance can be hidden from outside detection. A crew can seem perfectly professional in the simulator or during a safety audit. But that could just be an act. There is no substitute for an observation of crews on the line, with passengers, to really get to see how a flight crew really performs.
Having been in the business of instructing, observing, and evaluating professional pilots for three decades now, I have come to the conclusion that we are split fifty-fifty. About half of us walk the walk and try to do things as well as they can be done. Sure we don't get it by the book all the time, but we sure try. The other half? Not so much. These pilots believe they are above standardization and scoff at the idea they need any sort of evaluation at all. Reading this case study should make you mad. Mad that pilots like these are out there. Mad that they have tarnished your profession. Mad that we are all at risk of becoming just like them. If it doesn't make you mad, well, maybe you are in the wrong half of that fifty-fifty divide.
As usual, I will present a sterile accident report, a narrative that details what happened, an analysis of the findings, and the probable cause, straight out of the NTSB report. Unusually, I will also present a discussion of the gust lock in the GIV, since that is where much of the focus has been.
That gust lock, however, is a red herring. (An irrelevant topic introduced to divert attention from the important issue.) Yes, a better design of that gust lock could have prevented the mishap but consider the following. The GIV gust lock system is identical to that installed in the GII and GIII before it, almost identical to the GV, G550, and G450 that followed. And yet this is the first mishap of this type. That gust lock has been around for over a half century.
The NTSB accident report is quite good and devotes considerable discussion about the design of that gust lock, airport structures, the adequacy of emergency response, and the post-crash survival aspects. I shall leave all that to you. My focus shall be what happened, how could it have happened, and how it could have been prevented.
Everything here is from the references shown below, with a few comments in an alternate color.
Photo: N121JM Wreckage, aerial photograph, from NTSB Accident Docket, figure 6.
The NTSB says these pilots are guilty of habitual, intentional noncompliance. In my view that is an understatement. We need to attack this problem much more aggressively. See: The Normalization of Deviance for a plan to do just that.
A final thought. Pilots don't set out to be complacent, negligent, or habitually and intentionally noncompliant. You don't get to this level of aviation with those qualities. So how did that happen to these pilots? We will never know. But we should all understand it could very well happen to each of us. The thought haunts me.
Photo: N121JM Consolidated sequence of runway events, from Gulfstream Party Submission, Appendix A, page A-1.
NTSB Video: N121JM.
[NTSB AAR-15/03, ¶1.1]
The GIV Airplane Flight Manual (AFM) includes five checklists to be completed before takeoff: the Before Starting Engines checklist, the Starting Engines checklist, the After Starting Engines checklist, the Taxi/Before Takeoff checklist, and the Lineup checklist.
Despite the blue color of the RUDDER LIMIT message, it is not a normal indication and should have been cause to stop and look for causation.
One of the PM duties at this point is to ensure the target EPR is set. Failing this, the takeoff should have been aborted at this point.
With the gust lock engaged the ailerons and rudder are centered, but the elevator hangs full nose down due to the weight of the elevator. With the gust lock disengaged, the elevator remains full nose down but can be easily moved by pulling back on the control yoke. As the airplane accelerates, the relative wind acts to push the elevator from full nose down to centered. In the cockpit this can be seen as the yoke moving aft. There was a point in the airplane's history where the PM was required to test this movement at 60 knots and announce "elevator free." Gulfstream had a philosophy change and recommended the PF handle the yoke from brake release. The "elevator free" call out was removed and the PF instead was simply instructed to ensure it was indeed free. In my view this philosophy change was a mistake. The PF has a lot to think about at this point and tying the action of checking elevator freedom with the "60 knots, elevator free" call ensured it got done. Moreover, having the PF keep his or her left hand on the tiller until 80 knots provided an excellent abort cue. (No hands on the yoke prior to 80 knots: abort for most anything. One hand on the yoke: abort for engine failure, fire on the aircraft, directional control problems, or any conditions where the airplane will not fly. Both hands on the yoke: go unless you can't.)
There is no "steer lock" on the airplane. The NTSB report notes that when they used the parenthesis when quoting the cockpit voice recorder, the transcription was unsure.
The crew is now in uncharted territory. While we train incessantly that below V1 we can abort, above V1 we continue, it should have been obvious at this point the airplane was unflyable. The airplane was far below a balanced field condition and post crash analysis proved the airplane could have been stopped even at this point, beyond V1.
There is an undocumented technique among undisciplined GIV pilots to use the FPSOV to remove hydraulic power from the flight controls after engine start in case they forgot to disengage the gust lock. I've never seen this done but am assured it works. This technique is not correct and could damage the airplane. The correct procedure would be to shut down the engines, disengage the gust lock, and restart the engines. Whether it works in the chocks after engine start or not, it cannot work with any kind of air loads on the elevator. If the relative wind is pushing up on the elevator, the gust lock hook will have pressure loads that the gust lock handle cannot overcome.
Simulator tests proved that the takeoff could have been aborted even at this point, had it been properly executed. Specifically, had the brakes been applied fully and the throttles retarded simultaneously as late as 11 seconds after the rotate call, they could have stopped on the runway.
It is easy to get lost in the details of this mishap if you aren't a classic Gulfstream driver. Many are quick to blame the design of the airplane's gust lock but that really is just a red herring. Perhaps a short systems class is in order.
Figure: Exemplar GIV control pedestal showing the gust lock handle in the ON (up) position and the flight power shutoff valve handle (FPSOV) in the OFF (down) position, from NTSB AAR-15/03, figure 1.
[NTSB AAR-15/03, ¶1.1] The airplane’s mechanical gust lock system is used to lock the primary flight control surfaces (elevators, ailerons, and rudder) while the airplane is parked to protect them against wind gust loads. The system also restricts movement of the throttle levers. The GIV AFM includes disengaging the gust lock as an item in the Starting Engines checklist. The gust lock system is disengaged by moving the gust lock handle (shown in figure 1) to the OFF (down) position.
The GIV's gust lock system is fairly typical except for the elevator. When sitting without hydraulic pressure or air loads on the elevator, it falls to is full nose down position because of its weight. If still engaged when hydraulic pressure is applied, the gust lock is very difficult, if not impossible, to disengage because the hydraulic pressure is acting against the elevator actuator's hook.
Figure: Diagram of a gust lock handle in the ON and OFF positions. from NTSB AAR-15/03, figure 3.
[NTSB AAR-15/03, ¶1.3.1]
[NTSB AAR-15/03, ¶1.1] The GIV AFM includes a flight control check as an item in the After Starting Engines checklist. During the flight control check, one of the pilots moves the elevators, ailerons, and rudder stop to stop to confirm that they move freely and correctly. According to FDR data, the flight crew did not complete a flight control check after engine start or at any time thereafter. The control surface positions for the elevator and rudder that the FDR recorded showed that the movement of these control surfaces was restricted during the taxi and takeoff attempt.
A flight control check would have revealed an engaged gust lock by restricting movement in each axis. The GIV gust lock system is identical to that found in the GII and GIII. Its designed carried forward, with a few changes, into the GV, G550, and G450.
For more about this, see: G450 Systems / Gust Lock.
The NTSB Aircraft Accident Report is excellent, but a bit rambling in organization. They neglected a few areas of investigation but in general the report itself makes for a good case study. I've reorganized the analysis to place a focus on the pilots. I will not spend much time at all on the gust lock design; I agree it could have prevented this accident, but there is a much larger issue here. We need to keep our focus on the pilots because we are all susceptible to becoming just like them.
[NTSB AAR-15/03, ¶1.2.1]
[NTSB AAR-15/03, ¶1.2.2]
[NTSB AAR-15/03, ¶1.2.3] According to the accident airplane’s flight logs, the airplane was flown 308.8 hours in 2013 and 150.2 hours in 2014 (not including the flight time on the day of the accident), and the two pilots had operated the airplane as a flight crew for 84.5% of the hours in 2013 (261.1 hours) and 100% of the hours in 2014. They had flown the airplane 53 hours in the 90 days before the accident, with 8.9 hours flown in the last 30 days. Their most recent flights in the airplane before the accident were on May 20, 2014, when they flew four flight legs, totaling 2.7 hours.
This is a recipe for complacency. When two pilots fly exclusively with each other they tend to learn to anticipate the other pilot's needs and things get done before they are called for. After a while they stop being called for. Pilots in this situation need to be extra vigilant against this type of complacency.
More about this: Complacency.
[NTSB AAR-15/03, ¶2.3]
Large airlines, military squadrons, and very large civilian flight departments have a distinct advantage in the war against complacency: standardization and evaluation organizations. These so-called "black hats" can impartially look at the pilot force and squash complacency before it metastasizes. (Spreads, as with a cancer.) Smaller flight departments can do themselves a considerable favor by adopting a robust Line Operation Observation (LOO) Program.
[NTSB AAR-15/03, ¶1.11] An initial audit, completed on July 29, 2010, found that SK Travel complied with the IS-BAO standards at the stage 1 level (basic SMS). A second audit, completed on May 10, 2012, found that SK Travel complied with the IS-BAO standards at the stage 2 level (demonstration of effective SMS). The report for the 2012 audit noted that flight operations were not observed because no flights were scheduled during the audit period. At the time of the accident, the SIC was reportedly preparing for a third audit of SK Travel.
There is a problem here. The NTSB fails to mention who the auditor was. There are "consultant/auditors" who will pretty much bring a lazy flight department from zero compliance to "on paper" compliance for the right price. We don't know if that is the case here because it was never examined. They missed an opportunity to fix what is clearly broken.
[NTSB AAR-15/03, ¶1.2.1] The PIC’s most recent training was a GIV pilot recurrent course completed on September 17, 2013, at the FlightSafety International Wilmington Learning Center, New Castle, Delaware.
[NTSB AAR-15/03, ¶1.2.2] The SIC’s most recent training was a GIV pilot recurrent course completed on September 20, 2013, at the FlightSafety International Savannah Learning Center, Savannah, Georgia.
There are two choices in the Gulfstream world for initial and recurrent training and FlightSafety is the best. Their competitor is considerably cheaper and is known for being a "type rating mill." Much has been made about the fact these pilots used the better training vendor. That choice aside, some instructors at FlightSafety are less stringent on procedural compliance of 14 CFR 91 crews than they are 14 CFR 135. Many FlightSafety instructors do not fully appreciate the risk involved with some checklist philosophies.
More about that below.
[NTSB AAR-15/03, ¶2.2] The chief pilot, who was responsible for ensuring compliance with the company SOPs, was one of the two flight crewmembers. The company did not have a flight data monitoring (FDM) program, and the pilots were not regularly surveilled for compliance with SOPs by outside qualified personnel.
Most 14 CFR 91 pilots count themselves lucky they do not have the every six- or twelve-month rituals of a 14 CFR 135.293, 297, and 299 evaluations. But they are missing the opportunity of an outsider's "heading check," to make sure everything is okay. The 14 CFR 61.58 these pilots get are hardly adequate. The training vendor relies on keeping their customers happy and they are wary of busting a paying customer. The system is broken. Small flight departments are well advised to adopt a Line Operation Observation (LOO) Program.
[NTSB AAR-15/03, ¶2.2]
[NTSB AAR-15/03, ¶1.2.1] A contract pilot who had flown with the PIC two or three times several years before the accident characterized the PIC as a good pilot. He said that the PIC was very familiar with the airplane’s checklists and that he conducted a complete flight control check before each of their flights; however, he said that the PIC did not use a formal item-by-item checklist. The contract pilot reported that he was aware that, when the gust lock was not disengaged before starting the engines, some pilots occasionally used the FPSOV handle to momentarily remove hydraulic pressure from the flight controls, which allowed the gust lock to be disengaged without shutting down the engines. The contract pilot did not attribute these comments to a specific pilot or flight crew.
There is a false notion that the use of checklists in the 14 CFR 91 world is optional. There is another idea that a "flow" can be used so long as it is followed up by a checklist, the so-called "Do-Verify" method. That too is false for many checklists.
More about that: Checklist Philosophy.
[NTSB AAR-15/03, ¶3.1] The flight crewmembers’ lack of adherence to industry best practices involving the execution of normal checklists eliminated the opportunity for them to recognize that the gust lock handle was in the ON position and delayed their detection of this error.
[FAA Order 8900.1 Vol 3 Ch 32, ¶3-3403]
There is a debate in many pilot communities as to the efficacy of a flow ("Do Verify") versus the classic challenge and response ("Challenge-Do-Verify"). FAA Order 8900.1 should end that debate when dealing with any items that "have proven to be critical." There is a lot more to this than "because the book says so."
See Checklist Philosophy.
There appears to be a move to blame Gulfstream for this, saying none of it would happen had the gust lock managed to keep the throttles at idle. All of this ignores the fact that the procedures in place have prevented this from happening during millions of takeoffs.
Figure: GIV Engine Start and After Engine Start checklists, with highlighted items, from GIV Cockpit Card, extract.
[NTSB AAR-15/03, ¶2.1]
[NTSB AAR-15/03, ¶3.1] The flight crew failed to disengage the gust lock system as called for in the Starting Engines checklist and failed to conduct a flight control check as called for in the After Starting Engines checklist, during which the crewmembers would have detected that the gust lock system was engaged.
[NTSB AAR-15/03, ¶3.1] Given that the flight crew neglected to perform complete flight control checks before 98% of the crewmembers’ previous 175 takeoffs in the airplane, the flight crew’s omission of a flight control check before the accident takeoff indicates intentional, habitual noncompliance with standard operating procedures.
[NTSB AAR-15/03, ¶2.1]
The failure to abort at this point is inconceivable, especially considering the experience level of these pilots in type.
Even with an engineering level understanding of the system, a pilot is unlikely to realize the various interactions between systems and is well advised to keep this kind of "ad hoc airmanship" to a minimum.
[NTSB AAR-15/03, ¶1.10]
[NTSB AAR-15/03, ¶3.1] The flight crew delayed initiating a rejected takeoff until the accident was unavoidable; this delay likely resulted from surprise, the unsuccessful attempt to resolve the problem through the use of the flight power shutoff valve, and ineffective communication.
[NTSB AAR-15/03, ¶3.1] About the time that the airplane reached a speed of 150 knots, one of the pilots activated the flight power shutoff valve, likely in an attempt to unlock the flight controls, but this action was ineffective because high aerodynamic loads on the elevator were likely impeding gust lock hook release.
[NTSB AAR-15/03, ¶3.2] The NTSB determines that the probable cause of this accident was the flight crewmembers’ failure to perform the flight control check before takeoff, their attempt to take off with the gust lock system engaged, and their delayed execution of a rejected takeoff after they became aware that the controls were locked. Contributing to the accident were the flight crew’s habitual noncompliance with checklists, Gulfstream Aerospace Corporation’s failure to ensure that the GIV gust lock/throttle lever interlock system would prevent an attempted takeoff with the gust lock engaged, and the Federal Aviation Administration’s failure to detect this inadequacy during the GIV’s certification.
FAA Order 8900.1 Vol 3 Ch 32, Manuals, Procedures, and Checklists for 14 CFR Parts 91K, 121, 125, and 135.
Gulfstream Aerospace Corporation Party Submission, Accident Involving Arizin Ventures LLC - SKC Travel LLC - Operated Aircraft N121JM, May 31, 2014, Laurence G. Hanscom Field, Bedford, Massachusetts, ERA14MA271, May 11, 2015
Gulfstream GIV Cockpit Card, 22 Dec 2000
NTSB Accident Docket, ERA14MA271
NTSB Aircraft Accident Report, AAR-15/03, Runway Overrun During Rejected Takeoff Gulfstream Aerospace Corporation GIV, N121JM, Bedford, Massachusetts, May 31, 2014
Copyright 2019. Code 7700 LLC. All Rights Reserved.