Photo: N121JM Wreckage, aerial photograph, from NTSB Accident Docket, figure 6.

Eddie Sez:

This mishap should serve as a wake up call to all pilots, training vendors, and safety system auditors that procedural noncompliance can be hidden from outside detection. A crew can seem perfectly professional in the simulator or during a safety audit. But that could just be an act. There is no substitute for an observation of crews on the line, with passengers, to really get to see how a flight crew really performs.

Having been in the business of instructing, observing, and evaluating professional pilots for three decades now, I have come to the conclusion that we are split fifty-fifty. About half of us walk the walk and try to do things as well as they can be done. Sure we don't get it by the book all the time, but we sure try. The other half? Not so much. These pilots believe they are above standardization and scoff at the idea they need any sort of evaluation at all. Reading this case study should make you mad. Mad that pilots like these are out there. Mad that they have tarnished your profession. Mad that we are all at risk of becoming just like them. If it doesn't make you mad, well, maybe you are in the wrong half of that fifty-fifty divide.

As usual, I will present a sterile accident report, a narrative that details what happened, an analysis of the findings, and the probable cause, straight out of the NTSB report. Unusually, I will also present a discussion of the gust lock in the GIV, since that is where much of the focus has been.

That gust lock, however, is a red herring. (An irrelevant topic introduced to divert attention from the important issue.) Yes, a better design of that gust lock could have prevented the mishap but consider the following. The GIV gust lock system is identical to that installed in the GII and GIII before it, almost identical to the GV, G550, and G450 that followed. And yet this is the first mishap of this type. That gust lock has been around for over a half century.

The NTSB accident report is quite good and devotes considerable discussion about the design of that gust lock, airport structures, the adequacy of emergency response, and the post-crash survival aspects. I shall leave all that to you. My focus shall be:

  1. Complacency — This crew had all the warning flags when it comes to complacency. They were highly experienced in total time, time in type, and time with their current flight department. The two pilots flew almost exclusively with each other. The only checkrides they ever got were from simulator recurrent. They desperately needed an outsider to give them an honest assessment.

  2. Flawed Oversight — This crew had attained their International Standard for Business Aircraft Operations (IS-BAO) Safety Management System (SMS) Stage 2 Certification and attended regular training with the premier Gulfstream training vendor. It appears they were able to play the part of professional pilots for their audits and during training, but they did not fly like they trained.

  3. Checklist Discipline — Checklist philosophy debates normally center around the "Challenge-Do-Verify" (CDV) versus the "Do-Verify" (DV) question. Are flows always appropriate? But if these pilots were doing any checklists at all, they were silent checklists. Checklists are required. CDV are mandatory for all but two phases of flight.

  4. Procedural Noncompliance — Regardless of how you feel about checkrides and checklists, you are obligated to follow any procedures set out in the manufacturer's airplane flight manual.

  5. Rejected Takeoff Procedures — Even with all of these mistakes, the crew could have successfully stopped on the runway 11 seconds after the first "lock is on" comment, had they executed it properly. But they did not.

The NTSB says these pilots are guilty of habitual, intentional noncompliance. In my view that is an understatement. We need to attack this problem much more aggressively. See: Case Study: Bedford for a plan to do just that.

A final thought. Pilots don't set out to be complacent, negligent, or habitually and intentionally noncompliant. You don't get to this level of aviation with those qualities. So how did that happen to these pilots? We will never know. But we should all understand it could very well happen to each of us. The thought haunts me.

What follows are quotes from the sources listed below, as well as my comments in blue.


Accident Report


Narrative

Photo: N121JM Consolidated sequence of runway events, from Gulfstream Party Submission, Appendix A, page A-1.

[NTSB AAR-15/03, ¶1.1]


Aircraft Gust Lock Discussion

It is easy to get lost in the details of this mishap if you aren't a classic Gulfstream driver. Many are quick to blame the design of the airplane's gust lock but that really is just a red herring. Perhaps a short systems class is in order.

Figure: Exemplar GIV control pedestal showing the gust lock handle in the ON (up) position and the flight power shutoff valve handle (FPSOV) in the OFF (down) position, from NTSB AAR-15/03, figure 1.

[NTSB AAR-15/03, ¶1.1] The airplane’s mechanical gust lock system is used to lock the primary flight control surfaces (elevators, ailerons, and rudder) while the airplane is parked to protect them against wind gust loads. The system also restricts movement of the throttle levers. The GIV AFM includes disengaging the gust lock as an item in the Starting Engines checklist. The gust lock system is disengaged by moving the gust lock handle (shown in figure 1) to the OFF (down) position.

The GIV's gust lock system is fairly typical except for the elevator. When sitting without hydraulic pressure or air loads on the elevator, it falls to is full nose down position because of its weight. If still engaged when hydraulic pressure is applied, the gust lock is very difficult, if not impossible, to disengage because the hydraulic pressure is acting against the elevator actuator's hook.

Figure: Diagram of a gust lock handle in the ON and OFF positions. from NTSB AAR-15/03, figure 3.

[NTSB AAR-15/03, ¶1.3.1]

  • The gust lock system is a mechanical system that restricts the throttles and locks the ailerons, elevators, and rudder to protect them against wind gust loads while the airplane is parked. The ailerons and rudder are locked in the neutral position (0°), and the elevators are locked in the 13° trailing-edge-down position. The locks are mechanical hooks located near the control surfaces that are operated by a two-position, red-painted gust lock handle located on the right side of the control pedestal.

  • As shown in figure 3, the gust lock handle can be placed in either an up/aft position (gust lock on) or a down/forward position (gust lock off). Moving the handle forward and down to the OFF position releases the gust lock hooks and unlocks the flight control surfaces. Moving the handle aft and up to the ON position engages the gust lock hooks and locks the control surfaces. The gust lock handle latches internally in both the ON and OFF positions. A spring latch operated by the actuating lever must be unlocked before the handle can be moved out of either latched position.

  • A mechanical interlock between the gust lock handle and the throttle levers restricts the movement of the throttle levers when the gust lock handle is in the ON position. The interlock is incorporated into the sector assembly below the pedestal.

  • The sector assembly consists of control cable sheaves mounted on a common axis, which transmit incoming motion of the throttle levers, gust lock, and other controls via pushrods to the appropriate control system cables. The interlock mechanism consists of stops on the gust lock sheave that interface with corresponding stops on the left and right throttle lever sheaves. These stops allow full throttle movement with the gust lock handle down and restricted rotation above idle at the throttle sheaves with the gust lock handle up. According to Gulfstream, the interlock mechanism was intended to limit throttle lever movement to a throttle lever angle (TLA) of no greater than 6° ± 1° during operation with the gust lock on. However, as described further in section 1.10, post accident testing found that, with the gust lock handle in the ON position, the forward throttle lever movement that could be achieved on the GIV was greater than the intended TLA of 6°.

[NTSB AAR-15/03, ¶1.1] The GIV AFM includes a flight control check as an item in the After Starting Engines checklist. During the flight control check, one of the pilots moves the elevators, ailerons, and rudder stop to stop to confirm that they move freely and correctly. According to FDR data, the flight crew did not complete a flight control check after engine start or at any time thereafter. The control surface positions for the elevator and rudder that the FDR recorded showed that the movement of these control surfaces was restricted during the taxi and takeoff attempt.

A flight control check would have revealed an engaged gust lock by restricting movement in each axis. The GIV gust lock system is identical to that found in the GII and GIII. Its designed carried forward, with a few changes, into the GV, G550, and G450. For more about this, see: G450 Systems / Gust Lock.


Analysis

The NTSB Aircraft Accident Report is excellent, but a bit rambling in organization. They neglected a few areas of investigation but in general the report itself makes for a good case study. I've reorganized the analysis to place a focus on the pilots. I will not spend much time at all on the gust lock design; I agree it could have prevented this accident, but there is a much larger issue here. We need to keep our focus on the pilots because we are all susceptible to becoming just like them.

Complacency

[NTSB AAR-15/03, ¶1.2.1]

[NTSB AAR-15/03, ¶1.2.2]

[NTSB AAR-15/03, ¶1.2.3] According to the accident airplane’s flight logs, the airplane was flown 308.8 hours in 2013 and 150.2 hours in 2014 (not including the flight time on the day of the accident), and the two pilots had operated the airplane as a flight crew for 84.5% of the hours in 2013 (261.1 hours) and 100% of the hours in 2014. They had flown the airplane 53 hours in the 90 days before the accident, with 8.9 hours flown in the last 30 days. Their most recent flights in the airplane before the accident were on May 20, 2014, when they flew four flight legs, totaling 2.7 hours.

This is a recipe for complacency. When two pilots fly exclusively with each other they tend to learn to anticipate the other pilot's needs and things get done before they are called for. After a while they stop being called for. Pilots in this situation need to be extra vigilant against this type of complacency. More about this: Pilot Psychology / Complacency.

[NTSB AAR-15/03, ¶2.3]

Large airlines, military squadrons, and very large civilian flight departments have a distinct advantage in the war against complacency: standardization and evaluation organizations. These so-called "black hats" can impartially look at the pilot force and squash complacency before it metastasizes. (Spreads, as with a cancer.) Smaller flight departments can do themselves a considerable favor by adopting a robust Line Operation Observation (LOO) Program.

Flawed Oversight

[NTSB AAR-15/03, ¶1.11] An initial audit, completed on July 29, 2010, found that SK Travel complied with the IS-BAO standards at the stage 1 level (basic SMS). A second audit, completed on May 10, 2012, found that SK Travel complied with the IS-BAO standards at the stage 2 level (demonstration of effective SMS). The report for the 2012 audit noted that flight operations were not observed because no flights were scheduled during the audit period. At the time of the accident, the SIC was reportedly preparing for a third audit of SK Travel.

There is a problem here. The NTSB fails to mention who the auditor was. There are "consultant/auditors" who will pretty much bring a lazy flight department from zero compliance to "on paper" compliance for the right price. We don't know if that is the case here because it was never examined. They missed an opportunity to fix what is clearly broken.

[NTSB AAR-15/03, ¶1.2.1] The PIC’s most recent training was a GIV pilot recurrent course completed on September 17, 2013, at the FlightSafety International Wilmington Learning Center, New Castle, Delaware.

[NTSB AAR-15/03, ¶1.2.2] The SIC’s most recent training was a GIV pilot recurrent course completed on September 20, 2013, at the FlightSafety International Savannah Learning Center, Savannah, Georgia.

There are two choices in the Gulfstream world for initial and recurrent training and FlightSafety is the best. Their competitor is considerably cheaper and is known for being a "type rating mill." Much has been made about the fact these pilots used the better training vendor. That choice aside, some instructors at FlightSafety are less stringent on procedural compliance of 14 CFR 91 crews than they are 14 CFR 135. Many FlightSafety instructors do not fully appreciate the risk involved with some checklist philosophies. More about that below.

[NTSB AAR-15/03, ¶2.2] The chief pilot, who was responsible for ensuring compliance with the company SOPs, was one of the two flight crewmembers. The company did not have a flight data monitoring (FDM) program, and the pilots were not regularly surveilled for compliance with SOPs by outside qualified personnel.

Most 14 CFR 91 pilots count themselves lucky they do not have the every six- or twelve-month rituals of a 14 CFR 135.293, 297, and 299 evaluations. But they are missing the opportunity of an outsider's "heading check," to make sure everything is okay. The 14 CFR 61.58 these pilots get are hardly adequate. The training vendor relies on keeping their customers happy and they are wary of busting a paying customer. The system is broken. Small flight departments are well advised to adopt a Line Operation Observation (LOO) Program.

Checklist Discipline

[NTSB AAR-15/03, ¶2.2]

[NTSB AAR-15/03, ¶1.2.1] A contract pilot who had flown with the PIC two or three times several years before the accident characterized the PIC as a good pilot. He said that the PIC was very familiar with the airplane’s checklists and that he conducted a complete flight control check before each of their flights; however, he said that the PIC did not use a formal item-by-item checklist. The contract pilot reported that he was aware that, when the gust lock was not disengaged before starting the engines, some pilots occasionally used the FPSOV handle to momentarily remove hydraulic pressure from the flight controls, which allowed the gust lock to be disengaged without shutting down the engines. The contract pilot did not attribute these comments to a specific pilot or flight crew.

There is a false notion that the use of checklists in the 14 CFR 91 world is optional. There is another idea that a "flow" can be used so long as it is followed up by a checklist, the so-called "Do-Verify" method. That too is false for many checklists. More about that: Normal Procedures & Techniques / Checklist Philosophy.

[NTSB AAR-15/03, ¶3.1] The flight crewmembers’ lack of adherence to industry best practices involving the execution of normal checklists eliminated the opportunity for them to recognize that the gust lock handle was in the ON position and delayed their detection of this error.

[FAA Order 8900.1 Vol 3 Ch 32, ¶3-3403]

There is a debate in many pilot communities as to the efficacy of a flow ("Do Verify") versus the classic challenge and response ("Challenge-Do-Verify"). FAA Order 8900.1 should end that debate when dealing with any items that "have proven to be critical." There is a lot more to this than "because the book says so." See Normal Procedures & Techniques / Checklist Philosophy.

Procedural Noncompliance

There appears to be a move to blame Gulfstream for this, saying none of it would happen had the gust lock managed to keep the throttles at idle. All of this ignores the fact that the procedures in place have prevented this from happening during millions of takeoffs.

Figure: GIV Engine Start and After Engine Start checklists, with highlighted items, from GIV Cockpit Card, extract.

[NTSB AAR-15/03, ¶2.1]

  • The flight crew made a series of errors that culminated in the airplane overrunning the runway. Before starting to taxi, the crewmembers made two of these errors. First, they neglected to release and stow the gust lock handle as would normally be accomplished during the engine start process. Second, they neglected to perform a flight control check after the engines were started.

  • Further, a review of QAR data revealed that the flight crewmembers had neglected to perform complete flight control checks before 98% of their previous 175 takeoffs in the airplane, indicating that this oversight was habitual and not an anomaly.

  • The FDR recorded restricted motion of both the elevator and rudder throughout the taxi and attempted takeoff. This restricted motion indicates that the gust lock system was engaged because it is the only system on the airplane capable of restricting two independent flight control surfaces, and the restricted motion is consistent with the flight crew failing to disengage the gust lock system as called for in the Starting Engines checklist.

  • Further, the flight crew had an opportunity to detect that the gust lock system was engaged by conducting a flight control check as called for in the After Starting Engines checklist, but the FDR data indicated that a flight control check was not done. Therefore, the NTSB concludes that the flight crew failed to disengage the gust lock system as called for in the Starting Engines checklist and failed to conduct a flight control check as called for in the After Starting Engines checklist, during which the crewmembers would have detected that the gust lock system was engaged. Further, the NTSB concludes that, given that the flight crew neglected to perform complete flight control checks before 98% of the crewmembers’ previous 175 takeoffs in the airplane, the flight crew’s omission of a flight control check before the accident takeoff indicates intentional, habitual noncompliance with standard operating procedures (SOP).

[NTSB AAR-15/03, ¶3.1] The flight crew failed to disengage the gust lock system as called for in the Starting Engines checklist and failed to conduct a flight control check as called for in the After Starting Engines checklist, during which the crewmembers would have detected that the gust lock system was engaged.

[NTSB AAR-15/03, ¶3.1] Given that the flight crew neglected to perform complete flight control checks before 98% of the crewmembers’ previous 175 takeoffs in the airplane, the flight crew’s omission of a flight control check before the accident takeoff indicates intentional, habitual noncompliance with standard operating procedures.

[NTSB AAR-15/03, ¶2.1]

Rejected Takeoff Procedures

[NTSB AAR-15/03, ¶1.10]

[NTSB AAR-15/03, ¶3.1] The flight crew delayed initiating a rejected takeoff until the accident was unavoidable; this delay likely resulted from surprise, the unsuccessful attempt to resolve the problem through the use of the flight power shutoff valve, and ineffective communication.

[NTSB AAR-15/03, ¶3.1] About the time that the airplane reached a speed of 150 knots, one of the pilots activated the flight power shutoff valve, likely in an attempt to unlock the flight controls, but this action was ineffective because high aerodynamic loads on the elevator were likely impeding gust lock hook release.


Probable Cause

[NTSB AAR-15/03, ¶3.2] The NTSB determines that the probable cause of this accident was the flight crewmembers’ failure to perform the flight control check before takeoff, their attempt to take off with the gust lock system engaged, and their delayed execution of a rejected takeoff after they became aware that the controls were locked. Contributing to the accident were the flight crew’s habitual noncompliance with checklists, Gulfstream Aerospace Corporation’s failure to ensure that the GIV gust lock/throttle lever interlock system would prevent an attempted takeoff with the gust lock engaged, and the Federal Aviation Administration’s failure to detect this inadequacy during the GIV’s certification.


See Also:


References

FAA Order 8900.1 Vol 3 Ch 32, Manuals, Procedures, and Checklists for 14 CFR Parts 91K, 121, 125, and 135.

Gulfstream Aerospace Corporation Party Submission, Accident Involving Arizin Ventures LLC - SKC Travel LLC - Operated Aircraft N121JM, May 31, 2014, Laurence G. Hanscom Field, Bedford, Massachusetts, ERA14MA271, May 11, 2015

Gulfstream GIV Cockpit Card, 22 Dec 2000

NTSB Accident Docket, ERA14MA271

NTSB Aircraft Accident Report, AAR-15/03, Runway Overrun During Rejected Takeoff Gulfstream Aerospace Corporation GIV, N121JM, Bedford, Massachusetts, May 31, 2014