Gulfstream IV N121JM

This mishap should serve as a wake up call to all pilots, training vendors, and safety system auditors that procedural noncompliance can be hidden from outside detection. A crew can seem perfectly professional in the simulator or during a safety audit. But that could just be an act. There is no substitute for an observation of crews on the line, with passengers, to really get to see how a flight crew really performs.

Having been in the business of instructing, observing, and evaluating professional pilots for three decades now, I have come to the conclusion that we are split fifty-fifty. About half of us walk the walk and try to do things as well as they can be done. Sure we don't get it by the book all the time, but we sure try. The other half? Not so much. These pilots believe they are above standardization and scoff at the idea they need any sort of evaluation at all. Reading this case study should make you mad. Mad that pilots like these are out there. Mad that they have tarnished your profession. Mad that we are all at risk of becoming just like them. If it doesn't make you mad, well, maybe you are in the wrong half of that fifty-fifty divide.

As usual, I will present a sterile accident report, a narrative that details what happened, an analysis of the findings, and the probable cause, straight out of the NTSB report. Unusually, I will also present a discussion of the gust lock in the GIV, since that is where much of the focus has been.

That gust lock, however, is a red herring. (An irrelevant topic introduced to divert attention from the important issue.) Yes, a better design of that gust lock could have prevented the mishap but consider the following. The GIV gust lock system is identical to that installed in the GII and GIII before it, almost identical to the GV, G550, and G450 that followed. And yet this is the first mishap of this type. That gust lock has been around for over a half century.

The NTSB accident report is quite good and devotes considerable discussion about the design of that gust lock, airport structures, the adequacy of emergency response, and the post-crash survival aspects. I shall leave all that to you. My focus shall be what happened, how could it have happened, and how it could have been prevented.

Everything here is from the references shown below, with a few comments in an alternate color.

Photo: N121JM Wreckage, aerial photograph, from NTSB Accident Docket, figure 6.

1. Complacency — This crew had all the warning flags when it comes to complacency. They were highly experienced in total time, time in type, and time with their current flight department. The two pilots flew almost exclusively with each other. The only checkrides they ever got were from simulator recurrent. They desperately needed an outsider to give them an honest assessment.
2. Flawed Oversight — This crew had attained their International Standard for Business Aircraft Operations (IS-BAO) Safety Management System (SMS) Stage 2 Certification and attended regular training with the premier Gulfstream training vendor. It appears they were able to play the part of professional pilots for their audits and during training, but they did not fly like they trained.
3. Checklist Discipline — Checklist philosophy debates normally center around the "Challenge-Do-Verify" (CDV) versus the "Do-Verify" (DV) question. Are flows always appropriate? But if these pilots were doing any checklists at all, they were silent checklists. Checklists are required. CDV are mandatory for all but two phases of flight.
4. Procedural Noncompliance — Regardless of how you feel about checkrides and checklists, you are obligated to follow any procedures set out in the manufacturer's airplane flight manual.
5. Rejected Takeoff Procedures — Even with all of these mistakes, the crew could have successfully stopped on the runway 11 seconds after the first "lock is on" comment, had they executed it properly. But they did not.

The NTSB says these pilots are guilty of habitual, intentional noncompliance. In my view that is an understatement. We need to attack this problem much more aggressively. See: The Normalization of Deviance for a plan to do just that.

A final thought. Pilots don't set out to be complacent, negligent, or habitually and intentionally noncompliant. You don't get to this level of aviation with those qualities. So how did that happen to these pilots? We will never know. But we should all understand it could very well happen to each of us. The thought haunts me.

• Date: May 31, 2014
• Time: 2140 EDT
• Type: Gulfstream GIV
• Operator: Arizin Ventures LLC
• Registration: N121JM
• Fatalities: 3 of 3 crew, 4 of 4 passengers
• Aircraft Fate: Destroyed
• Phase: Takeoff
• Departure Airport: Laurence G. Hanscom Field, Bedford, Massachusetts
• Destination Airport: Atlantic City International Airport, Atlantic City, New Jersey

Photo: N121JM Consolidated sequence of runway events, from Gulfstream Party Submission, Appendix A, page A-1.

NTSB Video: N121JM.

[NTSB AAR-15/03, ¶1.1]

• About 1325, the airplane departed from its base at New Castle Airport, Wilmington, Delaware; flew to Atlantic City where the passengers boarded; and then flew to BED. The airplane landed at BED about 1544 and was parked on the ramp at one of the airport’s fixed-base operators.
• About 2128, the passengers returned to BED and boarded the airplane for the flight back to Atlantic City. The cockpit voice recorder (CVR) recorded sounds consistent with engine start beginning about 2130. The flap position recorded by the flight data recorder (FDR) changed from 0° to 20° at 2131:45. About 2133, the airplane began to taxi to runway 11, and, at 2139:20, the airplane began turning onto the runway. From the time the passengers boarded the airplane to the time the airplane reached the runway (a period of about 11 minutes), the CVR recorded minimal verbal communication between the flight crewmembers, and there was no discussion or mention of checklists or takeoff planning.

The GIV Airplane Flight Manual (AFM) includes five checklists to be completed before takeoff: the Before Starting Engines checklist, the Starting Engines checklist, the After Starting Engines checklist, the Taxi/Before Takeoff checklist, and the Lineup checklist.

• Between 2139:21 and 2139:31, as the airplane turned onto the runway, the CVR recorded a conversation between the flight crewmembers regarding the “rudder limit light” activating. These comments were consistent with the advisory message “RUDDER LIMIT” showing on the engine instrument and crew advisory system display. This message, which is displayed in blue letters, advises the flight crew when the airplane’s rudder actuator load limiter valve has been activated. The load limiter activates when the rudder contacts its stops and protects the airplane’s tail structure against overload by limiting actuator output load capacity. The load limiter also activates when the rudder is restricted from reaching its commanded position, as would be the case if the rudder was commanded to move with the gust lock engaged.

Despite the blue color of the RUDDER LIMIT message, it is not a normal indication and should have been cause to stop and look for causation.

• According to FDR data, at 2139:34, the brakes were released, and the throttle levers were advanced manually, resulting in the left and right engine pressure ratios (EPR) increasing to about 1.42 over a period of about 4 seconds, where they remained for about the next 5 seconds. At 2139:43, the autothrottle was engaged, and the EPRs began to increase again. At 2139:46, maximum EPR values of about 1.6 were achieved, and the airplane reached a speed of about 60 knots (kts). The EPRs then reduced, dropping to about 1.53 and stabilizing. At 2139:46.6, as the EPRs were dropping, the PIC said, “couldn’t get (it manually any further).”

One of the PM duties at this point is to ensure the target EPR is set. Failing this, the takeoff should have been aborted at this point.

• The Lineup checklist in the GIV AFM includes a note below the checklist items that calls for the pilot to confirm, at 60 kts during the takeoff roll, that the elevators are free and the control yoke has moved aft from the full forward to the neutral position. Aft movement of the control yoke is expected due to the increasing aerodynamic forces on the elevators as the airplane accelerates during takeoff, which act to move the elevators from their at-rest position of about 13° trailing edge down to a 0° (neutral) position. The elevator position recorded by the FDR remained constant at about 13° trailing edge down as the airplane accelerated through 60 kts.

With the gust lock engaged the ailerons and rudder are centered, but the elevator hangs full nose down due to the weight of the elevator. With the gust lock disengaged, the elevator remains full nose down but can be easily moved by pulling back on the control yoke. As the airplane accelerates, the relative wind acts to push the elevator from full nose down to centered. In the cockpit this can be seen as the yoke moving aft. There was a point in the airplane's history where the PM was required to test this movement at 60 knots and announce "elevator free." Gulfstream had a philosophy change and recommended the PF handle the yoke from brake release. The "elevator free" call out was removed and the PF instead was simply instructed to ensure it was indeed free. In my view this philosophy change was a mistake. The PF has a lot to think about at this point and tying the action of checking elevator freedom with the "60 knots, elevator free" call ensured it got done. Moreover, having the PF keep his or her left hand on the tiller until 80 knots provided an excellent abort cue. (No hands on the yoke prior to 80 knots: abort for most anything. One hand on the yoke: abort for engine failure, fire on the aircraft, directional control problems, or any conditions where the airplane will not fly. Both hands on the yoke: go unless you can't.)

• According to the CVR transcript, at 2139:51.3, the SIC said, “eighty,” indicating that the airplane had reached a speed of 80 kts. At 2139:57.5, the SIC said, “V-1,” indicating that the airplane had reached the takeoff decision speed, and 1.4 seconds later said, “rotate.” One second later, at 2139:59.9, the PIC said, “(steer) lock is on.” The PIC repeated this statement six times during the next 12.7 seconds.

There is no "steer lock" on the airplane. The NTSB report notes that when they used the parenthesis when quoting the cockpit voice recorder, the transcription was unsure.

The crew is now in uncharted territory. While we train incessantly that below V₁ we can abort, above V₁ we continue, it should have been obvious at this point the airplane was unflyable. The airplane was far below a balanced field condition and post crash analysis proved the airplane could have been stopped even at this point, beyond V₁.

• According to FDR data, at 2140:05.7, the ground spoilers and flight spoilers moved up about 1° to 3°, both ailerons moved trailing edge up about 1°, and the yaw damper disengaged, which was consistent with the activation of the FPSOV. (Flight Power Shut Off Valve) Activating the FPSOV by moving the FPSOV handle (shown in figure 1) up to the ON position removes hydraulic pressure from the actuators for the spoilers and the primary flight controls. Because the spoilers are normally held down by their actuators, when hydraulic pressure is removed from the actuators, the surfaces will “float” due to aerodynamic loading on the spoiler surfaces. Similarly, when hydraulic pressure is removed from the aileron actuators, both ailerons will “float” due to aerodynamic loads. Also, in the absence of hydraulic pressure to the rudder actuator, the yaw damper will disengage because the rudder actuator will not respond to yaw damper inputs.

There is an undocumented technique among undisciplined GIV pilots to use the FPSOV to remove hydraulic power from the flight controls after engine start in case they forgot to disengage the gust lock. I've never seen this done but am assured it works. This technique is not correct and could damage the airplane. The correct procedure would be to shut down the engines, disengage the gust lock, and restart the engines. Whether it works in the chocks after engine start or not, it cannot work with any kind of air loads on the elevator. If the relative wind is pushing up on the elevator, the gust lock hook will have pressure loads that the gust lock handle cannot overcome.

• At 2140:10, about 11 seconds after the “rotate” call, at a groundspeed of about 162 kts and with about 1,373 ft of runway remaining, the FDR recorded the left and right brake pressures beginning to rise. The CVR did not record any verbal communication between the flight crewmembers regarding rejecting the takeoff. At 2140:14 (4 seconds after the brake pressure increase), the throttle levers were pulled back. According to FDR data, the ground spoilers did not automatically deploy following the throttle reduction, which is consistent with the activation of the FPSOV. At 2140:14.3, the PIC said, “I can’t stop it.”

Simulator tests proved that the takeoff could have been aborted even at this point, had it been properly executed. Specifically, had the brakes been applied fully and the throttles retarded simultaneously as late as 11 seconds after the rotate call, they could have stopped on the runway.

• At 2140:15.3, the airplane exited the runway onto the paved overrun area at a groundspeed of about 151 kts, and, at 2140:15.5, the thrust reversers were deployed. At 2140:20 (about 5 seconds after exiting the runway), the airplane, traveling at a groundspeed of about 105 kts, exited the paved overrun area onto the grass. The CVR recorded the sound of an impact about 1 second later at a groundspeed of about 97 kts. FDR data ended at 2140:23.9 while the airplane was still in motion traveling at a groundspeed of about 90 kts.
• The two air traffic controllers on duty in the BED air traffic control tower (ATCT) observed the airplane rolling down the runway at “high speed” but not lifting off. They saw the airplane exit the runway and pass through the paved overrun area, and they immediately began accident notification procedures. One of the controllers stated that the airplane was engulfed in flames “almost instantaneously” with it coming to a stop.
• The airplane passed through the airport’s perimeter fence and came to rest spanning a ravine formed by the Shawsheen River. The main wreckage was about 8,880 ft from the runway threshold, or 1,869 ft past the runway end and 849 ft past the end of the paved overrun area.

Aircraft Gust Lock Discussion

It is easy to get lost in the details of this mishap if you aren't a classic Gulfstream driver. Many are quick to blame the design of the airplane's gust lock but that really is just a red herring. Perhaps a short systems class is in order.

Figure: Exemplar GIV control pedestal showing the gust lock handle in the ON (up) position and the flight power shutoff valve handle (FPSOV) in the OFF (down) position, from NTSB AAR-15/03, figure 1.

[NTSB AAR-15/03, ¶1.1] The airplane’s mechanical gust lock system is used to lock the primary flight control surfaces (elevators, ailerons, and rudder) while the airplane is parked to protect them against wind gust loads. The system also restricts movement of the throttle levers. The GIV AFM includes disengaging the gust lock as an item in the Starting Engines checklist. The gust lock system is disengaged by moving the gust lock handle (shown in figure 1) to the OFF (down) position.

The GIV's gust lock system is fairly typical except for the elevator. When sitting without hydraulic pressure or air loads on the elevator, it falls to is full nose down position because of its weight. If still engaged when hydraulic pressure is applied, the gust lock is very difficult, if not impossible, to disengage because the hydraulic pressure is acting against the elevator actuator's hook.

Figure: Diagram of a gust lock handle in the ON and OFF positions. from NTSB AAR-15/03, figure 3.

[NTSB AAR-15/03, ¶1.3.1]

• The gust lock system is a mechanical system that restricts the throttles and locks the ailerons, elevators, and rudder to protect them against wind gust loads while the airplane is parked. The ailerons and rudder are locked in the neutral position (0°), and the elevators are locked in the 13° trailing-edge-down position. The locks are mechanical hooks located near the control surfaces that are operated by a two-position, red-painted gust lock handle located on the right side of the control pedestal.
• As shown in figure 3, the gust lock handle can be placed in either an up/aft position (gust lock on) or a down/forward position (gust lock off). Moving the handle forward and down to the OFF position releases the gust lock hooks and unlocks the flight control surfaces. Moving the handle aft and up to the ON position engages the gust lock hooks and locks the control surfaces. The gust lock handle latches internally in both the ON and OFF positions. A spring latch operated by the actuating lever must be unlocked before the handle can be moved out of either latched position.
• A mechanical interlock between the gust lock handle and the throttle levers restricts the movement of the throttle levers when the gust lock handle is in the ON position. The interlock is incorporated into the sector assembly below the pedestal.
• The sector assembly consists of control cable sheaves mounted on a common axis, which transmit incoming motion of the throttle levers, gust lock, and other controls via pushrods to the appropriate control system cables. The interlock mechanism consists of stops on the gust lock sheave that interface with corresponding stops on the left and right throttle lever sheaves. These stops allow full throttle movement with the gust lock handle down and restricted rotation above idle at the throttle sheaves with the gust lock handle up. According to Gulfstream, the interlock mechanism was intended to limit throttle lever movement to a throttle lever angle (TLA) of no greater than 6° ± 1° during operation with the gust lock on. However, as described further in section 1.10, post accident testing found that, with the gust lock handle in the ON position, the forward throttle lever movement that could be achieved on the GIV was greater than the intended TLA of 6°.

[NTSB AAR-15/03, ¶1.1] The GIV AFM includes a flight control check as an item in the After Starting Engines checklist. During the flight control check, one of the pilots moves the elevators, ailerons, and rudder stop to stop to confirm that they move freely and correctly. According to FDR data, the flight crew did not complete a flight control check after engine start or at any time thereafter. The control surface positions for the elevator and rudder that the FDR recorded showed that the movement of these control surfaces was restricted during the taxi and takeoff attempt.

A flight control check would have revealed an engaged gust lock by restricting movement in each axis. The GIV gust lock system is identical to that found in the GII and GIII. Its designed carried forward, with a few changes, into the GV, G550, and G450.

For more about this, see: G450 Systems / Gust Lock.

The NTSB Aircraft Accident Report is excellent, but a bit rambling in organization. They neglected a few areas of investigation but in general the report itself makes for a good case study. I've reorganized the analysis to place a focus on the pilots. I will not spend much time at all on the gust lock design; I agree it could have prevented this accident, but there is a much larger issue here. We need to keep our focus on the pilots because we are all susceptible to becoming just like them.

Complacency

[NTSB AAR-15/03, ¶1.2.1]

• The PIC, age 45, who was seated in the left pilot seat, held an airline transport pilot certificate with a multiengine airplane rating and type ratings for the Gulfstream G-1159 (Gulfstream GII/GIII), Gulfstream GIV, Beechcraft BE-400/Mitsubishi MU-300, and Gates Learjet LR-JET airplanes.
• At the time of his April 2014 medical examination, he reported a total flight time of 11,250 hours, with 150 hours flown in the preceding 6 months.
• The PIC had worked for the owners of SK Travel for about 12 years and had been flying the GIV for them for about 7 years (since the owners acquired the airplane in June 2007).

[NTSB AAR-15/03, ¶1.2.2]

• The SIC, age 61, who was seated in the right pilot seat, held an airline transport pilot certificate with a multiengine airplane rating and type ratings for the Gulfstream G-1159 (Gulfstream GII/GIII), Gulfstream GIV, Gulfstream GV, and Lockheed L-1329 (Jetstar/Jetstar II) airplanes.
• The SIC’s flight time logbook included entries current through March 23, 2014. His flight time totaled 18,530.4 hours, with 14,441.8 hours in multiengine airplanes.
• The SIC had worked for the owners of SK Travel for about 27 years and had been flying the GIV for them for about 7 years. Before the GIV, the SIC had flown a GIII, a Jetstar II, and a Jetstar for the owners.

[NTSB AAR-15/03, ¶1.2.3] According to the accident airplane’s flight logs, the airplane was flown 308.8 hours in 2013 and 150.2 hours in 2014 (not including the flight time on the day of the accident), and the two pilots had operated the airplane as a flight crew for 84.5% of the hours in 2013 (261.1 hours) and 100% of the hours in 2014. They had flown the airplane 53 hours in the 90 days before the accident, with 8.9 hours flown in the last 30 days. Their most recent flights in the airplane before the accident were on May 20, 2014, when they flew four flight legs, totaling 2.7 hours.

This is a recipe for complacency. When two pilots fly exclusively with each other they tend to learn to anticipate the other pilot's needs and things get done before they are called for. After a while they stop being called for. Pilots in this situation need to be extra vigilant against this type of complacency.

More about this: Complacency.

[NTSB AAR-15/03, ¶2.3]

• A troubling aspect of this accident is the flight crew’s pattern of noncompliance with an important step in the manufacturer’s After Starting Engines checklist—the flight control check—which appears to have been intentional. Because the flight crewmembers could not be interviewed, and because they had not recently flown with other pilots who could provide detailed insights into their motivations in this area, there is little hard evidence upon which to base an analysis of the reasons for the flight crew’s intentional noncompliance.
• However, the remarkable consistency of this flight crew’s omission of such checks (as indicated by QAR data) suggests shared crew attitudes about the necessity of the flight control check. Although it is unknown whether the crewmembers consciously omitted the performance of a flight control check during the accident flight, it is likely that they decided to skip the check at some point in the past and that doing so had become their accepted practice.
• When flight crewmembers perform a routine check repeatedly over a long period of time and never encounter an example of its effectiveness as a safety protection, they may experience a decreased perception of the check’s importance (Degani and Wiener 1990). As a result, they may begin to skip the check and reallocate their efforts toward other goals that they regard as more important. Such changes can lead to the development of new group norms about what is expected and an increasing mismatch between written guidance and actual operating practice. This increasing mismatch has been described as “procedural drift” (Dekker 2006).
• Smaller business operators with much smaller pilot workforces, such as the dedicated two-pilot crew involved in this accident, might face a much greater risk of procedural drift because their operating practices could more easily drift in parallel.

Large airlines, military squadrons, and very large civilian flight departments have a distinct advantage in the war against complacency: standardization and evaluation organizations. These so-called "black hats" can impartially look at the pilot force and squash complacency before it metastasizes. (Spreads, as with a cancer.) Smaller flight departments can do themselves a considerable favor by adopting a robust Line Operation Observation (LOO) Program.

Flawed Oversight

[NTSB AAR-15/03, ¶1.11] An initial audit, completed on July 29, 2010, found that SK Travel complied with the IS-BAO standards at the stage 1 level (basic SMS). A second audit, completed on May 10, 2012, found that SK Travel complied with the IS-BAO standards at the stage 2 level (demonstration of effective SMS). The report for the 2012 audit noted that flight operations were not observed because no flights were scheduled during the audit period. At the time of the accident, the SIC was reportedly preparing for a third audit of SK Travel.

There is a problem here. The NTSB fails to mention who the auditor was. There are "consultant/auditors" who will pretty much bring a lazy flight department from zero compliance to "on paper" compliance for the right price. We don't know if that is the case here because it was never examined. They missed an opportunity to fix what is clearly broken.

[NTSB AAR-15/03, ¶1.2.1] The PIC’s most recent training was a GIV pilot recurrent course completed on September 17, 2013, at the FlightSafety International Wilmington Learning Center, New Castle, Delaware.

[NTSB AAR-15/03, ¶1.2.2] The SIC’s most recent training was a GIV pilot recurrent course completed on September 20, 2013, at the FlightSafety International Savannah Learning Center, Savannah, Georgia.

There are two choices in the Gulfstream world for initial and recurrent training and FlightSafety is the best. Their competitor is considerably cheaper and is known for being a "type rating mill." Much has been made about the fact these pilots used the better training vendor. That choice aside, some instructors at FlightSafety are less stringent on procedural compliance of 14 CFR 91 crews than they are 14 CFR 135. Many FlightSafety instructors do not fully appreciate the risk involved with some checklist philosophies.

More about that below.

[NTSB AAR-15/03, ¶2.2] The chief pilot, who was responsible for ensuring compliance with the company SOPs, was one of the two flight crewmembers. The company did not have a flight data monitoring (FDM) program, and the pilots were not regularly surveilled for compliance with SOPs by outside qualified personnel.

Most 14 CFR 91 pilots count themselves lucky they do not have the every six- or twelve-month rituals of a 14 CFR 135.293, 297, and 299 evaluations. But they are missing the opportunity of an outsider's "heading check," to make sure everything is okay. The 14 CFR 61.58 these pilots get are hardly adequate. The training vendor relies on keeping their customers happy and they are wary of busting a paying customer. The system is broken. Small flight departments are well advised to adopt a Line Operation Observation (LOO) Program.

Checklist Discipline

[NTSB AAR-15/03, ¶2.2]

• According to the GIV AFM, five normal checklists should be accomplished by the flight crew before takeoff: the Before Starting Engines checklist, the Starting Engines checklist, the After Starting Engines checklist, the Taxi/Before Takeoff checklist, and the Lineup checklist. Although one of the pilots could have completed one or more of these checklists silently, the pilots did not discuss or call for any of these checklists, execute any of the checklist items using standard verbal callouts, or verbally acknowledge the completion of any of these checklists. As previously discussed, two of these checklists include an item that involved either confirming that the gust lock was off or performing another action that would have alerted the flight crew that the gust lock was not off; evidence indicates that the flight crew omitted performance of both items.
• For optimum benefit, normal checklist items should be verbally called out by flight crewmembers using a challenge-verification-response format (Degani and Wiener 1990). The monitoring pilot (the SIC in this case) would read a checklist item, the flight crew would verify that the check or action has been properly performed, and the flying pilot (the PIC in this case) would call out a response. When executed in this fashion, checklists can help a flight crew recall the steps for configuring the airplane, specify a logical sequence and distribution of workload, enhance mutual supervision (crosschecking), and support shared awareness of the airplane’s configuration. Due to these benefits, the challenge-verification-response method has become the industry standard, with many air carriers requiring flight crews to execute normal checklists in this manner. However, a pilot who had previously flown the GIV airplane with the PIC stated that the PIC had memorized the GIV checklists and that he did not normally ask for the checklists to be formally completed. This interview statement, the total lack of discussion of the checklists during the accident flight, and the routine omission of flight control checks during their last 175 flights indicate that the flight crewmembers did not routinely use the normal checklists or the optimal challenge-verification-response format. These behaviors likely resulted from a complacency that evolved over time because the two pilots flew the same airplane almost exclusively with each other over multiple years.
• Executing checklists by memory or without standardized verbal callouts removes many of their benefits and leaves a flight crew more susceptible to error. Thus, the flight crewmembers’ nonadherence to best practices for checklist execution made it more likely that they would commit an error of omission and that such an error would go undetected. The NTSB concludes that the flight crewmembers’ lack of adherence to industry best practices involving the execution of normal checklists eliminated the opportunity for them to recognize that the gust lock handle was in the ON position and delayed their detection of this error.

[NTSB AAR-15/03, ¶1.2.1] A contract pilot who had flown with the PIC two or three times several years before the accident characterized the PIC as a good pilot. He said that the PIC was very familiar with the airplane’s checklists and that he conducted a complete flight control check before each of their flights; however, he said that the PIC did not use a formal item-by-item checklist. The contract pilot reported that he was aware that, when the gust lock was not disengaged before starting the engines, some pilots occasionally used the FPSOV handle to momentarily remove hydraulic pressure from the flight controls, which allowed the gust lock to be disengaged without shutting down the engines. The contract pilot did not attribute these comments to a specific pilot or flight crew.

There is a false notion that the use of checklists in the 14 CFR 91 world is optional. There is another idea that a "flow" can be used so long as it is followed up by a checklist, the so-called "Do-Verify" method. That too is false for many checklists.

More about that: Checklist Philosophy.

[NTSB AAR-15/03, ¶3.1] The flight crewmembers’ lack of adherence to industry best practices involving the execution of normal checklists eliminated the opportunity for them to recognize that the gust lock handle was in the ON position and delayed their detection of this error.

[FAA Order 8900.1 Vol 3 Ch 32, ¶3-3403]

• Operators may choose from at least two accepted methods of checklist design: the “challenge-do-verify” (CDV) method and the “do-verify” (DV) method.
• “Challenge-Do-Verify.” The CDV method consists of a crewmember making a challenge before an action is initiated, taking the action, and then verifying that the action item has been accomplished. The CDV method is most effective when one crewmember issues the challenge and the second crewmember takes the action and responds to the first crewmember, verifying that the action was taken. This method requires that the checklist be accomplished methodically, one item at a time, in an unvarying sequence. The primary advantage of the CDV method is the deliberate and systematic manner in which each action item must be accomplished. The CDV method keeps all crewmembers involved (in the loop), provides for concurrence from a second crewmember before an action is taken, and provides positive confirmation that the action was accomplished. The disadvantages of the CDV method are that it is rigid and inflexible and that crewmembers cannot accomplish different tasks at the same time.
• “Do Verify.” The DV method (or “clean-up” method) consists of the checklist being accomplished in a variable sequence without a preliminary challenge. After all of the action items on the checklist have been completed, the checklist is then read again while each item is verified. The DV method allows the flightcrew to use flow patterns from memory to accomplish a series of actions quickly and efficiently. Each individual crewmember can work independently, which helps balance the workload between crewmembers. The DV method has a higher inherent risk of an item on the checklist being missed than does the CDV method.
• In the taxi and pretakeoff phases, aircraft configuration (such as flaps, trim, and speedbrakes) and flight guidance items (such as heading, flight director, altitude select panel settings, and airspeed bugs) have proven to be critical. All flightcrew members should confirm these items, and at least two crewmembers should respond to applicable checklist items.

There is a debate in many pilot communities as to the efficacy of a flow ("Do Verify") versus the classic challenge and response ("Challenge-Do-Verify"). FAA Order 8900.1 should end that debate when dealing with any items that "have proven to be critical." There is a lot more to this than "because the book says so."

See Checklist Philosophy.

Procedural Noncompliance

There appears to be a move to blame Gulfstream for this, saying none of it would happen had the gust lock managed to keep the throttles at idle. All of this ignores the fact that the procedures in place have prevented this from happening during millions of takeoffs.

Figure: GIV Engine Start and After Engine Start checklists, with highlighted items, from GIV Cockpit Card, extract.

[NTSB AAR-15/03, ¶2.1]

• The flight crew made a series of errors that culminated in the airplane overrunning the runway. Before starting to taxi, the crewmembers made two of these errors. First, they neglected to release and stow the gust lock handle as would normally be accomplished during the engine start process. Second, they neglected to perform a flight control check after the engines were started.
• Further, a review of QAR data revealed that the flight crewmembers had neglected to perform complete flight control checks before 98% of their previous 175 takeoffs in the airplane, indicating that this oversight was habitual and not an anomaly.
• The FDR recorded restricted motion of both the elevator and rudder throughout the taxi and attempted takeoff. This restricted motion indicates that the gust lock system was engaged because it is the only system on the airplane capable of restricting two independent flight control surfaces, and the restricted motion is consistent with the flight crew failing to disengage the gust lock system as called for in the Starting Engines checklist.
• Further, the flight crew had an opportunity to detect that the gust lock system was engaged by conducting a flight control check as called for in the After Starting Engines checklist, but the FDR data indicated that a flight control check was not done. Therefore, the NTSB concludes that the flight crew failed to disengage the gust lock system as called for in the Starting Engines checklist and failed to conduct a flight control check as called for in the After Starting Engines checklist, during which the crewmembers would have detected that the gust lock system was engaged. Further, the NTSB concludes that, given that the flight crew neglected to perform complete flight control checks before 98% of the crewmembers’ previous 175 takeoffs in the airplane, the flight crew’s omission of a flight control check before the accident takeoff indicates intentional, habitual noncompliance with standard operating procedures (SOP).

[NTSB AAR-15/03, ¶3.1] The flight crew failed to disengage the gust lock system as called for in the Starting Engines checklist and failed to conduct a flight control check as called for in the After Starting Engines checklist, during which the crewmembers would have detected that the gust lock system was engaged.

[NTSB AAR-15/03, ¶3.1] Given that the flight crew neglected to perform complete flight control checks before 98% of the crewmembers’ previous 175 takeoffs in the airplane, the flight crew’s omission of a flight control check before the accident takeoff indicates intentional, habitual noncompliance with standard operating procedures.

[NTSB AAR-15/03, ¶2.1]

• The PIC was likely aware of the throttle lever restriction because the interlock restricted the throttle levers to about 50% of the range of movement that the flight crew typically used. The PIC would not normally have encountered a restriction, and the restriction prevented him from smoothly setting takeoff power at an EPR of 1.7 before engaging the autothrottle, as the flight crew had consistently done on previous takeoffs. Despite encountering this abnormal throttle lever restriction, the PIC did not immediately call out the problem or call for a rejected takeoff before engaging the autothrottle.

The failure to abort at this point is inconceivable, especially considering the experience level of these pilots in type.

• It is unclear why the PIC engaged the autothrottle, as it would seem extremely imprudent to continue a takeoff after encountering a substantial restriction to throttle lever movement while setting takeoff power. The PIC did not likely understand the reason for the throttle lever restriction and attempted to force the levers forward with the help of the autothrottle. As a result of the autothrottle engagement, and possibly due, in part, to manual forces applied to the throttle levers, the lock pin in the gust lock handle was likely broken or compromised, allowing the throttle levers to move forward and the engines to attain an EPR value that approached the target setting. This increase in EPR may have contributed to the flight crewmembers’ confusion about the nature of the problem and given them some confidence that they could continue the takeoff and get airborne.
• As the EPRs were decreasing from their maximum values, the CVR recorded the first comment made by either pilot during the takeoff roll, which was the PIC’s comment, “couldn’t get (it manually any further).” This comment strongly suggests that the PIC was aware of the throttle lever restriction. However, the SIC did not verbally respond, and the CVR did not record any discussion between the flight crewmembers. The SIC’s failure to acknowledge the PIC’s statement about the restriction and the PIC’s continuation of the takeoff without any verbal acknowledgement from the SIC (or any clear resolution of the problem) are additional examples of ineffective communication that is inconsistent with best practices for CRM.
• As the airplane accelerated through an airspeed range of 60 to 80 kts during takeoff, the PIC did not check the elevator for freedom of movement or notice that the control yoke was not moving from the full forward position to the neutral position as a result of the restriction imposed by the gust lock. Although this check is not included in the Lineup checklist that was found in the cockpit, a note below the Lineup checklist in the AFM states that such a check should be performed. In addition, standard maneuvers and callouts in training materials that the flight crewmembers used during their recurrent training at FlightSafety International state, “by 80 knots, air loads will cause the yoke to move from full forward to the neutral position indicating that the elevator is free” and that “if this does not occur by 80 knots, the takeoff should be aborted.” A review of QAR data from the airplane’s previous 175 takeoffs revealed that the elevators always began to move toward neutral at an airspeed of 60 to 80 kts.
• The flight crew did not immediately initiate a rejected takeoff when the PIC attempted to rotate the airplane, discovered that he could not move the control yoke, and began calling out “(steer) lock is on.” At this point, the PIC clearly understood that the elevator was immobilized because the gust lock was engaged. The airplane performance study determined that, if the flight crew had initiated a rejected takeoff in accordance with the GIV AFM at the time of the PIC’s first “lock is on” comment or at any time up until about 11 seconds after this comment, the airplane could have been stopped on the paved surface. However, the flight crew delayed initiating a rejected takeoff for about 10 seconds, and a further delay of 4 seconds existed between brake application and power reduction; therefore, the rejected takeoff was not initiated until the accident was unavoidable.
• FDR data indicated that about 6 seconds after the PIC first called out “(steer) lock is on,” one of the pilots attempted to resolve the situation by operating the FPSOV handle. The use of the FPSOV is called for in the AFM emergency procedure for an immovable flight control. However, a GIV pilot indicated that he was aware that at least some GIV pilots used the FPSOV to relieve hydraulic pressure and allow the gust lock handle to be moved to the OFF position if it stopped in an intermediate position due to a hydraulic load on one of the gust lock hooks. Testing verified that this technique, although not approved by Gulfstream, is effective when the airplane is parked on the ground or taxiing at low speeds but would not likely be effective at takeoff speeds due to aerodynamic loading on the elevator.
• By the time that the FPSOV was activated, the airplane’s speed had increased to about 150 kts. According to a post accident analysis provided by Gulfstream, the hand force required to push the gust lock handle forward and disengage the elevator gust lock hook at 150 kts due to aerodynamic loading would have been about 189 lbs. A pilot would not likely have the physical strength to disengage the gust lock at such speeds.
• The post accident OFF position of the gust lock handle is consistent with one of the pilots unlatching the handle and attempting to push it down to the OFF position but being unable to do so because of aerodynamic loading of the elevator. With the handle in an intermediate position, as the airplane’s speed decreased, the aerodynamic load would have decreased, eventually allowing the return springs to pull the handle down to the OFF position.
• A pilot would not likely be aware of the difficulty involved in releasing the gust lock system at high speeds without having a very detailed, engineering-level understanding of the flight control system. Thus, the delay in initiating a rejected takeoff likely resulted, in part, from surprise but also from a knowledge-based mistake stemming from an incomplete mental model of the gust lock system. The NTSB concludes that, about the time that the airplane reached a speed of 150 kts, one of the pilots activated the FPSOV, likely in an attempt to unlock the flight controls, but this action was ineffective because high aerodynamic loads on the elevator were likely impeding gust lock hook release.

Even with an engineering level understanding of the system, a pilot is unlikely to realize the various interactions between systems and is well advised to keep this kind of "ad hoc airmanship" to a minimum.

Rejected Takeoff Procedures

[NTSB AAR-15/03, ¶1.10]

• Investigators from the NTSB, Gulfstream, and the FAA performed multiple rejected takeoffs in the GIV simulator to evaluate the effect of various pilot actions on the accelerate-stop distance of the airplane under the loading and environmental conditions of the accident. In particular, the investigators performed exercises to evaluate whether the airplane could be brought to rest on the runway or paved overrun area if the rejected takeoff procedure outlined in the GIV Operating Manual was applied shortly after the point at which the CVR recorded the first “lock is on” comment. The rejected takeoff procedure specified that the flying pilot (the PIC in this case) should take the following steps: (1) retard throttle levers to idle and apply maximum braking, (2) deploy spoilers, and (3) use reverse thrust if desired. In addition, exercises were performed to determine what effect spoiler deflection would have on the speed at which the airplane departed the runway and paved overrun area. (As previously mentioned, FDR data indicated that the spoilers did not deploy during the deceleration segment of the ground roll, consistent with activation of the FPSOV.)
• The exercises indicated that the airplane could have been stopped on the paved surface if the flight crew had rejected the takeoff at the time that the CVR recorded the first “lock is on” comment. The exercises also indicated that full deployment of the spoilers when the throttle levers were pulled back (14 seconds after the first “lock is on” comment) would not have significantly diminished the speed at which the airplane departed the runway but could have reduced the speed at which the airplane departed the paved overrun area by about 9 kts, corresponding to a 16% decrease in the airplane’s kinetic energy at that point.
• Calculations using the deceleration that the FDR recorded after the throttles were pulled back indicated that, if the rejected takeoff procedures outlined in the AFM (simultaneous braking and power reduction) had been applied as late as about 11 seconds after the first “lock is on” comment, the airplane could have been stopped on the paved surface, even without functioning spoilers.

[NTSB AAR-15/03, ¶3.1] The flight crew delayed initiating a rejected takeoff until the accident was unavoidable; this delay likely resulted from surprise, the unsuccessful attempt to resolve the problem through the use of the flight power shutoff valve, and ineffective communication.

[NTSB AAR-15/03, ¶3.1] About the time that the airplane reached a speed of 150 knots, one of the pilots activated the flight power shutoff valve, likely in an attempt to unlock the flight controls, but this action was ineffective because high aerodynamic loads on the elevator were likely impeding gust lock hook release.

[NTSB AAR-15/03, ¶3.2] The NTSB determines that the probable cause of this accident was the flight crewmembers’ failure to perform the flight control check before takeoff, their attempt to take off with the gust lock system engaged, and their delayed execution of a rejected takeoff after they became aware that the controls were locked. Contributing to the accident were the flight crew’s habitual noncompliance with checklists, Gulfstream Aerospace Corporation’s failure to ensure that the GIV gust lock/throttle lever interlock system would prevent an attempted takeoff with the gust lock engaged, and the Federal Aviation Administration’s failure to detect this inadequacy during the GIV’s certification.

Checklist Philosophy

Complacency

G450 Gust Lock

Line Operation Observations (LOOs)

Reliability Engineering: Murphy's Law

Safety > Comfort > Reliability

. . . and other Case Studies

FAA Order 8900.1 Vol 3 Ch 32, Manuals, Procedures, and Checklists for 14 CFR Parts 91K, 121, 125, and 135.

Gulfstream Aerospace Corporation Party Submission, Accident Involving Arizin Ventures LLC - SKC Travel LLC - Operated Aircraft N121JM, May 31, 2014, Laurence G. Hanscom Field, Bedford, Massachusetts, ERA14MA271, May 11, 2015

Gulfstream GIV Cockpit Card, 22 Dec 2000

NTSB Accident Docket, ERA14MA271

NTSB Aircraft Accident Report, AAR-15/03, Runway Overrun During Rejected Takeoff Gulfstream Aerospace Corporation GIV, N121JM, Bedford, Massachusetts, May 31, 2014