Locked into error

How did an experienced crew, flying a modern business jet with an impeccable safety record, make such a simple, yet deadly, mistake?

It began as a typical business jet trip. Two pilots and a flight attendant in a Gulfstream IV were to return the millionaire who owned the jet to Atlantic City, New Jersey, a 43-minute flight from Boston. The millionaire was a philanthropist who had spent the afternoon attending a fundraising event with friends, during which time the crew relaxed in the aircraft and ordered pizza. They were experienced and had flown together for 12 years logging about 300 hours each year. The only time another pilot ever flew the privately owned Gulfstream was when one of them was away on holiday.

Their final trip together never left the ground.

About 2140 US eastern daylight time, in what the US National Transportation Safety Board (NTSB) report described as night visual meteorological conditions, the Gulfstream IV ran off the end of the runway and into a ravine at about 100 knots. The two pilots, a flight attendant and four passengers were not killed outright, but died in the ensuing fire. ‘All seven occupants were found unrestrained and in positions consistent with movement within the airplane after the crash,’ the NTSB reported. Fire had made the Gulfstream’s over-wing exits and rear door unusable, but nobody on board was able to open the main door.

The flight data (FDR) and cockpit voice recorders (CVR) survived the flames and provided answers with surprising speed. What was most revealing were the words missing from the CVR. There was a brief discussion of taxiway navigation, a confirmation that a phone call had been made, and momentary consideration of a rudder limit warning, but none of the litanies and incantations of checklist use.

Instead, a few terse words revealed the immediate cause of the crash.

At 21.39.59 the pilot said, ‘Steer lock is on,’ a remark he repeated six more times in the remaining 20 seconds of the flight. Fourteen seconds later he said, ‘I can’t stop it’.

There was no other discussion of the situation and the only other words before the recording stops were one of the flight crew saying, ‘Oh no, no’ as the aircraft sped towards the ravine that would trap it. Fire broke out ‘almost instantaneously’, in the words of a witness.

Investigation of the wreckage found the gust lock handle was off, as it should have been, despite no indication in the cockpit recording of it being moved. Unusually, another handle was in the activated position. It was the flight power shut-off valve, which disables hydraulic power to the control surfaces. The gust lock system locks the flight control surfaces to prevent them being damaged by winds while the aircraft is parked. It is, to say the least, incompatible with controlled flight, and its disengagement is a prominent item on the checklist of any aircraft that uses one.

The Gulfstream IV has five normal checklists to be completed by the flight crew before take-off:

• ‘Before starting engines’ checklist.
• ‘Starting engines’ checklist.
• ‘After starting engines’ checklist.
• ‘Taxi/before take-off’ checklist.
• ‘The line-up’ checklist.

The NTSB said, ‘Although one of the pilots could have completed one or more of these checklists silently, the pilots did not discuss or call for any of these checklists, execute any of the checklist items using standard verbal callouts, or verbally acknowledge the completion of any of these checklists.’

The CVR did not record previous flights, but the aircraft’s quick access recorder, which also survived the crash, yielded a damning parameter. On only three of the aircraft’s previous 175 take-offs had there been a full stop-to-stop control check, as required by the checklist. This was a non-compliance rate of 98 per cent.

The investigation concluded that the pilots had been habitual ignorers of spoken checklists, with the senior pilot known to have memorised checklists. The crew either did not use checklists, or ran through them silently. Either way, they allowed too much opportunity for mistakes and omissions.

‘These behaviors likely resulted from a complacency that evolved over time because the two pilots flew the same airplane almost exclusively with each other over multiple years,’ the NTSB concluded, describing the phenomenon as ‘drift in parallel’.

No mechanism was in place for the company to detect this routine non-compliance. The chief pilot, whose job was to ensure compliance with the company’s exemplary written standard operating procedures (SOPs), was one of the two on the flight deck. The company did not have a flight data monitoring program, which by detecting the lack of control check movement, for example, could have pointed to a problem with SOPs. And the pilots were not regularly observed in flight by other qualified personnel.

None of this had prevented the company from successfully passing safety audits, including one from the International Business Aviation Council’s (IBAC) IS-BAO (International Standard for Business Aircraft Operations) program. The 2012 audit had verified proper checklist usage during one of the pilot’s annual proficiency checks in a simulator.

The gust lock and missed clues

The Gulfstream IV has an interlock in its gust lock system, intended to limit the operation of the throttles when the system is engaged, and thereby make take-off impossible. This should give the flight crew an unmistakable warning that the gust lock is on should the crew attempt to take off.

The interlock mechanism was intended to limit throttle lever movement to an angle of six degrees during operation with the gust lock on. However, testing on nine in-service Gulfstream IVs found throttle lever angles of up to 24.2 degrees were possible. Incorrect rigging could increase this to 26 degrees. The crashed aircraft, which had a damaged pin its gust lock handle mechanism, could achieve 27.5 degrees (out of a 58 degree normal range, or 22 degrees with an undamaged pin). This allowed the aircraft to accelerate to substantial speed, against the design’s intention, and against airworthiness regulations.

Early in the take-off run the pilot commented ‘couldn’t get it,’ which the NTSB took to be an expression of surprise at meeting the throttle lever restriction. He did not abort take-off but engaged the auto-throttle, which allowed the engines to deliver power close to the take-off setting. Speed was below 80 knots at this point.

This imperfect warning was the second indication that the gust lock had been left on. The first had been the rudder limit warning, most likely caused when an inadvertent touch of the pedal moved the rudder against the gust lock stop.

There was a third, admittedly subtle, clue that the crew did not spot. At rest, the Gulfstream’s yokes lean forward in each cockpit, but according to the handling notes used by the crew in their most recent training ‘by 80 knots, air loads will cause the yoke to move from full forward to the neutral position indicating that the elevator is free. If this does not occur by 80 knots, the takeoff should be aborted.’

Instead it appears likely that the crew tried to work around the problem. Investigators spoke to one of the pilots who flew the aircraft to cover for crew holidays. The relief pilot named no names, but told of a practice used when the gust lock was not disengaged before starting the engines. Some pilots would use the flight power shut-off handle to relieve hydraulic pressure momentarily on the flight controls. This allowed the gust lock to be removed without shutting down the engines.

This is what the NTSB concluded had happened, based on non-activation of the spoilers, and deactivation of the hydraulic yaw damper. Its testing found the work-around to be effective when the aircraft was parked or taxiing at low speed, but unlikely to be effective at take-off speeds due to aerodynamic loading on the elevator. Under these conditions the gust lock handle would go to an intermediate position with the gust lock hooks remaining engaged. When the load was removed, the gust lock handle sprang to the off position. To perceive this limitation would require an ‘engineering-level understanding of the flight control system,’ the NTSB said.

The investigation noted ‘missteps during the emergency response (involving water resupply procedures, firefighter knowledge of the airport and Gulfstream IV main entry door operation procedures)’ but said the outcome would likely have been the same had these not occurred.

A design that failed to do its task had met a crew that failed to do theirs. They made an omission, as all human beings do sooner or later, because they were relying on skill instead of procedure. They also missed several warnings, although two of these—the rudder light and the yoke—are undoubtedly much clearer in hindsight. It’s more difficult to explain away ignoring a jammed throttle. Then when the problem became clear, they tried to work around it instead of stopping, which the investigation found they would have been able to do, even after waiting another 11 seconds from the first call of ‘steer lock is on’.

NTSB board member, Robert Sumwalt, added an appendix with a bitter, but true, remark. ‘You can fool the auditors, but never fool yourself.’

NTSB animation