Everyone involved with aviation knows checklists. They are the cornerstone of aviation safety, meant to protect against the ever increasing complexity of aircraft and the limited attention span of the average human. They follow a pattern: a B-32 checklist from 1943 is similar in concept and design to a modern airliner checklist.

It would be nice to believe that every pilot understands the importance of checklists and why we rely on them instead of own own fallible memories, especially in times of stress.

But every so often, a flight crew decides that they don’t need to follow the checklists, that they know it all, that it is just a waste of time.

This fatal accident is the result of one such crew.

It happened at Hanscom Field southwest of Bedford, Massachusetts on the 31st of May in 2014. Hanscom is primarily a general aviation airport. The primary runway is 11/29 is 2,137 metres (7,011 feet) of asphalt with a 0.1% gradient.

At the end of runway 11, there is a paved overrun area which forms a clear area beyond the runway (the runway safety area or RSA). At the end of this, there’s a flat grassy area leading to the chain-link fence which marks the airport perimeter. On the other side of the fence is a ravine containing the Shawsheen River.

The total usable flat land in an emergency is 2,680 metres or 8,780 feet.

The accident aircraft was N121JM, a fourteen-year-old Gulfstream Aeropace Corporation G-IV.

The Gulfsteam IV’s take-off distance is 1,707 metres (5,600 feet) at sea-level. Hanscom Field is 132 feet above mean sea level.

The operator was SK Travel. They only operated the one aircraft and they employed three people: two pilots and one flight attendant. One of the two pilots was also the chief pilot and director of maintenance for SK travel. When one of the two pilots was not available, contract pilots were used. This happened most recently in May 2013, over a year before the accident.

The SK Travel Flight Operations Manual stated that all pilots must complete all checklists during flight operations; a standard requirement. The company did not have a flight data monitoring program. The pilots were not regularly assessed by outside personnel for compliance with standard operating procedures. The chief pilot, who is responsible for ensuring that flight crew comply with the company’s policies, was one of only two flight crew working for the company and he was the Pilot Monitoring on the accident flight.

NTSB Board Member Statement, included in the final report:

To all outward appearances, SK Travel had the hallmarks of a well-run flight department. They were operating a top-of-the-line business jet. They had long-time employment stability – something not often found with small aviation departments. They did their training at FlightSafety International instead of just trying to do it “on the cheap.” The chief pilot was described as being very meticulous about the airplane’s maintenance. They had undergone two voluntary industry audits and were preparing for their third audit, in itself a remarkable feat.

That day, the Gulfstream-IV departed from New Castle Airport in Wilmington, Delaware at 13:25. It had an uneventful flight to Atlantic City to pick up passengers and delivered them to Hanscom Field at 15:44. The passengers were attending a charitable event in Bedford. The crew remained with the aircraft parked at the ramp, ready to take the passengers back to Atlantic City after the event. They did not request any maintenance or fuel services.

It was 21:28 when the passengers arrived back at Hanscom Field and boarded the aircraft. The engine start is recorded at 21:30.

At 21:31:45 the flap position changed from 0° to 20°. At 21:33, the aircraft began its taxi to runway 11. The pilots discussed the taxi route and clearances as they made their way to the holding point. The Pilot Monitoring confirmed that they were cleared to take-off right turn heading two five zero.

Already cleared for take-off, they turned directly onto the runway at 21:39:20.

Now it may not be immediately obvious what’s wrong here, but from getting the passengers on board to turning onto the runway, the total elapsed time is eleven minutes.

The Gulfstream IV airplane flight manual includes five checklists to be completed before take-off: the Before Starting Engines checklist, the Starting Engines checklist, the After Starting Engines checklist, the Taxi/Before Takeoff checklist, and the Lineup checklist.

Even if we presume the pilots did a walk-around before the passengers got there, there wasn’t enough time to go through the After Starting Engines checklist in the three minutes before they started taxiing. Those checks include making sure that the brakes are working and that all the controls were free and correct.

The Cockpit Voice Recorder has not record of any conversation at all to do with checklists.

Because they skipped the checklists, they did not notice that the gust lock system was still engaged.

The gust lock system is a mechanical system which locks the aileron, rudder and elevators into place in order to protect against gusting winds when the aircraft is parked.

The aircraft cannot fly when the gust lock system is engaged.

The certification standard requires that, if the gust lock system prevents normal operation of the control surfaces by the pilot, it must either automatically disengage when the pilot operates the primary flight controls or limit the operation of the aircraft so that the pilot receives an unmistakable warning at the start of the take-off.

An unmistakeable warning is described as a warning which physically limits the operation of the aircraft in order to prevent an unsafe take-off.

When engaged, the Gulfstream-IV gust lock system restricts the operation of pilot controls (yoke, column, rudder pedals) and limits the operation of the throttle levers. The gust lock handle is painted red and when the system is engaged, the lever is “prominently adjacent” to the flap handle, so that the pilot’s hand will make physical contact with the handle when selecting the flap position.

These features are meant to limit the operation of the aircraft and provide an unmistakable warning to the crew.

According to the certification, the throttle levers are limited to 6° if the gust lock mechanism is engaged. However, this was approved based on review of the drawings of the design and specification requirements and was not tested on the final product.

Gulfstream reported to the NTSB that post-accident analysis and testing “verified that the current detailed pedestal design does not meet the 6° throttle interlock specification requirement.” In fact, it was found that the forward throttle lever movement was in fact three to four times greater and that, if the throttles were left at the maximum allowed by the interlock, the aircraft still achieved take-off speed, although it was about seven seconds later and about 350 metres (1,200 feet) farther down the runway than it would have.

The NTSB concludes that the FAA missed opportunities to detect the inadequate design of the gust lock system during the G-IV’s certification because the FAA relied solely on a review of engineering drawings to determine if the system met certification requirements. The NTSB further concludes that Gulfstream’s use of a G-IV drawing review alone to show compliance with 14 CFR 25.679 led to a gust lock/throttle interlock system that did not comply with the regulation. Had verification testing or analysis been performed, Gulfstream would have identified that the gust lock/throttle interlock system allowed throttle lever movement well beyond 6° when the gust lock handle was in the ON position.

As the aircraft turned onto the runway, the yaw damper or the rudder pedal moved the rudder control surface where it hit the restriction of the gust lock mechanism. This illuminated a warning on the control panel.

Pilot Flying	It says rudder limit light is on.
Pilot Monitoring	What’s that?
Pilot Flying	The rudder limit light is on.
Pilot Monitoring	Are you using your rudders?
Pilot Flying	No. [unintelligible]
Pilot Monitoring	Huh.

Then, they increased the power for the ground roll.

Normally, the pilot would advance the throttle levers to an angle of around 30° which would give them an engine power ratio (EPR) of about 1.7 for the take-off roll before engaging the auto-throttle.

Because the gust lock system was engaged, the throttle lever was restricted to about 50% of the normal range of movement. The levers stopped at 17.5°, achieving an engine power ratio of about 1.42, where it remained for about five seconds.

Here’s the conversation in the cockpit as they continued. Words in brackets are not clear on the recording but are the investigator’s best guess. The call-outs took place over a period of about eight seconds.

Pilot Flying	Couldn’t get (it manually any further).
Pilot Monitoring	Eighty.
Pilot Monitoring	V-1.
Pilot Monitoring	Rotate.

This would normally be a good time to abort the take-off as the Pilot Monitoring appears clear that he couldn’t get the throttles further forward.

The Pilot Flying never checked the elevator for freedom of movement (tip: it had none). He did not notice that the control yoke, which would normally shift position from the air loads, was held firmly in place by the gust lock mechanism.

Instead, the Pilot Flying engaged the autothrottle. It’s unclear what he was thinking but the report theorises that, based on his comment, the Pilot Flying understood that the throttle lever was restricted; however he had no idea why and believed that he could force the levers forward with the help of the autothrottle.

As a result, investigators believe that the lock pin in the gust lock handle broke at this point. Certainly, the throttle levers suddenly moved forward again, allowing the engines to reach something close to the engine power ratio of 1.7 required for take-off. The problem had not been resolved and the gust lock system was still engaged, yet the Gulfstream IV continued to barrel down the runway.

The Pilot Monitoring did not acknowledge the issue at all. V-1 is the take-off decision speed, the point at which the pilots should decide whether to continue or abort the take-off. Rotate is the the instruction to apply back pressure to the controls to lift the nose wheel off the ground as take-off speed has been reached.

When the Pilot Flying attempted to rotate, he discovered that he couldn’t move the control yoke. He finally grasped what was wrong and called out that the lock was on.

Again, you might that this would be a good time to abort the take-off.

If this were a simple case of not following the checklist, this article would end right here. Having realised that the aircraft was in no state to fly, the flight crew could have stopped the aircraft and dealt with the problem.

The flight crew didn’t.

Pilot Flying	(Steer) lock is on.
Pilot Flying	(Steer) lock is on.
Pilot Flying	(Steer) lock is on.
Pilot Flying	(Steer) lock is on.
Cockpit Area Microphone	[sounds similar to thump and squeak]
Pilot Flying	(Steer) lock is on.
Pilot Flying	(Steer) lock is on.
Pilot Flying	(Steer) lock is on.

The Pilot Monitoring did not acknowledge.

One of the pilots, or possibly both, attempted to disengage the gust lock as they continued the take-off roll.

They activated the flight power shutoff valve. Activating the flight power shutoff valve removes hydraulic pressure from the actuators for the spoilers and the primary flight controls. This is intended for the event of a flight control actuator malfunction. The ailerons, elevator and rudder revert to manual operation when the flight power shutoff valve is activated.

A Gulfstream IV pilot interviewed by investigators said that relieving the hydraulic pressure by using the flight power shutoff valve could allow the gust lock handle to be moved to the OFF position if it had stopped in an intermediate position as a result of a hydraulic load on one of the gust lock hooks. That is, if the gust lock system did not fully disengage, activating the flight power shutoff valve could help to get it into position.

This usage is not approved by Gulfstream; however testing showed that, if the aircraft was parked or taxi-ing at low speed, it could allow the gust lock handle to be moved if stuck.

But by the time they’d activated the flight power shutoff valve, the Gulfstream was going about 150 knots. Even if the action had relieved the hydraulic pressure, the hand force required to push the handle forward and disengage the elevator gust lock hook at 150 knots would be about 189 pounds. It appears that one of the pilots attempted to push the handle to the OFF position but he would not have had the physical strength to disengage the gust lock in this way.

Human factors research shows that a flight crew confronted with a sudden abnormal event will have a delayed response. Reaction times of 8 to 10 seconds may not be unusual. But the problem here was that the reaction was wrong.

If they had aborted their take-off when the Pilot Flying first announced that the lock was on, they would have come to a complete and safe stop still on the runway. Instead of rejecting the take-off, the flight crew appear to have concluded that whatever was wrong, they could fix it quickly during the take-off roll and still get away on time.

The attempt to disengage the lock by operating the flight power shutoff valve took place six seconds after the Pilot Flying first called out that the lock was on.

If they’d initiated the rejected take-off six seconds after that call-out, instead of engaging the flight power shutoff valve, the aircraft still could have been stopped safely. The simulation showed that if they rejected the take off as late as 11 seconds after the call-out, the aircraft still would have stopped on the paved surface.

Ten seconds after the Pilot Flying realised that the lock was on, the flight data recorded the left and right brake pressures beginning to rise. Here was the decision to abort the take-off. But there was no verbal communication between the pilots. The decision was made too late and the reaction times too slow. It was a full four seconds later that the throttle levers were pulled back.

Because the flight power shutoff valve was activated, the ground spoilers did not automatically deploy.

Fifteen seconds after his first announcement that the locks were engaged, four seconds after his final chance to abort the take-off safely, the Pilot Flying said, “I can’t stop it.” He was right.

His last words were “Oh no. No.” as the aircraft broke through the perimeter fence.

The skid marks from the brakes started 425 metres (1,400 feet) from the end of the runway and continued a total of 730 metres (2,400 feet) to the end of the paved overrun area.

Here, the ground sloped down slightly to a small service road.The three wheels dug into the grass just after the road and the nose gear assembly was found at the end of a rut about 25 metres (85 feet) long. Three approach light structures and the localizer antenna were knocked down and broken. The ruts from the main gear continued on. The airport’s chain-link perimeter fence was knocked down and the tail of the Gulfstream IV came to rest on the airport side of the ravine. The engines, wings and fuselage were in the ravine with the cockpit on the far side.

A fire erupted immediately. The Hanscom Air Force Base Fire Department was notified just 9 seconds after the Pilot Flying said “I can’t stop it,” as it became clear to controllers that the aircraft was going to overrun. The first vehicle left the station within a minute and a half of the alert and reported smoke in the air and visible fire near the end of runway 11. A minute later, the first firefighting vehicle reached the scene and another three departed the fire station. The aircraft was engulfed in flames and the ravine shielded the fire. They did not know how to get across and the airport grid map did not show the location of the perimeter gate needed to access the east side of the ravine. It was an hour and 47 minutes before they were able to control the fire and attempt to gain entry to the Gulfstream. It was much too late.

The initial fire blocked access to the overwing emergency exit windows and the baggage compartment door, leaving only the main entry door useable. The Pilot Flying was kneeling in his seat, facing his open oxygen mask compartment with the mask lying on the floor in front of his seat. The Pilot Monitoring was sitting in his seat facing inboard, with one foot on the floor and the other on the centre console. One passenger was kneeling near the main entry door, another lying in the aisle between the cabin and the main entry door. All of the passengers had removed their seatbelts and were in the process of moving away from their seats.

From this, we know that they survived the initial impact; however the fire burnt so fast and furiously that they were not able to make it to the exit of the aircraft. Cause of death for six of the seven occupants was smoke inhalation and thermal injuries.

Investigators determined that even if the fire fighting crew had been able to get to both sides of the ravine immediately and more quickly gain control of the fire, it would have been too late.

A pilot friend once told me that, having flown the aircraft once that day, I didn’t need to worry about the full pre-flight checklist, as I already knew the plane was in good working order. I find that attitude shocking enough, but it wouldn’t have surprised me if that’s what had happened in this instance.

What the NTSB found here was much worse.

The Gulfstream IV’s quick access recorder had 303 hours of data stored on a removable compact flash card. This data included 176 take-offs, including the accident take-off.

The NTSB reviewed the data looking for evidence of a complete or partial control check before take-off, that is, stop-to-stop motions of the elevators, ailerons and rudder to show that the three primary flight controls were free and correct.

In all 176 recorded take-off events, the NTSB only found two complete control checks, and sixteen partials. The most recent partial control check (stop-to-stop movement of the elevators and ailerons but not the rudder) was performed 12 flights before the accident.

3.2 Probable Cause

The NTSB determines that the probable cause of this accident was the flight crewmembers’ failure to perform the flight control check before takeoff, their attempt to take off with the gust lock system engaged, and their delayed execution of a rejected takeoff after they became aware that the controls were locked.

Contributing to the accident were the flight crew’s habitual noncompliance with checklists, Gulfstream Aerospace Corporation’s failure to ensure that the G-IV gust lock/throttle lever interlock system would prevent an attempted takeoff with the gust lock engaged, and the Federal Aviation Administration’s failure to detect this inadequacy during the G-IV’s certification.

I feel like I should investigate the concept of habitual noncompliance in more detail but, in the end, the only thing that I can formulate with any coherence is, what an utterly, utterly stupid way to die.

The full accident report is available at http://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1503.pdf