A year after a Spanish jetliner crashed and killed 154 people because the pilots failed to properly configure the plane’s flaps before takeoff, the U.S. National Transportation Safety Board (NTSB) is urging the Federal Aviation Administration (FAA), airlines to require new checklists and onboard safeguards to prevent similar accidents.
On August 20, 2008, a McDonnell Douglas MD-82 (EC-HFP) operating as Spanair Flight JK5022 crashed after takeoff from Runway 36 Left at Madrid Barajas International Airport, Madrid, Spain. The airplane impacted a field between the departure ends of runways 36L and 36R and was destroyed by impact forces and post-crash fire.
Of the 172 people onboard, 154 died, including six crewmembers; 18 passengers were seriously injured. The flight was destined for Las Palmas de Gran Canaria Airport in the Canary Islands.
An interim accident report by the Comision de Investigacion de Accidentes e Incidentes de Aviacion Civil (CIAIAC) of Spain indicates that the leading edge slats and trailing edge flaps were not extended during takeoff, reducing the airplane’s ability to achieve adequate aerodynamic lift.
The report also indicates that no takeoff warning system (TOWS) annunciations were recorded by the cockpit voice recorder (CVR) during the takeoff roll. The TOWS should have annunciated a clear and audible aural warning when the throttles were advanced to takeoff power while the trailing edge flaps were not extended in a takeoff position.
Before the attempted takeoff, the airplane had been delayed at the airport because of an abnormally high ram air temperature (RAT) as measured by the RAT probe.
Data from the flight data recorder (FDR) later confirmed that the measured RAT reached 104� C during the initial taxi to the runway for takeoff. The airplane returned to the parking stand to resolve the issue.
The excessive temperature measured by the probe indicated that the RAT probe heater was operating while the airplane was on the ground, even though the heater is designed to operate only when the airplane is airborne. Maintenance personnel pulled the RAT probe-heat circuit breaker, and the MD-82 returned to the runway.
When the MD-82 becomes airborne, the ground-sensing system, composed of several relays, enables or disables several systems. One of these relays, the R2-5, disables the TOWS and provides power to the RAT probe heater at takeoff. If the R2-5 relay fails, it places the TOWS in air mode and de-powers it. In this circumstance, a flight crew who started a takeoff roll in an airplane that was not properly configured would not receive an annunciated TOWS warning.
The NTSB noted that the CIAIAC is also investigating another incident similar to the Spanair accident.
On June 5, 2007, a Boeing MD-83 (EO-LMM) operated by MAP Jet as a charter flight, performed a takeoff without extended trailing edge flaps at Lanzarote Airport, Gran Canarie, Spain. According to the FDR data and pilot reports, the takeoff was performed without the proper takeoff configuration, and a TOWS warning was not annunciated to the flight crew during the event. The aircraft continued on its flight undamaged.
The NTSB addressed safety issues concerning the takeoff checklist and TOWS on an MD-82) after investigating an August 16, 1987, accident involving the same airplane model.
Northwest Airlines Flight 255 (N312RC) crashed shortly after taking off from Runway 3 Center at Detroit Metropolitan Wayne County Airport, Romulus, MI. Flight 255 was en route to Phoenix, AZ. Six flight crewmembers, 148 of the 149 passengers, and two people on the ground were killed. One passenger and one person on the ground were seriously injured.
The NTSB determined that the probable cause of the accident was the flight crew’s failure to use the taxi checklist to ensure that the flaps and slats were extended for takeoff. Contributing to the accident was the absence of electrical power to the airplane’s TOWS, which, thus, did not warn the flight crew that the airplane was not configured properly for takeoff. The reason for the absence of electrical power could not be determined.
As a result of the Northwest Flight 255 accident, McDonnell Douglas issued a telex to all DC-9-80 operators on September 1, 1987, recommending that the airplane checklist include a check of the TOWS before each flight. When the NTSB’s final accident report was issued on May 2, 1988, all U.S. operators had incorporated this change in their checklist.
However, the checklist associated with the August 2008 Spanair accident airplane did not reflect the McDonnell Douglas 1987 telex because, although the Spanair After Start checklist required a check of the TOWS before the first flight of the day, it allowed the check to be skipped on subsequent flights if at least one pilot remained onboard between flights.
Following the accident, the European Aviation Safety Agency (EASA) issued Airworthiness Directive (AD) 2008-0197 on October 29, 2008, for McDonnell Douglas DC-9, MD-88, MD-90, and B-717 series airplanes. The AD acknowledged that some operators’ checklists did not comply with the McDonnell Douglas telex and required operators to amend the procedures section of the affected airplane flight manuals to incorporate a mandatory check of the TOWS before the engine start for every flight.
On November 5, 2008, the Federal Aviation Administration (FAA) issued Safety Alert for Operators (SAFO) 08021, “Importance of Standard Operating Procedures (SOP) as Evidenced by a Take-off Configuration Hazard in Boeing DC-9 series, MD-80 series, MD-90, and B-717 Airplanes.” The SAFO referenced the 1987 McDonnell Douglas telex recommending a check of the TOWS before each flight and indicated that the hazard of misconfiguration of flaps and slats could be mitigated “in two distinct ways: 1) warning systems and 2) [SOPs].” The SAFO recommended that directors of operations, maintenance, safety, and training review procedures to ensure that maintenance and flight crew SOPs lead to the proper operation of TOWS and that personnel are effectively trained in approved SOPs for their aircraft.
“The NTSB agrees with the intent of the SAFO and the EASA AD; the operation and effectiveness of the TOWS depends on both maintenance and flight crew personnel adhering to SOPs and complying with the McDonnell Douglas telex. However, the NTSB is concerned that, because the telex was issued more than 20 years ago, some operators may be unaware of it and may have developed new checklists that do not include the TOWS check before every flight.
“The NTSB is also concerned that, like Spanair’s procedures, U.S. operators’ procedures may not require checking TOWS before every flight in all cases. Finally, SAFO 08021 is insufficient because operators are not required to implement its recommendations. Therefore, the NTSB recommends that the FAA require that operators of Boeing DC-9 series, MD-80 series, MD-90 series, and B-717 airplanes include items in their preflight checklists to verify that a check of the TOWS is accomplished before every flight, “the letter to the FAA continued.
In support of the CIAIAC accident investigation, the NTSB conducted a ground test of an MD-88 airplane at Ronald Reagan Washington National Airport, Washington, D.C. The test conditions attempted to replicate the possible conditions of the Spanair accident and MAP Jet incident by opening various circuit breakers and advancing the throttles while the leading edge slats and trailing edge flaps were not properly configured for takeoff.
Several significant findings were observed. First, with only the RAT-probe-heater circuit breaker open, the TOWS operated normally and provided a takeoff configuration warning. Second, with the R2-5 left-ground-sensing control relay circuit breaker open, no TOWS warning was annunciated during the test. Third, when the R2-5 relay wiring was disconnected from the power source, the TOWS did not annunciate a warning during the test.
When the R2-5 relay was disconnected from its power source, the relay’s condition and the status of the TOWS were not apparent to observers, even though investigators noted several non-normal indicators, such as a significant rise in the RAT, indicating that the RAT probe heater was active. Although these observations indicated an atypical situation, they, even in total, would not have presented a flight crew with a clear indication that the R2-5 relay was not functioning and that the TOWS was disabled.
“This condition may reflect what occurred in the August 2008 accident: the flight crew and maintenance personnel who performed troubleshooting on the airplane after it returned for maintenance did not associate the excessive RAT values with a possible faulty R2-5 relay and did not realize that, if the R2-5 relay was not functioning, the TOWS could be disabled.
“A working TOWS greatly affects safety because it alerts pilots to configuration errors that can lead to deadly accidents, and such errors are not uncommon. Since 1968, takeoff configuration errors have figured in 49 accidents worldwide resulting in 392 fatalities,” the Safety Board noted.
Stated the NTSB: “Numerous pilot reports to systems such as the National Aeronautics and Space Administration (NASA) Aviation Safety Reporting System indicate that even highly experienced airline pilots, with unblemished safety records, can fail to properly set and verify takeoff configuration, especially when their normal procedures have been interrupted. Yet, the TOWS on DC-9 series airplanes can be disabled by a single failure, the loss of the R2-5 relay.
“Although the TOWS for the DC-9 series airplane was designed as a nonessential system, an unannunciated loss of the TOWS could result in a critical risk to the flight. Because the certification standards for TOWS systems permit such a design, other airplane models might also possess, now or in the future, similar vulnerabilities.
The NTSB recommended that the FAA mandate a certification standard that will ensure either that 1) the TOWS cannot be disabled by a single failure or 2) if the system fails or has power removed while the airplane is operating on the ground, a discrete and clear annunciation of the loss of TOWS protection is provided to flight crews.
Because takeoff configuration tasks are subject to human/airplane interaction errors, the mitigation of those errors should be a part of the evaluation of aircraft for certification.
The NTSB has addressed the issue of human/airplane interaction and certification in the past. In a recent study of the certification process, for example, the NTSB issued Safety Recommendation A-06-37, which asked the FAA to amend the advisory materials associated with 14 CFR 25.1309 to include consideration of structural failures and human/airplane system interaction failures in the assessment of safety-critical systems.
“The recommendation is classified “Open–Acceptable Response” because the FAA indicated that it is incorporating more standardized consideration of human factors into new certification projects and that it plans to develop new regulations and advisory material, amend existing regulations and advisory material, and develop a formal human factors design guide,” said the NTSB.
The NTSB noted that takeoff configuration is safety critical and, thus, falls under the purview of Safety Recommendation A-06-37. “The NTSB concludes that although the FAA’s revisions to 14 CFR 25.1309 may address takeoff configuration errors, the criticality of the takeoff configuration makes it imperative that aircraft design be robust enough to minimize such human errors. Further, takeoff configuration errors involve failures of omission that may be difficult to predict at the time of initial certification.”
The NTSB recommended that the FAA assess the history of pilot errors related to takeoff configuration and identify needed mitigating design elements; the FAA should require inclusion of such design elements when determining current and future aircraft certifications.
The Safety Board believes that “checklists are a critical component of standardization and safe airplane operations. Effective checklist procedures and compliance are especially important during takeoff because failure to set flaps and slats can have fatal consequences and there are no obvious external cues in aircraft behavior to warn pilots that the flaps and slats are not set.
“The Spanair After Start checklist used at the time of the accident was inconsistent with these principles. The ‘Flaps and Slats’ item required a response of ‘set and checked’ rather than a more informative response like ‘5 degrees selected and indicated.’ Moreover, the item, although critical, was the ninth and last item on the checklist, and the checklist did not include a completion call item. In the Spanair accident, the last item of the After Start checklist was skipped because the captain asked the first officer to request taxi,” the rather detailed letter to the FAA continued.
“Recent research based on airline observations, event reports by pilots, and accident histories, has focused on the nature of flight crew task omissions in airline operations, such as the failure to set takeoff configuration. Researchers note that the pretakeoff phase of flight, when the configuration is set and verified, is often replete with interruptions, distractions, and unexpected task demands that can negatively affect the efficacy of even the best-designed checklists.
“Inadvertent omissions, when pilots forget to perform an intended task, typically occur when operational procedures are interrupted, not executed in their normal, practiced sequence, or pressured by unanticipated new task demands or concurrent task demands.
“The Spanair flight was subject to such interruptions and demands because the high RAT forced the pilots to delay departure and travel to the parking stand,” the Safety Board has concluded.
Researchers and expert pilots have proposed numerous mitigation strategies based on laboratory experimentation and observations of operational environments. Mitigations include pilot training on how to manage interruptions, procedures to redistribute workload away from the taxi period, a pre-departure configuration check that could include partially advancing throttles, and a periodic companywide updating of standard procedures based on pilot incident reporting. Further, some current generation aircraft employ computer procedures to effectively support pilots in preventing takeoff configuration errors.
These procedures include displayed electronic checklists in which items remain active until the computer confirms that the appropriate actions have been accomplished, regardless of delays caused by interruptions, and a pre-departure configuration check during which the computer simulates advancing power.
“The NTSB has long recognized the importance of examining operational procedures in addressing takeoff configuration errors and is encouraged by the recent efforts to develop guidance and mitigation strategies. The NTSB concludes that there would be safety benefits from better dissemination and industry consideration of best practices related to checklist design, training, and procedures,” the letter stated.
The NTSB recommended that the FAA convene a meeting of industry, research, and government authorities, including international representatives, to develop guidance on industry best practices in operational areas (including checklist design, training, and procedures) that relate to flight crews properly configuring airplanes for takeoff and landing.
Further, the NTSB recommended that the FAA require operators to modify their takeoff and landing checklists to reflect the best practices identified as a result of the meeting recommended in Safety Recommendation A-09-70.
Meanwhile, Spanair says it will replace eleven MD-82s and MD-87s with Airbus jetliners next year as it moves towards an all-Airbus fleet, says a Spanair spokesman. “Next year the leasing contracts on our MD-82 and MD-87s expire and we want to take the opportunity to bring in planes from Airbus,” the spokesman said.