“After liftoff, the wings of the airplane rolled to the left and right about 35 inches in each direction” before it struck the ground in a wipe out failed takeoff attempt. This description would seem to apply to the Spanair MD-82 crash 20 August 2008 at Madrid that killed 153 of the 172 people aboard. Actually, the words are from a report of a 1987 accident in Detroit, Michigan, of a DC-9, an earlier version of the MD-82, which killed all but one passenger.

And in June 2007 an Air Comet MD-83 experienced a stall on takeoff from Lanzarote the Canary Islands from which the pilots luckily recovered. This was reported by the Spanish Civil Aviation Accident and Incident Investigation Commission (CIAIAC), which found a system design flaw that played out with fatal consequences in the case of Spanair flight JK5022.

History repeats itself, despite reams of accident reports, special studies and other written analyses. The “lessons” plainly written in blood have failed utterly to be absorbed, indicating that the airline industry is incapable of learning from painful experience.

Actually, it was the airplane’s second takeoff attempt. The airplane had taxied out from the gate, but it had returned because of a malfunctioning heating element in the ram air temperature (RAT) sensor. The heater was then intentionally disabled by a mechanic before the second and tragic takeoff attempt. The operation of the de-icing element on the sensor has little direct impact on the airplane’s ability to fly. It’s there simply to stop the sensor from icing up in wintry conditions. However, it’s beginning to appear that the fix was simply to deactivate the heater, rather than examine possible causes for the overheating of the sensor’s heating element. If the pilot’s control yoke had been disconnected, the situation could not have been any more fraught.

If they had been familiar with the ground-air sensing circuitry and its interconnects, the mechanics may have investigated whether the L/H GND CTRL RLY circuit breaker (CB) had been pulled as part of a system check – and then been left out.

The CB resides innocuously behind the pilot, but it’s a potentially damning discrepancy for take-off success when its pulled to the OUT position. Unfortunately, mechanics on the flight line are under pressure and rarely have the time for in-depth trouble shooting; it’s often easier to deactivate a troublesome system, especially when that’s permitted under the MEL (Minimum Equipment List), which appears to be the chosen action in this case.

Mechanics routinely pull this CB while performing their daily check of wing-tip strobe lights. These lights only work once the aircraft is airborne, as they are too intense to be seen flashing in close proximity to the ground. This use of the CB as a switch has been standard procedure worldwide in the maintenance community for years on the MD-80 family.

This epicentric CB, though, does quite a few vital things. It puts the aircraft artificially in FLT mode, including placing the RAT probe’s sensor heating on and turning both the avionics cooling fan and the cabin recirculation fans off. This is reportedly easily spotted or heard if inside the cockpit when these systems are powered down – but not necessarily so if these noise-makers are already off (e.e., the CB is already pulled before pilots enter the cockpit).

Unfortunately, that one ground-air sensing CB, working through 15 relays on the nose wheel oleo, also kills off the take-off configuration warning system’s aural alarms (because effectively the aircraft has sensed that it’s already airborne once the CB is pulled).

The pilots’ problem with the RAT probe’s heater being in the airborne mode was that the heater was drawing full airborne current. It was overheating and causing a false high temperature input by the probe – and feeding that false temperature into the airplane’s central air data computer (CADC). The CADC provides ambient air data inputs to the engines’ thrust-determining computers, so an incorrect temperature input would result in an improper take-off power output. The ramifications of a single tripped CB can be seen to be widespread – which alone is a damning discrepancy. The setup was similar to the Air Florida B737 crash into the Potomac River shortly after takeoff in 1988. In that accident, the engine’s thrust measurement (EPR) was significantly over-reading due to an iced up sensor.

If Spanair flight JK5022’s pilots, in their haste, attempted takeoff with the wing’s leading-edge slats and/or trailing-edge flaps stowed, a central air warning system (CAWS) should have sounded an alarm, alerting them to the fact that the aircraft was not configured properly for takeoff. It never sounded, because the CB was pulled. Investigators found the flaps’ jackscrews and slats’ actuators in the wreckage – all retracted.

A very heavy jet taking off on a hot day with wind at its tail, not on its nose, would just be compounding the challenge of getting airborne. One can speculate that the Spanair flight crew may also have prematurely or over-enthusiastically rotated the aircraft, perhaps caused by a flawed airspeed indicator, an error in calculated takeoff weight, or a miscalculated rotation speed. However, without flaps and slats it was never going to fly, not with a full load. The Air Comet MD-83 crew in 2007 had the benefit of a post-rotation upslope, light weight, and more powerful engines. They were able to keep flying without slats and flaps. Not so the Spanair MD-82. The flight data and cockpit voice recorder (FDR/CVR) will be critical in filling in these details as Spanish investigators strive to piece together what happened.

If any one of a number of factors had been absent, the DC-9 flight likely would have been able to take off safely:

1. The aircrew did not extend the flaps and slats as was required in their “before takeoff” checklist.

2. The takeoff configuration warning alert, CAWS, was non-functional due to an unexplained loss of power (perhaps the same CB, but that could not be confirmed).

3. The flight was almost fully loaded and would require flaps and slats for a successful takeoff.

4. When the aircraft rotated, at the calculated speed, it failed to gain altitude, but the pilot continued to pull up, stalling the airflow over the wings.

5. As the wings began to stall, the aircraft “wobbled” laterally, rolling left and right, until the left wing struck a 42-foot tall light pole five feet from the top.

Now consider what would have broken the chain of accident causation:

1a. If the aircrew had remembered to extend the flaps and slats, the takeoff would have been perfectly normal.

2a. If the CAWS had been functional, it would have alerted the aircrew to the fact that the flaps and slats were not in the takeoff configuration when they advanced the power-levers.

3a. If the flight had been lightly loaded, it conceivably may have gotten airborne, even without flaps or slats extended. However, if the pilots were rotating into the normal (that is, steep) noise abatement climb attitude, even that scant possibility would have been remote.

4a. If the handling pilot had resisted the natural temptation to pull up, the aircraft would have still climbed, albeit slowly, and the light pole would have been cleared by some 80 feet.

5a. If the left wing had dipped just 4º less, it would have cleared the light pole by a couple of feet and the aircraft might have been able to continue its slow climb to safety.

Even without a CAWS warning, there are solutions. Cabin crew are trained to alert pilots to any ice build up on the wings before take off, so why not mention that the flaps are not extended? This could be included as an “awareness check,” rather than making it mandatory. A further back-up on some modern aircraft is that the ECL (electronic checklist) will not allow the takeoff checklist to progress to completion until the takeoff configuration is correct.  This excellent safety measure prevents misconfiguration should the flap/slat deployment have to be delayed in icing conditions, or the deployment is forgotten for any reason. Some operators will not permit the flight crews to commence taxi without the slats and flaps being selected first. Some airlines even have an FDR “event” marker triggered if this procedure is not followed. It is clear from these variable procedures that threat awareness across the industry is highly variable.

The parallels of the Northwest DC-9 accident to the Spanair MD-82 case are evident. When an aircraft’s wings are misconfigured for its weight and center of gravity (CG), runways become killing fields. Examples abound:

The crew of a Lion Airlines B737-200, trying to take off at Riau, Indonesia, in January 2002 forgot to extend the flaps or complete the takeoff checklist. Feeling the aircraft was unable to lift off, the pilot in command (PIC) aborted takeoff, lowered the nose, and the aircraft overran the runway, hit fences and come to a halt 900 feet off the runway tarmac. Examination of the aural warning CB showed that it would not stay engaged due to wear on the latching system.

The probable cause of a Delta Air Lines B727 crash in August 1988 at Dallas Ft. Worth was determined by the National Transportation Safety Board (NTSB) to be “(1) the captain and first officer’s inadequate discipline, which resulted in … takeoff without the wing flaps and slats properly configured; and (2) the failure of the takeoff configuration warning system to alert the crew that the airplane was not properly configured for the takeoff.” Fourteen died when the airplane rotated, rolled suddenly, and the right wingtip dug in. Rotating into a surprise stall on lift-off is about as conclusively terminal as you can get in aviation.

Here’s an incident that also may bear on the present case: in August 2006 a B717 (a.k.a, the MD-90 design, which is a continuation of the DC-9/MD-80 lineage) took off from Alice Springs, Australia, for a flight to Perth. The correct settings and techniques were applied by the flight crew for takeoff, but 31 feet above the runway the stall warning system activated. In response to activation of the stick shaker, the flight crew increased engine thrust and reduced pitch angle to successfully complete the takeoff.

The problem was traced to a faulty left wing slat sensor signal. The flight control computer was receiving a “slats not-extended” signal (erroneously) from the left wing and a “slats extended” signal from the right wing. The computer defaulted to the flaps extended/slats-retracted stick shaker angle of attack schedule.

And here’s another: in December 1997 involving a BAe146 on a flight from Cairns to Ayers Rock in Australia, in which the Bureau of Air Safety Investigation determined:

“Just before the aircraft reached 100 ft. AGL [Above Ground Level] after takeoff, the flaps had begun to retract. This was the position after takeoff when the call to retract the landing gear would have normally been made. Again, because of he conflicting recollections of the pilots, no positive conclusion could be drawn concerning a ‘gear up’ call and the actions of either pilot.

“On balance, however, given that the pilot in command was the pilot flying the aircraft, and that neither gear retraction nor flap retraction is performed by the flying pilot during normal operations, the likelihood rests that the co-pilot inadvertently selected the flaps up instead of the landing gear ….

“The effect of the early flap retraction had been to reduce the margin of safety of the aircraft during a critical stage of flight.”

Of interest, the latest Airbus aircraft (A320/A330/A340) indicate open CB’s on the lower ECAM (Electronic Caution Alert Module). These messages appear when the event occurs, or are otherwise hidden from the crew until the STATUS button is pushed during the cockpit check to inform the pilots of any massages regarding the status of the aircraft. These messages may be recalled at any time and reviewed.

Also, the air-ground sensing on the Airbus is substantially different than previous types and has no CB’s as such to “interrupt” sensing. It is instead controlled and monitored by two Landing Gear Control Interface Units (LGCIUs). These two computers alternate between 1 and 2 on each flight leg. They receive inputs from proximity and position detectors on the gear shock absorbers, gear doors, cargo door components and locking mechanisms, door sills, and flap attachments. In other words, it is not a single-point failure design such as one which only senses nose wheel oleo compression via a “squat switch” and multiple relays. Keep in mind, though, that the oleo design philosophy was sufficient at the time of its inception and that the Airbus state-of-the-art technology was developed long after.

There is a considerable body of literature about the problems of failing to set flaps or activating the flap lever instead of the landing gear handle. Premature retraction of its leading edge slats caused a BEA Trident to enter a superstall and crash at Staines Middlesex, UK, in June 1972, so the problem is as old as swept-wing jets. The lack of a salient annunciation was one factor behind such pilot mistakes, so, in the case of the Spanair crash, the possible lack of a CAWS annunciation as the plane taxied out to the runway for a second time bears examination. As one human factors study recounted, “(The) snowball effect of one error producing overload … undermines error-trapping and results in more errors.”

Nor should the power of distraction be underestimated. As a study of cockpit interruptions said:

“We find numerous and varied events that interrupt and generally distract pilots from their prescribed duties … Opportunities for errors increase dramatically as distractions continuously threaten to sidetrack even the most meticulous and experienced pilot.”

The fact that the plane was late for departure as a result of the maintenance delay, and the overall situation of chaos at Spanair, may have been sufficient to distract the crew. In a May 2007 e-mail to Spanair’s management, Sepla, the Spanish pilots’ union, complained that the airline’s day-to-day operations were “a disaster.”

In an April e-mail to Spanair management, the union said:

“The lack of resources and their quality on the ground, the repeated AOGs [grounded planes] in the fleet, the scarcity of crews and the system of movement of crew members mean that the general feeling is one of operational chaos that places passengers at risk.”

Against this unsettled background, the situation following return to the ramp certainly added to the pilots’ tension. If a ground/air sensor failed, or a circuit breaker was left open by a maintenance technician (i.e., the CAWS was deactivated), then none of these developments would be evident to hurried pilots.

At this point, it is useful to consider the 2007 incident in the Canary Islands involving the MD-83. After rotation, the flight crew experienced a stall and wing banks of up to 50º. The pilot managed to get the aircraft stable after selecting gear up. The crew then found their flap handle to be in the “up” position. How was this possible?

The Spanish investigators found a circuit breaker pulled when the aircraft had landed safely. The breaker was, once again, the deadly L/H GND CTRL RLY.

In performing their daily checks, maintenance technicians had pulled this circuit breaker to ensure that the wingtip strobe lights, which are disabled on the ground because they can damage people’s eyes, were functioning. But the CB does a few things. When pulled out, the aircraft is put partly in an artificial flight mode, and the RAT (ram air temperature) probe heating defaults to its airborne ON high current heating.

Going back to the accident aircraft, the pilots reported having problems with their RAT probe heating and came back to the ramp. The maintenance technician on duty disabled the item by pulling the CB. It’s no coincidence that if it is just the RAT probe that’s unserviceable, it is coincidentally controlled by the weight on wheels switch, and so its heating is turned on normally once the aircraft is airborne. The RAT probe is also activated when the infamous GND CTL RLY circuit breaker is pulled. With no aerodynamic cooling, the probe will soon go to an overheat condition and then fail because of incorrectly getting its full airborne current. The probe could have been left on for hours, depending on when the last daily ground technician checks were performed prior to flight.

As the saying goes, this was the Spanair pre-crash scenario “to a T.”

The pilots in the 2007 MD-83 incident also reported a thrust rating problem. This was hardly coincidental. The RAT probe is sensing the electric current-generated heat as outside air temperature and is controlling the thrust setting accordingly. If the probe heat is ON, the system will soon go to a reading of 100ºC (212ºF) and the thrust management system will think that is nonsense. The TRP (Thrust Rating Panel) will go to NO MODE without anybody understanding why.

The infamous L/H GND CTRL RLY circuit breaker also controls the take-off warning system on MD-80 aircraft. Thus, once the breaker is pulled, the takeoff warning system (CAWS) will not work. In which case, it is of course possible to take off without flaps and slats extended and no warning will be generated. This goes beyond being just a plausible scenario; it’s eminently repeatable due to poor system design.

Spanair was just one of those flights when it all went terribly wrong and resulted in the crash of an almost perfectly serviceable aircraft in good weather. But the crew probably didn’t know the pitfalls associated with pulling the circuit breaker – and wasn’t trained to avoid them.

What saved the MD-83 in 2007, compared to the Spanair MD-82, were the more powerful JT8D-219 engines, as compared to the -217 engines mounted on most MD-82s. The MD-83 also benefited from less weight on board and, fortuitously, some upslope keeping the aircraft in ground effect for a few moments – enough to permit some vital acceleration.

It is evident that any pilot in the left seat of the MD-80 series aircraft needs to religiously take a closer look behind his left shoulder to note if the L/H GND CTRL RLY circuit breaker is pushed in; the potential difference is between life and death. It is reported that this particular breaker may be pulled every single day on every single MD-80 operated around the globe, irrespective of regulator rhetoric that CBs are not to be used as switches. This being the case, there is a vital need for the pilots to double check whether the CB is in the “out” or “in” position.

Whatever did or did not happen inside the airplane, the airport environment was a contributing factor in the delayed response of Airport Rescue and Fire Fighting (ARFF) assets, according to William Mulcahy, editor of Aviation Fire Journal. In the September-October issue, he wrote:

“The recent Spanair MD-82 crash in Madrid reinforces the fact that on-airport accidents are most likely to occur during take-off or landing. This tragic event that took over 150 lives also illustrates the need to look carefully at your off-runway environment. I have learned that the parallel runways where the accident took place were separated by a wide and deep ravine that was full of heavy brush, trees and lacked access roads

“In addition, to complicate matters, the airport fire rescue service was hampered by a 4 kilometer fence surrounding both of these runways. These fences lacked ‘crash gates’ and forced responders to have to cut through the fences, slowing access to the crash site. The ensuing fuel-fed heavy vegetation fire, which covered over one square kilometer, also complicated the firefighting and rescue efforts considerably.”

To make things smooth, the ravine would have to be filled in. The ravine features a river, and a storm water drain would have to be installed, above which the ground would have to be filled in. That is but a portion of the work required, and the cost could run anywhere from $20-$70 million, depending on haulage, design, contract administration, and so forth.

It should also be pointed out that the airport meets ICAO (International Civil Aviation Organization) standards, and it could be argued that the airport meets the balance between risk and cost.

Contributing Editor John Sampson takes a different view:

“Risk and risk exposure are two very different considerations, in my humble opinion, when evaluating the cost/benefit versus the happenstance. The area between the two parallel runways, especially at around their midpoint, is a risk for landings and take-offs, and not just on one or two runways. In fact, its four distinct take-off directions if you consider both ends of each runway. Doesn’t that add up to eight times the evaluated risk exposure?

“Even if the landfill solution were side-stepped,  the soil could be excavated, spread, and a shallow lake could be emplaced that would be acceptable. If that ravine had been a lake, perhaps only an incapacitated few would have drowned, as opposed to the numbers who burnt to death.

“The midpoint ravine is a high hazard area – the MD-82 lies broken up there as mute testimony.”

Ironically, Madrid’s airport received the European Union’s first EMAS (Engineered Material Arresting System) installation in 2007, at the ends of both runways. But the Spanair accident was off to the side, and not the bitter end.

Clearly, the Spanish accident investigators have a good deal to consider. As a minimum, the pall of precedent hangs over the Spanair crash. After the DC-9 crash in Detroit 21 years ago, the U.S. National Transportation Safety Board (NTSB) concluded:

“The probable cause of the accident was the flight crew’s failure to use the taxi checklist to ensure that the flaps and slats were extended for takeoff. Contributing to the accident was the absence of electrical power to the airplane takeoff warning system, which thus did not warn the flight crew that the airplane was not configured properly for takeoff. The reason for the absence of electrical power could not be determined.”

But among its numerous recommendations, two stand out, as do the FAA responses:

 - NTSB recommendation A-88-64: Conduct a directed safety investigation to determine the reliability of circuit breakers and the mechanisms by which failures internal to the circuit breakers can disable operating systems and to identify appropriate corrective actions as necessary

FAA response: The last entry indicated that the FAA was “gathering data from both the airplane and circuit manufacturers to determine what, if any, action should be taken.” In other words, the “directed safety investigation” called for by the NTSB was not yet begun. It is apparent that the investigation was never conducted.

The NTSB characterized this recommendation CLOSED – ACCEPTABLE ALTERNATE ACTION (The nature of the alternate action is unclear.)

 - NTSB recommendation A-88-65: Require the modification of the DC-9 series airplanes to illuminate the existing central aural warning system (CAWS) fail light on the overhead annunciator panel in the event of CAWS input power loss.

FAA response: AD-90-04 was issued to require modification of the MD-80 to eliminate nuisance warnings of the takeoff warning system. Thus, the flight crews will not feel the temptation to deactivate the system.

The NTSB characterized this recommendation CLOSED – ACCEPTABLE ALTERNATE ACTION (The NTSB said, “While the FAA did not require the recommended modification to the DC-9 CAWS fail light circuit, the Safety Board accepts the actions taken by the FAA…” We should note that those actions are neither alternate nor in response to the stated problem.)

These two recommendations are highly relevant to the Spanair case. It is obvious that an inoperative CAWS constitutes a single point of catastrophic failure. There is a critical design deficiency here, when pulling the CB for one reason (strobe light test) leads to another consequence, the CAWS being rendered inoperative. Add in deficiencies in human factors training, and the potential for catastrophe is evident.

The belated report by the Spanish CIAIAC on the June 2007 MD-83 stall incident gives hope that the investigation and recommendations on the Spanair crash will be faster, if only to widely spread the word about this latent threat. One suspects that the Spanish could well issue the same recommendations as the NTSB, which were never acted upon.

What is also evident is that by not acting on recommendations coming out of the Detroit crash, the FAA is responsible for tolerating a known design flaw. The NTSB is culpable for characterizing the FAA’s inaction as acceptable. The fact that the design deficiency was revealed by loss of life spanning two decades makes the situation all the more unconscionable. The high death toll in the Spanair accident may at least serve to circumvent further derelict inaction.

(For the report of the 1987 crash, see http://amelia.db.eraw.edu/reports/ntsb/aar/ AAR88-05.pdf; for the 2009 stall warning event, see www.atsb.gov.au/ publications/investigation_reports/2006/AAIR/pdf/air200604439_001.pdf; for the 1997 event involving inadvertent retraction of flaps, see www.atsb.gov.au/

publications/investigation_reports/1997/AAIR/pdf/aair199704041_001.pdf; for papers on pilot-related human factors, see http://human-factors.arc.nasa.gov/

his/flightcognition/publications.html; for the 2007 stall incident in the Canary Islands, see the report at tinyurl.com/3udulw)