National Aeronautics and Space Administration

No Guarantees

The Gulfstream G650 Test Crash

April 2, 2011, 9:34 a.m. mountain daylight time (MDT), Roswell International Air Center, Roswell, New Mexico: An experimental Gulfstream Aerospace Corporation GVI (G650), N652GD, took off on a planned one-engine-inoperative (idle) (OEI), heavy take-off weight test flight. Test scheduling had been aggressive in order for Gulfstream to obtain Federal Aviation Administration (FAA) type certification for the G650 by the third fiscal quarter of 2011. During the takeoff, the G650 crashed and the four crewmembers aboard died.

Background

The Gulfstream G650

The Gulfstream G650 is a swept-wing airplane with a fly-by-wire flight control system and is powered by two Rolls-Royce BR700-725A1-12 high-bypass-ratio turbofan engines. The G650 specifically involved in the incident was one of five operating under a special experimental airworthiness certificate for conducting research and development and showing compliance with federal regulations.

Test Parameters

Gulfstream was performing field performance validation to gather supporting data for Federal Aviation Administration (FAA) type certification of the G650 under 14 CFR Part 25, “Airworthiness Standards for Transportation Category Airplanes.” A type certificate is issued to indicate an aircraft is manufactured according to an approved design that ensures compliance with airworthiness requirements. The tests, which began in October 2010, were also used to develop takeoff and landing speed schedules and distances for the G650 flight manual.

Gulfstream was designing an angle-of-attack (AOA) limiter function as the primary stall protection system in the G650 (versus a traditional stick pusher). However, the AOA limiter software was not completed yet, so Gulfstream disabled the function during the takeoff performance tests. With this arrangement, the test pilots would receive tactile warning of an impending stall from the stick shaker and visual indication on the pitch limit indicator (PLI).

What Happened

Gulfstream maintained an aggressive schedule for G650 testing. However, the aircraft was not meeting a key design requirement: achieve minimum safe takeoff speed with one engine inoperative using 6,000 feet of runway, plus or minus eight percent. The right outboard wing had stalled and caused the aircraft to roll during takeoff tests twice before — one month and five months — prior to April 2, 2011 and Gulfstream opted to develop a takeoff technique to meet the requirement instead of investigating stall causes.

During a briefing before the day of the accident, one of the flight test engineers indicated that the target pitch attitude for continued takeoff tests with the flaps set to 10 degrees would be reduced to 9 degrees. He also indicated that they should discontinue a test if pitch reached 11 degrees during the initial takeoff and then decrease pitch and add engine power. The engineer made the change in target pitch to be consistent with takeoff test procedure with flaps set to 20 degrees, and to ensure that the AOA would remain below the range at which two previous uncommanded roll events had occurred.

NoGuarantees-1

Figure 1. The wreckage of the Gulfstream G650 involved in the incident. Source: NTSB

On April 2, during the twelfth takeoff of the day, the pilot abruptly raised the aircraft’s nose 11.2 degrees — 2.2 degrees past the target pitch angle of 9 degrees — while using the modified piloting technique. The right outboard wing stalled and the aircraft rolled right. The right wingtip struck the runway and the aircraft departed the runway to the right. It then struck a concrete structure and airport weather station. The aircraft crashed 8,404 feet from the runway and the ensuing fire consumed the fuselage and cabin interior. The two pilots and two flight test engineers aboard the flight survived the initial impact, but died in the postcrash fire.

Proximate Cause

The NTSB determined that the probable cause of this accident was an aerodynamic stall and subsequent uncommanded roll during an OEI takeoff flight test.

Underlying Issues

During their investigation, the NTSB determined that multiple issues contributed to the stall and crash.

Improper Validation

During field performance testing before the accident, Gulfstream was validating V-speeds — various important airspeeds for operation of aircraft. V refers to “Vitesse,” which is French for ‘speed’ or ‘rate.’

The G650 consistently exceeded target V2 takeoff safety speeds — or the speed that an airplane attains at or before a height of 35 feet Above Ground Level (AGL) with one engine inoperative. Gulfstream needed to resolve these V2 exceedances because achieving the planned V2 speeds was necessary to maintain the airplane’s 6,000-foot takeoff performance guarantee. Otherwise, the airplane could only operate on longer runways.

However, the flight test data analysis was performed by a single Gulfstream flight test engineer and not a proper discipline engineer, even though the company had published a flight testing handbook that recommended data analysis be done by discipline engineers who were better qualified to interpret the data. The method for developing G650 takeoff speeds was flawed and resulted in V2 speeds that were too low and takeoff distances that were longer than anticipated. In short, the G650 could not create enough lift with the low V2 speed.

NoGuarantees-2

Figure 2. V1 indicates the speed beyond which the takeoff should no longer be aborted. VR indicates the speed at which the pilot begins to apply control inputs to cause the aircraft nose to pitch up, after which it will leave the ground. VLOF indicates lift-off speed. V2 indicates takeoff safety speed — the speed at which the aircraft may safely be climbed with one engine inoperative. One engine of the G650 was stalled in order to validate the V2 speed. Source: NASA

This issue was compounded when Gulfstream failed to recognize and correct the V2 error during previous G650 flight tests. Rather than determining the root cause for the V2 exceedance problem, Gulfstream attempted to reduce the V2 speeds and the takeoff distances by modifying the piloting technique used to rotate the airplane for takeoff. Further, Gulfstream did not validate the speeds using a simulation or physics-based dynamic analysis before or during field performance testing. If the company had done so, then it could have recognized that the target V2 speeds could not be achieved even with the modified piloting technique. In addition, the difficulties in achieving the target V2 speeds were exacerbated in late March 2011 when the company reduced the target pitch angle for some takeoff tests without an accompanying increase in the takeoff speeds.

The NTSB also examined the role of “ground effect” on the airplane’s performance. Ground effect refers to changes in the airflow over the airplane resulting from the proximity of the airplane to the ground. Ground effect results in increased lift and reduced drag at a given angle of attack (AOA) as well as a reduction in the stall AOA. In preparing for the G650 field performance flight tests, Gulfstream considered ground effect when predicting the airplane’s takeoff performance capability but overestimated the in-ground-effect stall AOA. Consequently, the airplane’s AOA threshold for stick shaker (stall warning) activation and the corresponding pitch limit indicator (on the primary flight display) were set too high, and the flight crew received no tactile or visual warning before the actual stall occurred.

NoGuarantees-3

Figure 3. Aircraft lift versus angle of attack in and out of ground effect. Source: NTSB

As pitch angle and AOA were increasing through 11.2 degrees, large aerodynamic rolling and yawing moments to the right were acting on the airplane. These aerodynamic moments were indicators of an asymmetric stall of the airplane. Before the accident, Gulfstream estimated that the in-ground-effect stall AOA would be 13.1 degrees and set the AOA threshold for the activation of the stick shaker stall warning at 12.3 degrees.

OEI continued takeoff flight tests were considered by Gulfstream to be high risk because of the potential hazards and possible outcomes associated with the tests. Gulfstream prepared a test safety hazard analysis (TSHA) for all tests determined to be medium or high risk. The TSHA for OEI continued takeoff field performance tests indicated that, although the tests were high risk, the hazards associated with the tests (“aircraft departs runway/inadvertent ground contact”) had a low probability of occurrence. The OEI continued takeoff TSHA did not identify low altitude stall and uncommanded roll as potential hazards.

Aggressive Schedule

Although there were Cockpit Voice Recorder (CVR) and Flight Data Recorder (FDR) systems installed on the aircraft, neither were certified nor validated by Gulfstream or the FAA. Those systems were not required to be installed or certified until the aircraft was type certified. The FDR recorded only 10 seconds of the accident flight because of a wiring issue that resulted in power not being applied to the FDR until the weight-on-wheels indications transitioned from ground to air. This wiring issue, which was reported in late 2010, had not been corrected at the time of the accident and was a deferred maintenance item.

Gulfstream maintained an aggressive schedule for the G650 flight test program so that the company could obtain Federal Aviation Administration (FAA) type certification by the third quarter of 2011. The schedule pressure, combined with inadequately developed organizational processes for technical oversight and safety management, led to a strong focus on keeping the program moving and a reluctance to challenge key assumptions and highlight anomalous airplane behavior during tests that could slow the pace of the program. These factors likely contributed to key errors, including the development of unachievable takeoff speeds, as well as the superficial review of the two previous uncommanded roll events, which allowed the company’s overestimation of the in-ground-effect stall AOA to go undetected.

According to the NSTB, Gulfstream did not ensure that the roles and responsibilities of team members had been appropriately defined and implemented. Additionally, engineering processes had not received sufficient technical planning and oversight, potential hazards had not been fully identified, and appropriate risk controls had not been implemented.

Inadequate Investigation

The accident flight was the third time that a right outboard wing stall occurred during G650 flight testing. Not until after the accident did Gulfstream determine that the cause of two previous uncommanded roll events was a stall of the right outboard wing at a lower-than-expected AOA. If Gulfstream had performed an in-depth aerodynamic analysis of these events shortly after they occurred, the company could have proactively recognized that the actual in-ground-effect stall AOA was lower than predicted.

NoGuarantees-4

Figure 4. A private Gulfstream G650 departing Bristol Airport, England. Source: Adrian Pingstone

Aftermath

Gulfstream stated that it accepted “full responsibility” for the accident and, in response, implemented corrective actions to preclude such an accident from recurring. One of these actions was to integrate safety management system principles and practices into the company’s flight test operations. As a result of this investigation, the NTSB issued two recommendations to Gulfstream to commission an audit to evaluate the status of the company’s safety management program before the start of its next major certification program and share lessons learned with aircraft manufacturers and flight test industry groups.

Additional actions to help improve the management and safety of flight test programs include providing aircraft manufacturers with flight test operating guidance and flight test safety guidelines based on best practices in aviation safety management. The NTSB issued two safety recommendations to the Flight Test Safety Committee (an independent flight test safety organization) and two recommendations to the FAA regarding the development of this guidance. The NTSB is also issuing one recommendation to the FAA to incorporate the flight test safety guidelines in an agency document.

In addition, the NTSB is issuing three other recommendations as a result of its investigation of this accident. One of these recommendations, addressed to the FAA, discusses the potential for domestic and foreign airplane manufacturers to overestimate an airplane’s stall AOA in ground effect. The other two recommendations, addressed to the FAA and the Flight Test Safety Committee, discusses advance coordination of high-risk flight tests among manufacturers, airport operators and aircraft rescue and firefighting personnel.

After the accident, Gulfstream suspended field performance testing through December 2011 while the company examined the circumstances of the accident. In March 2012, Gulfstream reported that company field performance testing had been repeated and completed successfully. In June 2012, the company reported that FAA certification field performance testing had been successfully completed. Gulfstream obtained FAA type certification for the G650 on Sept. 7, 2012.

Relevance to NASA

For NASA aviation safety within the flight test regime, NPR 7900.3A includes a sound Airworthiness Review Board (ARB) process to be followed for modifications to any NASA aircraft that affect its NASA Airworthiness Certificate. Hazards identified to the public, crew, payload or mission are addressed via engineering and administrative barriers or controls subject to reviews and configuration control.

For all projects, the basic assumptions upon which engineering calculations are based can be flawed, as can the calculations themselves. It is important to understand the limitation of assumptions and engineering data. In this case, the maximum lift coefficient in ground effect was assumed to be equal to that out of ground effect; scientific research has found a significant difference exists.

For all projects, listen to what tests are telling you; failure to understand the conditions leading to anomalies can result in solutions with unintended, disastrous consequences. Schedule pressure will continue to exist, but trying “too hard” to achieve a test point or milestone should raise a red flag. Investigate anomalous test events as far as evidence allows and beware of developing workarounds rather than understanding the environment or design. Seek expert advice if need be.

Although test anomalies will continue to occur, lack of schedule margin to investigate anomalies creates an “unknown known” condition going forward. From a safety standpoint, such risk is unjustifiable. Years of vigilance are no guarantee of safety today.

Questions for Discussion

  • What are all the assumptions you are making before you test, run a simulation or perform a Probabilistic Risk Assessment?
  • Is your confidence based on past success, on the interpretation of a dataset or on something else?
  • When planning to meet schedule milestones, do you expect to need time to recover from test failures?
  • Are your data analysts who calculate expected system performance during test the personnel most qualified to do such analysis?
  • What is an example of a weak signal in your project’s history that could foretell of a major failure or mishap?

References

Aircraft Accident Report: Crash During Experimental Test Flight, Gulfstream Aerospace Corporation GVI (G650), N652GD, Roswell, New Mexico, April 2, 2011. National Transportation Safety Board. October 10, 2012.

Responsible NASA Official: Steve Lilley

This is an internal NASA safety awareness training document based on information available in the public domain. The findings, proximate causes and contributing factors identified in this case study do not necessarily represent those of the agency. Sections of this case study were derived from multiple sources listed under References. Any misrepresentation or improper use of source material is unintentional.