The Devil in the Routine: The crash of Spanair flight 5022
Note: this accident was previously featured in episode 44 of the plane crash series on July 7th, 2018, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
On the 20th of August 2008, a Spanish airliner taking off from Madrid stalled and crashed just moments after liftoff, careening off the runway and exploding in flames as hundreds looked on in horror. By the time firefighters reached the crash site beside runway 36L, the plane lay ruined and burning, surrounded by the charred remains of 154 passengers and crew, who just moments earlier had been bound for the sunny beaches of the Canary Islands. Amid the wreckage, rescuers managed to find just 18 survivors, all badly injured, who had been spared by the flames.
At first, no one could say why Spanair flight 5022 was unable to climb, but the truth was soon revealed in the wreckage itself. Somehow, the pilots had sent their plane hurtling down the runway without extending the flaps and slats for takeoff, then failed to detect their error in time to avoid a catastrophic crash. It was a mistake which, over the years, had caused tragedy after tragedy, from America to Indonesia, and now it had happened again in the heart of Spain’s capital city. And just as in accidents past, a crucial alarm that should have warned of the danger failed to sound. How could it have happened again? Had the lessons of the past gone unheeded? A comprehensive investigation would eventually reveal how regulatory failures prevented detection of the faulty warning, and how a series of delays, interruptions, and stressors, when mixed with poor procedural design, led a normally competent crew to attempt a takeoff without performing one of the most basic steps to prepare their airplane for flight.
◊◊◊
In 1986, Scandinavian Airlines, the joint flag carrier of Norway, Denmark, and Sweden, launched a new subsidiary airline in Spain, christened Spanair, with services to holiday destinations in Europe and the Americas. The company grew steadily over the years, becoming a member of the Star Alliance group of airlines in 2003, but it was hit hard by the financial downturn of 2008. In 2007, Scandinavian Airlines had announced its intention to sell its controlling stake in Spanair, but as the financial crisis escalated, prospective buyer Iberia pulled out of a deal to merge with Spanair in May 2008. Unable to sell the ailing carrier, Scandinavian Airlines was forced to downsize it instead. That summer Spanair announced that it would ground 15 airplanes and cut 25% of its workforce in order to reduce costs, a move which was met with internal discontent and whispers of a possible strike.
By August 20th, the layoffs had not yet begun, but for 31-year-old First Officer Francisco Javier Mulet, the likely prospect of a pink slip was hovering menacingly in the background. With only 1,276 total flying hours, he was at the bottom of the seniority ladder and would surely be among the first to be let go. Those who knew him say he was in the process of looking for work at other airlines, but in the meantime, he continued to fly for Spanair, which had scheduled him on a multi-leg domestic trip around Spain on the 20th of August. Starting in Barcelona, he met up with his Captain for the day, 39-year-old Antonio Garcia Luna, a moderately experienced pilot with almost 8,500 hours, over half of them in the McDonnell Douglas MD-82, the aircraft which they would be flying that day.
Known among pilots as the “Mad Dog,” the MD-80 series consists of several stretched and updated versions of the 1960s-era McDonnell Douglas DC-9, fitted with somewhat more modern systems and avionics. By 2008, however, even these were fairly old. The last MD-82 had been delivered in 1997, but the aircraft in question, registration EC-HFP, was manufactured in 1993 and delivered to Korean Air, which handed it off to Spanair in 1999 as it prepared to retire the model. By then McDonnell Douglas had ceased to exist and the MD-80 series was, officially, a Boeing product.
After an uneventful flight from Barcelona, Captain Garcia Luna, First Officer Mulet, and their airplane arrived at Madrid Barajas International Airport at 10:13 local time, taxied to the gate, and shut down the engines. Their next flight was scheduled to depart at 13:00 with a nearly full load of 166 passengers, bound for Las Palmas in the Canary Islands, an autonomous Spanish archipelago off the coast of Morocco. Most were headed there on vacation, but for the pilots it was just another day at work. Their vacation would start a little bit later: in fact, after the end of his duty period that day, First Officer Mulet was planning to meet up with his girlfriend for a holiday in Palma de Mallorca.
Returning to their airplane after lunch, the pilots carried out the standard pre-flight checks and Before Start checklist, configuring the airplane for the coming flight. The pilots fired up the engines, received the all-clear signal from the ground crew for pushback, and then deployed the flaps and slats — the last major configuration item. Fully prepared for the journey ahead, Spanair flight 5022 to Las Palmas departed the gate at 13:14 and began taxiing toward runway 36L.
The flaps and slats are panels attached to the wing’s trailing and leading edges, respectively, which can be extended on takeoff and landing in order to increase the lift provided by the wing’s effective surface area. This increased lift allows flight at lower airspeeds. In normal flight, lift is a function of the inverse relationship between airspeed and angle of attack, or the angle of the wings relative to the airstream: for a given, constant amount of lift, a decrease in airspeed requires an increase in angle of attack, and vice versa. However, a stall will occur if the angle of attack becomes too high, resulting in a catastrophic loss of lift; therefore, there is, for any given set of conditions, a minimum speed at which the airplane can safely fly without stalling. The flaps and slats serve to improve this relationship by increasing the lift provided by the wings at low speed without a corresponding increase in angle of attack. Bringing the “stall speed” down in this manner allows airplanes to take off at lower speeds than could otherwise be achieved safely.
On this flight, the pilots had calculated that they would need to set their flaps to 11 degrees for takeoff. The slats, located on the leading edges of the wings, were adjusted automatically depending on the flap setting, and at flap angles below 14 degrees, they would extend to the intermediate or “mid” position. This is the only slat position other than fully retracted or extended.
As they taxied to the runway, the pilots confirmed that they had set the flaps and slats correctly, and all initially seemed normal. But then, just after taxiing onto the runway, they noticed something odd: the outside temperature reading, recorded by the Ram Air Temperature (RAT) probe on the exterior of the aircraft, was showing an absurdly high value, way above the actual ambient temperature of 29˚C at Barajas Airport. This malfunction would have implications for the takeoff because of the pilots’ plan to use the autothrottle to automatically control engine thrust. When engaged during takeoff, the autothrottle calculates an engine pressure ratio, or EPR, limit — effectively, the highest thrust which can be achieved without overheating the engines. The value of this EPR limit understandably depends on the outside air temperature. Therefore, with the RAT probe reading a temperature of 104˚C, the autothrottle would calculate an erroneously low EPR limit, most likely leaving them without enough thrust to become airborne. This left the pilots in a bind: they needed to either fix the problem immediately, or take off without the autothrottle, which would require calculating the EPR limit by hand and setting thrust manually.
Hoping to avoid a tiresome manual calculation, Captain Garcia Luna decided to find out if there was a quick fix. With the plane idling at the runway threshold, already in possession of takeoff clearance, Garcia Luna used his cell phone to call Spanair’s Maintenance Control Center at Palma de Mallorca for advice. The MCC advised him to try resetting the Z-29 circuit breaker, which controls power to the RAT probe heating system, but he replied that he had already done this and it didn’t work. With no other immediate troubleshooting methods available, Garcia Luna ended the call and ruefully radioed air traffic control to report that Spanair flight 5022 would not be taking off due to a mechanical problem. Instead, the pilots received instructions from Spanair operations to taxi the airplane, passengers and all, to a remote maintenance area at the edge of the airfield so that mechanics could try to fix the problem.
After a lengthy taxi, flight 5022 arrived at the remote parking area at 13:42, whereupon the pilots carried out the standard shutdown procedure, which involved turning off the engines, retracting the flaps, and setting the parking brake, among other items. Air stairs were then brought to the plane and mechanics boarded in an attempt to troubleshoot the issue. The proximate cause of the overheating probe was easy to guess: for whatever reason, the probe heater was turned on when it should not have been. When the airplane is airborne, the heater automatically turns on in order to ensure that the temperature probe remains free of ice, but the system should be inhibited on the ground. The problem on flight 5022 perfectly illustrated why: with the plane stationary in near 30˚C weather, the heater was warming the air around the probe before it could blow away, skewing the temperature reading.
Mechanics discovered that the manual contained a troubleshooting procedure for a heater that was inactive in flight, but there was no procedure for the opposite problem, a heater that was active on the ground. The mechanics carried out some routine procedures to confirm that the heater was working, but that was no use — the problem was that they couldn’t get it to stop!
Before long, the pressure to get going again became critical. With the engines off, the MD-82 had no air conditioning, and the temperature in the passenger cabin was becoming unbearable. Furthermore, they were already nearly an hour behind schedule, and Captain Garcia Luna could be heard on the cockpit voice recorder making comments about the delay. And so the mechanics and pilots agreed to defer the defect — repairing the probe heater could wait until the end of the day. The defect was recorded in the technical log, and mechanics pulled the Z-29 circuit breaker, cutting power to the probe heater so that it would stop overheating. The pilots confirmed that this was permitted as long as they did not expect to encounter in-flight icing along their route, which they did not.
With the problem having been deferred, a fuel truck was called to replace the fuel burned during the taxi to the maintenance area. Meanwhile, First Officer Mulet used his cell phone to call his girlfriend, informing her that he would be late arriving in Palma de Mallorca and that they would have to adjust their plans. To the Captain, he also expressed concern that they would not be able to use the autothrottle on takeoff if the Z-29 circuit breaker was open. The RAT probe itself fed information to the thrust rating panel, which the autothrottle in turn used to calculate the EPR limits, and Mulet believed that disabling the probe heater would affect the operation of the thrust rating panel. However, Captain Garcia Luna did not appear to be worried — if they couldn’t use the autothrottle on takeoff, that was no big deal.
Once refueling was complete, the pilots immediately launched into the pre-flight procedure and Before Start checklist, started the engines, and began the After Start checklist. Normally, the First Officer would read each item in the checklist, then the Captain would reply with its status; however, Captain Garcia Luna appeared to be in a hurry, because he replied to several items before First Officer Mulet read them out.
The last item on the After Start checklist was to set the flaps and slats, which was normally completed only once the ground crew had given the “all clear” signal for pushback. In practice, this often meant that the Captain would call for the flaps out of sequence, but in this case that never happened. In fact, just before First Officer Mulet would have reached the end of the After Start checklist, Captain Garcia Luna ordered him to ask air traffic control for clearance to taxi, and the checklist was abandoned.
With the flaps and slats still unset, flight 5022 departed the remote parking area at 14:14. The pilots discussed the situation with another pilot who was riding in the cockpit jump seat, remarking on the unfortunate nature of their malfunctions and delays. According to standard operating procedures, conversations with third parties in the cockpit during taxi are prohibited.
Just before 14:16, the pilots began the Taxi checklist, verifying the condition of the brakes, flight controls, instruments, transponder, and several other systems. The last item on the taxi checklist was the takeoff briefing, which covers all the proper settings for takeoff, such as engine power, stabilizer position, and flap angle. However, for reasons unknown, the takeoff briefing never happened — perhaps they felt confident that the briefing during their previous attempt to taxi, now almost an hour earlier, had been good enough. But since the pilots had carried out the full shutdown procedure when they parked at the remote stand, this was now considered a new flight, and technically they were supposed to do the briefing again.
Once again, First Officer Mulet expressed concern that the autothrottle could not be used. Captain Garcia Luna repeated that they would try the autothrottle, and if it didn’t work, they would adjust the thrust manually.
At 14:21, with flight 5022 now second in line for departure, the aircraft ahead of them was cleared for takeoff, and the pilots began the Before Takeoff checklist (known as “Takeoff Imminent” at Spanair). Reading off the items, the pilots confirmed that the flight attendants had been alerted, the spoilers and autobrakes were armed in case of a rejected takeoff, and the cockpit windows were closed. All that remained were the “final items:” one last round of checks of the airplane’s basic configuration. Hurrying through the list, First Officer Mulet called out, “Final items: we have, sorry, eight, eleven, aligned, eleven, stowed.” Although he didn’t specify what the numbers meant, the pilots knew the order by heart: “eight” was the center of gravity, the first “eleven” was the flap position according to his own display, and the second “eleven” was the flap position according to the Captain’s display. Except, neither of these displays actually showed the flaps at 11 degrees, because the flaps were retracted. And on the slat position indicator, where a light reading “T/O” (“takeoff”) should have been illuminated, all the lights were still dark.
Moments later, at 14:23, air traffic control cleared Spanair flight 5022 for takeoff, and the pilots engaged the autothrottle in takeoff mode. Noting that the system didn’t work, they switched to plan B and advanced the thrust levers manually to the calculated EPR limit, exactly as planned. Both engines spooled up to takeoff power, and the plane accelerated down the runway with First Officer Mulet at the controls. Watching their speed build up, Captain Garcia Luna called out 60 knots, followed by 100 knots, and then V1, the highest speed at which the takeoff could be aborted. Moments later, the plane reached 157 knots, or VR — rotation speed. Garcia Luna called out “Rotate,” And Mulet pulled back on the controls to lift the plane off the runway. Due to reduced forces related to the absence of the flaps, the nose came up faster than he was expecting, reaching 14 degrees pitch up within seconds. The airplane lifted off moments later, but almost the instant it did so, the stick shaker stall warning activated, shaking the pilots’ control columns, while an automated voice called out, “STALL! STALL!”
“Engine failure?” First Officer Mulet asked, trying desperately to figure out why the plane was stalling.
Captain Garcia Luna shouted to turn off the warning voice, but not only would that have done nothing to correct the situation, he seemed not to recognize that the stall warning cannot be silenced.
Of course, the real reason for the warning was that the flaps and slats were not extended, and the plane wasn’t flying fast enough to climb without them. At its current weight and altitude, the stall speed with flaps and slats retracted was 160 knots, compared to 123 knots with the flaps at 11˚ and the slats at “mid.” Furthermore, it would not be possible to maintain a speed greater than 160 knots unless the pilots kept the pitch angle below 13 degrees. Without the flaps and slats, the plane did not have enough lift to climb at a higher pitch angle without sacrificing speed for altitude, resulting in an almost immediate stall, since the speed at liftoff was already at the stall speed.
Unsure what was going on and fumbling for a solution, the pilots failed to take decisive action, and within seconds the airplane began to stall. On aircraft with significantly swept wings like the MD-82, this results in lateral instability. As soon as the stall began, flight 5022 rolled hard to the right, reaching a bank angle of 32 degrees, while the pitch angle increased to 18 degrees, far above the highest sustainable value. Its wingtip almost touching the ground, with stall warnings and “BANK ANGLE” warnings blaring, the plane streaked along just barely above the runway, the pilots shouting desperately as they fought for control. First Officer Mulet advanced the thrust levers to full power, but without pitching down or deploying the flaps, this was insufficient to recover. The high bank angle only worsened the situation: when lift is not directed straight upward, the stall speed increases, requiring an even more aggressive recovery.
No such recovery ever came. Six seconds after liftoff, flight 5022 reached a maximum height of 40 feet above the ground, then descended sharply. After just ten seconds in the air, the MD-82 came crashing back to earth, impacting the grass verge beside the runway with its right engine and wingtip. Lurching down onto its landing gear, the plane skidded across the grass for 448 meters, then flew off an embankment, dropping down into the area between runway 36L and the parallel runway 36R. Still traveling at great speed, it touched down in a field, flattened a fence, cleared a small gully, and slammed into rising terrain with tremendous force. Breaking apart as it went, the fuselage continued forward, spinning around and turning over as both wings separated, liberating vast quantities of fuel, which ignited. Engulfed in flames, what remained of the plane tumbled into the bed of a creek, scattered burning debris through the water and across the opposite bank.
The powerful explosion and column of black smoke immediately turned heads throughout Madrid Barajas Airport, as passengers and airport staff alike looked on in horror. The crash alarm sounded in the airport fire stations, and dozens of first responders rushed to the scene — only to find that access was blocked by the fence, which had formed part of the airport perimeter prior to the last runway expansion. One heavy fire truck managed to run down the fence, but the rest were substantially delayed, rushing to find an alternative route as flames spread through the brushland surrounding the crash site.
Against all odds, their presence was sorely needed. The devastating crash had instantly killed dozens of people, and the massive fire which followed took the lives of most of the rest almost as quickly, but a few, by some stroke of luck, had managed to survive. The forward cabin behind the cockpit had broken away from the section behind it as the plane crossed the creek bed, plunging its occupants into the water, where they were spared from the flames. Some had been ejected while still strapped in their seats, while others were pinned in the wreckage, struggling to keep their heads above water. As firefighters finally arrived, they extracted a number of disoriented survivors from the stream, all of them seriously injured, and pulled apart the wreckage to free several more who were trapped. But after collecting 26 people with signs of life, no more could be found.
Over the next few hours, most of those who suffered severe burns died in hospital or on the way, and by the time the others began to recover, only 18 remained. Of the 172 people on board Spanair flight 5022, 154 lay dead — the worst crash on Spanish soil since 1983.
All of the survivors — 17 passengers and a flight attendant — had been seated forward of row 9, in the part of the plane which plunged into the water. Of those who perished, 119 died of burning and/or impact forces, 32 from impact forces alone, one from smoke inhalation, and two from drowning — an unlucky side effect of the water which saved so many others.
◊◊◊
Over the first days and weeks of the investigation, experts with Spain’s Civil Aviation Accident and Incident Investigation Commission, known by its Spanish acronym CIAIAC, began piecing together why Spanair flight 5022 failed to become airborne. While other causes were ruled out, a failure to extend the flaps was swiftly ruled in, as the flap control lever in the cockpit was found in the wreckage with witness marks indicating it had been in the retracted position at the moment of impact. Although several data points from the flight data recorder had been corrupted, including the flap and slat positions, other recorded parameters linked to the flaps and slats were consistent with the devices having been retracted throughout flight 5022’s fatal takeoff. An analysis of the light bulbs which indicate the slat position also confirmed that none of them were illuminated at the time of the crash. The central question faced by the inquiry was therefore simple, but baffling: how could two well-trained pilots, flying for a Star Alliance airline with a perfect safety record, simply forget to extend the flaps?
Unfortunately, this was far from the first time a crash like this had happened. In an almost identical incident in 1987, Northwest Airlines flight 255, another MD-82, crashed on takeoff from Detroit, Michigan after the pilots forgot to deploy the flaps, killing 154 of the 155 aboard as well as two on the ground. One year later, 14 people were killed when Delta Air Lines flight 1141, a Boeing 727, crashed on takeoff from Dallas, Texas for the exact same reason. Similar crashes also befell a LAPA Boeing 737 in Buenos Aires in 1999, killing 65, and a Mandala Airlines Boeing 737 in Medan, Indonesia, in 2005, killing 149. Now this age-old error had claimed another 154 lives in Madrid.
Some of these crashes were the result of blatant misconduct — the LAPA pilots, for instance, spent the time before takeoff smoking and chatting with the cabin crew, then plowed ahead with the takeoff in spite of a blaring alarm telling them that the flaps weren’t extended. But most of the rest involved seemingly competent pilots who appeared to be capable of flying safely, and the Spanair crew fit this model. Both possessed at least average skills compared to other Spanair pilots, and the airline itself was not known for sloppiness either. Although the airline was under special observation due to its poor financial status, recent audits by European and Spanish authorities had found no serious safety problems, and a separate inspection by Boeing experts concurred.
Nevertheless, by listening to the cockpit voice recording and examining the checklists used by the crew, investigators started to see how things went wrong. The first taxi attempt was normal, and the pilots extended the flaps properly, but after discovering the mechanical fault with the ram air temperature probe, they were forced to park the airplane and return it to its original configuration. Faithfully following standard procedures, the pilots retracted the flaps before shutting off the engines. That meant that they would need to do everything over again when it was time to leave.
In the meantime however, stress began to build. The plane was an hour behind schedule, mechanics were having trouble finding the source of the malfunction, the First Officer was going to be late for his vacation, and the temperature in the cabin was unbearably hot. To make matters worse, the pilots knew that the autothrottle would likely be unable to set the thrust during takeoff, on top of the inoperative RAT probe heater, and several other outstanding defects carried over from previous flights, including a broken thrust reverser. This perfect storm of psychological pressures began to influence the pilots’ mindsets as they prepared for the second departure attempt. Captain Garcia Luna’s comments about the delay and his preemptive replies to checklist items strongly suggested that he was in a hurry to get going. At the same time, First Officer Mulet’s call to his girlfriend, conversations with the jump seat occupant, and repeated focus on the performance of the autothrottle indicated that his mind was elsewhere throughout the configuration and taxi phases. These two factors — hurrying and distraction — negatively complemented one another and set the stage for the human errors which followed.
The first error was the failure to set the flaps and slats during the After Start checklist, before the plane started taxiing. This error was made possible in part due to a lack of clarity surrounding when, and by whom, the step was supposed to be carried out. Spanair’s operating procedures stated that this item was to be accomplished after receiving the “all clear” from the ground crew, but that created a certain risk, in that it sometimes required deferral of the flaps and slats if the after start checklist was completed too early. If some distraction occurred before coming back to this step, it could be forgotten. Furthermore, the procedures did not actually clarify who would call for the step to be completed once it had been deferred. Some Spanair pilots said this was the captain’s responsibility, but others described Captain Garcia Luna as “the type of captain who would call for flaps,” indicating that there were some captains who presumably left this up to the first officer.
The proximate cause of the failure to complete this step on flight 5022 appeared to be Captain Garcia Luna’s decision to interrupt First Officer Mulet just before he reached the flaps/slats item on the After Start checklist, after which the checklist was never completed. However, the common practice of deferring the checklist could have normalized the sensation of leaving it incomplete, while the lack of clarity surrounding who should announce its resumption could have made it easier for both pilots to forget.
In order to account for situations like this one, Spanair’s checklists included another check of the flaps and slats during the takeoff briefing in the Taxi checklist, and again in the “final items” at the end of the Before Takeoff checklist. However, no takeoff briefing was conducted, possibly because the pilots were in a hurry and decided not to repeat a briefing that they had just conducted a little over an hour ago. Another chance to correct their mistake was thus missed. And then there were the “final items,” during which First Officer Mulet actually called out the correct flap setting, despite the fact that his displays must have shown that the flaps were retracted. This kind of error had been seen before — in fact the pilots of Delta flight 1141 did the exact same thing. Rushing to complete the final items before takeoff, the First Officer on that flight also called out the correct flap setting, apparently without actually looking at the flap position indicator. This kind of automatic behavior is common in situations where a pilot must carry out familiar but repetitive tasks while under stress or time pressure. Under such circumstances, the brain focuses on the desired outcome, regardless of the actual indications. This is often called “looking without seeing.” In the event, First Officer Mulet had already mentally moved past the configuration phase, so his expectation was that these items had been successfully completed. He thus formed a conception which was disconnected from the raw visual information provided by his eyes, and called out a value of 11 degrees because that was the number in his mind.
Moments later, the pilots initiated their takeoff with the flaps retracted.
In analyzing this sequence of events, the CIAIAC reserved substantial criticism for the design of Spanair’s checklists. In fact, investigators noted that after the Northwest Airlines crash in 1987, research had been conducted into how best to design checklists so as to prevent this type of error. Among the conclusions were two particularly salient points: first, that the last step on every checklist should be to call “checklist complete;” and second, that the most important items on a checklist should be near the beginning.
Spanair’s checklists met neither of these criteria. Calling “checklist complete” at the end of every checklist primes a pilot to expect that call and to notice if it’s missing, reducing the chances that a checklist could be left unfinished, but none of Spanair’s checklists explicitly included this step. Furthermore, in every checklist where they appeared, the flaps and slats were the last item. If a checklist is interrupted or left incomplete, the items near the end are more likely to be forgotten, which is why important items like the flaps and slats should be near the start.
After the Northwest Airlines and Delta Air Lines accidents in the United States in the late 1980s, the Federal Aviation Administration began requiring that checklists used by US airlines be submitted for approval by FAA inspectors. Those FAA inspectors were in turn given the checklist design guidelines developed in the wake of the two crashes, including the two points described above, in order to use them as part of the approval criteria. As a result, the quality of checklists in the United States underwent significant improvements. So why had the same process not taken place at Spanair?
As it turned out, neither Spain nor the European Union had ever followed in the FAA’s footsteps. In fact, the only European country which promulgated the new checklist design guidelines was the United Kingdom. In all other countries, airlines were left on their own, and many of them never incorporated the new design strategies.
◊◊◊
Investigators now understood how a series of psychological stressors, combined with poor checklist design and a little bit of bad luck, led the pilots of flight 5022 to attempt a takeoff without extending the flaps. However, it is possible to become airborne if the flaps are not extended, so long as adequate airspeed is achieved. For that reason, the CIAIAC also conducted several simulations in order to evaluate the pilots’ response to the stall warnings and determine whether they could have recovered in time to avert the crash.
Stall recovery procedures in general advise the pilots to pitch down to reduce the angle of attack and increase airspeed. However, this situation presented some unique difficulties. Because the stall occurred immediately after liftoff, there was no room to gain speed by descending, and the extent to which the pilots could pitch down was limited by the proximity of the ground. Although the stall could in theory have been avoided by maintaining a pitch angle below 13 degrees, this came with a huge caveat, as it assumed that the wings remained level. In the event, the tendency of the airplane to sway wildly from side to side resulted in high bank angles that further increased the stall speed, making it harder to avoid the stall simply by pitching down. The simulations showed that instead, the easiest way to escape the stall and avoid the crash would have been to deploy the flaps and slats within the first 5 seconds or so after the onset of the stick shaker stall warning. This would have given the plane enough lift to climb at its present speed and angle of attack without stalling. However, the stall recovery procedures published by Spanair and Boeing did not ask pilots to verify the position of the flaps and slats, nor was this a normal part of training related to stalls on takeoff, so it was unlikely that the crew of flight 5022 would have thought to do this during the mere seconds available to them.
This problem was underscored by the findings in previous accidents and incidents involving inadvertent takeoff with the flaps retracted. In a significant percentage of such cases, the pilots lost control of the plane and crashed, because the window in which to identify the problem was extremely short. Investigators did however point out one incident involving a Boeing 737 departing from Reagan National Airport in Washington, D.C., in which the pilots received a stall warning seconds after takeoff, only for the First Officer to suddenly realize that the flaps were retracted. He immediately extended the flaps, at which point the stall warning stopped and the takeoff was continued uneventfully. The successful outcome in this incident suggested that training pilots to check the position of the flaps and slats during a stall on takeoff could have prevented the Spanair disaster.
◊◊◊
All of this having been said, one glaring question remained: where was the takeoff configuration warning horn?
The MD-82, like all transport aircraft, has been required since 1979 to have an alarm capable of alerting the pilots if they attempt to take off with an incorrect configuration, such as the flaps and slats retracted or stabilizer wrongly set. This system, referred to as a Takeoff Warning System, or TOWS, should activate if the thrust levers are moved to takeoff power while the flaps and slats are not extended, sounding a horn followed by an automated voice calling out, “FLAPS… SLATS.” However, this warning was clearly not heard on flight 5022’s cockpit voice recording, a discovery which sent investigators deep into the plane’s electrical system in an attempt to figure out why it was missing.
One obvious red flag was the seemingly unrelated failure of the RAT probe heater. The RAT probe heater and the TOWS shared one major commonality: they were both systems which behaved differently on the ground and in the air, and thus relied on a correct indication from the plane’s air/ground system. Because the TOWS is only supposed to sound on the ground, and the RAT probe heater is only supposed to work in the air, both need to know whether the plane is in fact on the ground or in the air, and it was here that investigators observed a connection between them. The plane’s air/ground status is determined by the compression of the nose gear shock strut, which sends a signal to various relays which then distribute the information to systems which require it. Most of these systems were working properly on the day of the accident; only the TOWS and RAT probe heater were not, so the air/ground switch itself couldn’t have been at fault. But as it turned out, both of the faulty systems received air/ground signals via an electrical relay known as R2–5, buried deep in the bowels of the airplane. If the R2–5 relay was erroneously reporting that the plane was in the air, it could explain both malfunctions.
Despite the damage to the airplane, investigators managed to find the R2–5 relay amid the wreckage and ultimately spent months examining it for clues. In the end, however, they were unable to confirm the presence of a malfunction affecting both the TOWS and the probe heater. Under close examination, the electrical contacts which transmit an “air” signal to the RAT probe heater showed evidence of having fused and then separated again, but it was impossible to say whether this occurred before, during, or after the crash. Furthermore, this malfunction wouldn’t affect the TOWS, which used a different set of contacts within the relay, so the common source of the two problems, if there was one, must have been elsewhere. This deeper source was unfortunately never found.
If the R2–5 relay was in fact responsible for both malfunctions, which is at least probable if not provable, then the crash might have been incidentally prevented if the mechanics had discovered the cause of the RAT probe heater problem and replaced the relay. Evidence suggested that they could very well have done so. In May of 2008, a similar malfunction was reported on another Spanair MD-82, which mechanics managed to trace to the R2–5 relay by simple deduction: if the heater was on while the plane was on the ground, then the heater must think the plane is in the air, which means the air/ground system is likely at fault. Those mechanics replaced the R2–5 relay and the problem went away. This was actually a common outcome: Boeing’s records showed that MD-80 operators had reported 103 cases of RAT probe heaters overheating, of which 72 were resolved by replacing the R2–5 relay. Despite this fact, however, the MD-82 maintenance troubleshooting manual did not provide procedures for correcting an overheating RAT probe, leaving maintenance personnel to figure it out on their own, as the Spanair mechanics had done back in May.
Investigators also noted that according to the flight data recorder, the RAT probe heater on this aircraft had activated on the ground six times between August 18 and August 20, of which the last three were recorded in the technical log, including the one before the accident flight. Mechanics in Barcelona on August 19 had also attempted to fix the issue, but like the mechanics in Madrid, they were unable to trace the problem back to the R2–5 relay. If they had searched the airline’s maintenance records for similar cases, they would have discovered the May incident and the mechanics’ solution, but it seems they never did. If they had, then perhaps the TOWS would have been unknowingly fixed, the warning would have sounded during the takeoff roll, and 154 people would still be alive.
However, the fact that no one knew that the TOWS was faulty was a significant point in and of itself. In fact, the only way to determine whether the warning was working or not was to test it by advancing the thrust levers without configuring the airplane for takeoff. Spanair’s pre-flight procedures called for just such a check, before starting the engines, in order to verify both the full range of thrust lever movement and the integrity of the TOWS. (The TOWS does not care if the engines are actually generating power; it will sound when the levers are advanced even if the engines are off.) Critically, however, this check was only required before a given flight crew’s first flight of the day in that airplane. That meant that Captain Garcia Luna and First Officer Mulet had checked the system that morning before leaving Barcelona, but were not required to check it again when departing Madrid in the same aircraft. According to the flight data recorder, the RAT probe heater was working normally in Barcelona, so the presumed failure of the R2–5 relay must have happened after that. This represented a fundamental vulnerability in the design of the check — namely, that a crew who flew the same airplane together all day would not detect a failure of the TOWS if it occurred after the start of their shift.
This vulnerability had actually been recognized 20 years earlier by McDonnell Douglas, the now-defunct manufacturer of the MD-80 series. Following the 1987 crash of Northwest Airlines flight 255, in which the takeoff configuration warning horn also did not sound, McDonnell Douglas urged all MD-80 operators to conduct the TOWS check before every flight, not just the first flight of the day. Every US-based MD-80 operator incorporated the change, and indeed they were highly incentivized to do so, having just witnessed a catastrophe on home turf. In Europe, however, the response was more muted. Scandinavian Airlines, which originally created the procedures later used by Spanair, had received McDonnell Douglas’s recommendation but chose not to implement it, for reasons which remain unknown. Nor were they alone in that decision: of five European MD-80 operators surveyed by the CIAIAC, only two required their pilots to check the TOWS before every flight. In their report, investigators wrote that this situation could have been avoided if the FAA, as the party responsible for the MD-80 type certificate, had issued a directive mandating the change.
Even so, fundamental problems with the TOWS remained. Investigators also highlighted the fact that the TOWS was legally considered a non-critical system, meaning that there was no requirement for redundancy in its design, nor any means of directly alerting the crew should it fail. According to the official position of the manufacturer, the system was merely an aid to the crew, who were expected to configure their aircraft correctly, and therefore its failure should not directly impact flight safety. This has been a common view in the industry regarding safety systems meant to catch flight crew errors, but it has recently come under increasing scrutiny, and the CIAIAC criticized the classification. In their view, the accident record should speak for itself: in the five major air disasters between 1987 and 2008 which involved a failure to extend the flaps, the takeoff configuration warning failed to sound in four of them. In contrast, NASA’s database of anonymous aviation safety reports had recorded 52 cases in which pilots aborted a takeoff after receiving a configuration warning. This number represented only those cases which occurred in the US during the existence of the NASA reporting system and in which the pilots chose to submit an anonymous report — the true number, therefore, was likely much higher.
Had the aircraft involved in these incidents not been equipped with takeoff warning systems, then a significant percentage of these flights might have crashed. This also explains why there have been so many crashes which follow the format of Spanair flight 5022 — a failure to deploy the flaps, followed by a failure of the TOWS — even though this ostensibly requires two independently improbable events. The truth was that pilots were actually forgetting the flaps all the time, and the TOWS was regularly bailing them out. The obvious conclusion to be drawn from this was that the TOWS is, in fact, a safety critical system which deserves to be held to a high standard of mechanical reliability.
◊◊◊
By the time the investigation concluded in mid-2011, investigators had taken what seemed on the surface to be a simple case of pilot error and revealed several systemic deficiencies which made the crash possible, including poor checklist design at European airlines, stall procedures which did not draw attention to the position of the flaps, and a takeoff warning system which was safety critical but would provide no indication of failure and was not checked before every flight. Many of these deficiencies had been identified after the two US crashes in 1987 and 1988, but while lessons had been learned in America, their application in Europe was spotty at best, leaving gaps in the safety net which could and should have been filled. The crash of Spanair flight 5022 was therefore entirely preventable, not only by the crew, but by countless others along the long road to disaster. Nevertheless, as so often seems to happen, the headlines surrounding the publication of the final report cited “pilot error,” and that tends to be the way the accident is described to this day.
◊◊◊
As a result of the crash, Spanair carried out an internal safety audit which identified 95 deficiencies, most notably the lack of a defined procedure for designing checklists. Although efforts to correct these deficiencies were initiated, the airline didn’t last long enough to see real results. In the aftermath of the accident, Spanair’s already unstable financial situation only continued to deteriorate, and the airline permanently ceased operations in 2012.
Nevertheless, changes were made in other areas. The European Aviation Safety Agency (EASA) issued an airworthiness directive requiring a TOWS check before every flight on all aircraft in the DC-9 family, including the MD-80 and Boeing 717, and issued guidance to operators recommending that they have their ground crews verify deployment of the flaps as a plane is pushing back from the gate. The FAA also wrote and published a new, comprehensive guide for designing flight crew checklists, and Spain’s AESA (the local FAA equivalent) did the same. Boeing made changes as well: the MD-80’s official stall recovery procedure now comes with a warning that a stick shaker on takeoff could mean that the flaps and slats are not extended, and the operations manual now states that “first flight of the day” checks should be accomplished again if the aircraft undergoes maintenance in between flights.
Between all of these changes, the CIAIAC got a reasonable share of what it asked for after the accident, but a few suggestions were rebuffed: the agency’s recommendation to classify takeoff warning systems as safety critical, for instance, was not accepted. However, the FAA pointed out that takeoff warning systems on modern airplanes are much more robust, thanks to design guidelines issued after the MD-80 was certified. By the time of this writing, MD-80s have been retired from service in much of the world, and few airliners equipped with early-generation takeoff warning systems remain.
It is also perhaps worth noting that every crash caused by failure to deploy the flaps has involved either a Boeing or McDonnell Douglas aircraft, not Airbus. This is no coincidence — in fact, even if an Airbus pilot were to attempt to take off without the flaps, the flight envelope protections would not allow the airplane to stall. Airbus systems prevent the pilot from pitching up beyond the stall angle of attack, and it makes no difference whether the pilot thinks the flaps are deployed — because the computer knows they are not, and adjusts the maximum angle of attack accordingly. Had flight 5022 been an Airbus, all else being equal, the plane would have climbed away from the runway at an angle shallow enough to ensure that it maintained sufficient airspeed, and no one would have been hurt. In the eternal Boeing vs. Airbus debate, then, this is a strike in Airbus’s column.
◊◊◊
Today, the crash of Spanair flight 5022 holds several important qualifiers which give it enduring significance. It remains, as of this writing, the last fatal crash of an airliner in Spain; the last crash of an airliner due to failure to deploy the flaps; and the last fatal crash of a passenger jet in the European Union, with the exception of Germanwings flight 9525, which was destroyed deliberately by the pilot. The story of flight 5022 might seem disconcertingly recent, but in reality it marked the end of a previous era and the start of a new, much safer period for Europe’s passenger airlines. Nevertheless, maintaining that sterling safety record requires that we not forget mistakes of the past. If there is one lesson that flight 5022 ought to teach us, it’s that within every pilot, there is an unconscious but persistent tendency to hurtle headlong toward a takeoff without extending the flaps, as though driven by a devil on their shoulder, forcing them past one check after another. The job of well-designed procedures is to defeat this metaphorical devil, and it must be defeated on every single flight, because we can’t afford not to. And for the pilots reading this — it never hurts to check one last time, just in case.
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 240 similar articles
