Every parked aircraft has a problem: wind. A gust across the ramp can slam a rudder or an elevator against its stops, damaging the control system or hurting someone nearby. The fix is simple and almost as old as aviation itself. Lock the controls.

That lock is called a gust lock, or control lock. On a light aircraft it may be a metal pin pushed through the control column. On a big jet it may be a lever in the cockpit that clamps the control surfaces. On many aircraft it is a clamp fitted directly to the tail, hung with a red "remove before flight" streamer.

And it has killed people for almost a century, because a crew that tries to take off with the controls locked has an aircraft that cannot be flown. Here is how gust locks work, and why the accidents keep happening.

The Crash That Invented the Checklist

On 30 October 1935, Boeing's Model 299, the four-engined prototype that would become the Forteresse volante B-17, took off from Wright Field in Ohio on an evaluation flight for the US Army Air Corps. On board were Major Ployer Peter Hill, chief of the Wright Field flying branch, Lieutenant Donald Putt, and Boeing's chief test pilot, Leslie Tower.

Soon after take-off the aircraft stalled and crashed, bursting into flames. Hill died within hours and Tower died weeks later. Interviews with the survivors established the cause: the gust lock on the control surfaces had not been released.

The aircraft was more complex than anything the Air Corps had flown before, and the lesson was that even the best pilots could forget a step. The response was a written list of items to check before take-off. Historians credit the loss of the Model 299 with the creation of the modern pilot's checklist, a tool now used everywhere from airliners to operating theatres.

How the 1935 crash of Boeing's Model 299 changed aviation and led to the checklist.

A Century of the Same Mistake

The Model 299 was not the last. In 1947 a KLM Douglas DC-3 crashed at Copenhagen after the elevator lock was not released, killing all 22 on board, among them Sweden's Prince Gustaf Adolf and the American singer Grace Moore. In 1979 a Dan-Air Hawker Siddeley HS 748 could not rotate on take-off from Sumburgh in Shetland because its elevator lock had re-engaged; it ran into the sea and 17 of the 47 on board drowned. In 1992 a modified DHC-4 Caribou crashed at Gimli in Canada after a design flaw let its gust locks engage during the take-off.

Each accident follows a similar pattern. The aircraft accelerates normally, because engines and wheels do not care whether the controls are locked. Only when the pilot pulls back to lift off does the problem become obvious, often at a speed where stopping safely is no longer possible.

Bedford, 2014

The most studied recent case happened on 31 May 2014 at Hanscom Field in Bedford, Massachusetts. A Gulfstream IV business jet, registration N121JM, began its take-off roll with the gust lock engaged. The crew did not begin braking until about ten seconds after passing the decision speed, V1, and did not reduce thrust for another four. The jet overran the runway, crossed a fence and stopped in a ravine, where it caught fire. All seven people on board were killed, including the Philadelphia Inquirer co-owner Lewis Katz.

The National Transportation Safety Board's findings were damning. Data from the aircraft showed the crew had skipped complete flight control checks before 98 percent of their previous 175 take-offs in the aircraft. The Gulfstream's gust lock was supposed to be linked to the throttles so that take-off power could not be set with the lock engaged, but post-accident tests found the throttles could move three to four times further than intended.

The NTSB also faulted Gulfstream for a throttle interlock that did not work as intended and the FAA for not catching it during certification. The FAA later required the gust lock system on affected Gulfstreams to be retrofitted, and Gulfstream announced a redesign.

The NTSB's animation of the Gulfstream IV rejected take-off and overrun at Bedford in 2014.

How Pilots Prevent It

The defence has not changed since 1935. Before every take-off, the pilot moves every flight control through its full range and checks that the surfaces respond: full forward and back on the stick or yoke, full left and right, full rudder both ways. It takes seconds. In many aircraft a second crew member watches the control-position indicators or the surfaces themselves.

Designers add layers too: cockpit locks that physically block the throttles, external locks with bright streamers that are hard to miss on the walk-around, and warnings when a lock is still engaged. None of these is perfect on its own, which is the point of having several.

The gust lock is a reminder that aviation's most dangerous errors are often the simplest. More than 90 years after the Model 299, the solution is still a pilot, a checklist, and the discipline to use it every single time.

A reconstruction of the 2014 Gulfstream IV crash at Hanscom Field, Bedford.

Sources: Wikipedia (Gust lock; Boeing Model 299; 2014 Bedford Gulfstream IV crash); NTSB; PhillyVoice; U.S. Air Force.