Full HTML Version

Aviation Safety Letter

Issue 3/2012

In this Issue...

Decorative line Decorative line

Learn from the mistakes of others;

you’ll not live long enough to make them all yourself...


The Aviation Safety Letter is published quarterly by Transport Canada, Civil Aviation. The contents do not necessarily reflect official government policy and, unless stated, should not be construed as regulations or directives.

Letters with comments and suggestions are invited. All correspondence should include the author’s name, address and telephone number. The editor reserves the right to edit all published articles. The author’s name and address will be withheld from publication upon request.

Please address your correspondence to:

Paul Marquis, Editor
Aviation Safety Letter
Transport Canada (AART)
330 Sparks Street, Ottawa ON K1A 0N8
E-mail: paul.marquis@tc.gc.ca
Tel.: 613-990-1289 / Fax: 613-952-3298
Internet: ASL


Some of the articles, photographs and graphics that appear in the Aviation Safety Letter are subject to copyrights held by other individuals and organizations. In such cases, some restrictions on the reproduction of the material may apply, and it may be necessary to seek permission from the rights holder prior to reproducing it.

To obtain information concerning copyright ownership and restrictions on reproduction of the material, please contact:

Public Works and Government Services Canada

Publishing and Depository Services
350 Albert Street, 4th Floor, Ottawa ON K1A 0S5
Fax: 613-998-1450
E-mail: copyright.droitdauteur@pwgsc.gc.ca

Note: Reprints of original Aviation Safety Letter material are encouraged, but credit must be given to Transport Canada’s Aviation Safety Letter. Please forward one copy of the reprinted article to the editor.

Electronic distribution:

To subscribe to the Aviation Safety Letter e-Bulletin notification service, visit: www.tc.gc.ca/ASL.


To purchase a Print-on-Demand (POD) version (black and white), please contact:

The Order Desk

Transport Canada
Toll-free number (North America): 1-888-830-4911
Local number: 613-991-4071
E-mail: MPS1@tc.gc.ca
Fax: 613-991-2081
Internet: www.tc.gc.ca/Transact

Sécurité aérienne — Nouvelles est la version française de cette publication.

© Her Majesty the Queen in Right of Canada,
as represented by the Minister of Transport (2012).
ISSN: 0709-8103
TP 185E


Improving Safety by Focusing on the Basics

Photo of John Crichton, President and CEO of NAV�CANADA

John Crichton

The aviation industry has always made steady progress in identifying and managing safety risks by focusing on the basics.

In the provision of safe and efficient air navigation services, communications, navigation and surveillance (CNS) form the core of those basics. That is why at NAV CANADA we continue to place much of our emphasis for improvements on these three areas.


Timely communications between air traffic services (ATS) personnel and pilots is essential for both safe and efficient air operations. By expanding the availability and type of communications, and by making them more effective, we have sought to improve safety through better service and reduced errors.

In 2004 we tackled the tough issue of frequency congestion on 126.7 MHz. Communications on this frequency—whose primary purpose was to facilitate air-to-air advisories between pilots in uncontrolled airspace—had become so congested in particular areas that the purpose of the frequency was compromised.

The solution was to take flight information service enroute (FISE), which can involve lengthy communications between the pilot and the flight service specialist, off of 126.7. We established a new network of additional frequencies which pilots could use to directly access our flight information centres (FIC).

We then added additional remote communications outlets (RCO) in areas where communications coverage was sparse, thus further improving access to essential information for pilots. Finally, we undertook pilot awareness efforts on good communications practices to reduce unnecessary communications and ensure the availability of any frequency when it was needed.

We have also made significant investments to improve communications in northern, remote, and oceanic areas. In 2007, we added 15 new VHF peripheral stations (PAL) in northern Canada to provide direct controller-pilot communications (DCPC), allowing reduced separation and faster response time to flight requests.

These sites were in addition to the long-range VHF PALs that were installed around Hudson Bay and in southern Greenland to support automatic dependent surveillance-broadcast (ADS-B) operations.

Any discussion of advances in pilot-ATS communications would not be complete without reference to data link. Controller-pilot data link communications (CPDLC) enables altitude and speed clearances, change requests and other related ATS information to be exchanged via direct text communication between controllers and pilots, resulting in fewer communication errors.

Common on the North Atlantic for years, NAV CANADA has now deployed CPDLC in domestic airspace in the Montréal and Edmonton flight information regions (FIR). We expect further expansion of this capability in the coming years, with associated safety and efficiency benefits.

The quality of our communications practices is another area where we have been proactive. The NAV CANADA-led ATS-Pilot Communications Working Group has actively sought to raise awareness of the risks of non-standard communications and the importance of active monitoring and accurate readbacks.

We are also trying to influence behaviour by encouraging pilots to request confirmation when a communication is unclear, or to indicate if they do not have in sight traffic that has been identified to them.

We will be taking further action on the issue of pilot-ATS communications by developing guidance material on good communication practices and standardized, common phraseology.


Satellite navigation is often referred to as the biggest game changer for aviation. There is no doubt that the proliferation of satellite navigation throughout the world is providing significant benefits to both customers and air navigation system providers.

It is becoming the cornerstone of enroute and terminal navigation and is a key enabler of the performance-based navigation (PBN) concept, which includes both area navigation (RNAV) and required navigation performance (RNP).

The improved aircraft navigation performance that stems from use of the global navigation satellite system (GNSS) also has a positive impact on safety and efficiency. Designing airways and instrument procedures without the limitation of ground-based navigational aids allows improved designs that increase airspace capacity, provide more flexibility and predictability, and allow more efficient flight profiles.

Satellite navigation has also enabled improved airport accessibility, resulting in fewer diversions, and has brought the safety benefits of straight-in instrument approaches with vertical guidance to airports where they were previously unavailable due to the lack of ground-based navigation infrastructure.

We are committed to expanding PBN in Canada, and we continue to work with our customers, Transport Canada, and the International Civil Aviation Organization (ICAO) to implement PBN specifications where it makes sense to do so. In the future, equipage with GNSS may become mandatory in high traffic density terminal areas because of the efficiencies it brings to airspace management.


Surveillance is a key enabler to improving efficiency by enabling reduced separation standards to be employed, as compared to procedural airspace. That is why improving and expanding surveillance capability by using both existing and emerging technologies has been a focus of much of our capital investment in recent years. We have expanded radar coverage with the addition of seven new northern radars; we have expanded access to surveillance information by deploying auxiliary radar displays to flight service stations (FSS); and, we have introduced ADS-B—a cost-effective alternative to radar, but one that requires special aircraft equipage—in select areas where it will deliver clear benefits to our customers.

Further to this, multilateration has been deployed to provide infill surveillance for specific operating areas, as well as to improve surface surveillance at airports. We are also expanding our use of intelligent video surveillance and are excited about the potential of this technology as a cost-effective surface surveillance solution for many airports.

While our focus on expanding surveillance coverage in all areas is requiring our customers to be suitably equipped, the benefits far outweigh the cost of this equipage. The result is a measurable enhancement of both safety and efficiency.

In summary, NAV CANADA will continue to adopt new technologies and to modernize the air navigation system in collaboration with our people, our customers and our stakeholders.

In the past 15 years, a strong emphasis on the three core areas of communications, navigation and surveillance has been central to that work.

We look forward to finding ways to deliver even greater benefits for the safety and efficiency of the air traffic we manage by building on the innovations of the past 15 years.

John Crichton
President and CEO



Soaring Association of Canada (SAC) logo

The SAC Column: Power FLARM

by Dan Cook, Chairman, Flight Training & Safety Committee, Soaring Association of Canada (SAC)

Last year, two gliders collided head-on over the Rockies near Invermere, B.C., and sadly both pilots were killed. Both gliders carried GPS data loggers, which are common in cross-country gliding; this has helped in the accident analysis. It appears that one glider was flying towards the setting sun and the other had the sun behind it. Based on their altitudes, it is likely that the glider flying into the sun would have had the mountains behind it, making it more difficult to identify the glider given that it would have appeared stationary against the rough background terrain of the mountain.

Gliding also has unique challenges compared to powered flight. Generally, when a power pilot identifies another aircraft, the pilots try to avoid each other or maintain maximum separation. With gliders, the presence of another glider generally indicates the potential for lift; as soon as a glider circles or climbs, other gliders are drawn to the source of lift and separation decreases, sometimes to a few hundred feet. Separation and safety are maintained by communications and/or thermal and ridge protocols as the gliders circle together or dolphin fly along the lift. This becomes more difficult to manage in popular soaring locations with dozens of gliders or during soaring contests.

In Europe, which has more gliders and less usable airspace, this challenge was heightened. It reached a point where the European gliding community identified mid-air collision as their number-one hazard for gliding. Conventional airborne collision avoidance systems (ACAS) were of little use due to their false alarm rates caused by the close proximity necessary for gliding without being in danger of collision. This requirement should not be confused with transponders used for collision avoidance in controlled airspace or with commercial aviation. Low power consumption transponders are now available to meet glider requirements, and some soaring clubs near high commercial traffic areas are now equipping their gliders with transponders. However, this does not ensure the glider-to-glider alerting required at most of our more remote gliding locations, which are away from commercial air traffic and often in ground radar shadows. An inexpensive flight alarm (FLARM) was specifically developed in Europe to address the glider-to-glider or close proximity warning requirement without false alarms. The device uses GPS and an altitude barometric sensor to transmit 3D information at a distance of 3–5 km to other FLARM units. The FLARM’s close-formation motion-prediction algorithms identify potential conflicts for up to 50 other signals and warn the pilot using sound and visual cues.

A few years ago, the gliding community in Switzerland experienced several fatal accidents due to glider collisions over the Alps; since voluntarily implementing FLARM, they have not reported any more fatal accidents due to collisions. For the North American market, Power FLARM was developed due to different spectrum management requirements and a desire to include the ability to detect Mode C/S and automatic dependent surveillance-broadcast (ADS-B) signals up to 100 km away to provide glider pilots with a greater capacity to avoid general aviation or commercial airline traffic. In addition, the device is certified as an International Gliding Commission (IGC) data logger to keep downloadable track information. It can store and warn of obstacles in a database, comes in portable or panel-mount variations, and can feed different display devices.

It is not known if Power FLARM would have prevented the accident last year, but users of the devices are satisfied they work well. With the addition of any devices to improve warning, it is up to the pilot to maintain a proper scan and not let a disciplined approach break down. There will always be obstacles, non-equipped aircraft, birds, and malfunctions that will require vigilance. Also, once the information is received, the pilot must take action.

Power FLARM is now approved for use in Canada and in the U.S.A. The Flight Training and Safety Committee for the Soaring Association of Canada is recommending that all glider owners equip their aircraft with Power FLARM (at a cost of less than $2,000), especially those used in competitions or congested soaring areas where ridge or wave soaring is common. In addition, aircraft operating near gliding operations or involved in close-proximity flying with other aircraft in the context of flight schools, parachute operations, helicopter operations, aerobatics or formation flying would greatly benefit from this technology. Contest operations are introducing safety management systems (SMS), and it is hoped the process will reinforce the need for Power FLARM in competitions.

Canadian Owners and Pilots Association (COPA) logo

COPA Corner: Single-Pilot Resource Management (SRM)

by Alexander Burton. This article was previously published in the July 2011 issue of COPA Flight, and is reprinted with permission.

Aviation safety is always a question of risk management. Each flight involves both risk and benefit. Our job as pilots is to maximize the benefit and manage the inherent risk using the best tools at our disposal. The success of how we go about managing risk and the level of risk we are willing to accept can often be traced back to the type and extent of the training we receive or choose to seek out. As Jay Hopkins wrote, “One of the basic attributes of professionals is that they are always seeking to learn more about their profession.”[1]

Single-Pilot Resource Management (SRM), first introduced in 2005 by the National Business Aviation Association[2] and now gaining significant ground in the U.S., is a system designed to help reduce the number of aviation accidents resulting from human error by teaching pilots about their own limitations and providing training guidelines for single pilots operating the new very light jets (VLJ).

While the system was originally developed for training VLJ pilots, it has rapidly been adapted for other technically advanced aircraft (TAA) and it is entirely compatible with the needs of all pilots flying single-pilot aircraft, technically advanced or not. The principles of SRM apply just as well to the single pilot flying at 60 kt as to the single pilot flying at 250 kt.

Accidents statistics for both GA and commercial operations demonstrate clearly: pilot error is the most common cause of aviation accidents. In the United States, between 70 and 90% of all airline and military aviation accidents are traced back to pilot error.[3]

In Canada, pilot error was found to be a “broad cause/factor” in 84% of all aviation accidents and 96% of fatal accidents.[4] As a good friend of mine likes to say, “The biggest threat to aviation safety is the loose link between the yoke and the rudder pedals.”

Most pilots are familiar with the concept of Crew Resource Management (CRM) which focuses on the interactions occurring in the two crew environment. CRM training has been successful in reducing the number and frequency of aviation accidents resulting from the difficulties encountered in a multi-crew environment.

SRM training is designed to provide the assistance needed by pilots operating in a single crew environment and, just for perspective, in the United States GA accounts for 96% of the total number of aircraft, 60% of the total flight hours and 94% of the fatal aviation accidents.[5]

A significant proportion of all aviation and a disproportionate percentage of fatal accidents, at least in North America, involve single-pilot operations.

The practical application of SRM centres on what are called the “5 P’s”. The 5 P’s are based on the idea that five essential variables impact a pilot’s environment and can cause him or her to make a single critical decision or several less critical decisions that when added together can create a critical outcome. [6]

The 5 P variables are: the Plan, the Plane, the Pilot, the Passengers and the Programming.

Using the 5 P’s, the pilot will review the essential variables of the flight, the 5 P’s, at those points during the flight sequence when decisions are typically most likely to be effective: during the pre-flight planning session; prior to takeoff; at mid point during the flight unless the flight is longer than two hours, in which case an hourly review is suggested; prior to descent for landing and just prior to the final approach fix or, if on a VFR flight, just prior to entering the traffic pattern as preparations for landing begin.

Using this system helps the pilot remain alert and aware of the variables that directly affect the safety of the flight and gives him or her scheduled and regular opportunities to review and re-evaluate how the flight is progressing and whether or not a new plan may be required.

Disciplined use of the 5 P’s is, essentially, a “wake up and smell the coffee” prod for the pilot at each of the critical points in the flight sequence.

The “Plan” contains all the basic elements of cross-country planning including weather, routing, fuel requirements and required publications and other information. The Plan is not completed and fixed for all time prior to the flight; it must be reviewed on a regular basis as a flight progresses.

Things change: takeoff can be delayed; unexpected changes in the weather may occur; NOTAMS due to forest fires or police activity may be issued; the extra cup of coffee you drank before jumping in the machine may not allow you to continue for the initially planned time of the flight.

While the initial plan stage is a perfect time to evaluate whether or not a flight should be carried out, it is also an ongoing critical variable of the flight that must be reviewed as the flight progresses and new information becomes available.

“We are what we repeatedly do. 
Excellence, then, is not an act 
but a habit.”-

The “Plane” incorporates all the elements of mechanical and functional aspects of the machine itself. Is the plane capable of the planned flight? Is all maintenance up to date? Do we have sufficient fuel, equipment, avionics, survival supplies, charts and clothing? In TAA aircraft a review of the Plane expands to include items like database currency, automation status and emergency backup systems that were not at all common only a few years ago.

Pilot proficiency and currency may also be included when inventorying and reviewing the “Plane” or may be included in the following P, the “Pilot”.

The “Pilot” is a critical variable in all flights. Traditionally, most of us have been taught the IMSAFE acronym and it is a good place to start. Once again, however, a one-time assessment of the pilot, the person on whom all others in the aircraft and all those poor, non-aviating souls walking about below are dependent, is really not sufficient.

Just as the weather and the condition of the aircraft change throughout the duration of the flight, so too does the condition of the pilot. Fatigue, stress, the effects of low altitude hypoxia and the cumulative effects of noise and vibration all reduce the effectiveness of the person driving the aircraft.

There are reasons why 61% of all aviation accidents occur on landing. At the end of a flight pilot performance is at its lowest point. According to a study carried out by the Australian Bureau of Air Safety Investigation, Department of Transport and Regional Development, the most commonly assigned factor in fatal aviation accidents was poor judgement; judgement is a human capability very susceptible to fatigue.[7]

A review of the condition of the pilot at regular, planned intervals during any flight is one excellent way to increase air safety.

The “Passengers” on a flight can also be a critical variable in safety. Particularly for GA and business aviation, passengers can have significant influence over what a pilot does or does not do and their influence on the pilot can significantly affect how a flight is carried out.

The worst scenario, perhaps, is when one or more of the passengers is also a pilot. There is an old saying: if you ask four rabbis the same question you will get at least five different answers. The same, no doubt, is true of pilots.

When interacting with non-pilots, the pilot in command of the flight must remember passengers do not always understand or appreciate the risks involved in a particular flight. We’ve all heard some variation on the story of the hunters who wanted to get just one more case of beer or one more trophy deer on the aircraft. Setting and maintaining a positive and clearly defined relationship between the pilot and passengers is a critical factor in flight safety.

The “Programming”, most applicable to TAA aircraft, also has importance for less well equipped machines. While pilots of TAA aircraft enjoy many benefits from the new technology, that very technology itself can become a challenge. For VFR flight, particularly, pilots may become so engrossed in their screens and devices they may become distracted and forget to look outside and maintain positive situational awareness.

Pilots flying TAA aircraft must be familiar and comfortable with their fancy devices prior to flight. A good time to learn use of an unfamiliar piece of equipment is on the ground not during a difficult flight segment.

For all flights, organizing the navigational equipment and instrumentation you will use to assist your efforts to achieve safe flight must be evaluated and re-evaluated at appropriate intervals during the flight, whether that is modern, electronic wizardry or maps, watches and pencils.

In his book, Target Risk 2: A New Psychology of Safety and Health, Gerald J. S. Wilde, a professor emeritus of psychology at Queen’s University in Kingston, Ontario, proposes what he refers to as the Risk Homeostasis theory.[8]

The theory of Risk Homeostasis, in short, states that people become accustomed to and comfortable with a particular level of risk. If that level of risk is reduced by some change in the environment, the addition of anti-lock braking systems for example, people tend to respond by driving faster and reducing the distance behind the next vehicle in order to maintain the level of risk with which they are comfortable: people adapt their behaviour to changes in environmental conditions. Few of us willingly embrace change regardless of its form or stated purpose.

As Wilde says, “...safety and lifestyle dependent health is unlikely to improve unless the amount of risk people are willing to take is reduced.”[9]

Systematically implementing SRM into a pilot’s personal procedures is one way to guide and assist him or her toward becoming more safety conscious and toward consciously reducing the level of risk he or she is willing to accept as normal.

Alexander Burton is a Class I instructor, pilot examiner and a regular contributor to several aviation publications both in Canada and in the U.S. He is currently Base Manager for Selair Pilots’ Association in cooperation with Selkirk College, operating their satellite base in beautiful Abbotsford, B.C. (CYXX). He can be contacted at: info@selair.ca.

decorative line above footnotes

[1] Hopkins, Jay. “The Professional Pilot”, Flying, Jan. 10, 2010.

[2] “NBAA Training Guidelines for Single Pilot Operations of Very Light Jets and Technically Advanced Aircraft”. National Business Aviation Association. 2005, www.nbaa.org/ops/safety/vlj/.

[3] Wiegmann, D. A., S.A. Shappell (2001), “Human Error Analysis of Commercial Aviation Accidents Using the Human Factors Analysis and Classification System (HFACS)” (pdf) Federal Aviation Administration. 

[4] Transport Canada, Human Factors for Aviation, Basic Handbook (TP 12863) p. 3.

[5] Kane, Robert (2002), Air Transportation (14th ed.), Kendall/Hunt Publishing Company, p. 751, ISBN 0787288810.

[6] “Managing Risk through Scenario Based Training, Single Pilot Resource Management, and Learner Centered Grading,” Summers, Michele M; Ayers, Frank; Connolly, Thomas; Robertson, Charles. Sept. 2007, www.faa.gov/training_testing/training/fits/guidance/media/RM_thorugh_SBT.pdf.

[7] “Human Factors in Fatal Aircraft Accidents,” Department of Transport and Regional Development Bureau of Air Safety Investigation. www.atsb.gov.au/media/28363/sir199604_001.pdf.

[8] Wilde, Gerald J.S. (2001). Target Risk 2: A New Psychology of Safety and Health.

[9] Wilde, Gerald J.S. “Risk homeostasis theory: an overview”, Injury Prevention, 1998; 4:89-91.



By Brooke Hutchings, NAV CANADA

Canada’s rugged terrain and immense size often result in challenging flights. Throw in our diverse and unpredictable weather conditions, and those challenges intensify. Aircrew have their hands full; however, one thing that pilots do not have to worry about is the provision of alerting service to activate search and rescue (SAR) when an incident occurs. Why? NAV CANADA provides alerting protection to all portions of the flight information region (FIR) where they provide service.

The Canadian Aviation Regulations (CARs) require pilots to file an arrival report as soon as practicable after landing, but not later than one hour after their estimated time of arrival (ETA) (24 hours for a flight itinerary) or by the specified SAR time if non-standard. But what exactly does the provision of SAR “alerting service” by an area control centre (ACC) entail?

If an arrival report is not received at the expected time, ACC air traffic operations specialists (ATS) are required to notify the appropriate joint rescue coordination centre (JRCC) of the overdue aircraft and commence a communications search on a priority basis.

Initial calls actually begin as early as 15 minutes prior to the overdue time, enabling the ATS to potentially locate the pilot prior to involvement of the JRCC, and respond quickly to the JRCC at the overdue time. The communications search involves advising the company and contacting all facilities or contacts at the destination or last reported point. It may involve requesting a police search of the destination airport. During this time, any filed phone numbers will be called, and airports along the route of flight will also be contacted. Within one hour of the overdue time, the ACC must report on the results of the search to the JRCC. If the communications search is unsuccessful, the JRCC will take further actions as required, such as launching search aircraft.

What many may not be aware of is that in addition to providing pilots with enroute and destination SAR protection, ACC ATS also provide departure alerting to proposed flights on an IFR flight plan. If an aerodrome does not have air traffic services onsite that are able to observe the safe departure, then ACC ATS are required to monitor the flight to ensure it departs safely and initiates communications with ATC as expected. Onsite air traffic services include an open control tower, an FIC or an FSS with visibility to the runways. For example, when London Tower closes in the evening; even though the London FIC is open, they do not provide aerodrome advisory service and do not have the required visibility. Since the Sault Ste. Marie FSS, which is responsible for providing remote aerodrome advisory service (RAAS) during that time, is not onsite, responsibility for departure alerting reverts to the Toronto ACC. The flight will be considered overdue one hour after the estimated time of departure (ETD) and the JRCC must be notified. Initial calls to the pilot, company or departure facility may be made as early as 45 minutes after the proposed departure time.

Often, the ACC ATS will find that an aircraft overdue on departure never even arrived at the proposed departure point. The ACC is still obligated to locate the aircraft and ensure its safety. More often, the flight is simply running late.

What further complicates the search activity is when the aircraft has one call-sign inbound (e.g. ABC123) and has a proposed departure outbound with a change in call-sign (e.g. ABC124). The aircraft can still be inbound when the ACC ATS is notified by an overdue departure warning to search for the outbound aircraft.

Remember, once airborne, if you cancel your IFR but retain your flight plan, you are still being provided with alerting services.

Pilots flying VFR on one leg and IFR on another should also be aware of the differences between VFR and IFR alerting services. A FIC will “assume departure” for VFR flights departing remote uncontrolled aerodromes, and VFR alerting service is initiated automatically, but the ACC does not have that luxury. The ACC cannot “assume departure” for IFR flights departing uncontrolled aerodromes as this can negatively affect IFR clearances, separation standards and conflict prediction in the IFR environment. The only exception to this is IFR flight itineraries that remain outside controlled airspace.

Some companies use satellite tracking for their aircraft. This can be especially handy if the dispatcher has real-time data available for the ACC ATS when contacted. Better yet, if those companies could be proactive and call to amend their flight plans when running late, it would help reduce the number of unnecessary communications searches.

In the aviation world, as in life, plans often change unexpectedly. If you find yourself in this position, simply call a NAV CANADA facility and update or cancel your flight plan. Even if you are departing an aerodrome with a control tower, it is important to keep your flight plan up to date.

Updating your “flight plan on file” on a regular basis, and including cell phone numbers, will help reduce the time spent in the communications search stage and may reduce the time required to initiate rescue assistance when actually needed.

Your timely call will help ensure continuous and expeditious service for all and prevent unnecessary activation of SAR operations.

The end of the float could be... the end of your life!

Flight Operations


Visual Flight—Safe and Legal

by Don Taylor, Civil Aviation Safety Inspector, National Operations Branch, Civil Aviation, Transport Canada

You’ve been flying for an hour and a half in what can best be described as marginal VFR weather. You left Kenora, Ont., at 1300Z this morning in the club’s 172 on a VFR flight to Brandon, Man. An approaching warm front has kept you low, but you’ve been able to keep the flight safe and legal. It’s been Class G (uncontrolled) airspace all the way once you cleared the Kenora zone. When flying above 1 000 ft AGL, you have been able to maintain at least 1 mi. flight visibility, as well as 2 000 ft horizontally and 500 ft vertically from cloud. When the ceiling forced you down below 1 000 ft AGL, you were able to maintain 2 mi. flight visibility and stay clear of cloud. By keeping the ground in sight and avoiding built-up areas, you were able to keep it all legal, but just barely.

By diverting a bit to the south, you avoided the controlled airspace at Winnipeg and Portage la Prairie, but now you are approaching Brandon, your destination. You want to enter the control zone to land. The last weather information you have is:

METAR CYBR 091400Z 19008KT 4SM BR 
FEW005 BKN009 M01/M02 A3033 RMK
SF2SF3 SLP278=

Is it VFR? Will they let you in? Will you need special VFR (SVFR)? Can you get SVFR? Why would you want SVFR?

decorative line above footnotes

Control zones, VFR and SVFR
As pilots, air traffic controllers and flight service specialists, we should all know the rules on VFR and SVFR. Why do so many of us misunderstand these concepts? For one thing, some of the rules have changed since we first learned them. Air traffic services (ATS) procedures have been a bit slow to adjust to the new rules, but now the dust has settled. Let’s try to answer some of the questions aviation professionals have on the subject, such as: Why do we have control zones? Why are the weather rules different in control zones? What’s so special about special VFR anyway? If a pilot gets SVFR from ATS, does that mean it’s safe and legal to fly?

Let’s take a look at control zones, VFR and SVFR and the weather minima that go with them to determine what it all means to you, the pilot.

Control zones
Control zones have been a fact of life in Canadian aviation for a long time. We have 130 aerodrome control zones in Canada. According to the Transport Canada Aeronautical Information Manual (TC AIM), control zones are there in order to “keep IFR aircraft within controlled airspace during approaches and to facilitate the control of VFR and IFR traffic.” Perhaps more importantly, it also means that the weather minima are more restrictive. This gives aircraft on an IFR approach a better chance to see and be seen in order to avoid conflict with VFR aircraft in the control zone. A control zone normally has a 5- or 7-NM radius and extends from the surface to about 3 000 ft AGL. This fills the gap nicely, extending controlled airspace right down to the runway.

Along airways, the base of controlled airspace is normally 2 200 ft AGL. A number of airports with an instrument approach procedure (IAP) do not have a control zone. This would mean, for example, that if you are conducting an IFR approach for the Carp Airport, you will finish the approach in Class G (uncontrolled) airspace.

So where are these control zones? Certainly every airport control tower is located in one, because by definition, controllers cannot do their job in uncontrolled airspace. Most flight service stations (FSS) are in control zones, but not all: the Rankin Inlet FSS and the La Grande Rivière FSS are exceptions. Most community aerodrome radio stations (CARS) are not in control zones, but many are: the Fort Simpson and the Fort Smith CARS are located in control zones.

We have many control zones at airports where there are no local ATS or CARS services: Sarnia and Wiarton in Ontario and Princeton in British Columbia are examples.

Above Rocky Mountain House Airport (CYRM), you are in uncontrolled airspace from the runway right up to 18 000 ft. This means that the VFR weather minima at CYRM are much lower than they would be at a Princeton, where there is a control zone.

Visual Flight Rules in Control Zones

Control zone VFR regulations
For VFR flight in a control zone, you are required to maintain:

1. Visual reference to the surface;

2. Flight visibility of 3 mi.;

3. 1 mi. horizontally clear of cloud;

4. At least 500 ft vertically clear of cloud;

5. At least 500 ft AGL, except for takeoff and landing; and

6. Ground visibility (if reported) must be at least 3 mi.

As we said, these stricter rules are to help VFR and IFR aircraft avoid collisions in control zones. For example, an IFR aircraft in a control zone should not expect to encounter VFR aircraft in the first 500 ft after descending out of a cloud deck.

Here are a few things to keep in mind when flying VFR in a control zone:

  • There is no minimum reported ceiling for VFR flight in a control zone. It is left up to the pilot to ensure he can maintain at least 500 ft below cloud and legal altitude above ground regardless of the METAR reported ceiling.
  • Canadian Aviation Regulation (CAR) 602.14 still applies. For example, if you are over a “built-up area”, you will need to maintain at least 1 000 ft above obstacles.
  • In a control zone, you must have both 3 mi. flight visibility and 3 mi. ground visibility (if reported).
  • ATC, FSS or CARS will tell you that “IFR OR SVFR IS REQUIRED” any time the ground visibility is below 3 mi. It’s the pilot’s responsibility to ensure you can comply with all the minima, so if any of the other five are a problem, you need SVFR or IFR.

SVFR regulations
Control zones place stricter weather minima on VFR aircraft to allow “see and avoid” to work between IFR and VFR aircraft.

SVFR allows ATS to relax these more stringent rules when there is no conflicting IFR traffic. In this way, VFR traffic is not unnecessarily restricted. There are still weather minima for SVFR. For your daytime SVFR flight, you can fly provided you can maintain these minima:

  1. Visual reference with the surface;
  2. Height above ground in compliance with CAR 602.14;
  3. Clear of cloud;
  4. Flight visibility of 1 mi.*; and
  5. Ground visibility 1 mi.* (if reported).

Special visual flilght rules in control zones

Note that the SVFR minima are similar to uncontrolled airspace minima. This makes sense. Since there is no conflicting IFR traffic, we don’t really need the more restrictive control zone minima. When you request and obtain SVFR, you are guaranteed protection from IFR traffic conflicts.

If you request it and the ground visibility at the airport is 1 mi.* or more, CAR 602.117 requires ATC to grant SVFR (traffic permitting). They do not have a choice. If you receive SVFR approval from ATC or an FSS, it does not mean that it is legal or safe to fly in the control zone. ATC only knows what the ground visibility is; the other four criteria for SVFR are flight conditions, and it’s your responsibility as the pilot to know and respect these minima.

So how does all this work? 

  1. You are flying VFR down the Skeena River Valley through the Terrace, B.C., control zone westbound towards Prince Rupert. The Terrace weather is:

    METAR CYXT 091700Z 00000KT 8SM OVC007
    M02/M03 A3024 RMK SF8 INTMT -SN

    The Terrace FSS will not tell you that “IFR OR SVFR IS REQUIRED” because the ground visibility is over 3 mi.

    If you were going to Terrace Airport, you might have trouble maintaining the 500 ft below cloud and 500 ft above ground required for VFR flight in the control zone. If that were the case, you should request SVFR. But since you are just passing through the control zone along the river (which is over 500 ft below the airport elevation), you may very well find you can legally fly VFR in that portion of the control zone. SVFR would not be required.

  2. As you approach the Terrace control zone on your return trip, you find the weather has changed a bit:

    METAR CYXT 091900Z 00000KT 2SM BR
    OVC012 M02/M02 A3024 RMK SF8 SLP241= 

    You still have good ceilings and flight visibility of 4 mi. along the river valley, but because the reported ground visibility has dropped below 3 mi., VFR is no longer possible anywhere in the control zone. The Terrace FSS will tell you “IFR OR SVFR IS REQUIRED”, and you will need to request and obtain SVFR to proceed. Your other option is to stay outside the control zone, safe and legal in Class G airspace.

  3. You want to depart from Sarnia on a VFR flight to Toronto. The Sarnia weather is:

    SPECI CYZR 091756Z AUTO 30010KT 2SM 
    -SNSH OVC026 M02/M04 A3015 RMK
    SLP217 MAX WND 31017KT AT 1706Z= 

    Your departure path looks good, with visibility to the east at least 5 mi., but because the reported ground visibility is 2 mi., you cannot legally fly VFR in the Sarnia control zone; SVFR is required. Since there is no ATS unit at Sarnia, you will have to obtain SVFR from the London Flight Information Centre on frequency 123.475 MHz. If you get SVFR, you can be sure no IFR aircraft will be popping out of those snow showers.

  4. You roll your plane out of the hanger at Springbank. When you call the tower for your taxi clearance, they tell you the weather is:

    METAR CYBW 091800Z 33002KT 4SM -FZDZ 
    BR OVC004 M02/M03 A3026 RMK
    ST8 SLP258= 

    In this case, the tower won’t say “IFR OR SVFR IS REQUIRED” because the ground visibility is over 3 mi. You know that you won’t be able fly legally VFR or SVFR with a 400-ft overcast. IFR is your only option, but take another look at that weather. You really don’t want to fly today.

decorative line above footnotes

Back to Manitoba. You’re now 15 mi. from Brandon. It’s time to call the FSS for the advisory. They give you the latest weather information:

METAR CYBR 091500Z 19008KT 4SM BR 
SCT005 BKN008 M01/M02 A3033 RMK
SF3SF4 SLP278=

The flight service specialist knows that the reported visibility is good for VFR at 4 mi., but she doesn’t know if your flight conditions make VFR legal or not. She won’t say “IFR OR SVFR IS REQUIRED” because the ground visibility is over 3 mi. With all that low cloud, you know you won’t be able to stay 500 ft above ground and 500 ft below cloud. You know you need SVFR to stay legal. You make the request, and Winnipeg Area Control Centre approves it. Once you have it, you know you won’t come into conflict with any IFR aircraft. You can maintain the SVFR minima without a problem. Your arrival at Brandon is safe and legal.

The bottom line(s) 

  • Control zones extend controlled airspace down to the runway. Control zone weather regulations provide better conditions for IFR and VFR aircraft to see and be seen.
  • Control zone weather limits are based on reported ground visibility and your flight conditions. ATS will tell you if reported ground visibility makes it illegal to fly VFR (less than 3 mi.) or SVFR (less than 1 mi.*). It is your responsibility to observe and comply with the specified flight conditions.
  • When you request it, ATS will provide SVFR (traffic permitting) when the reported ground visibility is 1 mi.* or more.
  • SVFR guarantees protection from conflicting IFR traffic. It’s there for the pilot’s protection. Request it when you need it.
  • Check out CAR 602.14 (minimum altitudes), CAR 602.114 (VFR) and CAR 602.117 (SVFR).
  • Stay safe, stay legal, and have fun.  

decorative line above footnotes

mi. for helicopters

Focus on CRM

The following article was presented by Captain Dan Maurino, then Coordinator, Flight Safety and Human Factors Programme—ICAO, at the 2005 edition of the Canadian Aviation Safety Seminar (CASS) held in Vancouver, B.C., April 18–20 2005. It is an excellent article on threat and error management (TEM), and it serves our audience well in furthering our current awareness campaign on TEM theory and principles, in the context of extending CRM training for all commercial pilots.

Threat and Error Management

by Captain Dan Maurino (2005)

Threat and error management (TEM) is an overarching safety concept regarding aviation operations and human performance. TEM is not a revolutionary concept, but it evolved gradually, as a consequence of the constant drive to improve the margins of safety in aviation operations through the practical integration of Human Factors knowledge.

TEM developed as a product of the collective industry experience. Such experience fostered the recognition that past studies and, most importantly, operational consideration of human performance in aviation had largely overlooked the most important factor influencing human performance in dynamic work environments: the interaction between people and the operational context (i.e., organizational, regulatory and environmental factors) within which people discharge their operational duties.

The recognition of the influence of the operational context in human performance further led to the conclusion that study and consideration of human performance in aviation operations must not be an end in itself. In regard to the improvement of margins of safety in avaition operations, the study and consideration of human performance without context address only part of a larger issue. TEM therefore aims to provide a principled approach to the broad examination of the dynamic and challenging complexities of the operational context in human performance, for it is the influence of these complexities that generates consequences directly affecting safety.

The TEM model
The TEM model is a conceptual framework that assists in understanding, from an operational perspective, the inter-relationship between safety and human performance in dynamic and challenging operational contexts.

The TEM model focuses simultaneously on the operational context and the people discharging operational duties in such context. The model is descriptive and diagnostic of both human and system performance. It is descriptive because it captures human and system performance in the normal operational context, resulting in realistic descriptions. It is diagnostic because it allows quantifying complexities of the operational context in relation to the description of human performance in that context, and vice-versa.

The TEM model can be used in several ways. As a safety analysis tool, the model can focus on a single event, as is the case with accident/incident analysis; or it can be used to understand systemic patterns within a large set of events, as is the case with operational audits. The TEM model can be used as a licensing tool, helping clarify human performance needs, strengths and vulnerabilities, allowing the definition of competencies from a broader safety management perspective. The TEM model can be used as a training tool, helping an organization improve the effectiveness of its training interventions, and consequently of its organizational safeguards.

Originally developed for flight deck operations, the TEM model can nonetheless be used at different levels and sectors within an organization, and across different organizations within the aviation industry. It is therefore important, when applying TEM, to keep the user’s perspective in the forefront. Depending on “who” is using TEM (front-line personnel, intermediate management, senior management; flight operations, maintenance, air traffic control), slight adjustments to related definitions may be required. This paper focuses on the flight crew as “user”, and the discussion herein presents the perspective of flight crews’ use of TEM.

The components of the TEM model 
There are three basic components in the TEM model, from the perspective of flight crews: threats, errors and undesired aircraft states. The model proposes that threats and errors are part of everyday aviation operations that must be managed by flight crews, since both threats and errors carry the potential to generate undesired aircraft states. Flight crews must also manage undesired aircraft states, since they carry the potential for unsafe outcomes. Undesired state management is an essential component of the TEM model, as important as threat and error management. Undesired aircraft state management largely represents the last opportunity to avoid an unsafe outcome and thus maintain safety margins in flight operations.

Threats are defined as “events or errors that occur beyond the influence of the flight crew, increase operational complexity, and which must be managed to maintain the margins of safety.” During typical flight operations, flight crews have to manage various contextual complexities. Such complexities would include, for example, dealing with adverse meteorological conditions, airports surrounded by high mountains, congested airspace, aircraft malfunctions, errors committed by other people outside of the cockpit, such as air traffic controllers, flight attendants or maintenance workers, and so forth. The TEM model considers these complexities as threats because they all have the potential to negatively affect flight operations by reducing margins of safety.

Some threats can be anticipated, since they are expected or known to the flight crew. For example, flight crews can anticipate the consequences of a thunderstorm by briefing their response in advance, or prepare for a congested airport by making sure they keep a watchful eye for other aircraft as they execute the approach.

Some threats can occur unexpectedly, such as an in-flight aircraft malfunction that happens suddenly and without warning. In this case, flight crews must apply skills and knowledge acquired through training and operational experience.

Lastly, some threats may not be directly obvious to, or observable by, flight crews immersed in the operational context, and may need to be uncovered by safety analyses. These are considered latent threats. Examples of latent threats include equipment design issues, optical illusions, or shortened turn-around schedules.

Regardless of whether threats are expected, unexpected, or latent, one measure of the effectiveness of a flight crew’s ability to manage threats is whether threats are detected with the necessary anticipation to enable the flight crew to respond to them through deployment of appropriate countermeasures.

Threat management is a building block to error management and undesired aircraft state management. Although the threat-error linkage is not necessarily straightforward, although it may not be always possible to establish a linear relationship, or one-to-one mapping between threats, errors and undesired states, archival data demonstrates that mismanaged threats are normally linked to flight crew errors, which in turn are oftentimes linked to undesired aircraft states. Threat management provides the most proactive option to maintain margins of safety in flight operations, by voiding safety-compromising situations at their roots. As threat managers, flight crews are the last line of defense to keep threats from impacting flight operations.

Table 1 presents examples of threats, grouped under two basic categories derived from the TEM model. Environmental threats occur due to the environment in which flight operations take place. Some environmental threats can be planned for and some will arise spontaneously, but they all have to be managed by flight crews in real time. Organizational threats, on the other hand, can be controlled (i.e., removed or, at least, minimised) at source by aviation organizations. Organizational threats are usually latent in nature. Flight crews still remain the last line of defense, but there are earlier opportunities for these threats to be mitigated by aviation organizations themselves.

Table 1. Examples of threats (List not inclusive)

Environmental Threats Organizational Threats
  • Weather: thunderstorms, turbulence, icing, wind shear, cross/tailwind, very low/high temperatures.
  • ATC: traffic congestion, TCAS RA/TA, ATC command, ATC error, ATC language difficulty, ATC non-standard phraseology, ATC runway change, ATIS communication, units of measurement (QFE/meters).
  • Airport: contaminated/short runway; contaminated taxiway, lack of/confusing/faded signage/markings, birds, aids U/S, complex surface navigation procedures, airport constructions.
  • Terrain: High ground, slope, lack of references, “black hole”.
  • Other: similar call-signs.
  • Operational pressure: delays, late arrivals, equipment changes.
  • Aircraft: aircraft malfunction, automation event/anomaly, MEL/CDL.
  • Cabin: flight attendant error, cabin event distraction, interruption, cabin door security.
  • Maintenance: maintenance event/error.
  • Ground: ground handling event, de-icing, ground crew error.
  • Dispatch: dispatch paperwork event/error.
  • Documentation: manual error, chart error.
  • Other: crew scheduling event.

Errors are defined “actions or inactions by the flight crew that lead to deviations from organizational or flight crew intentions or expectations.” Unmanaged and/or mismanaged errors frequently lead to undesired aircraft states. Errors in the operational context thus tend to reduce the margins of safety and increase the probability of adverse events.

Errors can be spontaneous (i.e., without direct linkage to specific, obvious threats), linked to threats, or part of an error chain. Examples of errors would include the inability to maintain stabilized approach parameters, executing a wrong automation mode, failing to give a required callout, or misinterpreting an ATC clearance.

Regardless of the type of error, an error’s effect on safety depends on whether the flight crew detects and responds to the error before it leads to an undesired aircraft state and to a potential unsafe outcome. This is why one of the objectives of TEM is to understand error management (i.e., detection and response), rather than solely focusing on error causality (i.e., causation and commission). From the safety perspective, operational errors that are timely detected and promptly responded to (i.e., properly managed), errors that do not lead to undesired aircraft states, do not reduce margins of safety in flight operations, and thus become operationally inconsequential. In addition to its safety value, proper error management represents an example of successful human performance, presenting both learning and training value.

Capturing how errors are managed is then as important, if not more so, than capturing the prevalence of different types of errors. It is of interest to capture if and when errors are detected and by whom, the response(s) upon detecting errors, and the outcome of errors. Some errors are quickly detected and resolved, thus becoming operationally inconsequential, while others go undetected or are mismanaged. A mismanaged error is defined as an error that is linked to or induces an additional error or undesired aircraft state.

Table 2 presents examples of errors, grouped under three basic categories derived from the TEM model. In the TEM concept, errors have to be “observable” and therefore, the TEM model uses the “primary interaction” as the point of reference for defining the error categories.

The TEM model classifies errors based upon the primary interaction of the pilot or flight crew at the moment the error is committed. Thus, in order to be classified as an aircraft handling error, the pilot or flight crew must be interacting with the aircraft (e.g. through its controls, automation or systems). In order to be classified as a procedural error, the pilot or flight crew must be interacting with a procedure (e.g. checklists; SOPs; etc). In order to be classified as a communication error, the pilot or flight crew must be interacting with people (ATC; groundcrew; other crew members, etc.).

Aircraft handling errors, procedural errors and communication errors may be unintentional or involve intentional non-compliance. Similarly, proficiency considerations (i.e., skill or knowledge deficiencies, training system deficiencies) may underlie all three categories of error. In order to keep the approach simple and avoid confusion, the TEM model does not consider intentional non-compliance and proficiency as separate categories of error, but rather as sub-sets of the three major categories of error.

Table 2. Examples of errors (List not inclusive)

Aircraft handling errors
  • Manual handling/flight controls: vertical/lateral and/or speed deviations, incorrect flaps/speedbrakes, thrust reverser or power settings.
  • Automation: incorrect altitude, speed, heading, autothrottle settings, incorrect mode executed, or incorrect entries.
  • Systems/radio/instruments: incorrect packs, incorrect anti-icing, incorrect altimeter, incorrect fuel switches settings, incorrect speed bug, incorrect radio frequency dialled.
  • Ground navigation: attempting to turn down wrong taxiway/runway, taxi too fast, failure to hold short, missed taxiway/runway.

Procedural errors

  • SOPs: failure to cross-verify automation inputs.
  • Checklists: wrong challenge and response; items missed, checklist performed late or at the wrong time.
  • Callouts: omitted/incorrect callouts.
  • Briefings: omitted briefings; items missed.
  • Documentation: wrong weight and balance, fuel information, ATIS, or clearance information recorded, misinterpreted items on paperwork; incorrect logbook entries, incorrect application of MEL procedures.

Communication errors

  • Crew to external: missed calls, misinterpretations of instructions, incorrect readback, wrong clearance, taxiway, gate or runway communicated.
  • Pilot to pilot: within crew miscommunication or misinterpretation.

Undesired aircraft states
Undesired aircraft states are defined as “flight crew-induced aircraft position or speed deviations, misapplication of flight controls, or incorrect systems configuration, associated with a reduction in margins of safety.” Undesired aircraft states that result from ineffective threat and/or error management may lead to compromising situations and reduce margins of safety in flight operations. Often considered at the cusp of becoming an incident or accident, undesired aircraft states must be managed by flight crews.

Examples of undesired aircraft states would include lining up for the incorrect runway during approach to landing, exceeding ATC speed restrictions during an approach, or landing long on a short runway requiring maximum braking. Events such as equipment malfunctions or ATC controller errors can also reduce margins of safety in flight operations, but these would be considered threats.

Undesired states can be managed effectively, restoring margins of safety, or flight crew response(s) can induce an additional error, incident, or accident.

Table 3 presents examples of undesired aircraft states, grouped under three basic categories derived from the TEM model.

Table 3. Examples of undesired aircraft states (List not inclusive)    

Aircraft handling
  • Aircraft control (attitude).
  • Vertical, lateral or speed deviations.
  • Unnecessary weather penetration.
  • Unauthorized airspace penetration.
  • Operation outside aircraft limitations.
  • Unstable approach.
  • Continued landing after unstable approach.
  • Long, floated, firm or off-centreline landing.
Ground navigation
  • Proceeding towards wrong taxiway/runway.
  • Wrong taxiway, ramp, gate or hold spot.
Incorrect aircraft configurations
  • Incorrect systems configuration.
  • Incorrect flight controls configuration.
  • Incorrect automation configuration.
  • Incorrect engine configuration.
  • Incorrect weight and balance configuration.

An important learning and training point for flight crews is the timely switching from error management to undesired aircraft state management. An example would be as follows: a flight crew selects a wrong approach in the Flight Management Computer (FMC). The flight crew subsequently identifies the error during a crosscheck prior to the Final Approach Fix (FAF). However, instead of using a basic mode (e.g. heading) or manually flying the desired track, both flight crew become involved in attempting to reprogram the correct approach prior to reaching the FAF. As a result, the aircraft “stitches” through the localiser, descends late, and goes into an unstable approach. This would be an example of the flight crew getting “locked in” to error management, rather than switching to undesired aircraft state management. The use of the TEM model assists in educating flight crews that, when the aircraft is in an undesired state, the basic task of the flight crew is undesired aircraft state management instead of error management. It also illustrates how easy it is to get locked in to the error management phase.

Also from a learning and training perspective, it is important to establish a clear differentiation between undesired aircraft states and outcomes. Undesired aircraft states are transitional states between a normal operational state (i.e., a stabilised approach) and an outcome. Outcomes, on the other hand, are end states, most notably, reportable occurrences (i.e., incidents and accidents). An example would be as follows: a stabilised approach (normal operational state) turns into an unstablised approach (undesired aircraft state) that results in a runway excursion (outcome).

The training and remedial implications of this differentiation are of significance. While at the undesired aircraft state stage, the flight crew has the possibility, through appropriate TEM, of recovering the situation, returning to a normal operational state, thus restoring margins of safety. Once the undesired aircraft state becomes an outcome, recovery of the situation, return to a normal operational state, and restoration of margins of safety is not possible.

Flight crews must, as part of the normal discharge of their operational duties, employ countermeasures to keep threats, errors and undesired aircraft states from reducing margins of safety in flight operations. Examples of countermeasures would include checklists, briefings, call-outs and SOPs, as well as personal strategies and tactics. Flight crews dedicate significant amounts of time and energies to the application of countermeasures to ensure margins of safety during flight operations. Empirical observations during training and checking suggest that as much as 70% of flight crew activities may be countermeasures-related activities.

All countermeasures are necessarily flight crew actions. However, some countermeasures to threats, errors and undesired aircraft states that flight crews employ build upon “hard” resources provided by the aviation system. These resources are already in place in the system before flight crews report for duty, and are therefore considered as systemic-based countermeasures. The following would be examples of “hard” resources that flight crews employ as systemic-based countermeasures:

  • Airborne Collision Avoidance System (ACAS);
  • Ground Proximity Warning System (GPWS);
  • Standard operation procedures (SOPs);
  • Checklists;
  • Briefings;
  • Training.

Other countermeasures are more directly related to the human contribution to the safety of flight operations. These are personal strategies and tactics, individual and team countermeasures, that typically include canvassed skills, knowledge and attitudes developed by human performance training, most notably, by crew resource management (CRM) training. There are basically three categories of individual and team countermeasures:

  • Planning countermeasures: essential for managing anticipated and unexpected threats;
  • Execution countermeasures: essential for error detection and error response;
  • Review countermeasures: essential for managing the changing conditions of a flight.

Enhanced TEM is the product of the combined use of systemic-based and individual and team countermeasures. Table 4 presents detailed examples of individual and team countermeasures.

Table 4. Examples of individual and team countermeasures

Planning Countermeasures
SOP BRIEFING The required briefing was interactive and operationally thorough
  • Concise, not rushed, and met SOP requirements
  • Bottom lines were established
PLANS STATED Operational plans and decisions were communicated and acknowledged
  • Shared understanding about plans
  • “Everybody on the same page”
Roles and responsibilities were defined for normal and non-normal situations
  • Workload assignments were communicated and acknowledged
Crew members developed effective strategies to manage threats to safety
  • Threats and their consequences were anticipated
  • Used all available resources to manage threats
Execution Countermeasures
Crew members actively monitored and cross-checked systems and other crew members
  • Aircraft position, settings, and crew actions were verified
Operational tasks were prioritized and properly managed to handle primary flight duties
  • Avoided task fixation
  • Did not allow work overload
Automation was properly managed to balance situational and/or workload requirements
  • Automation setup was briefed to other members
  • Effective recovery techniques from automation anomalies
Review Countermeasures
Existing plans were reviewed and modified when necessary
  • Crew decisions and actions were openly analyzed to make sure the existing plan was the best plan
INQUIRY Crew members asked questions to investigate and/or clarify current plans of action
  • Crew members not afraid to express a lack of knowledge
  • “Nothing taken for granted” attitude
ASSERTIVENESS Crew members stated critical information and/or solutions with appropriate persistence
  • Crew members spoke up without hesitation

Bounce Back! Train Your Crews for Bounced Landing Recovery Techniques!

Incorrect recoveries from bounced landings have contributed to several accidents in which aeroplanes operated by Canadian Subpart 705 air operators have sustained substantial damage. After investigating the bounced landing and subsequent tail strike during the go-around of a Boeing 727 at the Hamilton International Airport, the Transportation Safety Board of Canada (TSB) has recommended, in TSB Final Report A08O0189, that air operators “…incorporate bounced landing recovery techniques in the flight manuals and to teach these techniques during initial and recurrent training.” (TSB A09-01)

As a result of this recommendation, on January 1, 2010, Transport Canada issued Advisory Circular (AC) 705-007, which encouraged Canadian Subpart 705 air operators to voluntarily institute bounced landing recovery training into their flight crew training syllabus, and to provide bounced landing information in their company operations manual (COM). The AC includes excellent references, including accident reports for review. A must-read reference is the Flight Safety Foundation’s Approach and Landing Accident Reduction (ALAR) Tool Kit, 6.4 Bounce Recovery – Rejected Landing. In fact, while you’re at it, you may want to re-familiarize yourself with the entire ALAR Tool Kit, which received a significant update in 2010. Just visit this link: FSF ALAR.

Transport Canada is currently assessing the effectiveness of the voluntary approach to bounced landing recovery training. We encourage all air operators, not only 705 but also 703 and 704, to add this important training to their annual and recurrent training syllabus.

Got time for a quick refresher on 
uncontrolled aerodrome procedures?

...take five minutes to review the 
and take five more to review the 

airplane about to land on runway

maintenance and certification icon


Top 10 Tips for Turbines

by James Careless, Aircraft Maintenance Technology (AMT) contributor. This article was originally published in the July 2008 issue of AMT magazine, and is reprinted with permission.

Turbine engines are many aircraft technicians’ bread-and-butter. But even the most experienced technician can benefit from some sage advice on turbine repair and servicing, as provided by the experts at Dallas Airmotive and Standard Aero. Here is the cream of their collected wisdom, distilled into 10 Top Tips for Turbines!

1. Before you start, think
Tearing a turbine engine apart when you haven’t formulated a plan of attack first is a recipe for disaster. Not only could you miss the problem you are trying to fix, but you could even make matters worse, not better. This is why Standard Aero SVP of Technology Kim Olson stresses “getting your overall mindset together first. You need to go over the fault reports you’ve got, then pull out the manuals and look them over carefully,” he tells AMT. “Next, you have to use this information to put together a comprehensive plan of attack, making sure that you take the right tools for the job and follow the proper precautions as well. Do your homework before you start diving in and turning wrenches!”

Mechanic working on a turbine
Before you start working on a turbine, put together
a plan of attack with the right tools and manuals.
(Photo: Dallas Airmotive)

2. Talk to the flight crew
Troubleshooting an intermittent fault is a technician’s worst nightmare, especially when it can’t be recreated in the shop. This is why it is important to thoroughly debrief the flight crew to find out the conditions under which the fault occurred. “Does it only occur at 18 000 ft or when the anti-icing system is on? These are details that can help you pinpoint a problem,” says Larry Galarza, Dallas Airmotive’s 731 field service manager. “But you can only learn about these details if you talk to the flight crew and get comprehensive answers first. So get out there and ask questions; lots of questions.”

3. Let’s say it again—read the manual
When it comes to making mistakes in turbine repair, “the most common error is not to read the manual first,” says Olson. “I know we’re guys and that we like to assemble things before we ever look at a manual, but turbine engines are complicated. Read first, then act.”

4. Troubleshoot carefully
When you are troubleshooting a turbine, take your time and be careful not to jump to conclusions. “Every detail counts,” explains Olson. “Depending on the symptoms and evidence you find, troubleshooting will lead you to draw different conclusions. Rush through the process, and you could end up drawing the wrong conclusions; to the detriment of the engine and possibly yourself.”

5. Work methodically
Turbine engines are complex, so be sure to approach them in a logical manner. In particular, work in a methodical, step-by-step basis. You don’t want to find yourself at job’s end with a few unexplained spare parts!

6. Know your limitations
It is important to know what you are capable of doing on a turbine engine, and when you are out of your league. “Don’t be afraid to pick up the phone to ask someone for qualified advice,” says Terry Huecker, Dallas Airmotive’s Pratt & Whitney 300/500 field service manager. “Many companies such as Pratt & Whitney and Honeywell have excellent help desks. As well, it makes sense to build a community of technicians who you can consult and who can consult you. You can meet them at training courses, conventions, or even social events. Wherever you find them, get networking today to have people to call tomorrow.”

7. Get out your borescope
When in doubt, it makes sense to get a closer look at possible problem areas inside an engine using a borescope. “If you go in early enough, you can often catch a problem such as a cracked blade before it becomes serious,” says Olson. “Problems caught early are easier and less expensive to fix, and don’t result in additional problems such as having damaged blade fragment and damaging the entire engine.”

8. Take the turbine’s temperature
Tracking down an elusive problem? Try checking the turbine’s inlet temperature over time—using data downloaded from the aircraft’s monitoring system—“can guide you as to where you should start looking,” Olson says.

9. Don’t be rushed
When it comes to troubleshooting and then repairing a turbine engine, give yourself the time to do the job correctly. “A lot of times aircraft technicians get caught up in the hurry to get an aircraft back into service,” says Galarza. “Don’t let them put a flight schedule in front of you. Stick to your skills and your expertise, and do the job properly at the right pace.”

10. Finally, a clean turbine is a happy turbine
Well, maybe not happy, but taking the time to do compressor washes on a regular basis can reduce blade corrosion. In turn, reduced blade corrosion means longer life and more efficient fuel usage; a critical concern given today’s sky-high fuel prices.

“I have seen a number of engines that were stored for future repair without having their compressors washed,” Olson says. “The resulting corrosion can be so bad that the engine may end up being irreparable by the time it gets pulled out of storage for servicing.” He adds that fuel nozzle cleaning “is also very important for a turbine engine’s health and longevity.”

Double or Triple Release?

by Brad Taylor, Civil Aviation Safety Inspector, Operational Airworthiness, Standards Branch, Civil Aviation, Transport Canada

Maintaining a stores department for an air operator or distributor is not a simple task! Ensuring that high demand spares are always available requires a systematic approach for processing rotables and replenishing consumable materials. Success or failure in this discipline can mean the difference between profit and loss for an organization.

The personnel working in this capacity must be experienced in the handling and shipping of aviation components, ranging from lead acid or nickel cadmium batteries, static sensitive components, chemicals, and a wide variety of hazardous materials. Then, just to make the job just a bit more demanding, personnel are often called upon to be inspectors and are expected to be well versed on the regulatory requirements associated with the job, such as segregating serviceable and unserviceable products, purchase orders, eligibility and international agreements for maintenance acceptance.

The purpose of this article is to focus specifically on maintenance releases for rotable (repairable) parts that, on occasion, must be maintained by organizations located outside of Canada. This genre of spare parts represents a large investment for an organization and therefore demands the most attention by the stores personnel to ensure that it is managed as efficiently as possible.

Aeronautical products maintained under any regulatory system receive a maintenance release after the maintenance is complete, which states the pertinent data by which the work was completed and under which regulatory system the work is acceptable. The regulatory reference and the approval number of the organization that performed the work are also essential to the subsequent installer in order to determine whether the product has been maintained in accordance with the applicable standards of airworthiness for the aircraft or assembly on which the product is to be installed. This determination (eligibility) is the aircraft maintenance engineer’s (AME) responsibility and the basis for this decision is the country in which the aircraft or assembly is registered. Of course there are more factors involved in the decision, including parts numbers, mod status of the aircraft/component, etc., but the first step is determining the applicable regulatory system by which the aircraft or component must be maintained.

Approved maintenance organizations (AMO) and distributors find that having “maintained” aeronautical products in their inventory that have dual releases to be advantageous; these products are accepted for installation by two regulatory authorities, the European Aviation Safety Agency (EASA)/Transport Canada Civil Aviation (TCCA) or the U.S. Federal Aviation Administration (FAA)/EASA. A dual release adds value to the product in the resale market and provides flexibility to large operators when aircraft are registered in different countries. Applying the same logic, a part with a triple release would be of even more value, if it were possible.

Recently, we (Transport Canada [TC]) have been receiving some comments from EASA-based Part 145 AMOs, informing us that they were no longer allowed to issue a triple release. Some organizations hold EASA Part 145 approvals as well as FAA and Canadian approvals for repairing aeronautical products. They have often certified the work performed on an authorized release certificate with all three regulatory references so the customers could install the item on a wide variety of aircraft or distribute them to a broader customer base. It was a service that provided the customer with more flexibility with respect to their spares.

The issue with this practice isn’t that the organization doesn’t have the authority; it’s more of a technicality within the international agreements. The agreements are bilateral between parties such as Canada and EASA, or EASA and the FAA; they are not trilateral. Therefore, the agreements were never intended to be applied at the same time, which means the application of all three approvals on one authorized release certificate would not be appropriate or acceptable. This is also evident when examining the authorized release certificate forms or templates recognized by TC, the FAA or EASA. None of them allow for more than two regulatory references because the document is intended to be used with a maximum of two parties.

So what can an organization receiving, selling or using maintained aeronautical products do? Firstly, in the short term, we recommend a discussion take place with your staff to ensure that everyone knows how to identify a discrepant authorized release certificate. Secondly, if an organization wishes to maintain this flexibility within its spares pool, it must be specified on the work order that the repair organization issued separate authorized release certificates in order to respect international agreements. This may add cost and paperwork to the process, but it will ensure that an organization has a spare part which is of maximum value to it.


by Gerry Binnema. Gerry is a renowned consultant and facilitator in all aviation safety management topics. For more information, visit www.gjbconsulting.com.

One of the greatest fears an aircraft maintenance technician has is making an error that leads to a fatal accident. Maintenance errors occur every day; fortunately these errors are usually caught well before anything terrible happens. The most common maintenance errors are errors of omission: the technician knows what to do, intends to do the right thing, but for some reason, a step is overlooked. A bolt doesn’t get properly torqued, a nut doesn’t get a cotter pin, or an assembly lacks an O-ring. A distraction at a critical moment is often a contributing factor to such errors.

Over the last couple of years, I have run several recurrent training sessions on human factors in maintenance. Through the use of a quick poll, I asked people which of the dirty dozen they find to be most significant in their workplaces. The results have been quite consistent, with distraction being the most significant issue that people are currently facing. This is certainly a sign of our times, as the prevalence of smart phones and the expectation of immediate responses to e-mails and phone calls has led to frequent disruptions in the workplace for all of us.

There is a fallacy that we are becoming better at multi-tasking and can therefore handle these disruptions. The truth is, multi-tasking is an illusion that our brain generates as we rapidly switch our attention between various tasks. We can only focus our conscious attention on one thing at a time, and while we focus on one thing, we lose our focus on whatever else we are supposed to be doing. This creates an opportunity for errors of omission.

Managing distractions is obviously a significant topic of discussion that we need to have in our workplace. During my last human factors course, I facilitated a discussion on managing distractions and promised to write an article based on that discussion. I am indebted to that class of experienced maintenance technicians for the following ideas on how to manage distractions.

Perhaps the first and most significant idea is to get rid of the belief that we are capable of multi-tasking. If you are conducting maintenance while also engaging in some other activity that requires your conscious attention, then you are setting yourself up for failure. Create rules in the workplace regarding common distractions such as phones, tablets, or other technology near a working technician. Even if a person says they will ignore incoming messages, a flashing light or soft beeping signalling a new message will distract the technician, affecting their focus on the work at hand. Keep this in mind driving around the ramp and for run-ups. If you are talking on a cell phone you are not focusing on the task at hand.

Another idea is creating an atmosphere and culture in the workplace that makes it okay to say “not right now.” Maintenance tasks often require an extra set of hands so we are often asked to help move an airplane, hold a propeller or provide other types of support. We all want to be good team members and we are always willing to help, but when those distractions come at critical moments, the possibility of an error of omission is introduced. We need to support the person who says “not right now” under those circumstances. Often we just need a couple of minutes to complete a step and then are able to help out, thereby eliminating the fear that something critical may be missed.

If you are distracted, or step away from the job even for a moment, review the last three steps of the job to make sure they were completed before you move on. Our minds are always thinking several steps ahead in the job we are doing and when we are distracted and then return to the job, it is often easy for us to believe that we were several steps further ahead than we actually are. Use the maintenance task card or checklist as they were intended to be used by signing off on each task as it is completed. This will help ensure that we don’t get too far ahead of ourselves.

Finally, plan ahead to avoid distractions. You may have many different responsibilities at your workplace and these may lead to conflicting priorities. If you are a crew chief or a manager, ensure that you set up your day so that you can deal with your managerial responsibilities during certain hours and then focus on your maintenance responsibilities when you are on the hangar floor.

None of these suggestions are especially difficult to execute, but they require a great deal of discipline to actually follow consistently. By taking the threat of distractions seriously, we can create a culture in our workplace that encourages good habits. I encourage you to bring up the threat of distraction at your next pre-shift briefing to discuss some of these ideas.

STOP! Inventory your tools after each job



The following summaries are extracted from final reports issued by the Transportation Safety Board of Canada (TSB). They have been de-identified and include the TSB’s synopsis and selected findings. Some excerpts from the analysis section may be included, where needed, to better understand the findings. For the benefit of our readers, all the occurrence titles below are now hyperlinked to the full TSB report on the TSB Web site. —Ed.

TSB Final Report A08P0241—Aerodynamic Stall—Collision with Terrain

On August 3, 2008, at 07:08 Pacific Daylight Time (PDT), a Grumman G-21A Goose amphibian operating as a charter flight departed Port Hardy Airport, B.C., on a VFR flight to Chamiss Bay, B.C. At 08:49 and again at 09:08, the flight follower attempted to contact the tugboat meeting the aircraft at Chamiss Bay by radiotelephone but was unsuccessful. At 09:53, the flight follower reported the aircraft overdue to the joint rescue coordination centre (JRCC) in Victoria, B.C., and an aerial search was initiated. A search and rescue (SAR) aircraft located the wreckage on a hillside near Alice Lake, approximately 14 NM from its departure point. A post-crash fire had ignited. The emergency locator transmitter (ELT) had been destroyed in the crash and did not transmit. The accident happened at about 07:22. Of the seven occupants, the pilot and four passengers were fatally injured, one passenger suffered serious injuries, while another suffered minor injuries. The two survivors were evacuated from the accident site at approximately 16:10.

amphibian plane crashed in woods


Nothing was found to indicate that there was any airframe or system malfunction before or during the flight.

The weather at Port Hardy was VFR, consistent with the forecast. Even though the ceiling was at 1 000 ft AGL, the visibility was very good at 20 SM. The pilot likely expected the clouds observed along the mountain ridge to the south and southwest of the airport to be patchy as per the graphic area forecast (GFA). Knowing that the weather at Chamiss Bay was sunny with good visibility, the pilot likely considered the clouds on the mountain tops as local phenomena, which he could negotiate to successfully cross the ridge. This assessment of the weather likely led the pilot to choose the direct route.

As the flight proceeded towards the higher terrain, the pilot likely discovered that the cloud coverage was more extensive than observed from the ground, with hilltops obscured. Considering that the pilot was not instrument rated and the aircraft was not certified for IFR flight, he would have rejected the idea of climbing into the clouds and proceeding under IFR. Instead, his options would have been to turn around (either return to Port Hardy or double-back to follow the low-level route along the coast), continue towards a pass that would allow him to cross the ridge into better weather, or try to fly above the clouds on the ridge and below the overcast ceiling. It is likely that he found the weather conditions at the pass to be unsuitable and instead elected to climb above the ridge and below the overcast ceiling. The climb began, gently at first, then more abruptly with what was probably full climb power. With clouds obscuring the ridge, the pilot would have recognized the risk of flight into terrain if he allowed the aircraft to penetrate the clouds. During the climb, the aircraft reached the stall angle and the left wing dropped. This caused the aircraft to lose considerable height. The pilot was able to recover from the stall in a nose-down attitude. Before he could raise the nose to the level position, the aircraft struck the tops of several trees, which slowed the aircraft before it fell to the ground.

The failure of the ELT to activate upon impact significantly increased the risk to survivors. In this case, the ELT was destroyed on impact, which hindered SAR efforts to locate the downed aircraft.

It is unknown whether the pilot attempted to contact flight following in the moments before the accident. The fact that the aircraft could not be reached did not alarm the company flight following because it was not unusual for aircraft to be out of radio range of the flight watch facility. It was also not unusual for pilots to land somewhere along their route to wait for weather to improve before continuing to destination. As a result, the company did not notify the Victoria JRCC until 09:53, about one hour after the aircraft’s expected arrival time back at Port Hardy. The lack of an effective means of tracking the flight progress led to delays in SAR action. These delays increased the risk to survivors.

Findings as to causes and contributing factors 

  1. While likely climbing to fly above a cloud-covered ridge and below the overcast ceiling, the aircraft stalled aerodynamically at a height from which full recovery could not be made before striking the trees.

  2. The aircraft broke apart upon impact, and electrical arcing from exposed wires in the presence of spilled fuel caused a fire that consumed most of the aircraft.

Findings as to risk 

  1. While the company’s established communications procedures and infrastructure met the regulatory requirements, they were not effective in ascertaining an aircraft’s position and flight progress, which delayed critical SAR action.

  2. The ELT was destroyed in the crash and failed to operate, making it difficult for SAR to find the aircraft. This prolonged the time the injured survivors had to wait for rescue and medical attention.

Safety action taken 

After conducting a risk assessment of its routes, the operator selected the latitude system, which provides an ELT-like function. This system has been installed on all company floatplanes.

The operator has recognized the need for a tailored pilot decision making (PDM) course for its subpart 703 VFR floatplane pilots. A flight training unit has been contracted to create a special PDM course for single-pilot float operations, and the company has worked closely with them to develop the course outline. The course is to consist of one day of classroom instruction and one of practical instruction in a simulator. Emphasis will be on cockpit resources for a single pilot, decision-making processes, physiological and psychological effects, GPS issues, and a review of relevant accidents.

The operator has instituted VFR line checks as part of its monitoring and quality control, which are similar to its subpart 704 and subpart 705 operations.

The operator reviewed its safety management system (SMS) manual and included revised risk assessment procedures. It also reviewed accident investigation procedures and contracted with outside consultants to conduct three days of accident investigation and risk assessment training for company management and supervisors.

TSB Final Report A08W0162—Controlled Flight Into Water

On August 9, 2008, the pilot and sole occupant of the Bell 206B helicopter was departing from its base on the west bank of the Yukon River at Carmacks, Y.T., at about 07:00 Pacific Daylight Time (PDT). After lifting off the pad into a low hover facing away from the river, the pilot pedal-turned through 180 degrees to the left and departed over the river on an easterly heading. Shortly thereafter, there was a loud impact and splash, and pieces of wreckage drifted down the river. A pilot and two aircraft maintenance engineers (AME), who were preparing a Bell 205 helicopter for flight from an adjacent pad, immediately started the aircraft, tracked the aft fuselage section that was floating down the river, and assisted in its recovery. The submerged forward fuselage section, engine, and transmission were not recovered until located by side-scan sonar on August 17, 2008. The pilot drowned.

piece of helicopter fuselage


A normal helicopter departure requires the pilot to lower the nose of the aircraft slightly and to increase collective pitch to initiate forward flight and begin to climb. During the departure/climb phase of the flight, any problems, such as a loss of power, would be countered by raising the nose to initiate a flare to slow the helicopter for landing. In this occurrence, the pilot accelerated to about 40 knots through translation in a level or slightly nose-down attitude, flying in a straight line for about 14 seconds until impact. Engine and rotor sounds were normal, and wreckage examination did not reveal mechanical or control anomalies that would have prevented the helicopter from accelerating and climbing.

The pilot had lifted off facing away from the sun and then had turned to face directly into the sun as he began forward flight. A more common departure procedure in a single-engine helicopter would be to turn 90 degrees to the left or right, to accelerate and climb along the riverbank before turning out over the water. This would decrease the risk of having to ditch in the fast-flowing river in case of an engine or power train failure.

The sun was at a low angle above his horizon and the bright sunlight was compounded by its strong reflection off the water. The resulting glare on and through the windscreen would have obscured the pilot’s forward vision before his eyes could react to the sudden brightness, especially because he was not wearing sunglasses. The bright light would also have obscured the instrument panel in shadow, depriving the pilot of backup instrument information.

During this period, the helicopter would have been accelerating. Somatogravic illusion would likely have caused the pilot to sense that the aircraft was climbing at about an 8.5-degree angle when, in fact, the aircraft was descending slightly until impact.

Findings as to causes and contributing factors 

  1. The pilot’s forward vision was obscured by the bright sunlight and glare from the surface of the river.

  2. The pilot most likely lost visual reference with terrain and descended into the surface of the river.

  3. It is likely that the pilot did not realize that the helicopter was descending instead of climbing due to somatogravic illusion.

Finding as to risk

  1. Departing over water, instead of accelerating and climbing along the shoreline, increases the risk of losing visual references and the risk of ditching into water in the event of a power train failure.

TSB Final Report A08A0106—Loss of Control—Stall/Spin

On August 18, 2008, the amateur-built Denney Kitfox IV, a single-engine tail-wheel configured aircraft, had departed from a private airstrip on a local flight near the community of Huntington, N.S. The aircraft flew in the local area for approximately 15 minutes until a local resident heard the sound of impact at approximately 11:30 Atlantic Daylight Time (ADT). There were no eyewitnesses to the accident. Within minutes of the impact, the aircraft was found along the edge of the access road to the pilot’s residence. The pilot was critically injured and was transported to hospital. The aircraft came to rest directly along the extended centreline of Runway 20 of the private airstrip, about 275 ft beyond the departure end. The aircraft was destroyed and there was no fire.

aircraft impact orientation - nose down - on edge of runway

Aircraft impact orientation


With no eyewitness accounts and without the pilot being able to recall any significant moments of the accident flight, investigators had to rely on an analysis of information from the accident site and the pilot’s experience/currency to determine the most likely cause of the accident.

The aircraft’s impact orientation indicates there was a departure from controlled flight, resulting from a stall/spin scenario. The stall/spin scenario was not a result of a structural failure in flight, no engine or control anomalies were noted during the wreckage examination, the weather was determined not to be a factor, and a stall/spin scenario would not have been deliberately initiated at such a low altitude. The most likely scenario leading to the accident would be the pilot’s lack of currency and inexperience on type, leading to a failure to detect the symptoms of an approaching stall and apply the appropriate corrections in a timely manner, resulting in an unintentional stall/spin situation. Once the aircraft had departed controlled flight, there was insufficient altitude to recover. Within seconds, the flight profile would have changed from horizontal to vertical with the aircraft contacting the ground shortly after.

The pilot was inexperienced on this aircraft type and was not very familiar with the symptoms that it would display prior to a stall. The pilot was inexperienced on tail-wheel aircraft handling and had not flown this aircraft from his airstrip prior to this flight. During the course of a practice touch-and-go, the pilot would have been preoccupied with controlling the aircraft directionally on the ground and initial climb out. It is possible that due to this distraction, the pilot’s unfamiliarity with the aircraft, and the lack of a stall warning device, the decreasing airspeed in the climb and the approaching stall symptoms may have been missed. With a low airspeed, a high angle of attack, and the engine at climb power, if a stall occurred, a right wing drop and associated spin is likely. Based on the location of the crash site, the proximity of the aircraft to the surrounding trees and power wires, an indication of right-hand rotation at impact, and the aircraft’s orientation make this scenario the most plausible.

The onset of the stall would likely have been abrupt and without warning, leaving little time or altitude to effect a recovery. In this accident, if the aircraft was so equipped, a stall warning horn may have sounded early enough to give the pilot time to take action to avoid the stall.

The pilot survived his extensive injuries as a result of timely medical care because a local resident heard the impact and quickly located the accident site.

Findings as to causes and contributing factors 

  1. The pilot was inexperienced on the aircraft type and had not flown it in the previous ten months; he may have been unfamiliar with the symptoms of an impending aircraft stall and the proper corrective action.

  2. The aircraft was operating at the departure end of Runway 20 at low altitude when it stalled and entered an incipient spin from which there was insufficient height to recover before it collided with terrain.

Findings as to risk 

  1. In the absence of a stall warning device on amateur-built aircraft, pilots may not be able to detect an impending stall.

  2. With an emergency locator transmitter (ELT) switch in the OFF position during an aircraft accident, it is possible that a seriously injured pilot might succumb to injuries before help arrives.

TSB Final Report A09W0037—Risk of Collision

On March 6, 2009, a Bombardier CL-600-2D15 had been cleared to the Whitehorse International Airport, Y.T., for an approach. Whitehorse International Airport is located in a mountainous, non-radar environment and at the time of the occurrence a winter snow storm was moving through the area. An instrument landing system (ILS) approach to Runway 31L was hand-flown by the captain using the head-up guidance system (HGS). On initial contact, no current position report or estimate for the airport was given by the crew or requested by the tower. Whitehorse tower requested the aircraft to report 10 mi. final, and advised that sweeping was in progress. The crew acknowledged the request. The aircraft landed approximately nine minutes later, at 13:50 Pacific Standard Time (PST), after flying over two runway snow sweepers operating on the portion of the runway located before the displaced threshold for Runway 31L. A position report was not provided to Whitehorse tower at 10 mi. final and no landing clearance was issued. The weather report issued 10 minutes after landing reported the ceiling as vertical visibility 600 ft, visibility of 3/4 SM in light snow and drifting snow with a runway visual range (RVR) of 4 500 ft.

Artist’s impression of risk of collision event, as the CL-600 overflew the two snow sweepers on final approach
Artist’s impression of risk of collision event, as the CL-600
overflew the two snow sweepers on final approach

Findings as to causes and contributing factors 

  1. Communication transfers between the Edmonton area control centre (ACC) and Whitehorse tower did not take place in accordance with the Inter Unit Arrangement between the two facilities, resulting in a wide variation in aircraft position at the time of the communication transfer.

  2. The relieving tower controller did not establish the position of the CL-600 on initial contact. The relieving tower controller assumed that the CL-600 was 45 NM from the airport and this resulted in an inaccurate assessment of the flight time left prior to the aircraft’s arrival.

  3. Information that the CL-600 would have to hold was not communicated to the relieving tower controller during the position transfer briefing and the flight progress strip did not contain holding information, a fix reference or an airport ETA for the CL-600. This reduced the opportunity for the relieving tower controller to establish accurate initial situational awareness and allowed the 45 mile from airport assumption to persist.

  4. The mental models of the flight crew and the Whitehorse tower controller were not aligned; the flight crew believed the Whitehorse controller knew their location when tower communication was established and their current position was not requested.

  5. The first officer handled all aircraft-ATC communications following the decision to conduct an HGS approach, and several communication errors subsequently occurred. The pattern of communication errors was consistent with task saturation.

  6. Whitehorse tower’s instruction to call 10 mi. final became a prospective memory task with no relevant memory reminder cue for the first officer. As well, the significance of the instruction to report 10 mi. final as a cue for the relieving tower controller to remove the trucks from the runway and issue the landing clearance was not recognized by the flight crew; thus the call was missed.

  7. The relieving tower controller relied entirely on the instruction for the CL-600 to report 10 mi. final to establish situational awareness prior to the aircraft entering the Whitehorse control zone. When the crew did not comply with the instruction to report 10 mi. final, the relieving tower controller did not receive the necessary trigger to issue a landing clearance.

  8. The flight crew’s perception that the approach clearance meant there was no equipment on the runway demonstrated a misunderstanding of the difference between an approach clearance and a landing clearance relative to the status of the active runway.

  9. The flight crew’s perception was that there were no vehicles or obstructions in the touchdown zone. The captain, believing that the trucks were holding until the flight landed, elected to land without the flight receiving a landing clearance.

Findings as to risk 

  1. There were differences in how the relieving tower controller, compared to other Whitehorse tower controllers, routinely handled IFR arrivals which created the potential for situational ambiguity between controllers, especially during position transfers.

  2. A pilot flying’s (PF) attention resources may be fully occupied, due to moderate to high perceived workload, when hand-flying an approach using the HGS under instrument meteorological conditions (IMC), resulting in a significantly reduced capacity to monitor radio communications and provide support to the pilot not flying (PNF).

  3. To properly assess applicants for pilot positions, operators need access to information on experience and performance that is factual, objective, and (preferably) standardized. Transport Canada pilot records are not available to employers—this may lead to the appointment of pilots to positions for which they are unsuited, thereby compromising safety.

  4. The crew had no assurance that other maintenance vehicles were not on the runway beyond its field of view. Had there been another vehicle on the unseen portion of the runway, the decision to continue the landing would have exacerbated the risk of collision.

Other findings 

  1. The cockpit voice recorder (CVR) was not secured following the incident and the incident was not reported to the TSB by the quickest available means, which resulted in the loss of beneficial investigative evidence.

  2. Wide area multilateration and automatic dependent surveillance-broadcast (ADS-B) technology may be useful tools to enhance tower controller situational awareness of traffic and reduce the risk of collision between arriving aircraft and ground vehicles in non-radar environments.

Safety action taken 

On May 15, 2009, as a result of this incident, NAV CANADA issued Whitehorse Control Tower Operations Letter 09-04. The letter stated that the following procedure will be in effect:

On initial contact and in addition to the usual information (e.g. aircraft identity, type and altitude) the following must also be obtained from pilots:

  • position report from VFR and IFR aircraft which might include a VFR reporting point, an IFR navigation aid or distance (DME or GPS) back from an IFR navigation aid and,
  • from IFR aircraft the pilot’s ETA for the airport.

Transport Canada 
Transport Canada has undertaken, through its National Operations Branch Oversight Plan, to monitor Whitehorse tower and other units within uncontrolled or non-radar environments, in order to identify possible systemic issues related to communication protocols and the adherence to those protocols by all air traffic controllers.

The operator has taken the following safety actions:

  • Increased emphasis on HGS usage for the CRJ fleet. On November 1, 2009, the CRJ aircraft operating manual was modified to state that the captain shall utilize the HGS, when serviceable, for all phases of flight as both the PF and PNF.
  • On June 11, 2010, the new Section 7.3.6 of the Flight Operations Control Manual (New Hire-Line Pilot Employment Follow-Up Procedure) was published. This procedure describes the process to evaluate the performance of new pilots and validate the effectiveness of training.
  • Recurrent training on uncontrolled airport operations has been added as a pre-briefing item. The training will include procedures published in the Transport Canada Aeronautical Information Manual (TC AIM) and will also include reference to the forthcoming language in the company operations manual (COM) with respect to supplemental information that must be communicated to air traffic services (ATS).

TSB Final Report A09A0016—Main Gearbox Malfunction/Collision with Water

(* This is a major accident report and only the summary and findings as to causes and contributing factors are listed in the ASL. Readers are encouraged to read the complete report on the TSB Web site.)

On March 12, 2009, at 09:17 Newfoundland Daylight Time (NDT), a Sikorsky S-92A departed St. John’s International Airport, N.L., with 16 passengers and 2 flight crew, to the Hibernia oil production platform. At approximately 09:45, 13 minutes after levelling off at a flight-planned altitude of 9 000 ft above sea level (ASL), a main gearbox oil pressure warning light illuminated. The helicopter was about 54 NM from the St. John’s International Airport. The flight crew declared an emergency, began a descent, and diverted back towards St. John’s. The crew descended to, and levelled off at, 800 ft ASL on a heading of 293° Magnetic with an airspeed of 133 kt. At 09:55, approximately 35 NM from St. John’s, the crew reported that they were ditching. Less than 1 minute later, the helicopter struck the water in a slight right-bank, nose-high attitude, with low speed and a high rate of descent. The fuselage was severely compromised and sank quickly in 169 metres of water. One passenger survived with serious injuries and was rescued approximately 1 hour and 20 minutes after the accident. The other 17 occupants of the helicopter died of drowning. There were no signals detected from either the emergency locator transmitter (ELT) or the personal locator beacons (PLB) worn by the occupants of the helicopter.

Wreckage layout
Wreckage layout: A—Cockpit; B—Upper deck/engines; C—Sponson;
D—Tail rotor; E—Main rotor blades; F—Cabin area

Findings as to causes and contributing factors 

  1. Galling on a titanium attachment stud holding the filter bowl assembly to the main gearbox (MGB) prevented the correct preload from being applied during installation. This condition was exacerbated by the number of oil filter replacements and the re-use of the original nuts.

  2. Titanium alloy oil filter bowl mounting studs had been used successfully in previous Sikorsky helicopter designs; in the S-92A, however, the number of unexpected oil filter changes resulted in excessive galling.

  3. Reduced preload led to an increase of the cyclic load experienced by one of the titanium MGB oil filter bowl assembly attachment studs during operation of CHI91, and to fatigue cracking of the stud, which then developed in a second stud due to increased loading resulting from the initial stud failure. The two studs broke in cruise flight resulting in a sudden loss of oil in the MGB.

  4. Following the Australian occurrence, Sikorsky and the U.S. Federal Aviation Administration (FAA) relied on new maintenance procedures to mitigate the risk of failure of damaged mounting studs on the MGB filter bowl assembly and did not require their immediate replacement.

  5. The operator did not effectively implement the mandatory maintenance procedures in aircraft maintenance manual (AMM) revision 13 and, therefore, damaged studs on the filter bowl assembly were not detected or replaced.

  6. Ten minutes after the red MGB OIL PRES warning, the loss of lubricant caused a catastrophic failure of the tail take-off pinion, which resulted in the loss of drive to the tail rotor shafts.

  7. The S-92A rotorcraft flight manual (RFM) MGB oil system failure procedure was ambiguous and lacked clearly defined symptoms of either a massive loss of MGB oil or a single MGB oil pump failure. This ambiguity contributed to the flight crew’s misdiagnosis that a faulty oil pump or sensor was the source of the problem.

  8. The pilots misdiagnosed the emergency due to a lack of understanding of the MGB oil system and an over-reliance on prevalent expectations that a loss of oil would result in an increase in oil temperature. This led the pilots to incorrectly rely on MGB oil temperature as a secondary indication of an impending MGB failure.

  9. By the time the helicopter crew had established that MGB oil pressure of less than 5 psi warranted a “land immediately” condition, the captain had dismissed ditching in the absence of other compelling indications such as unusual noises or vibrations.

  10. The captain’s decision to carry out pilot flying (PF) duties, as well as several pilot not flying (PNF) duties, resulted in excessive workload levels that delayed checklist completion and prevented the captain from recognizing critical cues available to him.

  11. The pilots had been taught during initial and recurrent S-92A simulator training that a gearbox failure would be gradual and always preceded by noise and vibration. This likely contributed to the captain’s decision to continue towards St. John’s International Airport.

  12. Rather than continuing with the descent and ditching as per the RFM, the helicopter was levelled off at 800 ft ASL, using a higher power setting and airspeed than required. This likely accelerated the loss of drive to the tail rotor and significantly reduced the probability of a successful, controlled ditching.

  13. The captain’s fixation on reaching shore, combined with the first officer’s non-assertiveness, prevented concerns about the helicopter’s flight profile from being incorporated into the captain’s decision-making process. The lack of recent, modern, crew resource management (CRM) training likely contributed to the communication and decision-making breakdowns which led to the selection of an unsafe flight profile.

  14. The throttles were shut off prior to lowering the collective, in response to the loss of tail rotor thrust. This caused significant main rotor RPM droop.

  15. The pilots experienced difficulties controlling the helicopter following the engine shut-down, placing the helicopter in a downwind autorotative descent with main rotor RPM and airspeed well below prescribed RFM limits. This led to an excessive rate of descent from which the pilots could not recover prior to impact.

  16. The severity of the impact likely rendered some passengers unconscious. The other occupants seated in the helicopter likely remained conscious for a short period of time, but became incapacitated due to the impact and cold water shock, and lost their breath hold ability before they could escape the rapidly sinking helicopter.

TSB Final Report A09P0187—Wake Turbulence Encounter—Collision with Terrain

On July 9, 2009, a Piper PA-31-350 Chieftain aircraft was operating under VFR on the final leg of a multi-leg cargo flight from Vancouver to Nanaimo and Victoria, B.C., with a return to Vancouver. The weather was visual meteorological conditions (VMC) and the last 9 minutes of the flight took place during official darkness. The flight was third for landing and turned onto the final approach course 1.5 NM behind and 700 ft below the flight path of a heavier Airbus A321, approaching Runway 26R at the Vancouver International Airport. At 22:08, Pacific Daylight Time (PDT), the target for the Chieftain disappeared from tower radar. The aircraft impacted the ground in an industrial area of Richmond, B.C., 3 NM short of the runway. There was a post-impact explosion and fire. The two crew members on board were fatally injured. There was property damage, but no injuries on the ground. The onboard emergency locator transmitter (ELT) was destroyed in the accident and no signal was detected.

Aircraft traffic pattern at 22:04:42

Aircraft traffic pattern at 22:04:42

Diagram and map of air traffic at 22:06:09

At 22:06:09, the Chieftain intercepts the localizer 1.5 NM
behind the Airbus, approximately 2.6
NM from the crash site.

Findings as to causes and contributing factors 

  1. The Piper Chieftain turned onto the final approach course within the wake turbulence area behind and below the heavier aircraft and encountered its wake, resulting in an upset and loss of control at an altitude that precluded recovery.

  2. The proximity of the faster trailing traffic limited the space available for the Chieftain to join the final approach course, requiring the Chieftain not to lag too far behind the preceding aircraft.

Findings as to risk 

  1. The current wake turbulence separation standards may be inadequate. As air traffic volume continues to grow, there is a risk that wake turbulence encounters will increase.

  2. Visual separation may not be an adequate defence to ensure that appropriate spacing for wake turbulence can be established or maintained, particularly in darkness.

  3. Neither the pilots nor the operator were required by regulation to account for employee duty time acquired at other non-aviation related places of employment. As a result, there was increased risk that pilots were operating while fatigued.

  4. Not maintaining engine accessories in accordance with manufacturers’ recommendations can lead to failure of systems critical to safety.

Other finding 

  1. The Piper Chieftain was not equipped with any type of cockpit recording devices, nor was it required to be. As a result, the level of collaboration and decision-making discussion between the two pilots remains unknown.

Safety action taken 

On July 24, 2009, the operator held a wake turbulence refresher session for all of its pilots.

Transportation Safety Board of Canada (TSB)
On January 12, 2011, the TSB issued Aviation Safety Advisory A09P0187-D3-A1, entitled Wake Turbulence Encounters During Visual Operations in Darkness, to NAV CANADA and copied to Transport Canada. The advisory suggested that NAV CANADA may wish to address ways to reduce the possibilities of hazardous encounters with wake turbulence within radar service areas during VMC in darkness.

The TSB also issued Aviation Safety Advisory A09P0187-D2-A1, entitled Pilot Fatigue, to Transport Canada. The advisory suggested that Transport Canada may wish to consider ways to ensure that all operators and flight crew take into account non-carrier time commitments for the purpose of flight crew fatigue management.

On March 31, 2011, Transport Canada responded and advised that in the summer of 2010, the Canadian Aviation Regulatory Advisory Council (CARAC) established the Flight Crew Fatigue Management Working Group. The Working Group has a mandate to review the Canadian Aviation Regulations (CARs) flight and duty time limitation and rest period requirements, as well as make recommendations for change where it is felt necessary.

The response indicated that the Working Group has begun to discuss prescriptive requirements and that the matter raised in this Advisory has already been discussed extensively and will be considered further in their deliberations.

TSB Final Report A09Q0190—Collision with Cable

On November 12, 2009, a privately owned and operated Robinson R44 II Raven helicopter took off for a VFR flight from a work site at Baie-Trinité, to Baie-Comeau, Que. At 12:49 Eastern Standard Time (EST), the helicopter struck a ground wire atop a power line crossing the Franquelin River and crashed on the river bank below. The pilot sustained fatal injuries and the two passengers on board were seriously injured. A pedestrian discovered the wreckage at approximately 14:10 and advised the authorities.

cable marking on control tubes
Cable marking on control tubes


Low flying increases the risk of collision with wires or other obstacles. The direction of flight into the sun would have caused glare on the windscreen and would have most likely decreased the pilot’s forward visibility and ability to see the wires. Also, the wires were unmarked, rendering them more difficult to detect. A thorough scan for obstacles in front and in periphery of the aircraft might have helped to detect the towers of Line 1615 situated atop the cliffs on either side of the river. Although the pilot saw the wires immediately prior to colliding with them and attempted evasive action, a collision with the first of the two ground wires ensued.

While the aircraft was equipped with a GPS capable of providing the pilot with obstacle and terrain warnings when flying at low altitude, only the terrain display feature was functional in the area the flight took place. In addition, it could not be determined if the pilot was aware of those features and associated limitations when used in Canada. The GPS is an aid to navigation and should not replace the use of authorized navigation charts.

Cables and wires may be unmarked if they are not considered to be an aeronautical or marine hazard. The towers atop the cliffs on either side of the river and the ground wire lines and main power lines were not deemed a hazard. While the location where Line 1615 crosses the Franquelin River is not close to an aerodrome, it is situated on the VFR GPS route from Baie-Comeau to Sept-Îles. Without careful flight planning, flights conducted at low level are at increased risk of collision with unmarked hazards such as wires or other obstacles.

The 406 MHz emergency locator transmitters (ELT) are relatively new to the aviation industry. The helicopter’s ELT installation included a programmable dongle, information which did not appear on the aircraft equipment list. The owner completed the required registering of the ELT unit but had not done a periodic self-test as recommended by the ELT manufacturer. The maintenance facility had confirmed the ELT unit tested serviceable but did not know the dongle was programmable and therefore had not programmed it or had it programmed to match the owner and aircraft information. No self-test or transmission test had been completed since the owner acquiring the aircraft. The fact that the programmed dongle information supersedes the ELT-programmed information was not widely known. The ELT manufacturer recommends a self-test once a month to verify the integrity of the installation; however, there are no regulatory requirements to conduct this self-test. A signal received by the COSPAS-SARSAT Canadian Mission Control Centre (CMCC) in the test mode would not necessarily initiate search and rescue in the same manner as that of a signal received in the normal mode.

The 406 and 121.5 MHz signals were significantly attenuated due to the severed antenna cable. The failure of the Q8 amplifier resulted in an additional attenuation of the 406 MHz signal. Activation of this type of ELT, even for test purposes, without a proper load such as an antenna, can result in damage to its circuitry, rendering the device unserviceable.

An improperly programmed dongle may result in the transmission of incorrect information, thereby delaying search and rescue.

Aerial view of accident site

Aerial view of accident site

Findings as to causes and contributing factors 

  1. The helicopter was flown at low altitude, increasing its exposure to a collision with obstacles.

  2. The sun’s glare likely degraded the pilot’s ability to detect the unmarked power lines and ground wires in time to avoid a collision.

  3. The helicopter struck the ground wire likely rendering the helicopter partially uncontrollable and it crashed in the river below.

Findings as to risk 

  1. Given the difficulty in seeing unmarked wires, pilots must plan their flight path appropriately before operating at low levels, especially in valleys.

  2. A dongle that has not been properly programmed may result in the transmission of incorrect information, thereby delaying search and rescue. An ELT self-test would confirm a programming fault.

  3. The ELT antenna cable became severed during the impact sequence, increasing the risk of the signal not being detected.

Other finding

  1. Turning an ELT ON or conducting a self-test without installing a load (antenna) may overload the transmission amplifier rendering the unit unserviceable.

  2. The GPS terrain display feature was operational in the area the flight took place; however, the obstacle warning feature was not. The GPS is an aid to navigation and should not replace the use of authorized navigation charts.

Safety action taken 
On July 12, 2010, the TSB sent an aviation safety information letter to Transport Canada on the 406 MHz ELT programmable dongle issue. It highlighted the importance of informing aircraft operators, owners, maintainers and avionics facilities of the purpose of the programmable dongle. A comprehensive article regarding the ELT programmable dongle was published in Issue 3/2011 of the Aviation Safety Letter.

TSB Final Report A10P0244—Collision with Terrain

On July 31, 2010, at 20:02 Pacific Daylight Time (PDT), a Convair 580 departed Kamloops to fight a wildfire near Lytton, B.C. The bombing run required crossing the edge of a ravine in the side of the Fraser River canyon before descending on the fire located in the ravine. About 22 minutes after departure, the aircraft approached the ravine and struck trees. An unanticipated retardant drop occurred coincident with the tree strikes. Seconds later, the aircraft entered a left-hand spin and collided with terrain. A post-impact explosion and fire consumed much of the wreckage. A signal was not received from the on-board emergency locator transmitter; nor was it recovered. Both crew members were fatally injured.

aircraft crashed in forest

Analysis—Operational Factors

In the absence of concrete data from recorders, the investigation looked at two possible operational factors:

  • The flight inadvertently entered a low energy condition approaching the ravine in an attempt to recover altitude.
  • A visual illusion affected the crew’s ability to recognize and assess the aircraft’s proximity to the rising terrain resulting in this being a controlled flight into terrain (CFIT) accident.

It was established that the aircraft descended more than 400 ft early in the circuit and was flying in a slow climb toward the edge of the ravine. A slow climb, rising terrain and the lack of a good horizon reference, are criteria that could contribute to the development of a low energy condition. Regardless of engine power, the low energy condition may not have allowed the aircraft sufficient time to pull up and establish an adequate climb, even with the benefit of the partial retardant drop. Airspeed and angle of attack (AOA) indicators should have provided visual indications of low energy conditions and impending stall awareness. But there was no audible or visual alert that would have drawn the crew’s attention to these indicators.

If the airspeed was low and an overshoot was commanded, the flaps would have to be retracted to 15°. This would result in a reduction in the initial rate of climb. The aircraft was interpreted as going into a descent when observed by the bird dog crew. However, the bird dog crew did not know that the Convair was climbing. Without a horizon reference, a reduction of the climb angle could appear to the bird dog crew as a change from level flight to a descent. Maximum power and 12° of flap, as found, would be consistent with an attempted go-around. While retracting flaps for a go-around, inadvertently holding the flap selector switch for one additional second would result in 2° or 3° more flap retraction than the target setting of 15°. There is no performance data in the aircraft operating manual (AOM) to determine a potential rate of climb.

Map of estimated flight path

Estimated flight path

However, this should not be an issue because the plan to climb out following the first intended drop and accelerate from 120 knots to 140 knots in the 20° flap configuration, with 7/8 of the load remaining on board, is indicative of the airplane capability at an appropriate airspeed.

Furthermore, a visual illusion may have affected the crew’s ability to recognize, or accurately assess, the aircraft’s flight path relative to the elevation of the rising terrain which, unbeknownst to the crew, put the aircraft too low before the edge of the ravine.

The local terrain was mountainous and precluded a good horizon reference. The flight occurred during the last hour of daylight in growing shadows and some smoke, which are factors that affect visibility. The action to continue the bombing run rather than take the exit route and circle for another attempt or to jettison the retardant load to improve the climb performance suggests the crew did not recognize the imminent danger ahead of them and may have neglected the altimeter, believing it was reasonable to continue and assess their progress visually. The criteria (a slow climb, rising terrain, lack of a good horizon reference) conducive to a low energy condition can also be conducive to a visual illusion producing a false sense of height, as observed during the TSB investigation flight.

Given the last-second response to avoid a collision with terrain at the edge of the ravine, and the partial retardant load drop, it is likely the crew was under the influence of a visual illusion. The aircraft’s proximity to terrain came as a surprise to the crew and as a result, affected the crew’s decisions and actions leading up to the event.

The bird dog pilot, however, had the benefit of flying consecutively lower circuits in the development of the bombing run to the target fire, and lighting conditions may have been slightly different. This opportunity may have reduced the likelihood of a height- or depth-perception illusion, and illusions were not discussed in any briefings to the Convair crew.

Findings as to causes and contributing factors 

  1. It could not be determined to what extent the initial collision with trees caused damage to the aircraft which may have affected its controllability.

  2. Visual illusion may have precluded recognition, or an accurate assessment, of the flight path profile in sufficient time to avoid the trees on rising terrain.

  3. Visual illusion may have contributed to the development of a low energy condition which impaired the aircraft performance when overshoot action was initiated.

  4. The aircraft entered an aerodynamic stall and spin from which recovery was not possible at such a low altitude.

Findings as to risk 

  1. Visual illusions give false impressions or misconceptions of actual conditions. Unrecognized and uncorrected spatial disorientation, caused by illusions, carries a high risk of incident or accident.

  2. Flight operations outside the approved weight and balance envelope increase the risk of unanticipated aircraft behaviour.

  3. The recommended maintenance check of the emergency drop (E–drop) system may not be performed and there is no requirement for flight crews to test the E–drop system, thereby increasing the risk that an unserviceable system will go undetected.

  4. The location of the E–drop selector requires crews to divert significant time and attention to identify and confirm the correct switch before operating it. This increases the risk of collision with terrain while attention is distracted.

Safety action taken 

Since the accident, the operator has taken further action to mitigate the risks of recurrence.

  1. The glare shield over the flight instrument panel in the Convair 580 has been modified to improve both pilots’ view of the top row of flight instruments, which include the airspeed indicators and the AOA indicator.

  2. A project has been initiated to change the E-drop selector from a guarded toggle switch to a large push-button type switch and relocate it to the middle of the glare shield, in full view and within reach of both pilots.

  3. A project is underway to modify the existing load release button on the left-hand control wheel to include a safety function which will jettison the entire retardant load if the button is depressed five times within three seconds.

  4. The operator’s pilot training program is being amended to incorporate more emphasis on emergency drop procedures.

  5. The operator is developing a stall–g–speed (SgS)[1] system for air tanker operations. This system will be initially installed on the Lockheed L–188 Electra air tanker.

decorative line above footnotes

[1] SgS defines a safety flight envelope for “low speed warning”, “vertical acceleration (g) warning” and “overspeed warning”. This system will provide flight crews with trend information relating airspeed, angle–of–attack, and “g” load information in a visual display with audio warnings and a stick–shaker function.

TSB Final Report A10O0240—Loss of Control and Collision with Terrain

On November 18, 2010, at approximately 18:19 Eastern Standard Time (EST), a Beechcraft F33A aircraft departed Toronto/Buttonville Municipal Airport for Kingston Airport, Ont., on a night VFR flight with an instructor and two commercially qualified students on board. Weather en route began to deteriorate and the aircraft was headed back to Toronto/Buttonville Municipal Airport. The aircraft was observed on radar to be westbound in level flight before it turned north and began to climb. The aircraft then turned abruptly to the left and descended; radar contact was lost. The aircraft was subsequently located in a ploughed level field approximately 10 NM east of the Toronto/Buttonville Municipal Airport. It was destroyed on ground impact and the three occupants were fatally injured. There was no fire and the emergency locator transmitter (ELT) did not activate. The accident occurred at approximately 18:44 EST during the hours of darkness.

Map showing location of accident site and weather conditions

Location of accident site and weather conditions


The analysis will focus on the environmental conditions at the location of the occurrence, and provide a plausible scenario for the deviation in the flight path that led to the loss of directional control and rapid descent with no recovery prior to ground impact.

Deteriorating weather conditions encountered en route prompted the flight crew to cancel the planned flight to Kingston and return to Toronto/Buttonville. Radar data and recorded voice communications indicate that the return flight was normal until the climbing right turn. During that turn, airspeed was allowed to decrease suggesting that engine power was not increased to maintain a safe airspeed. The aircraft rolled into a steep left turn with a high rate of descent. The flight manoeuvre that was observed on radar and further supported by engineering estimations indicates a left wing stall followed by an abrupt left wing drop. The abruptness of the wing stall could have been exacerbated by any airframe icing which may have accumulated on the wings.

Weather information from other aircraft in the vicinity and from ground observations indicated that local weather conditions which included rain, snow, and freezing rain, were quite different from the conditions at either Oshawa airport or Toronto/Buttonville municipal airport. Encountering these weather conditions unexpectedly may have influenced the crew’s decision to intentionally deviate to the north to find better weather. Outside visual reference may have also been hampered by these weather conditions and by darkness.

Although it is impossible to ascertain who was controlling the aircraft at the time, it is logical to assume that the student was at the controls while the instructor was requesting the approach clearance. When the aircraft stalled, the instructor would have been attempting to recover control. The rapidity of the stall, the airspeed during the descent and the lack of available altitude prevented a full recovery before the aircraft struck the ground. This would have been compounded by limited visual reference due to the weather conditions and the lack of flight instruments on the right side of the instrument panel.

There were approximately eight seconds between the loss of control and when the aircraft struck the ground assuming a constant rate of descent of 9 600 ft/min. Ground impact marks show that, although the aircraft was nose down, it was in a near wings-level attitude, suggesting that the recovery had been initiated but altitude and excessive descent speed precluded full recovery.

Findings as to causes and contributing factors 

  1. After encountering adverse weather conditions, a climbing right turn was initiated. During the climbing turn, engine power was likely not increased and the airspeed decayed. The angle of attack on the left wing was allowed to increase until it stalled and dropped unexpectedly.

  2. The location of the flight instruments made it more difficult for the instructor in the right seat to see and react to them and control of the aircraft was not regained before the aircraft struck the ground in a non-survivable impact.

Safety action taken 

Flying school 
The flying school has instituted the following changes to its training program to enhance flight safety:

  • Group weather briefing—This is attended by all instructors and students who will be flying on that particular shift. By doing this, it is ensured that everyone has looked at the weather prior to their flight. The only exception is if a student is going on a Transport Canada flight test where the student will be graded by an examiner for checking weather.
  • Recurrent upset training for instructors—All instructors to go through upset training in flight training devices to assist them in any given circumstances where they need to take control of an aircraft and recover from an unusual attitude. This training is done with certain flight instruments failed.
  • Night flying ground briefing for instructors—A recurrent training session regarding night flying.
  • Weather briefing for instructors—A recurrent training session regarding weather hazards with a focus on icing.
  • Briefing on spatial disorientation for instructors—A recurrent training session reviewing different types of illusions and preventative measures.
  • Expanded indoctrination training for new instructors—New instructors to have an expanded indoctrination checklist they complete when they start teaching at the college.
  • The school’s aviation training program is broken up into different phases. An expanded training program is being developed for instructors who start training in a new phase of the program based on their past experience.
  • Standby attitude indicators to be installed in aircraft—The plan is for standby attitude indicators to be installed in all aircraft that require them. This is in the event there is a failure of the primary attitude indicator; the standby attitude indicator can be used to aid in flying the aircraft.

The school has instituted the limits shown below for single-engine at-night operations:

  • All night flying is to be conducted in VFR weather only.
  • Instrument or IFR training may be conducted at night in visual meteorological conditions (VMC) only.
  • VFR flight plans are to be filed at night outside of the circuit (no IFR filing even in VMC).
  • Reported and forecast visibility shall not be less than 6 SM. Authorized ceiling remains as per its Operations Manual Section 2.6.
  • There shall be no visible or forecast precipitation in the area of operation when flying in temperatures of 5°C or colder (at operating altitude).
  • No observers are permitted on board training flights at night, i.e., one student and one instructor only. Combined lessons where more than one student participates will be restricted to daytime flying.
  • Any exceptions to this policy will be at the sole discretion of the certificated flight instructor (CFI) or delegate on a case-by-case basis.


Note: The following accident synopses are Transportation Safety Board of Canada (TSB) Class 5 events, which occurred between November 1, 2011, and January 31, 2012. These occurrences do not meet the criteria of classes 1 through 4, and are recorded by the TSB for possible safety analysis, statistical reporting, or archival purposes. The narratives may have been updated by the TSB since publication. For more information on any individual event, please contact the TSB.

— On November 4, 2011, a privately operated Cessna 182G experienced a brake failure while being taxied into a parking position at the airport at Sudbury/Coniston (CSC9), Ont., resulting in a collision with an adjacent Cessna 172L, and causing substantial damage to the right wing and propeller of the 182 and damage to the left wing and propeller of the 172. The 182 had been brought to a complete stop without any braking difficulty after taxiing clear of the runway. After the mishap, the right brake pedal went completely to the floor. TSB File A11O0209.

— On November 6, 2011, a privately operated Cessna A185E approached a private landing strip at McKellar, Ont., with a slight tailwind, resulting in the aircraft floating beyond the intended touchdown point. An overshoot was initiated and shortly thereafter, the aircraft stalled, dropping the left wing. The aircraft struck the ground adjacent to the left side of the runway and sustained substantial damage to the landing gear and propeller. The pilot, wearing a three-point harness, was uninjured. The emergency locator transmitter (ELT) activated and was turned off by the pilot. TSB File A11O0211.

— On November 17, 2011, the pilot of a Cessna 172 was flying locally and practising circuits at the airport at Ottawa/Rockcliffe (CYRO), Ont. During the landing approach, at a height of approximately 10 ft over Runway 27, the stall warning horn sounded and the pilot added power. The added power was insufficient and the aircraft stalled and hit the ground hard, bending the nose gear and right main landing gear. The aircraft veered off the runway and struck its right wing and stabilizer before coming to a rest near Taxiway Bravo. The pilot and two passengers were uninjured, but the aircraft suffered substantial damage. TSB File A11O0215.

— On November 19, 2011, a Piper J-3C-65 was on a VFR flight in the Boisbriand, Que., region. The pilot was accompanied by one passenger. The pilot had earlier landed without incident in an adjoining field. Although the wind was from the northwest, the final approach to the field being used as a landing strip was conducted in a southerly direction. Although its speed was 50 mph, the aircraft pitched nose-down at a height at which the pilot was unable to regain control. The aircraft crashed but did not catch fire. Both occupants were quickly rescued and were transported to hospital with serious injuries. TSB File A11Q0212.

— On November 22, 2011, a student pilot was receiving tail-wheel training in a Bellanca 7ECA in the circuit at Bassano (CEN2), Alta. The exercise was crosswind landings and departures, with a crosswind of about 45° from the left. On climb-out after a touch-and-go, the instructor in the rear seat failed the engine for a forced landing. He expected the pilot to turn left into wind for a landing in the adjacent open field. Instead, the pilot attempted to land straight ahead as he had been taught. The instructor took control just prior to a hard landing that resulted in damage to the right-hand fuselage, landing gear, propeller and engine. There were no injuries. TSB File A11W0178.

— On November 23, 2011, a private Piper PA24-250 was on a VFR flight from Kitchener/Waterloo (CYKF), Ont., to Burlington (CZBA), Ont. During the approach, the landing gear was not selected down and the aircraft landed with the gear fully retracted. The aircraft sustained damage to the propeller, engine and lower fuselage skin. The pilot, the sole occupant, was uninjured. TSB File A11O0233.

— On November 26, 2011, a Cessna 150L had departed on a VFR flight from the airport at Bromont (CZBM), Que., to Québec/Jean Lesage International Airport (CYQB), Que. Approximately 15 min after takeoff, the engine (Teledyne Continental O-200-A) lost power, decreasing from 2 400 RPM to 2 000 RPM and then to 1 200 RPM. The pilot made a forced landing in a field. During the final landing phase of the flight, the left wing was sectioned when it hit a telephone pole, causing the aircraft to pivot left. The right main landing gear collapsed and the tail section was bent. The two occupants sustained minor injuries. The aircraft was substantially damaged. The temperature and dew point were conducive to serious carburetor icing conditions. TSB File A11Q0218.

— On November 26, 2011, an AS350 B2 helicopter was supporting drill operations from a staging area located 6 NM west of the airport at Wabush (CYWK), N.L. The pilot landed the aircraft, keeping the main rotor at full RPM, but while he turned in his seat to retrieve his gloves from behind him, the helicopter lifted and abruptly turned right. The pilot was unable to reach the collective, cyclic and pedal controls in time to arrest the lift-off and right turn. The collective lock latch had not been secured. The helicopter turned over and came to rest on its right side approximately 30 ft from the original landing spot. The pilot was seriously injured. One person working on the ground was not injured. The aircraft was substantially damaged. TSB File A11Q0217.

— On December 3, 2011, a privately operated Luscombe Silvaire 8F airplane on floats was being taxied for takeoff on Smiths Mill Pond, near Scotland, Ont. After taxiing a short distance, the pilot attempted to turn back to shore because of ice on the intended take-off path. During the turn, the outside float caught beneath the ice, resulting in the aircraft nosing over and coming to rest inverted. Neither the pilot nor the passenger was injured; both egressed safely. Both floats sustained damage, allowing water to leak into the forward compartments. TSB File A11O0232.

— On December 3, 2011, a Cessna 172 was overturned by the propeller blast from a Convair 340 that was doing a maintenance-related full-power run-up at Kelowna Airport (CYLW), B.C. The Cessna was taxiing on an uncontrolled section of the airport, en route for takeoff to conduct flight training. The flight instructor and the student on board the Cessna were not injured, but the aircraft was substantially damaged. TSB File A11P0163.

— On December 4, 2011, a Piper PA-44-180 aircraft was on a local flight with a pilot and instructor on board. During an approach to land at Gander, N.L., the landing gear was selected down and an unsafe nose indication was received. The pilot observed the nose gear down in the mirror on the cowling, and the tower confirmed the gear was down when the aircraft did a fly-by. The gear was cycled a few times and although an emergency extension was carried out, the nose gear still did not show down and locked. Numerous attempts were made to jolt the nose gear down into the locked position, but all were unsuccessful. The pilot declared an emergency and was cleared to land on Runway 21 with emergency response services (ERS) on standby. After touchdown, the nose gear collapsed and the aircraft came to rest about 3 200 ft from the intersection of runways 13 and 34. There were no injuries and the aircraft sustained damage to the nose landing gear doors, nose gear and lower fuselage. Company maintenance noted that one of the nose gear door rods had fractured, which would have prevented the nose gear from coming down. TSB File A11A0093.

— On December 6, 2011, a DHC-6-300 was on a night cargo flight from Iqaluit, Nun., to Kimmirut, Nun. During the area navigation (RNAV) approach to Runway 34, the crew noticed an increase in the ground speed due to an estimated 10-to-15-kt tailwind. The reported surface wind was from the east and estimated to be 10 kt. In an attempt to land as close as possible to the runway threshold, the pilot at the controls reduced the power to idle when the aircraft was on short final. However, the aircraft touched down on rocky ground approximately 5 to 10 ft before the runway threshold. The right wheel struck a large rock and the right landing gear strut broke. Having spun 180°, the aircraft came to rest in the middle of the runway. Neither of the two pilots, the sole occupants of the aircraft, sustained any injury. Repairs were carried out and the aircraft was ferried to Iqaluit for further repairs. The crew was aware of a NOTAM stating that the light on the wind direction indicator was out of service. The emergency locator transmitter (ELT) did not activate. TSB File A11Q0220.

— On December 8, 2011, an amateur-built CUBY aircraft ground-looped upon landing at the airport in Sorel, Que. The pilot, who was the only person on board, was not injured. The aircraft was significantly damaged. TSB File A11Q0227.

— On December 15, 2011, a Beech King Air 100 took off, with two pilots on board, from Val-d’Or, Que., on an IFR flight to Rouyn, Que. Having carried out a missed approach procedure because of bad weather at Rouyn, the aircraft returned to land at Val-d’Or. During the ground run, around 500 ft from the touchdown point, the landing gear lever was inadvertently pulled instead of the flap lever. The main gear retracted during the ground run. The propeller of the right engine struck the runway surface, the flaps and gear doors were damaged as well as a part of the belly surface. The aircraft came to rest on the runway and both pilots walked away unhurt. TSB File A11Q0231.

— On January 3, 2012, an R44 II helicopter was repositioning in a hover along a tree-lined road about 75 NM north of Fort St. John, B.C., when the main rotor blades clipped a tree. Control was lost, and the helicopter rolled on its side. The aircraft was substantially damaged, and the pilot and passenger sustained minor injuries. The 406 MHz emergency locator transmitter (ELT) activated. TSB File A12W0001.

— On January 5, 2012, a Cessna 172I was on a local flight in the vicinity of St. Claude, Man., with only the pilot on board. The pilot landed the aircraft in a northerly direction on a provincial road and the left wing came up during the landing roll. The pilot lost directional control of the aircraft and hit a utility pole. The pilot was not injured and the aircraft was substantially damaged. The winds were from the west, gusting to 18 kt. TSB File A12C0003.

— On January 7, 2012, a Eurocopter AS350 BA helicopter had lifted off to reposition for refuelling in a seismic operation staging area 20 NM west of Steen River, Alta., when the long line became entangled in the tail rotor. The aircraft landed with no injuries to the pilot, and substantial damage to the helicopter’s tail rotor system and tail boom. TSB File A12W0002.

— On January 22, 2012, a Cessna 205 departed Springhouse Airpark (CAQ4), B.C., around 08:30 Pacific Standard Time (PST) to conduct moose inventory in the Big Creek area, about 70 NM southwest of Williams Lake, B.C. About an hour later, Caribou Fire Centre noticed the aircraft’s on-board tracking system was displaying a red icon, and the pilot had not radioed in as required. The appropriate authorities were notified and a company aircraft departed CAQ4 to locate the missing aircraft. The search aircraft received an emergency locator transmitter (ELT) signal, but was forced to return to CAQ4 due to turbulence. A search and rescue (SAR) Buffalo aircraft located the crash site at about 13:00 PST and paradropped SAR technicians. A SAR Cormorant helicopter and a Bell 206B arrived about half an hour later and transported the pilot, three passengers and SAR technicians to Williams Lake. At the time of the accident the sky was overcast and as a result of the flat light, the aircraft was flown low over the snow-covered terrain to allow the spotters to identify moose tracks. At the end of a run heading toward rising terrain, the aircraft encountered a strong downdraft and was unable to outclimb the terrain. It struck the hillside at about 7 300 ft above sea level (ASL), overturned and was significantly damaged. One spotter was thrown from the aircraft on impact and received minor injuries. The pilot and the other two spotters were not injured. TSB File A12P0010.

— On January 29, 2012, a Cessna A185F equipped with Fluidyne 3600-type retractable skis was taxiing on the snow-covered surface of Lake Mercier, Que., to go to the take-off area. Because there was water under the snow covering, the pilot had to maintain a speed of around 25 kt. The right ski went under the snow, which caused the aircraft to flip over. There was damage to the propeller, the right wing and the empennage. None of the four occupants was injured. TSB File A12Q0016.

— On January 30, 2012, a Bell 212HP helicopter on heli-ski operations near McBride, B.C., was struck by an avalanche. The helicopter had dropped off skiers at the top of the ski run and the pilot was in the process of shutting down the Pratt &Whitney PT6T “twin-pack” engines after landing at the staging area at the bottom of the hill. The rotors were turning at idle RPM when the helicopter was struck by the avalanche. The snow pushed the helicopter onto its side and broke the tail boom. The pilot was the only person on board and he escaped with minor injuries. The avalanche did not affect the skiers. TSB File A12P0014.

Terrain Awareness and Warning Systems - 
Regulations Published in Canada Gazette Part 2

On July 4, 2012, Transport Canada announced new regulations requiring the installation and operation of Terrain Awareness and Warning Systems (TAWS) in private turbine-powered and commercial airplanes configured with six or more passenger seats.

For details, click HERE, and also consult Advisory Circular (AC) No. 600-003.

Regulations and You


Suspension of Canadian Aviation Documents—Immediate Threat to Aviation Safety

by Jean-François Mathieu, LL.B., Chief, Aviation Enforcement, Standards, Civil Aviation, Transport Canada

In a previous Aviation Safety Letter (ASL) article, we indicated that Transport Canada Civil Aviation (TCCA) has recently published internal guidance material related to the suspension or cancellation of a Canadian aviation document (CAD), typically a licence or certificate issued by TCCA. This information was published in TCCA staff instructions SUR-014, SUR-015 and SUR-016. In that article, we indicated that we would delve further into the legal authority the Minister has to suspend or cancel these documents.

We would now like to provide some detail regarding the suspension of a CAD under the authority of section 7 of the Aeronautics Act (the Act), that is to say—the suspension of a CAD in response to an “immediate threat to aviation safety”.

While the Act gives the Minister of Transport the authority to suspend a CAD when there are grounds to believe there is an immediate threat to aviation safety, the Act does not provide much detail in describing what an “immediate threat to aviation safety” is. For that reason, we have attempted to define it by rationalizing the two key words used in the phrase, those being: “immediate” and “threat”, as they relate to aviation safety.

An immediate threat to aviation safety is a threat to the safety of an aircraft that creates a reasonable expectation that unless immediate action is taken to neutralize the threat, an aircraft accident causing death, injury or significant damage to property is likely to occur imminently.

While a common use of the word “threat” can be interpreted rather broadly, in the context of aviation safety, and for the purpose of providing guidance to TCCA inspectors, we have defined “threat” as a condition that is likely to pose a risk of injury, death or significant property damage, as a result of an aircraft accident. While other threats may exist within aviation, such as risks to the health of ground personnel related to working conditions, or financial risks related to business operations, the “aviation safety” context limits the scope of the section 7 authority. The word “immediate” can be interpreted as qualifying something that currently exists or is about to exist imminently or without delay. Therefore, an immediate threat to aviation safety is a threat to the safety of an aircraft that creates a reasonable expectation that unless immediate action is taken to neutralize the threat, an aircraft accident causing death, injury or significant damage to property is likely to occur imminently.

An example of an “immediate threat to safety” would be a pilot who refused to de-ice and who proceeded for takeoff after he had been made aware that there was ice or snow adhering to the critical surfaces of his aircraft. In this context, the “threat” that is likely to pose a risk of death, injury or significant property damage is an aircraft accident resulting from the imminent attempt to take off in the knowledge that the performance of the aircraft would be degraded by the ice or snow adhesion. Therefore, a TCCA inspector could, where verbal notification of the surface contamination was being ignored by the pilot, serve the pilot with notice of pilot licence suspension. Wilfully disregarding a suspension is an additional offence of a serious nature under section 7.3 of the Act.

Due to the immediate nature of such a threat, a CAD suspension under this section takes effect immediately, and no procedural constraints delay the coming-into-effect of this type of suspension—except for the requirement to provide a notice to the holder of the CAD whose CAD is being suspended. Additionally, once the threat has been neutralized, the suspension is to be withdrawn. This authority is used only if an immediate threat to aviation safety exists. The Act recognizes and identifies the transient nature of such threats by providing authority to suspend only; cancellation of a CAD is not authorized under this section of the Act. A CAD suspension under section 7 is not used to address past regulatory non-compliance or any other identified safety deficiencies that are not of an urgent or immediate nature; it is used only to address existing and identifiable threats to safety that are of an urgent or immediate nature. Other actions can be taken with regard to the circumstances that lead to the immediate threat developing, but any other action would have to be taken under different sections of the Act, and such actions would take longer to implement and would involve more procedural fairness in their application.

Certainly, it would be a rare circumstance where this authority would need to be used; there are not many CAD holders (pilots, operators, etc.) who, when apprised of an immediate threat to aviation safety, would continue the aircraft operation, knowing that an accident is imminent. In fact, should such a circumstance arise, that is—where a CAD holder is not concerned enough about their own safety or the safety of their passengers to put a stop to a flight that is likely to end in an accident—a suspension of a licence or certificate may not be a strong enough response to eliminate the immediate threat. In these cases, it may be necessary to use the authority under a different section of the Act (section 8.7) to detain the aircraft until the safety issue can be dealt with in another way.

And so, while this authority is rarely used by TCCA, it is important that it exists and that CAD holders know that TCCA inspectors have the legal authority to take immediate action, and will do so whenever necessary to neutralize an immediate threat to aviation safety.

For more information on the subject, please refer to Staff Instruction SUR-014.


A Just Culture

by Arnaud Delmas. This article is one of many excellent articles published by Jean Gabriel Charrier and his team on the French www.mentalpilote.com Web site. It was translated from its original version and is reproduced with permission.

From a “punitive culture” to a “just culture”
Since ancient times, people have always been held responsible for their actions, even unintentional errors. Is it the notion of “an eye for an eye, a tooth for a tooth” that holds in check the desire for justice—or vengeance—felt by victims’ families and the public? As human beings, we believe that the person responsible is also the person to blame.

This interpretation of justice or the “punitive culture” has not evolved very much, except regarding the types of punishment, which are far less barbaric! Under the French penal code, not only negligence or carelessness, but also clumsiness or lack of attention are considered just cause to impose a heavy penalty, such as death or serious injury, on the person responsible for an accident.

Aviation is one of the high-risk activities in which complex systems are in play, and safety is a determining factor. This “punitive culture” is increasingly perceived by the operators of these systems as unjust and ineffective:

  • unjust, because a mishap and the deliberate violation of rules are condemned in equal measure;
  • ineffective, because contrary to the “one rotten apple theory”, we all, without exception, make mistakes. It is unrealistic to claim that human error can be eradicated!

In fact, a “punitive culture” does not differentiate between the mistake that constitutes a deliberate infringement of a rule and the error that is unintentional. Error can be seen as an unintentional infringement.

In our increasingly litigious society, where we are all trying—quite rightly—to protect ourselves, the “punitive culture” has two adverse effects on aviation:

  • refusal to take risks, which is arguably an application of the “precautionary principle”;
  • failure to divulge errors so as to “preserve the right of defence”.

And yet, to achieve progress in the field of safety, it is much more effective to analyze the errors made by those who were lucky enough to escape and who are willing to talk about it, rather than to try to get the wrecks and the witnesses to give up their secrets when those involved in the tragedy are dead.

Serious accidents are only the tip of an iceberg of accidents, incidents and events that are significant for flight safety. By reducing the number of these events, it is hoped that the likelihood of a serious accident can also be reduced. To achieve this reduction, it is first necessary to acquire a good understanding of the causes of each event.

Flight safety is based, therefore, on transparency and on the sharing of information. Indeed, to be effective, all feedback systems rely on each person’s willingness to provide essential safety information, which often means being prepared to report one’s own mistakes and errors. It is essential to establish a “just culture” in order to create a climate of trust that encourages and facilitates communication and the sharing of information.

A “just culture”
The concept of a “just culture” is based on a non-punitive attitude toward human error. Voluntary transgression on the other hand must be punished.

Professor James Reason defines a just culture as “an atmosphere of trust in which those who provide essential safety-related information are encouraged and even rewarded, but in which people are clear about where the line is drawn between acceptable and unacceptable behaviour.”

European Union states and organizations have proposed the following definition: “A culture in which front-line players are not punished for actions, omissions or decisions proportional to their experience and training, but also a culture in which serious negligence, deliberate violation and destructive acts are not tolerated.”

France’s Civil Aviation Code (s. L 722-3) states that: “No administrative, disciplinary or professional sanction can be imposed on persons who have reported a civil aviation accident or incident or an event..., under the conditions stated in section L. 722-2, whether or not those persons were involved in the accident, incident or event, unless those persons were themselves guilty of a deliberate or repeated breach of the safety regulations.” [Translation]

In light aviation, this protection is provided to pilots who report an event to the Recueil d’Événements Confidentiels (REC) [confidential reporting system] created by France’s Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (BEA) [civil aviation accident investigation agency]. The report is not anonymous, but it is confidential; those involved are not identified in the reports of the REC.

The four basic principles of the Canadian Air Force’s Flight Safety (FS) Program provide another interesting example[1]:

  • The main focus of the FS Program is on the prevention of occurrences. Although cause factors are assigned to occurrences, this is only done to assist in the development of effective preventive measures (PMs).
  • Personnel involved in conducting and supporting flying operations are expected to freely and openly report all FS occurrences and FS concerns.
  • In order to determine the cause of occurrences so that appropriate and effective PMs can be developed and implemented, personnel involved in conducting and supporting flying operations are expected to voluntarily acknowledge their own errors and omissions.
  • In order to facilitate free and open reporting and voluntary acknowledgement of errors and omissions, the FS Program does not assign blame. Personnel involved in a FS occurrence are de-identified in the final reports and the reports themselves cannot be used for legal, administrative, disciplinary or other proceedings.

Establishing a “just culture” in a flying club
In order to promote trust, it is essential that reported occurrences are dealt with in the strictest confidence. In a small organization like a flying club, this is the responsibility of the “flight safety representative”, as distinct from the chief pilot.

In this environment, a “just culture” means:

  • In cases of error or involuntary infringement, no sanction is imposed.
  • All events involving flight safety must be reported to the flight safety representative.
  • Reported incidents are treated as confidential (no public confession!) and feedback is used in a depersonalized form.
  • Sanction is imposed in cases of deliberate or repeated breach of safety regulations, or of failure to report any obviously significant incident.
  • Since all those involved are called upon to acknowledge their errors and omissions, a request for retraining is not seen as a sanction, but as a normal part of the process.

Often, these aspects of a “just culture” are already in place, but they should be set down in specific internal regulations that everyone is aware of and that are applied.

decorative line above footnotes


decorative line above footnotes


Authorized? Be sure! Runway Incursions Are Real!


Safety in the air starts on the ground—Maintenance (poster)
Date modified: