- Visual Flight—Safe and Legal
- Focus on CRM—Threat And Error Management (TEM)
- Bounce Back! Train Your Crews for Bounced Landing Recovery Techniques!
by Don Taylor, Civil Aviation Safety Inspector, National Operations Branch, Civil Aviation, Transport Canada
You’ve been flying for an hour and a half in what can best be described as marginal VFR weather. You left Kenora, Ont., at 1300Z this morning in the club’s 172 on a VFR flight to Brandon, Man. An approaching warm front has kept you low, but you’ve been able to keep the flight safe and legal. It’s been Class G (uncontrolled) airspace all the way once you cleared the Kenora zone. When flying above 1 000 ft AGL, you have been able to maintain at least 1 mi. flight visibility, as well as 2 000 ft horizontally and 500 ft vertically from cloud. When the ceiling forced you down below 1 000 ft AGL, you were able to maintain 2 mi. flight visibility and stay clear of cloud. By keeping the ground in sight and avoiding built-up areas, you were able to keep it all legal, but just barely.
By diverting a bit to the south, you avoided the controlled airspace at Winnipeg and Portage la Prairie, but now you are approaching Brandon, your destination. You want to enter the control zone to land. The last weather information you have is:
METAR CYBR 091400Z 19008KT 4SM BR
FEW005 BKN009 M01/M02 A3033 RMK
Is it VFR? Will they let you in? Will you need special VFR (SVFR)? Can you get SVFR? Why would you want SVFR?
Control zones, VFR and SVFR
As pilots, air traffic controllers and flight service specialists, we should all know the rules on VFR and SVFR. Why do so many of us misunderstand these concepts? For one thing, some of the rules have changed since we first learned them. Air traffic services (ATS) procedures have been a bit slow to adjust to the new rules, but now the dust has settled. Let’s try to answer some of the questions aviation professionals have on the subject, such as: Why do we have control zones? Why are the weather rules different in control zones? What’s so special about special VFR anyway? If a pilot gets SVFR from ATS, does that mean it’s safe and legal to fly?
Let’s take a look at control zones, VFR and SVFR and the weather minima that go with them to determine what it all means to you, the pilot.
Control zones have been a fact of life in Canadian aviation for a long time. We have 130 aerodrome control zones in Canada. According to the Transport Canada Aeronautical Information Manual (TC AIM), control zones are there in order to “keep IFR aircraft within controlled airspace during approaches and to facilitate the control of VFR and IFR traffic.” Perhaps more importantly, it also means that the weather minima are more restrictive. This gives aircraft on an IFR approach a better chance to see and be seen in order to avoid conflict with VFR aircraft in the control zone. A control zone normally has a 5- or 7-NM radius and extends from the surface to about 3 000 ft AGL. This fills the gap nicely, extending controlled airspace right down to the runway.
Along airways, the base of controlled airspace is normally 2 200 ft AGL. A number of airports with an instrument approach procedure (IAP) do not have a control zone. This would mean, for example, that if you are conducting an IFR approach for the Carp Airport, you will finish the approach in Class G (uncontrolled) airspace.
So where are these control zones? Certainly every airport control tower is located in one, because by definition, controllers cannot do their job in uncontrolled airspace. Most flight service stations (FSS) are in control zones, but not all: the Rankin Inlet FSS and the La Grande Rivière FSS are exceptions. Most community aerodrome radio stations (CARS) are not in control zones, but many are: the Fort Simpson and the Fort Smith CARS are located in control zones.
We have many control zones at airports where there are no local ATS or CARS services: Sarnia and Wiarton in Ontario and Princeton in British Columbia are examples.
Above Rocky Mountain House Airport (CYRM), you are in uncontrolled airspace from the runway right up to 18 000 ft. This means that the VFR weather minima at CYRM are much lower than they would be at a Princeton, where there is a control zone.
Control zone VFR regulations
For VFR flight in a control zone, you are required to maintain:
1. Visual reference to the surface;
2. Flight visibility of 3 mi.;
3. 1 mi. horizontally clear of cloud;
4. At least 500 ft vertically clear of cloud;
5. At least 500 ft AGL, except for takeoff and landing; and
6. Ground visibility (if reported) must be at least 3 mi.
As we said, these stricter rules are to help VFR and IFR aircraft avoid collisions in control zones. For example, an IFR aircraft in a control zone should not expect to encounter VFR aircraft in the first 500 ft after descending out of a cloud deck.
Here are a few things to keep in mind when flying VFR in a control zone:
- There is no minimum reported ceiling for VFR flight in a control zone. It is left up to the pilot to ensure he can maintain at least 500 ft below cloud and legal altitude above ground regardless of the METAR reported ceiling.
- Canadian Aviation Regulation (CAR) 602.14 still applies. For example, if you are over a “built-up area”, you will need to maintain at least 1 000 ft above obstacles.
- In a control zone, you must have both 3 mi. flight visibility and 3 mi. ground visibility (if reported).
- ATC, FSS or CARS will tell you that “IFR OR SVFR IS REQUIRED” any time the ground visibility is below 3 mi. It’s the pilot’s responsibility to ensure you can comply with all the minima, so if any of the other five are a problem, you need SVFR or IFR.
Control zones place stricter weather minima on VFR aircraft to allow “see and avoid” to work between IFR and VFR aircraft.
SVFR allows ATS to relax these more stringent rules when there is no conflicting IFR traffic. In this way, VFR traffic is not unnecessarily restricted. There are still weather minima for SVFR. For your daytime SVFR flight, you can fly provided you can maintain these minima:
- Visual reference with the surface;
- Height above ground in compliance with CAR 602.14;
- Clear of cloud;
- Flight visibility of 1 mi.*; and
- Ground visibility 1 mi.* (if reported).
Note that the SVFR minima are similar to uncontrolled airspace minima. This makes sense. Since there is no conflicting IFR traffic, we don’t really need the more restrictive control zone minima. When you request and obtain SVFR, you are guaranteed protection from IFR traffic conflicts.
If you request it and the ground visibility at the airport is 1 mi.* or more, CAR 602.117 requires ATC to grant SVFR (traffic permitting). They do not have a choice. If you receive SVFR approval from ATC or an FSS, it does not mean that it is legal or safe to fly in the control zone. ATC only knows what the ground visibility is; the other four criteria for SVFR are flight conditions, and it’s your responsibility as the pilot to know and respect these minima.
So how does all this work?
You are flying VFR down the Skeena River Valley through the Terrace, B.C., control zone westbound towards Prince Rupert. The Terrace weather is:
METAR CYXT 091700Z 00000KT 8SM OVC007
M02/M03 A3024 RMK SF8 INTMT -SN
The Terrace FSS will not tell you that “IFR OR SVFR IS REQUIRED” because the ground visibility is over 3 mi.
If you were going to Terrace Airport, you might have trouble maintaining the 500 ft below cloud and 500 ft above ground required for VFR flight in the control zone. If that were the case, you should request SVFR. But since you are just passing through the control zone along the river (which is over 500 ft below the airport elevation), you may very well find you can legally fly VFR in that portion of the control zone. SVFR would not be required.
As you approach the Terrace control zone on your return trip, you find the weather has changed a bit:
METAR CYXT 091900Z 00000KT 2SM BR
OVC012 M02/M02 A3024 RMK SF8 SLP241=
You still have good ceilings and flight visibility of 4 mi. along the river valley, but because the reported ground visibility has dropped below 3 mi., VFR is no longer possible anywhere in the control zone. The Terrace FSS will tell you “IFR OR SVFR IS REQUIRED”, and you will need to request and obtain SVFR to proceed. Your other option is to stay outside the control zone, safe and legal in Class G airspace.
You want to depart from Sarnia on a VFR flight to Toronto. The Sarnia weather is:
SPECI CYZR 091756Z AUTO 30010KT 2SM
-SNSH OVC026 M02/M04 A3015 RMK
SLP217 MAX WND 31017KT AT 1706Z=
Your departure path looks good, with visibility to the east at least 5 mi., but because the reported ground visibility is 2 mi., you cannot legally fly VFR in the Sarnia control zone; SVFR is required. Since there is no ATS unit at Sarnia, you will have to obtain SVFR from the London Flight Information Centre on frequency 123.475 MHz. If you get SVFR, you can be sure no IFR aircraft will be popping out of those snow showers.
You roll your plane out of the hanger at Springbank. When you call the tower for your taxi clearance, they tell you the weather is:
METAR CYBW 091800Z 33002KT 4SM -FZDZ
BR OVC004 M02/M03 A3026 RMK
In this case, the tower won’t say “IFR OR SVFR IS REQUIRED” because the ground visibility is over 3 mi. You know that you won’t be able fly legally VFR or SVFR with a 400-ft overcast. IFR is your only option, but take another look at that weather. You really don’t want to fly today.
Back to Manitoba. You’re now 15 mi. from Brandon. It’s time to call the FSS for the advisory. They give you the latest weather information:
METAR CYBR 091500Z 19008KT 4SM BR
SCT005 BKN008 M01/M02 A3033 RMK
The flight service specialist knows that the reported visibility is good for VFR at 4 mi., but she doesn’t know if your flight conditions make VFR legal or not. She won’t say “IFR OR SVFR IS REQUIRED” because the ground visibility is over 3 mi. With all that low cloud, you know you won’t be able to stay 500 ft above ground and 500 ft below cloud. You know you need SVFR to stay legal. You make the request, and Winnipeg Area Control Centre approves it. Once you have it, you know you won’t come into conflict with any IFR aircraft. You can maintain the SVFR minima without a problem. Your arrival at Brandon is safe and legal.
The bottom line(s)
- Control zones extend controlled airspace down to the runway. Control zone weather regulations provide better conditions for IFR and VFR aircraft to see and be seen.
- Control zone weather limits are based on reported ground visibility and your flight conditions. ATS will tell you if reported ground visibility makes it illegal to fly VFR (less than 3 mi.) or SVFR (less than 1 mi.*). It is your responsibility to observe and comply with the specified flight conditions.
- When you request it, ATS will provide SVFR (traffic permitting) when the reported ground visibility is 1 mi.* or more.
- SVFR guarantees protection from conflicting IFR traffic. It’s there for the pilot’s protection. Request it when you need it.
- Check out CAR 602.14 (minimum altitudes), CAR 602.114 (VFR) and CAR 602.117 (SVFR).
- Stay safe, stay legal, and have fun.
*½ mi. for helicopters
Focus on CRM
The following article was presented by Captain Dan Maurino, then Coordinator, Flight Safety and Human Factors Programme—ICAO, at the 2005 edition of the Canadian Aviation Safety Seminar (CASS) held in Vancouver, B.C., April 18–20 2005. It is an excellent article on threat and error management (TEM), and it serves our audience well in furthering our current awareness campaign on TEM theory and principles, in the context of extending CRM training for all commercial pilots.
Threat and Error Management
by Captain Dan Maurino (2005)
Threat and error management (TEM) is an overarching safety concept regarding aviation operations and human performance. TEM is not a revolutionary concept, but it evolved gradually, as a consequence of the constant drive to improve the margins of safety in aviation operations through the practical integration of Human Factors knowledge.
TEM developed as a product of the collective industry experience. Such experience fostered the recognition that past studies and, most importantly, operational consideration of human performance in aviation had largely overlooked the most important factor influencing human performance in dynamic work environments: the interaction between people and the operational context (i.e., organizational, regulatory and environmental factors) within which people discharge their operational duties.
The recognition of the influence of the operational context in human performance further led to the conclusion that study and consideration of human performance in aviation operations must not be an end in itself. In regard to the improvement of margins of safety in avaition operations, the study and consideration of human performance without context address only part of a larger issue. TEM therefore aims to provide a principled approach to the broad examination of the dynamic and challenging complexities of the operational context in human performance, for it is the influence of these complexities that generates consequences directly affecting safety.
The TEM model
The TEM model is a conceptual framework that assists in understanding, from an operational perspective, the inter-relationship between safety and human performance in dynamic and challenging operational contexts.
The TEM model focuses simultaneously on the operational context and the people discharging operational duties in such context. The model is descriptive and diagnostic of both human and system performance. It is descriptive because it captures human and system performance in the normal operational context, resulting in realistic descriptions. It is diagnostic because it allows quantifying complexities of the operational context in relation to the description of human performance in that context, and vice-versa.
The TEM model can be used in several ways. As a safety analysis tool, the model can focus on a single event, as is the case with accident/incident analysis; or it can be used to understand systemic patterns within a large set of events, as is the case with operational audits. The TEM model can be used as a licensing tool, helping clarify human performance needs, strengths and vulnerabilities, allowing the definition of competencies from a broader safety management perspective. The TEM model can be used as a training tool, helping an organization improve the effectiveness of its training interventions, and consequently of its organizational safeguards.
Originally developed for flight deck operations, the TEM model can nonetheless be used at different levels and sectors within an organization, and across different organizations within the aviation industry. It is therefore important, when applying TEM, to keep the user’s perspective in the forefront. Depending on “who” is using TEM (front-line personnel, intermediate management, senior management; flight operations, maintenance, air traffic control), slight adjustments to related definitions may be required. This paper focuses on the flight crew as “user”, and the discussion herein presents the perspective of flight crews’ use of TEM.
The components of the TEM model
There are three basic components in the TEM model, from the perspective of flight crews: threats, errors and undesired aircraft states. The model proposes that threats and errors are part of everyday aviation operations that must be managed by flight crews, since both threats and errors carry the potential to generate undesired aircraft states. Flight crews must also manage undesired aircraft states, since they carry the potential for unsafe outcomes. Undesired state management is an essential component of the TEM model, as important as threat and error management. Undesired aircraft state management largely represents the last opportunity to avoid an unsafe outcome and thus maintain safety margins in flight operations.
Threats are defined as “events or errors that occur beyond the influence of the flight crew, increase operational complexity, and which must be managed to maintain the margins of safety.” During typical flight operations, flight crews have to manage various contextual complexities. Such complexities would include, for example, dealing with adverse meteorological conditions, airports surrounded by high mountains, congested airspace, aircraft malfunctions, errors committed by other people outside of the cockpit, such as air traffic controllers, flight attendants or maintenance workers, and so forth. The TEM model considers these complexities as threats because they all have the potential to negatively affect flight operations by reducing margins of safety.
Some threats can be anticipated, since they are expected or known to the flight crew. For example, flight crews can anticipate the consequences of a thunderstorm by briefing their response in advance, or prepare for a congested airport by making sure they keep a watchful eye for other aircraft as they execute the approach.
Some threats can occur unexpectedly, such as an in-flight aircraft malfunction that happens suddenly and without warning. In this case, flight crews must apply skills and knowledge acquired through training and operational experience.
Lastly, some threats may not be directly obvious to, or observable by, flight crews immersed in the operational context, and may need to be uncovered by safety analyses. These are considered latent threats. Examples of latent threats include equipment design issues, optical illusions, or shortened turn-around schedules.
Regardless of whether threats are expected, unexpected, or latent, one measure of the effectiveness of a flight crew’s ability to manage threats is whether threats are detected with the necessary anticipation to enable the flight crew to respond to them through deployment of appropriate countermeasures.
Threat management is a building block to error management and undesired aircraft state management. Although the threat-error linkage is not necessarily straightforward, although it may not be always possible to establish a linear relationship, or one-to-one mapping between threats, errors and undesired states, archival data demonstrates that mismanaged threats are normally linked to flight crew errors, which in turn are oftentimes linked to undesired aircraft states. Threat management provides the most proactive option to maintain margins of safety in flight operations, by voiding safety-compromising situations at their roots. As threat managers, flight crews are the last line of defense to keep threats from impacting flight operations.
Table 1 presents examples of threats, grouped under two basic categories derived from the TEM model. Environmental threats occur due to the environment in which flight operations take place. Some environmental threats can be planned for and some will arise spontaneously, but they all have to be managed by flight crews in real time. Organizational threats, on the other hand, can be controlled (i.e., removed or, at least, minimised) at source by aviation organizations. Organizational threats are usually latent in nature. Flight crews still remain the last line of defense, but there are earlier opportunities for these threats to be mitigated by aviation organizations themselves.
Table 1. Examples of threats (List not inclusive)
|Environmental Threats||Organizational Threats|
Errors are defined “actions or inactions by the flight crew that lead to deviations from organizational or flight crew intentions or expectations.” Unmanaged and/or mismanaged errors frequently lead to undesired aircraft states. Errors in the operational context thus tend to reduce the margins of safety and increase the probability of adverse events.
Errors can be spontaneous (i.e., without direct linkage to specific, obvious threats), linked to threats, or part of an error chain. Examples of errors would include the inability to maintain stabilized approach parameters, executing a wrong automation mode, failing to give a required callout, or misinterpreting an ATC clearance.
Regardless of the type of error, an error’s effect on safety depends on whether the flight crew detects and responds to the error before it leads to an undesired aircraft state and to a potential unsafe outcome. This is why one of the objectives of TEM is to understand error management (i.e., detection and response), rather than solely focusing on error causality (i.e., causation and commission). From the safety perspective, operational errors that are timely detected and promptly responded to (i.e., properly managed), errors that do not lead to undesired aircraft states, do not reduce margins of safety in flight operations, and thus become operationally inconsequential. In addition to its safety value, proper error management represents an example of successful human performance, presenting both learning and training value.
Capturing how errors are managed is then as important, if not more so, than capturing the prevalence of different types of errors. It is of interest to capture if and when errors are detected and by whom, the response(s) upon detecting errors, and the outcome of errors. Some errors are quickly detected and resolved, thus becoming operationally inconsequential, while others go undetected or are mismanaged. A mismanaged error is defined as an error that is linked to or induces an additional error or undesired aircraft state.
Table 2 presents examples of errors, grouped under three basic categories derived from the TEM model. In the TEM concept, errors have to be “observable” and therefore, the TEM model uses the “primary interaction” as the point of reference for defining the error categories.
The TEM model classifies errors based upon the primary interaction of the pilot or flight crew at the moment the error is committed. Thus, in order to be classified as an aircraft handling error, the pilot or flight crew must be interacting with the aircraft (e.g. through its controls, automation or systems). In order to be classified as a procedural error, the pilot or flight crew must be interacting with a procedure (e.g. checklists; SOPs; etc). In order to be classified as a communication error, the pilot or flight crew must be interacting with people (ATC; groundcrew; other crew members, etc.).
Aircraft handling errors, procedural errors and communication errors may be unintentional or involve intentional non-compliance. Similarly, proficiency considerations (i.e., skill or knowledge deficiencies, training system deficiencies) may underlie all three categories of error. In order to keep the approach simple and avoid confusion, the TEM model does not consider intentional non-compliance and proficiency as separate categories of error, but rather as sub-sets of the three major categories of error.
Table 2. Examples of errors (List not inclusive)
|Aircraft handling errors||
Undesired aircraft states
Undesired aircraft states are defined as “flight crew-induced aircraft position or speed deviations, misapplication of flight controls, or incorrect systems configuration, associated with a reduction in margins of safety.” Undesired aircraft states that result from ineffective threat and/or error management may lead to compromising situations and reduce margins of safety in flight operations. Often considered at the cusp of becoming an incident or accident, undesired aircraft states must be managed by flight crews.
Examples of undesired aircraft states would include lining up for the incorrect runway during approach to landing, exceeding ATC speed restrictions during an approach, or landing long on a short runway requiring maximum braking. Events such as equipment malfunctions or ATC controller errors can also reduce margins of safety in flight operations, but these would be considered threats.
Undesired states can be managed effectively, restoring margins of safety, or flight crew response(s) can induce an additional error, incident, or accident.
Table 3 presents examples of undesired aircraft states, grouped under three basic categories derived from the TEM model.
Table 3. Examples of undesired aircraft states (List not inclusive)
|Incorrect aircraft configurations||
An important learning and training point for flight crews is the timely switching from error management to undesired aircraft state management. An example would be as follows: a flight crew selects a wrong approach in the Flight Management Computer (FMC). The flight crew subsequently identifies the error during a crosscheck prior to the Final Approach Fix (FAF). However, instead of using a basic mode (e.g. heading) or manually flying the desired track, both flight crew become involved in attempting to reprogram the correct approach prior to reaching the FAF. As a result, the aircraft “stitches” through the localiser, descends late, and goes into an unstable approach. This would be an example of the flight crew getting “locked in” to error management, rather than switching to undesired aircraft state management. The use of the TEM model assists in educating flight crews that, when the aircraft is in an undesired state, the basic task of the flight crew is undesired aircraft state management instead of error management. It also illustrates how easy it is to get locked in to the error management phase.
Also from a learning and training perspective, it is important to establish a clear differentiation between undesired aircraft states and outcomes. Undesired aircraft states are transitional states between a normal operational state (i.e., a stabilised approach) and an outcome. Outcomes, on the other hand, are end states, most notably, reportable occurrences (i.e., incidents and accidents). An example would be as follows: a stabilised approach (normal operational state) turns into an unstablised approach (undesired aircraft state) that results in a runway excursion (outcome).
The training and remedial implications of this differentiation are of significance. While at the undesired aircraft state stage, the flight crew has the possibility, through appropriate TEM, of recovering the situation, returning to a normal operational state, thus restoring margins of safety. Once the undesired aircraft state becomes an outcome, recovery of the situation, return to a normal operational state, and restoration of margins of safety is not possible.
Flight crews must, as part of the normal discharge of their operational duties, employ countermeasures to keep threats, errors and undesired aircraft states from reducing margins of safety in flight operations. Examples of countermeasures would include checklists, briefings, call-outs and SOPs, as well as personal strategies and tactics. Flight crews dedicate significant amounts of time and energies to the application of countermeasures to ensure margins of safety during flight operations. Empirical observations during training and checking suggest that as much as 70% of flight crew activities may be countermeasures-related activities.
All countermeasures are necessarily flight crew actions. However, some countermeasures to threats, errors and undesired aircraft states that flight crews employ build upon “hard” resources provided by the aviation system. These resources are already in place in the system before flight crews report for duty, and are therefore considered as systemic-based countermeasures. The following would be examples of “hard” resources that flight crews employ as systemic-based countermeasures:
- Airborne Collision Avoidance System (ACAS);
- Ground Proximity Warning System (GPWS);
- Standard operation procedures (SOPs);
Other countermeasures are more directly related to the human contribution to the safety of flight operations. These are personal strategies and tactics, individual and team countermeasures, that typically include canvassed skills, knowledge and attitudes developed by human performance training, most notably, by crew resource management (CRM) training. There are basically three categories of individual and team countermeasures:
- Planning countermeasures: essential for managing anticipated and unexpected threats;
- Execution countermeasures: essential for error detection and error response;
- Review countermeasures: essential for managing the changing conditions of a flight.
Enhanced TEM is the product of the combined use of systemic-based and individual and team countermeasures. Table 4 presents detailed examples of individual and team countermeasures.
Table 4. Examples of individual and team countermeasures
|SOP BRIEFING||The required briefing was interactive and operationally thorough||
|PLANS STATED||Operational plans and decisions were communicated and acknowledged||
|Roles and responsibilities were defined for normal and non-normal situations||
|Crew members developed effective strategies to manage threats to safety||
|Crew members actively monitored and cross-checked systems and other crew members||
|Operational tasks were prioritized and properly managed to handle primary flight duties||
|Automation was properly managed to balance situational and/or workload requirements||
|Existing plans were reviewed and modified when necessary||
|INQUIRY||Crew members asked questions to investigate and/or clarify current plans of action||
|ASSERTIVENESS||Crew members stated critical information and/or solutions with appropriate persistence||
Incorrect recoveries from bounced landings have contributed to several accidents in which aeroplanes operated by Canadian Subpart 705 air operators have sustained substantial damage. After investigating the bounced landing and subsequent tail strike during the go-around of a Boeing 727 at the Hamilton International Airport, the Transportation Safety Board of Canada (TSB) has recommended, in TSB Final Report A08O0189, that air operators “…incorporate bounced landing recovery techniques in the flight manuals and to teach these techniques during initial and recurrent training.” (TSB A09-01)
As a result of this recommendation, on January 1, 2010, Transport Canada issued Advisory Circular (AC) 705-007, which encouraged Canadian Subpart 705 air operators to voluntarily institute bounced landing recovery training into their flight crew training syllabus, and to provide bounced landing information in their company operations manual (COM). The AC includes excellent references, including accident reports for review. A must-read reference is the Flight Safety Foundation’s Approach and Landing Accident Reduction (ALAR) Tool Kit, 6.4 Bounce Recovery – Rejected Landing. In fact, while you’re at it, you may want to re-familiarize yourself with the entire ALAR Tool Kit, which received a significant update in 2010. Just visit this link: FSF ALAR.
Transport Canada is currently assessing the effectiveness of the voluntary approach to bounced landing recovery training. We encourage all air operators, not only 705 but also 703 and 704, to add this important training to their annual and recurrent training syllabus.
- Date modified: