Aviation Investigation Report A07A0134

On 11 November 2007, the Bombardier Global 5000 (registration C-GXPR, serial number 9211), operated by Jetport Inc., departed Hamilton, Ontario, for Fox Harbour, Nova Scotia, with two crew members and eight passengers on board. At approximately 1434 Atlantic standard time, the aircraft touched down seven feet short of Runway 33 at the Fox Harbour aerodrome. The main landing gear was damaged when it struck the edge of the runway, and directional control was lost when the right main landing gear collapsed. The aircraft departed the right side of the runway and came to a stop 1000 feet from the initial touchdown point. All occupants evacuated the aircraft. One crew member and one passenger suffered serious injuries; the other eight occupants suffered minor injuries. The aircraft sustained major structural damage.

1.1 History of the Flight

For the occurrence flight, the captain was occupying the left seat and was the pilot flying (PF), ^{Footnote 1} the first officer was occupying the right seat and was the pilot not flying (PNF). Due to the short runway at Fox Harbour aerodrome, Nova Scotia (CFH4), the captain, who had more experience on the aircraft, was at the controls. The en route portion of the flight to CFH4 was uneventful.

Approaching the destination, the crew completed the approach and landing briefing. Because a damp runway and a crosswind were expected, they planned a firm touchdown followed by use of reverse thrust. The autobrake system has settings of low, medium or high. For passenger comfort, the autobrake system was selected on the low setting. In order to maximize the available roll-out distance, the touchdown point was planned for the first 500 feet of runway, the same distance this crew had used in the past when flying into CFH4 with other company aircraft (see Appendix A – Touchdown Points). The captain had verified the landing distance performance and had estimated that, for the conditions, 4300 feet of the 4885-foot runway was required.

The crew completed the descent checklist and received descent clearance from Moncton Centre, New Brunswick, at 1406. ^{Footnote 2} The crew kept the autothrottle system engaged and used the autopilot to fly a full RNAV (GNSS) ^{Footnote 3} approach to Runway 33.

During the approach, the first officer keyed his microphone seven times to activate the aircraft radio control of aerodrome lighting (ARCAL) system. ^{Footnote 4} This caused the runway threshold, end and edge lights as well as the abbreviated precision approach path indicator (APAPI) to illuminate.

The landing gear was then extended and flaps were selected to the 30° position. The flight management system (FMS) target speed was selected to 118 knots to reflect the V_ref ^{Footnote 5} speed of 113 knots increased by 5 knots for wind gust. With the autopilot engaged, the aircraft remained on track and on the vertical path generated by the FMS, with only minor aileron and rudder inputs required to compensate for the crosswind. Although the wind caused bumpy flight conditions, the autothrottle was maintaining airspeed with minor fluctuations.

At 1430:53, five nautical miles (nm) from the threshold of Runway 33, the aircraft crossed the final approach fix at an altitude of 1680 feet above sea level (asl). At that point, the crew had the runway in sight. At 4.4 nm, the APAPI was visible to the crew. At this time, the aircraft was configured for landing and stabilized on approach, following FMS vertical path guidance.

At 1433:27 (T-58 ^{Footnote 6}), approximately 550 feet above the runway elevation and 1.4 nm from the threshold, the PF disconnected the autopilot and flew the approach manually, levelling off momentarily.

At 1433:38 (T-47), approximately 500 feet above the runway elevation and 1.1 nm from the threshold, the PNF called a deviation above the APAPI guidance and the PF corrected the flight path by increasing the descent rate to intercept the APAPI approach slope (see Appendix B – Flight Data Recorder Approach Data). At this point, the PNF switched his attention from monitoring the approach to searching for signs of wildlife because, in the previous week, there had been numerous deer in the vicinity of and on the runway.

At 1433:50 (T-35), approximately 350 feet above the runway elevation and 0.85 nm from the threshold, the aircraft intercepted the 3.0° APAPI path. At the same time, the PF began using the wing-low, crosswind landing technique. The right wing was lowered and left rudder was applied to maintain track. From this point on and until touchdown, the PF was using aileron and rudder input to maintain track. At this time, there was a 28-knot headwind and an 18-knot crosswind.

At 1433:57 (T-28), approximately 250 feet above the runway elevation and 0.7 nm from the threshold, the airspeed was fluctuating between 105 and 120 knots.

At 1434:05 (T-20), approximately 180 feet above the runway elevation and 0.5 nm from the threshold, the PF transitioned visually to the runway to assess the landing profile, and the aircraft descended below the APAPI on-slope indication. From this point on, even though the aircraft remained below the APAPI on-slope indication, no APAPI deviation calls were made.

At 1434:15 (T-10), approximately 100 feet above the runway elevation, the wind had decreased slightly and was calculated as a 26-knot headwind component and a 12-knot crosswind component.

At 1434:20 (T-5) and only 830 feet from the threshold, the aircraft radio altitude auto call-out system announced "50"; this is what the captain normally used as a prompt to begin the flare. The PF started raising the nose of the aircraft and was now using considerable aileron and rudder input. At this time, both engines were at 50 per cent N1 rpm ^{Footnote 7} and the wind was calculated as a 21-knot headwind component and an 8-knot crosswind component.

At 1434:21 (T-4) and only 680 feet from the threshold, the autothrottle mode changed from the SPEED to the RETARD mode. This caused the thrust levers to automatically retard to the IDLE position. At this point on the approach, there was no recognition by the crew that the aircraft was on an unsafe flight path.

At 1434:23 (T-2) and 360 feet from the threshold, the crew felt the aircraft sinking, and the airspeed decreased to 102 knots. The aircraft radio altitude auto call-out system announced "30". The PF increased the rate of pitch change, eventually reaching a nose-up attitude of 10.6°. At this time, the engines were at 38 per cent N1 rpm and still reducing, but no additional thrust was applied.

At 1434:25, the aircraft touched down 7 feet 6 inches short of Runway 33 and 18 inches below the surface of the runway (see Photo 1).

As the right main landing gear struck the edge of the runway surface, it collapsed. The initial impact triggered the emergency locator transmitter (ELT) as well as the cockpit voice recorder (CVR) acceleration switch, which ended the recording of crew exchanges.

The aircraft continued down the runway with the right wing dragging. At 640 feet from the touchdown point, the aircraft departed the right side of the runway. It travelled across several earthen mounds and pivoted 120° to the right before coming to a stop.

While the safety features card indicated that shoulder straps must be fastened for landing, none of the passengers was wearing the shoulder strap. Also, the passengers were not wearing their shoes, having removed them upon boarding the aircraft at Hamilton Airport, Ontario (CYHM).

To evacuate, the first officer attempted to open the main cabin door but was unable because it was damaged. The emergency exit located on the right side of the passenger cabin was opened, and all occupants evacuated the aircraft. The first officer had to be assisted away from the aircraft because he had suffered back injuries and had difficulty walking.

All occupants proceeded to a house approximately 200 feet from where the aircraft came to a stop and the first officer used his cellular telephone to contact the Halifax Flight Service Station, Nova Scotia, to advise that their aircraft had crashed at CFH4.

Emergency responders from the nearby town arrived rapidly. There was no fire; however, the aircraft suffered major structural damage. One crew member and one passenger suffered serious injuries while the other eight occupants suffered minor injuries.

1.2 Wreckage and Impact Information

1.2.1 Impact Information

The right main landing gear touched down on sloping terrain, 18 inches below runway elevation, 7 feet 6 inches short of the threshold, and the left main landing gear touched down 4 feet 10 inches short of the threshold (see Appendix C – Wreckage Path). The initial touchdown marks indicate that the aircraft touched down 14 inches right of the centreline, aligned with the runway.

The tire tracks leading up to the paved asphalt runway surface were approximately five inches deep. Two semi-circular cracks were found in the asphalt, in line with the right main landing gear touchdown point (see Photo 2), resulting from the force of the gear striking the runway edge.

Two scrape marks, caused by the right wing outer and centre flap canoe fairings, start to appear on the runway at a point located 140 feet from the runway threshold and 27 feet and 37 feet respectively right of the centreline. A third scrape mark, caused by the right wing inboard flap canoe fairing, starts 170 feet from the runway threshold and 18 feet right of the centreline, indicating that the right main landing gear was totally collapsed at this time.

The left main landing gear tire tracks cross the centreline 457 feet from the threshold. A runway edge light located 600 feet from the threshold was broken. A ground scar indicates that the right main landing gear departed the runway surface 640 feet from the threshold (see Photo 3) while the left main landing gear departed the runway surface 694 feet from the threshold.

The terrain along the right side of the runway slopes down slightly for approximately 20 feet, before sloping upward in a series of earthen mounds that are approximately 6 to 10 feet above runway elevation. Ground scars indicate that the aircraft started to rotate clockwise approximately 840 feet from the threshold when the right wing started to dig into the mounds.

By the time the aircraft reached a point 893 feet from the threshold, it had rotated clockwise through 90°. At that point, the nose landing gear struck the side of an air-conditioning unit located 89 feet right of the runway edge. The aircraft continued to rotate clockwise another 30° while sliding sideways before coming to rest with the nose 1017 feet from the threshold, 175 feet from the runway edge.

1.2.2 Wreckage Examination

The aircraft sustained extensive damage all attributed to the impact and post-impact accident sequence (see Photo 4). There was extensive damage to the fuselage structure and systems in both main landing gear bay areas caused by the detachment and pivoting of the landing gear following the initial impact with the runway edge.

Most of the other damage was incurred as the aircraft departed the right side of the runway and travelled through the series of mounds. The nose section of the aircraft between fuselage stations 169 to 288 had structural buckling 6 to 8 inches deep. Both wings sustained extensive damage to the auxiliary spar and surrounding structure due to the detachment of the main landing gear. The flap system was also heavily damaged. Both engines were damaged after ingesting debris.

The main passenger door was skewed rearward and the occupants were unable to open it for the evacuation. The cockpit floor was buckled in several places and both the captain's and first officer's seats were deformed and jammed in the seat rails. Some of the passenger seats sustained damage, mostly due to the side load experienced during the post-impact accident sequence. Some glassware was dislodged from the galley storage and broken glass littered the galley floor. Damage to the left wing resulted in a small fuel spill that was contained by the first responders.

1.3 Personnel Information

1.3.1 General

	Captain	First Officer
Pilot Licence	Airline Transport Pilot Licence	Airline Transport Pilot Licence
Medical Certificate Expiry Date	31 December 2007	30 April 2008
Total Flying Hours	9188	6426
Hours on Type	64	9
Hours Last 90 Days	88	104
Hours on Type Last 90 Days	64	9
Hours on Duty Prior to Occurrence	6.6	6.6
Hours off Duty Prior to Work Period	40	65

1.3.2 Captain

The captain was certified and qualified for the flight in accordance with existing regulations. At the time of the accident, he had accumulated 9188 hours of total flying time, including 3196 hours on turbojets. In his previous employment, he had accumulated over 2500 hours as captain on a DHC-6 Twin Otter, over 1000 hours on a Beechcraft B200 and over 1000 hours as captain on a Westwind WW24 turbojet. Since joining Jetport Inc. (Jetport) on 24 July 2000, he had accumulated 2196 hours as captain on the Gulfstream G100 and Bombardier Challenger 604 (CL604).

In June 2007, he completed the Global 5000 ground school and level D simulator training at the Bombardier Aerospace Training Centre in Saint-Laurent, Quebec. On 29 June 2007, the captain completed a Canadian Aviation Regulations (CARs) subpart 704 initial pilot proficiency check (PPC) monitored by a Transport Canada inspector. During training, the captain accumulated 42 hours of level D simulator time.

Bombardier, as the aircraft manufacturer, provides an experienced pilot for a 14-day period, for entry into service support. This is done to provide aircraft familiarization as part of the purchase contract of the aircraft. Jetport exercised the option to provide line training for its designated captain. This agreement started on 20 October 2007. Over the next 14 days, the support pilot operated with the captain for 42.7 hours, over nine segments. ^{Footnote 8} The support pilot occupied the right seat for the majority of the segments.

Before the occurrence flight, the captain had a total of 64 hours on the Global 5000, all flown on the occurrence aircraft (C-GXPR). The captain had flown other Jetport aircraft, including the CL604, into CFH4 approximately 75 times in the previous years. However, this was only his third landing in CFH4 at the controls of the Global 5000.

The captain's first landing at CFH4 with the Global 5000 was on 21 October 2007, accompanied by the support pilot. The aircraft landing weight for that flight was 63 032 pounds, approximately 2000 pounds heavier than on the occurrence flight. The ceiling and visibility were good and the winds were from the west at 13 knots gusting to 20 knots. The turbulent approach was flown manually from an altitude of 1200 feet asl and with the autothrottle engaged. The captain planned to touch down in the first 500 feet of runway, as he normally did in CFH4. The captain had just initiated the flare when the aircraft touched down, approximately 200 feet past the threshold, closer to the threshold than planned. This was debriefed by the support pilot.

On 07 November 2007, the captain of the occurrence flight flew from Calgary, Alberta, to CFH4, accompanied by the occurrence first officer. This flight, which took place four days before the occurrence day, was the captain's thirteenth landing on the aircraft and his second with the Global 5000 at CFH4. The aircraft landing weight for that flight was 59 982 pounds, approximately 1100 pounds lighter than on the occurrence flight. The ceiling and visibility were good and the winds were from the west at five knots. The landing was uneventful.

1.3.3 First Officer

The first officer was certified and qualified for the flight in accordance with existing regulations. At the time of the accident, he had accumulated 6426 hours of total flying time. In his previous employment, he had accumulated over 2000 hours of flying light and heavy turboprop aircraft. Since joining Jetport in 2000, he had accumulated 3064 hours, of which 2540 hours were as captain, on the Gulfstream G100 and the CL604 turbojets.

In July 2007, he completed the Global 5000 ground school and level D simulator training at the Bombardier Aerospace Training Centre in Saint-Laurent. On 03 August 2007, the first officer completed a CARs subpart 704 initial PPC monitored by a Transport Canada inspector. During training, the first officer accumulated 34 hours of level D simulator time.

After completion of his PPC, the first officer returned to flying on the CL604, accumulating 98.3 hours. On 06 November 2007, five days before the occurrence flight, and more than three months after his initial training and PPC, he completed his first flight on the Global 5000. At the time of the occurrence flight, he had completed three segments, including one into CFH4 four days earlier.

1.4 Aircraft Information

1.4.1 General

Manufacturer	Bombardier Inc.
Type and Model	BD-700-1A11
Year of Manufacture	2006
Serial Number	9211
Certificate of Airworthiness	Issued 30 July 2007
Total Airframe Time/Cycles	92 hours/26 cycles
Engine Type (number of)	BMW-Rolls Royce BR-700-710A2-20 (2)
Maximum Allowable Take-off Weight	87 700 pounds
Recommended Fuel Types	Jet A, Jet A-1
Fuel Type Used	Jet A

The Global 5000 design (see Figure 1) is based on the slightly larger Global Express corporate business jet, which entered service in 1996. Its take-off and landing performance, unlike some older generation business aircraft, allows it to operate from the shorter runways found at smaller aerodromes. Although used mostly as a business jet, the Global 5000 is considered a transport category aircraft.

C-GXPR was configured to carry up to 14 passengers and 3 crew members. It had recently been purchased by Jetport, joining the fleet three weeks before the occurrence on 19 October 2007.

At the time of landing in CFH4, the aircraft weight was 61 050 pounds. The aircraft weight and centre of gravity were within the prescribed limits.

1.4.2 Bombardier Aircraft Manuals

1.4.2.1 General

The Global 5000 aircraft flight manual (AFM), the Flight Crew Operating Manual (FCOM) and two Quick Reference Handbooks (QRHs) were on board the aircraft and available to the crew. These manuals describe the aircraft limitations and procedures as well as the performance capabilities of the aircraft.

The Global 5000 Operations Reference Manual (ORM) is based on standard jet operating procedures, modified for the specific handling characteristics of the Global 5000. It is provided to Global 5000 operators attending initial or recurrent training at the Bombardier training facilities. The ORM can be used as a foundation for standard operating procedures (SOPs). The crew responsibilities defined in this manual may be modified by individual operators to meet their requirements, if safety and the operational limits of the AFM are not contravened. Jetport had been provided a Global 5000 ORM but was not using it as a foundation for its SOPs; instead, it adapted its CL604 SOPs to the Global 5000 operation.

1.4.2.2 Landing Distance Calculation

The Performance Section of the Global 5000 AFM contains all the information required to obtain the landing performance data for varying conditions of temperature, airport pressure altitude, and aircraft weight for the specified approach and landing configurations. This information is also available in tabular form in the aircraft QRH that is kept on the flight deck and readily available to the crew at all times.

For the occurrence flight, the Global 5000 was operated under CARs subpart 604. The crew was not required to meet CARs subparts 704 and 705 requirements for calculating the landing field length (LFL).

The actual landing distance (ALD) is the distance from a height of 50 feet at V_ref with slats out and flaps at 30°, to a full stop on a smooth, dry, level, hard-surfaced runway at International Standard Atmosphere (ISA) temperature. For CARs subparts 704 and 705 operations, the factored runway length, referred as the LFL, should be taken into account. The LFL is equal to the ALD multiplied by an operational landing field length factor of 1/0.6. The LFL adds a safety margin to the ALD to allow for weather variations, landing technique, or a landing problem.

Calculations were made using the occurrence aircraft configuration and conditions of the day. The aircraft weight used was 61 050 pounds with a V_ref of 113 knots, slats out and flaps at 30°, and taking into account the winds from the north at 21 knots. For a dry runway, the ALD was 2095 feet with an associated LFL of 3492 feet.

For wet or slippery runway surfaces, regulations require that, for CARs subparts 704 and 705 operations, the runway length available be at least 115 per cent of the LFL. Using the occurrence flight data, the distance required for a wet runway increased the ALD to 2409 feet and the LFL to 4016 feet. Using performance charts, the captain had estimated that, for the conditions, 4300 feet of runway was required.

1.4.2.3 Approach Speed Corrections for Wind Gusts

Both the FCOM and the Global 5000 ORM indicate how adjustments for wind gusts should be calculated. If the reported wind contains a gust, the approach speed should be increased above the normal V_ref. The recommended speed for final approach with flaps at 30° is calculated as follows:

Corrected V_ref = V_ref + 1/2 of the wind gust (to a maximum of 10 knots)

The ORM also recommends that, when flying the approach, the increased speed should be maintained until the flare. This is followed by a note stating:

AFM landing distances are predicated on crossing the threshold at 50 feet, at V_ref with throttles at idle and on a normal glide path. Crews must consider the implications of landing with an increased V_ref, particularly when landing on short runways or when a performance landing is required.

The procedure used by the flight crew on the occurrence flight was that of the Bombardier Global 5000 ORM and not the procedure documented in the Jetport Global 5000 SOP manual.

1.4.2.4 Landing Procedure

Page 2-42 of the Global 5000 ORM describes the normal landing procedure:

Actual landing distances (ALD) derived from the AFM are based on crossing the runway threshold at 50 feet on normal glide path, at V_ref, with landing gear down and Flaps 30. These ALDs do not take into account any adjustments to V_ref due to wind gusts, therefore, an increase in ground roll should be anticipated. If stabilized on a normal approach, at approximately 30 feet above the touch down zone, the yoke should be eased back (flare) to reduce the rate of descent for a smooth touchdown. If on a steeper or shallower than normal glide path then a small adjustment may be required to the flare height. If crosswind is present, as the flare is commenced, gentle application of rudder should be used to align the fuselage parallel with the runway centerline. A small amount of into wind aileron may be required to control the sideways drift and is required throughout the landing roll, increasingly as the airspeed decreases.

This procedure is also described on page 04-08-16 of the FCOM.

1.4.2.5 Crosswind Landing Technique

Two common techniques can be used to land an aircraft in crosswind conditions. The crabbed approach technique, also called the wings-level technique, is the procedure recommended in the Global 5000 ORM for landing the Global 5000 in a crosswind. This is also the procedure taught by Bombardier during simulator training. This technique requires that, on approach, the pilot apply a drift correction to track the runway centreline and, as the flare is commenced, gentle application of rudder is used to align the fuselage parallel with the runway centreline.

The wing-low technique, also called the steady sideslip technique, requires that the pilot use a combination of into-wind aileron and opposite rudder to correct the drift and maintain runway centreline. This technique increases the risk of pilot-induced oscillations ^{Footnote 9} and of a resulting wing-tip strike. Because of the very high dihedral effect of the Global 5000, the use of the wing-low technique greatly increases the pilot's workload.

In this occurrence, the PF used the wing-low technique. While on approach, he used a combination of into-wind aileron and opposite rudder to correct for drift and to keep the aircraft fuselage aligned with the runway centreline. Due to the automatic roll assist feature of the flight control system, as the aircraft neared the threshold, this cross-controlling not only deflected the ailerons, it also deployed the multi-function spoilers on the right wing. A review of the flight data recorder information determined that the use of the wing-low technique caused spoiler deployment in the final segment of the approach. This resulted in a decrease in lift, which made the aircraft more difficult to control, increasing the PF workload, which was already high due to the combination of gusty winds and a low approach angle.

The occurrence pilot had used both the crabbed approach technique and the wing-low technique during his Global 5000 simulator training and believed that either method could be used.

1.4.2.6 Vertical Guidance

The Bombardier ORM addresses the use of vertical navigation as an option in numerous approach situations. It can add to situational awareness and can be used to give a constant descent profile. Vertical guidance is displayed on the primary flight display when the vertical captured mode is vertical path.

The descent path stored in the FMS ensures that all altitude restrictions from the final approach fix to the missed approach point are met; they must not be modified. For the CFH4 approach to Runway 33, vertical navigation would have guided the aircraft down to a height 58 feet over the threshold, resulting in a touchdown approximately 1000 feet down the runway.

1.4.2.7 Autothrottle System

The Global 5000 is equipped with a dual autothrottle system, which provides full flight regime thrust management via automatic positioning of the thrust levers. The autothrottle system provides thrust control and speed control. The primary flight display displays autothrottle engage status, operating mode, and faults.

The airspeed control mode is the basic control mode for the autothrottle. This mode tracks the active airspeed or Mach target. The airspeed target is selected on the flight guidance panel and is modified by the FMS or manually. This mode provides high- and low-speed protection. The retard mode control provides a fixed-rate thrust lever retard of both thrust levers to the idle position during aeroplane flare or landing. The autothrottle remains engaged until touchdown to provide go-around thrust if the go-around mode is selected. The retard mode activates based on a radio altitude of less than 50 feet above ground level (agl) if the aeroplane is in landing configuration with gear down and flaps greater than or equal to 16°.

Bombardier encourages operators to use the autothrottle for all phases of flight. However, some operators disconnect the autothrottle when in turbulence, or when the thrust levers are hunting, in an attempt to maintain the target airspeed. The PF can manually override the autothrottle at any point. An appropriate application of engine power would have arrested the low aircraft energy state and loss of lift experienced on short final.

1.4.3 Jetport Standard Operating Procedures for Global 5000

Jetport had been operating the CL604 since 2001 and was using SOPs that had evolved over the years. When it acquired the Global 5000, Jetport adapted the CL604 SOPs for the operation of the Global 5000. This is common practice for operators who want to maintain standard procedures on different aircraft types.

The Jetport Global 5000 SOPs contained a lot of good information; they also contained some procedures applicable to the CL604, which were not suitable for the Global 5000. These procedures did not reflect Bombardier's recommended procedures found in the ORM. Some of the differences include: circling approach procedures, speed deviation calls, and calculation of approach speed in gusty wind conditions.

Of particular concern is the description of the landing profile. Section 5.13 of the Jetport Global 5000 SOPs describes the final approach and landing procedure. It states in part:

The landing will normally take place near the glide-slope touch down point or about 1000 feet along the runway. The aircraft should be smoothly placed on the ground at this point and floating should be avoided.

However, this statement is preceded by the following:

The final approach will be flown on the glide slope, or VASIS [visual approach slope indicator system], or such other visual guidance as is available to the touchdown point. Sinking under the glide-slope is not a recommended technique and is not normally an accepted practice. Two exceptions are however, noted:

1. In good weather conditions, for day operations only, when it can be shown that an earlier touchdown can produce a significant reduction in taxiing time, and safety is not reduced, an earlier touchdown may be carried out; and
2. When operating on short runways or when braking action is reduced by contamination on the runway, landing as early as conditions permit is generally considered to be good airmanship.

1.5 Flight Recorders

Both the cockpit voice recorder (CVR) and flight data recorder (FDR) were recovered from the aircraft. The memory modules were downloaded and the data were successfully recovered.

The CVR was a Honeywell model SSCVR, part number 980-6022-001, serial number CVR120-08416. This model of CVR is a solid-state recording device with a storage capacity of approximately two hours. The severity of the initial impact triggered the CVR G-switch, which removed power from the CVR, thus terminating the recording.

The solid-state FDR was a Honeywell model SSFDR, part number 980-4700-041, serial number 12216. This particular FDR system on the Global 5000 records over 800 parameters within a data frame of 256 words per second, with a recording capacity of approximately 25 hours. The data contained the occurrence landing as well as information for the previous six landings.

A review of the FDR data indicated that, for the previous landings, the aircraft consistently flared at a rate of approximately 1.0° per second, to an attitude of approximately 5.4°. The occurrence landing differed in that, four seconds before initial impact, the aircraft flared at a rate of 3.9° per second, to an attitude of 10.6°.

1.6 Meteorological Information

Routine weather reporting services are unavailable at CFH4. Crews must interpolate between area forecasts and weather reported at nearby stations. Aside from the windsock located near the threshold of Runway 33, there is no equipment available to give accurate wind speed and direction information. No employees at CFH4 had received training in assessing and communicating weather conditions.

Pilots flying into Fox Harbour (CFH4) normally use weather from surrounding stations such as Halifax (CYHZ), Moncton, New Brunswick (CYQM), and Charlottetown, Prince Edward Island (CYYG), in order to assess the regional weather conditions. Of those three stations, Charlottetown (CYYG) is the closest, located 28 nm northeast of CFH4. Before departing from Hamilton, Ontario (CYHM), the crew members had reviewed the weather for these stations. They also had contacted a CFH4 employee to obtain general weather information at the aerodrome.

Before descent into CFH4, the crew had received the 1400 aviation routine weather report (METAR) for Halifax (CYHZ) and Charlottetown (CYYG) and had once again contacted a CFH4 employee, via flight telephone, to get the general weather information for CFH4.

The Charlottetown (CYYG) weather at 1400 was as follows: wind 360° true at 21 knots gusting to 33 knots, visibility 7 statute miles (sm) with light rain, overcast clouds at 900 feet agl, temperature 3°C, dew point 2°C, and altimeter setting 29.71 inches of mercury (in Hg). The weather issued at 1500 (35 minutes after the occurrence) was as follows: wind 360° true at 20 knots gusting to 34 knots, visibility 7 sm with light rain, overcast clouds at 1100 feet agl, temperature 3°C, dew point 2°C, and altimeter setting 29.73 in Hg. The actual weather on arrival in CFH4 corresponded to the Charlottetown (CYYG), Halifax (CYHZ) and Moncton (CYQM) terminal area forecasts.

During the approach, the crew was constantly assessing the winds and expected some turbulence. Although the winds were gusty, there were no reports of wind shear in the area nor did the aircraft enhanced ground proximity warning system (EGPWS) detect any.

The crew had filed Halifax (CYHZ) as an alternate airport with Québec, Quebec (CYQB), as a second alternate. The weather at both airports was within alternate limits and the aircraft was carrying enough fuel so that, in the event of a missed approach, the crew could have flown to Halifax (CYHZ) and then Québec (CYQB) if necessary.

1.7 Aerodrome Information

1.7.1 Aerodromes and Airports

The Aeronautics Act defines an aerodrome as "any area of land, water (including frozen surface thereof) or other supporting surface used or designed, prepared, equipped or set apart for use either in whole, or in part for the arrival and departure, movement or servicing of aircraft and includes any building, installations and equipment in connection therewith."

Where an aerodrome operator provides Transport Canada with information respecting the location, markings, lighting, use and operation of the aerodrome, Transport Canada registers the aerodrome and publishes the information in the Canada Flight Supplement (CFS). There are a few additional responsibilities for the registered aerodrome operator to comply with.

An airport is an aerodrome for which, under Part III of the CARs, an airport certificate has been issued by the Minister. Typically, if there is a scheduled commercial passenger service operating from the site, then the aerodrome is certified by Transport Canada. Airport operators are required to maintain and operate the site in accordance with applicable Transport Canada standards, and regular inspections are conducted by Transport Canada to verify compliance. Standards for airports are more stringent than standards for aerodromes.

1.7.2 Fox Harbour Aerodrome

Fox Harbour (CFH4) is a registered aerodrome operated by Fox Harbour Development Limited. It is located on the coast of the Northumberland Strait at 45°52.12′ N, 063°27.40′ W, and at a mean sea level (msl) elevation of 62 feet. Runway 33, the runway used by the crew on the occurrence day, is oriented 325° magnetic (M), constructed of asphalt and is 4885 feet long by 75 feet wide. Its threshold is at an elevation of 52 feet msl. Runway 33 has a published landing distance available of 4885 feet.

The aerodrome was built to service the golf resort that surrounds it. The Fox Harbour Resort complex also features a private-gated community. Fox Harbour Development Limited promotes the resort as an exclusive conference facility. As the use of the facility continues to increase, it is anticipated that many of the clients will prefer to travel to the location by air, further increasing utilization of the aerodrome.

Except in an emergency, the owner's or operator's permission is required before use. Aircraft operating into CFH4 can contact UNICOM (universal communications) ^{Footnote 10} on frequency 122.2 MHz or transmit blind when completing a position report on approach. The aerodrome is maintained by staff from the Fox Harbour Resort. None of the staff had any specialized training or experience in aerodrome management.

A type K ARCAL is available and can be used to activate the runway edge lights as well as the APAPI for Runway 33.

The CFS lists multiple cautions for this aerodrome (see Appendix D – Fox Harbour Aerodrome Canada Flight Supplement Information) including:

• Trees on approach to Runway 15, 250 feet from threshold and 52 feet above threshold elevation;
• Hangar 37 feet high, 175 feet from runway;
• Not recommended for use at night by high performance aircraft;
• Optical illusion can be experienced due to relative width of runway. Aircraft may appear to be higher than actual on approach;
• Be alert for wildlife on runway; and
• Due to adjacent trees, westerly winds may produce turbulence over runway.

A row of 12 condominiums, located approximately 250 feet east of the runway centreline, parallels the runway, beginning at a point near the threshold of Runway 33. A roadway also passes through the approach to Runway 33, approximately 30 feet from the threshold and 7 feet below runway elevation (see Appendix C – Wreckage Path).

There are no electronic navigation aids on the aerodrome; however, global positioning system (GPS) approaches are published in the Restricted Canada Air Pilot (RCAP) for both runways, as well as a standard instrument departure (SID) procedure.

1.7.3 Transport Canada Aerodrome Inspection

On 28 April 2000, Transport Canada inspected CFH4. Although registered aerodromes do not have to meet certified airport design standards, at the request of Fox Harbour management, the aerodrome was assessed from both certified and registered perspectives. This request was made with a view to having CFH4 eventually certified.

On 04 May 2000, Transport Canada sent its report to Jetport where it assessed CFH4 as unable to meet the standards of a certified airport. The runway had ditches and mounds on both sides as well as a steep rise at the threshold of Runway 33. The "graded area," which surrounds the runway, should be prepared to reduce the risk of damage to aircraft running off the runway. As well, the proximity of obstacles such as a power line, trees, condominiums, and the hangar protruded above acceptable height limits.

Administratively, an airport operations manual would be required. This details the physical characteristics and services provided by an airport. It also serves as an agreement by the airport operator to operate the airport in accordance with Transport Canada standards.

Jetport opted not to certify the aerodrome and the previously listed points were not addressed. However, measures were taken with respect to a number of other points identified in the inspection:

• APAPI systems were installed for both runways; however, only the APAPI for Runway 33 was put into operation since trees and a power line created obstructions on the approach to Runway 15.
• Some of the required runway markings such as threshold, runway designation and centreline markings were added; however, the aiming point and touchdown zone markings were not.
• A detailed land survey was prepared and forwarded to Transport Canada.

In a letter dated 09 January 2001, Transport Canada had advised Jetport that one area of concern at CFH4 was the roadway passing through the Runway 33 approach. It stated in part:

We consider roadways as 14′ high obstructions because of the truck traffic they will accommodate. Steps should be taken to preclude the possibility of a truck passing through the approach path at a time critical to air traffic. At the very least, this could include signs advising motorists to stop and scan for traffic before proceeding further.

No signs were installed by the aerodrome operator to advise motorists of the risk of low-flying aircraft nor was any other risk mitigation strategy adopted to address this area of concern.

1.7.4 Fox Harbour Aerodrome Aircraft Traffic

Fox Harbour Development Limited does not keep, nor is it required to keep, records of aircraft movements. The investigation could not accurately determine the number of aircraft arriving and departing at CFH4 each year. However, it was determined that many different aircraft types operate in and out of CFH4, from light single-engine aircraft to larger corporate jets. Since the opening of the golf course and resort at Fox Harbour in 2001, air traffic has increased substantially and now includes Beech 1900, Cessna Citation, as well as some of the larger corporate aircraft types such as the Gulfstream G200, Gulfstream G-IV, Gulfstream G-V, Bombardier Challenger, Bombardier Global 5000, Hawker 800, Learjet 45, Falcon 50, and Falcon 900.

Rubber deposits on the runway indicated that many of those aircraft had touched down in the first 500 feet. There were some marks as close as 60 feet past the runway threshold.

1.8 Visual Illusions

Narrow runways like CFH4's can lead to visual illusions. This topic is addressed in an Airbus Operational Briefing Note (AOBN) ^{Footnote 11} dealing with visual illusions awareness. It describes how visual illusions occur when conditions modify the pilot's perception of the environment, relative to expectations. Visual illusions may result in landing short of the runway, landing hard, or runway overrun, but may also cause spatial disorientation and loss of control. The AOBN notes that statistical data indicate that 30 per cent of approach-and-landing accidents occur during the conduct of visual approaches or the visual segment of an instrument approach.

Visual illusions affect perception of heights, distances and/or intercept angles. Visual illusions usually induce crew inputs (corrections) that cause the aircraft to deviate from the original and intended vertical or lateral flight path. A narrow or long runway resulting in a high aspect ratio, such as the CFH4 runway, may create an impression of the aircraft being too high on approach.

The AOBN also states that, in crosswind conditions, the runway lights and environment will be angled with the aircraft heading. Flight crew should maintain the drift correction and resist the tendency to align the aircraft heading with the runway centreline.

The following crew actions and the consequences are often cited in the analysis of approach-and-landing incidents or accidents resulting from visual illusions:

• unconscious modification of the aircraft trajectory to keep a constant perception of visual references;
• natural tendency to descend below the glide slope or the initial glide path (that is, "ducking under");
• inability to arrest the rate of descent after descending below the intended glide path (that is, late recognition of the flattening of runway and runway environment).

1.9 Aircraft Eye-to-Wheel Height

1.9.1 General

The vertical distance from a pilot's eyes to the lowest portion of the aircraft in the landing attitude is called the eye-to-wheel height ^{Footnote 12} (EWH) (see Photo 5). This distance varies from less than 4 feet to 45 feet for some wide-bodied aircraft, such as the Boeing 747. Knowledge of an aircraft's EWH is necessary for flight crews to assess the adequacy of a visual glide slope indicator (VGSI) system for the aircraft type flown.

1.9.2 Crew Knowledge of Eye-to-Wheel Height Information

In the course of the investigation, several airline transport pilots were contacted to determine their awareness and knowledge of EWH, as well as awareness and knowledge of VGSI limitations. Some were line pilots while others were instructors, check pilots, chief pilots, civil aviation inspectors, and test pilots. These pilots flew different aircraft types, from light turboprop to heavy jets. Represented in this group were manufacturers, airline companies, cargo operators, charter operators, training providers, and the regulator.

It was determined that, in general, pilots are not aware of the EWH of the aircraft they operate. Some pilots wrongly believe that the EWH is the distance between the pilot's eyes and the ground while the aircraft is sitting on the ground, as this information is published in the AFM by some manufacturers.

Normally, information that might have an impact on the safe operation of the aircraft is covered during pilot ground school and/or simulator training. For this crew, the topic of aircraft EWH was not covered during ground, simulator or line indoctrination training. Furthermore, the topic of EWH is rarely addressed in any type of pilot training.

1.9.3 Availability of Eye-to-Wheel Height Information

Normally, technical information that may affect the safe operation of an aircraft is contained in the AFM. Inquiries to different aircraft manufacturers revealed that other aircraft manuals might contain some information describing threshold crossing height (TCH) for different aircraft configuration and profiles. Although this information could be used in an attempt to calculate EWH, no information was found that would clearly indicate aircraft EWH. Transport Canada confirmed that AFMs do not contain EWH information, nor are they required to by regulation.

The Global 5000 EWH information was not available to the crew and the crew was not aware of the aircraft EWH. Following this occurrence, it was determined that this information is not readily available. The manufacturer had to complete calculations to determine C-GXPR's EWH for the occurrence flight configuration, as well as for the most critical (greatest) EWH for the Global 5000.

1.9.4 C-GXPR's Eye-to-Wheel Height

C-GXPR's EWH calculations were completed using the actual conditions, an aerodrome at sea level, a 3.0° flight path and the landing gear fully extended. For the occurrence flight, the EWH was determined to be 16.35 feet. Based on the Global 5000 maximum landing weight of 78 600 pounds, the greatest EWH for the Global 5000 in the approach configuration was determined to be 17.2 feet.

1.9.5 Bombardier Challenger 604's Eye-to-Wheel Height

Calculations were also completed by the manufacturer to obtain the EWH of the Bombardier Challenger 604 (CL604), assuming a 3.0° flight path, in both the light landing configuration and the heavy landing configuration. The EWH in the light landing configuration was calculated using a landing weight of 28 000 pounds and was determined to be 12.11 feet.

The EWH in the heavy landing configuration was calculated using a landing weight of 38 000 pounds and was determined to be 12.176 feet.

1.10 Visual Glide Slope Indicators

1.10.1 General

Over the years, many different types of visual glide slope indicators (VGSIs) have been in use. Until 1995, visual approach slope indicator systems (VASIS) were the standard systems in use in Canada. As of 1995, VASIS were being phased out and replaced by precision approach path indicator (PAPI) systems. PAPI systems are lighting systems intended to improve operational safety during the final approach and landing phases of flight. They provide vertical path visual guidance to pilots, who can rely on their guidance until they transition to runway environment visual cues in preparation for the flare and touchdown. They are sometimes used to supplement guidance information provided by electronic approach aids.

According to Transport Canada, 261 aerodromes and airports in Canada have runways equipped with VGSIs. Some airports such as Toronto/Lester B. Pearson International Airport, Ontario, have 10 PAPIs while many of the smaller aerodromes might just have one PAPI or VASIS at one or both ends of a single runway. The number of VGSIs in use across the country was estimated by Transport Canada to be between 400 and 500.

1.10.2 PAPI Standards

Transport Canada publication Aerodrome Standards and Recommended Practices (TP 312E) contains specifications applicable to land airports that are certified pursuant to Part III of the CARs. This publication serves as the authoritative document for airport specifications, including physical characteristics, obstacle limitations surfaces, lighting, markers, markings, and signs. Section 5.3.6 of this document deals with VASIS and details the different standards that apply to PAPIs and APAPIs.

The publication Aerodrome Standards and Recommended Practices (TP 312E) requires that a VASIS be provided to serve the approach to a runway where one or more of the following conditions exist:

• the runway is not served by an electronic glide path and the runway is used by turbojet or other aircraft with similar approach guidance requirements;
• the pilot of any type of aircraft may have difficulty in judging the approach due to:
  • inadequate visual guidance such as is experienced during an approach over water or featureless terrain by day or in the absence of sufficient extraneous lights in the approach area by night, or
  • misleading information such as is produced by deceptive surrounding terrain or runway slopes;
• the presence of objects in the approach area may involve a serious hazard if an aircraft descends below the normal approach path, particularly if there are no non-visual or other visual aids to give warning of such objects;
• physical conditions at either end of the runway present a serious hazard in the event of an aircraft undershooting or overrunning the runway; and
• terrain or prevalent meteorological conditions are such that the aircraft may be subjected to unusual turbulence during approach.

A PAPI system shall consist of a wing bar of four sharp transition multi-lamp (or paired single lamp) units, equally spaced, while an APAPI system shall consist of a wing bar of only two sharp transition multi-lamp (or paired single lamp) units. An APAPI may be installed when the available strip width precludes the use of a full system. The system shall be located on the left side of the runway unless it is physically impracticable to do so. The standard approach slope is three degrees.

The wing bar of an APAPI shall be constructed and arranged in such a manner that a pilot making an approach will:

• when on or close to the approach slope, see the unit nearer the runway as red and the unit farther from the runway as white;
• when above the approach slope, see both the units as white; and
• when below the approach slope, see both the units as red.

Although both the PAPI and APAPI offer visual glide path indications to pilots, a PAPI has the advantage of giving incremental deviation indications (see Figure 2) because it has four light units instead of the APAPI's two light units. This allows the pilot to better anticipate flight path corrections. This is especially important when making flight path corrections at low altitude, as the width of the visual signal narrows and it is easy to fly through the signal, from a white/white too-high, through the red/white on correct approach path, to the red/red too-low indication.

PAPI light units shall be located so as to provide the minimum wheel clearance over the threshold for the most demanding aircraft using the runway on a regular basis. Consequently, PAPI systems are based on the EWH of the aircraft that the aerodrome is intended to serve, and provide safe wheel clearance over the threshold when the pilot is receiving the on-slope indication. The runway threshold crossing height (TCH) can vary depending on the runway for which it is installed or the aircraft type. For example, chart 5-5 of the publication Aerodrome Standards and Recommended Practices (TP 312E) shows that an APAPI or PAPI 1, which could bring an aircraft to cross the threshold at a height of 19.7 feet, could also be installed to bring an aircraft as low as 4.9 feet over the threshold when it is installed on a shorter runway used mainly by lightweight non-turbojet aircraft.

Although runways should normally be equipped with VGSI equipment suitable for the most demanding (largest) aircraft operating to this runway on a regular basis, the investigation noted some exceptions. For example, Nanisivik Airport (CYSR) in Nunavut was identified as having different types of VGSIs at opposite ends of the same runway. A VASIS 1 suitable for aircraft with an EWH of less than 10 feet is installed for Runway 29T, while a VASIS 2, suitable for an aircraft with an EWH of less than 25 feet, is installed at the other end, for Runway 11T. Therefore, a pilot operating a large aircraft would only be assured a safe TCH while approaching Runway 11T.

The Canada Air Pilot (CAP) general pages (CAP GEN) describe the different types of PAPI systems available. A table gives the following information (see Appendix E – Visual Glide Slope Indicators):

APAPI (AP) Abbreviated PAPI for aircraft with eye-to-wheel to 10 feet
PAPI 1 (P1) PAPI for aircraft with eye-to-wheel up to 10 feet
PAPI 2 (P2) PAPI for aircraft with eye-to-wheel up to 25 feet
PAPI 3 (P3) PAPI for aircraft with eye-to-wheel up to 45 feet

It is possible to provide for safe wheel clearance over the threshold for aircraft with different EWH by varying the distance of the wing bar from the runway threshold (see Figure 3). By increasing the distance between the threshold and the PAPI units, a greater TCH is obtained. A PAPI 2 is required to ensure safe TCH for the Global 5000 with its EWH of 17.2 feet.

It is important to note that, for a pilot on approach, a PAPI 1, a PAPI 2 and a PAPI 3 ground installation all look the same from the aircraft. To differentiate the types of PAPIs, a pilot would have to refer to the aerodrome information available to him.

A misalignment of a PAPI unit, with its four sharp transition multi-lamp units, would not be critical, as the other three units would still give some incremental indication of deviation to a pilot following its guidance. Since an APAPI only has two light units, a misalignment would not be detected by the pilot, which could lead to a dangerous approach path. Because of this, it is essential that alignment be verified on a regular basis. A note in the publication Aerodrome Standards and Recommended Practices (TP 312E) emphasizes this point, stating "APAPI systems require regular inspection or monitoring to detect a misalignment which could lead to a dangerous approach path."

1.10.3 APAPI at Fox Harbour

Following an accident at CFH4 on 22 March 2000, where a Jetport business jet struck trees after descending too low during an approach at night, Fox Harbour Development Limited took several safety actions to improve safety at the aerodrome. This was documented in TSB investigation report A00A0051. In addition to cutting trees on the approach to Runway 33, one of the safety actions taken was the installation, in August 2000, of an APAPI for Runway 33 (see Photo 6). At that time, Fox Harbour Development Limited indicated to the TSB that calibration of the APAPI would be verified on a weekly basis as per the manufacturer's instructions.

The APAPI was installed 480 feet from the threshold on the right side of the runway, because a ramp on the left side of the runway precluded installation on that side. It was calibrated using the manufacturer's operating manual information, which describes the recommended Transport Canada aiming angles for a 3.0° glideslope. This operating manual also describes unit alignment procedures, recommended check intervals, and maintenance. For an APAPI installation, it recommends that the aiming check be carried out at least once per week.

Following the APAPI installation, different Jetport pilots based at CFH4 had reportedly been trained on the use of the alignment tool and were responsible for checking the APAPI alignment. However, at the time of the 11 November 2007 occurrence, it was determined that no one from Fox Harbour Development Limited was familiar with the alignment procedure. The last person responsible for checking APAPI alignment had left the company in the fall of 2006, one year earlier, and since then, no one had been assigned this responsibility. Fox Harbour Development Limited had no records of any alignment checks that might have been done on the APAPI.

1.10.4 APAPI Inspections

On 05 January 2001, Transport Canada inspected the APAPI installation and found that the APAPI angle had fallen one-half a degree to 2.5° since installation five months earlier. The APAPI was adjusted back to the 3.0° angle. The angle of the APAPI can be affected by settling of the installation, snow removal and maintenance operations, or ground heaves caused by frost.

In a letter sent to Jetport, dated 09 January 2001, Transport Canada stated: "To ensure that the angle does not fall to an unsafe level, we strongly recommend that you acquire a levelling bar and/or equip the APAPI with an automatic shut-off switch." Following this, the aerodrome operator did acquire an electronic level from the APAPI manufacturer; however, this electronic level was never used to carry out an aiming check. An automatic shut-off switch was not installed.

On 25 July 2006, the company that had completed the initial APAPI installation carried out a calibration of the APAPI. In an email dated 26 July 2006, it stated "It is critical that the alignment of these lights be periodically checked to ensure the accuracy of the units. They guide the aircraft on approach." In this same email, the company had offered its services to carry out annual checks of the different equipment installed at the aerodrome to ensure compliance with standards. Fox Harbour Development Limited did not take advantage of this offer, nor are there any records indicating that anyone from Fox Harbour Development Limited carried out regular checks of the APAPI.

1.10.5 APAPI Verification Following the C-GXPR Accident

The results of a post-accident alignment check revealed that Unit A, which is the unit furthest from the runway, was slightly out of alignment. While it should have been set to 2.7° in order to give a fly-up indication to an aircraft low on the approach, this unit was found to be at 2.6°. This difference would have the effect of changing the TCH by approximately one foot. The pilot's eyes above threshold would have been at 26.3 feet instead of 27.1 feet with a 2.7° angle.

1.10.6 APAPI Approach Scenarios for the Global 5000

Assuming that the Global 5000 approached the runway following the APAPI glide path of 3.0°, at its pitch angle of 3.3° and did not flare before touchdown, the main gear would have crossed the threshold at a height of 12 feet and touched down 214 feet past the runway threshold.

Assuming that the aircraft approached the runway following the APAPI red/white on-slope indication but had been at the lower limit of 2.7°, where the pilot should be getting a fly-up indication, the main gear would have crossed the threshold at 9 feet and touched down 183 feet past the runway threshold.

If the aircraft actually crossed the threshold while on the 2.6° angle (for fly-up indication) that the APAPI was set at on the occurrence day, the main gear would have crossed the threshold at 8 feet and touched down 172 feet past the runway threshold.

1.10.7 PAPI Type Displayed in Different Publications

Information regarding the type of VGSI currently in use in Canada can be found in the Canada Air Pilot (CAP) published by NAV CANADA. The VGSI configuration appears on a legend found in the CAP general pages (CAP GEN). For any given instrument approach published, an aerodrome chart is located at the bottom right of the page. On this chart, a circle is displayed in which the type of VGSI is indicated (see Figure 4). By taking a quick glance, a pilot knows exactly the type of VGSI in use for the runway on which he plans to conduct an approach.

Information is also available in the Canada Flight Supplement (CFS) published by NAV CANADA, but it is displayed differently. The CFS aerodrome chart is very similar to the aerodrome chart found in the CAP; however, the symbol used to display the type of VGSI is simply a circle in which the letter "P" or the letter "V" indicates to the pilot whether a PAPI or a VASIS is available (see Figure 5). To confirm the type of PAPI or VASIS, the pilot has to refer to the lighting section of the aerodrome description. In that section, the description of all lighting available for each runway is available. The type of PAPI is indicated as AP, P1, P2, or P3, while the type of VASIS is indicated as AV, V1, V2, or V3.

1.10.8 Pilot's Knowledge of Visual Glide Slope Indicator System

The occurrence crew was not aware of the limitations of the APAPI used in CFH4. Although most pilots are aware that different VGSI systems are in use, they are not aware of what the limitations of those VGSIs are, nor are they aware of the significance of following VGSI guidance from a type that is not appropriate to the aircraft type operated.

The majority of pilots surveyed indicated that a red/white on-slope indication on approach would lead them to assume that they were on a safe flight path to landing, without consideration for the type of VGSI generating the visual guidance. This false assumption can lead pilots to rely on VGSI guidance that is unsuitable for the aircraft type they are operating. Vertical guidance should only be used after confirmation that the VGSI type is appropriate for the aircraft type operated.

Although documentation related to VGSIs is available to pilots, for the most part, flight training only addresses the significance of VGSI indications to the pilots. It does not address the different types of VGSI equipment and their associated limitations. In the past, Transport Canada flight crew examinations have also only addressed the interpretation of the different visual indications provided by VGSI equipment. Aside from one question used in the early 1990s related to three-bar VASIS, the examinations did not cover the appropriateness of VGSI type for the aircraft type operated.

1.11 Safety Management and Oversight

1.11.1 Introduction

This accident needs to be considered in the context of a relatively new and evolving safety and regulatory environment. It involves Jetport as operator of the aircraft, the Fox Harbour aerodrome, the Canadian Business Aviation Association (CBAA) as both an industry advocate and Transport Canada–delegated agency, and Transport Canada as the regulator.

The purpose of this section is to describe this safety and regulatory environment to understand its relevance to this accident. It begins with a description of the principles of safety management systems (SMS).

SMS is the strategy adopted by Transport Canada for improving safety within the commercial and business sectors of the aviation industry. SMS principles are also the basis on which the CBAA developed its Business Aviation Operational Safety Standards (BA-OSS). These were the standards it was to use to gauge its members' safety management capability and issue, refuse to issue, or renew a private operator certificate (POC).

1.11.2 Safety Management Systems – The Concept

With global aviation activity expected to rise, it had become apparent that traditional safety approaches for reducing risk would not be sufficient. The traditional approach to safety management relied primarily on regulatory compliance and reacted to undesirable events by identifying the underlying causes and prescribing specific measures to prevent their recurrence. Modern safety management principles promote a proactive search for hazards, identification of risks and the best defences to reduce risk to an acceptable level. These principles must be embedded within an organization's management system so that safety policies, planning, procedures, and performance measurement are integrated into day-to-day operations.

The International Civil Aviation Organization (ICAO) has adopted the SMS concept. ICAO requires that its member States mandate the introduction of SMS in all sectors of civil aviation by 2009. To assist member States in fulfilling this requirement, ICAO has published a Safety Management Manual^{Footnote 13} that explains the differences between traditional and modern SMS–based safety management.

In this manual, ICAO defines safety as the state (or situation) in which the risk of harm to persons or of property damage is reduced to, and maintained at or below, an acceptable level, through a continuing process of hazard identification and risk management. It defines a SMS as an organized or systems approach to managing safety, including the necessary organizational structures, accountabilities, policies, and procedures.

The manual describes the challenges organizations will encounter adapting to SMS and it offers suggestions and guidance to help overcome these challenges. It takes a practical view of safety management in recognizing that different organizations will need to find their best model for SMS, and it offers examples of practical models that can be adapted to an organization's needs. The manual offers guidance for the development of effective SMS policies and it outlines the continuing oversight responsibilities of ICAO member States after they adopt a SMS approach to safety.

In recognition of the ICAO role in setting international aviation standards, and the fact that this manual is one of the most recent and comprehensive available to the aviation community today, it has been referenced extensively throughout this investigation to establish some basic benchmarks or standards for SMS.

Transport Canada has invested considerable resources in the development of SMS in Canada and is recognized as a world leader. Even before ICAO established the requirement to transition to SMS, Transport Canada introduced SMS to many sectors of the Canadian transportation industry. Transport Canada is the first civil aviation authority to put regulations in place requiring aviation companies to implement SMS. The following events partially outline SMS development in Canadian civil aviation:

• 2000–present: Development of 17 Notices of Proposed Amendments (NPAs) and changes to the Aeronautics Act.
• 2001: Published Introduction to Safety Management Systems (TP 13739).
• 2001-2004: Educational campaign on concepts and principles.
• 2002: Published Safety Management Systems for Flight Operations and Aircraft Maintenance Organizations (TP 13881).
• 2004: Published Safety Management Systems for Small Aviation Operations - A Practical Guide to Implementation (TP 14135).
• 2005: Published Implementation Procedures Guide for Air Operators and Approved Maintenance Organizations (TP 14343).

1.11.3 Safety Management System Description

Transport Canada guidance document Introduction to Safety Management Systems (TP 13739) describes SMS as:

A safety management system is a businesslike approach to safety. It is a systematic, explicit and comprehensive process for managing safety risks. As with all management systems, a safety management system provides for goal setting, planning, and measuring performance. A safety management system is woven into the fabric of an organization. It becomes part of the culture, the way people do their jobs.

A basic definition of SMS and a list of its essential components are contained in Part I of the CARs.

SMS is a documented process for managing risks that integrates operations and technical systems with the management of financial and human resources to ensure aviation safety or the safety of the public.

A safety management system shall include:

1. a safety policy on which the system is based;
2. a process for setting goals for the improvement of aviation safety and for measuring the attainment of those goals;
3. a process for identifying hazards to aviation safety and for evaluating and managing the associated risks;
4. a process for ensuring that personnel are trained and competent to perform their duties;
5. a process for the internal reporting and analyzing of hazards, incidents and accidents and for taking corrective actions to prevent their recurrence;
6. a document containing all safety management system processes and a process for making personnel aware of their responsibilities with respect to them;
7. a process for conducting periodic reviews or audits of the safety management system and reviews or audits for cause of the safety management system; and
8. any additional requirements for the safety management system that are prescribed under these Regulations.

The most important component of a SMS is a strong commitment and continuous support from senior management. It needs to develop and support a clearly enunciated safety philosophy, with supporting policies, including a non-punitive reporting policy, an internal safety oversight process, and safety documentation. If an organization truly makes safety its top priority, then the management structure, responsibilities, and allocation of sufficient resources must be consistent with the organization's stated safety objectives.

An operator must employ both reactive and proactive schemes for identifying safety hazards throughout its organization, using reporting systems such as voluntary incident reporting, safety surveys, operational safety audits, and safety (risk) assessments. Incident or hazard reports must be carefully reviewed to identify organizational vulnerabilities and safety deficiencies that can then be addressed by appropriate mitigation strategies.

Safety assessments provide another proactive mechanism for identifying potential hazards and finding ways to control the risks associated with them. When planning major changes involving operating procedures, equipment acquisition or configuration and organizational working relationships, a safety assessment is warranted.

Risk management has three essential elements: hazard identification, risk assessment, and risk mitigation. Once a hazard is identified, a risk assessment is conducted to determine the severity of the potential adverse consequences or the outcome of an unsafe event and the probability of the hazard contributing to an occurrence. In this example of a risk assessment chart (see Figure 6), a hazard assessed as having consequences of moderate severity combined with an unlikely probability would result in a medium-low risk assessment.

	Probability of Adverse Consequences
Severity of Consequences	Frequent	Probable	Occasional	Unlikely	Most Improbable
Catastrophic	High	High	High	Medium	Medium-Low
Major	High	High	High-Medium	Medium	Low
Moderate	High	Medium	Medium	Medium-Low	Low
Negligible	Low	Low	Low	Low	Low

Figure 6. Example of a risk assessment chart

Once the hazard has been assessed, and the level of risk assigned, an acceptable mitigation strategy is put in place and communicated to employees. The risk management process does not stop here. The effectiveness of the defence must be assessed and, in some cases, modified or replaced if it has introduced unexpected new hazards. This closed loop process of safety management requires meaningful feedback to allow management to question its assumptions, test the validity of its decisions, and assess the effectiveness of its safety strategies.

Both ICAO and Transport Canada have identified the importance of a disciplined approach to safety management documentation and information management. Documentation review is a vital part of internal or external safety oversight audits so that trends and/or weaknesses in safety management can be identified. When similar hazards recur, a company will be able to apply appropriate risk mitigation strategies. Eventually, comparing the results of several subsequent audits or internal assessment reports may reveal other organizational deficiencies. Finally, documentation of the safety action and its distribution to all staff members builds on the organization's commitment to achieving a positive safety culture.

1.11.4 Implementation of Safety Management Systems in Canada

Transport Canada has experience implementing SMS in other transportation sectors. SMS has been required in the federally regulated rail sector since 2001. Also, in 2001, pursuant to International Maritime Organization (IMO) requirements, the Canada Shipping Act has required SMS for all Canadian vessels engaged in international voyages. A number of Canadian domestic shipping companies have voluntarily adopted SMS, and Transport Canada is actively promoting its adoption.

Canadian airlines operating under subpart 705 ^{Footnote 14} of the CARs have been required to have a SMS since 31 May 2005, while February 2010 is the projected date when SMS will become mandatory for operators under subparts 702 ^{Footnote 15}, 703 ^{Footnote 16} and 704 ^{Footnote 17} of the CARs.

Business aircraft operators are also implementing SMS, even though the regulatory framework under which they operate (subpart 604 of the CARs) differs from CARs subpart 700-series operators (see section 1.12.4).

Transport Canada, recognizing that the implementation of SMS is challenging and involves progressive development, has taken a reasonable approach to implementation. It has a documented four-phase implementation plan, designed to extend over three years. This implementation plan sets clear milestones for the development of a company SMS and is outlined in the publication Implementation Procedures Guide for Air Operators and Approved Maintenance Organizations (TP 14343).

1.11.5 Responsibility for Safety Oversight

ICAO outlines the concept of shared responsibility for formal safety oversight and identifies it as one of the three defining cornerstones of effective safety management. Each operator must have an organization-wide system for the collection of hazard reports about unsafe conditions; it should conduct internal audits on a regular basis and should have an independent body periodically review the effectiveness of its SMS. In addition, ICAO identifies that the State, or the delegated organization, responsible for regulatory oversight must maintain a monitoring program to confirm an organization's continuing commitment to its corporate safety policy, objectives, goals, and standards.

ICAO differentiates between the State's and the organization's responsibility for safety oversight by referring to the organization's internal oversight function as safety performance monitoring. The value of an adequate State oversight system, other than just ensuring compliance, is that this independent assessment provides an organization with another method for proactive hazard identification, validation of safety program effectiveness and the continuing evaluation of safety performance. There should be a well-balanced allocation of oversight responsibility and performance monitoring between the State and the operator. ICAO does not suggest that responsibility for safety oversight be turned over completely to any organization.

In Canada, Transport Canada, and ultimately the Minister of Transport, is responsible for maintaining a safe aviation environment as expressed in the Aeronautics Act and the CARs and complying with ICAO's Standards and Recommended Practices (SARPs). ^{Footnote 18}

Operators bear significant responsibility for safety management in their organizations and are required to have an internal process for conducting periodic reviews or audits of their SMS to ensure it remains effective at reducing risks.

Concerns have been expressed that delegating more responsibility for safety oversight to some organizations might actually increase the risk of accidents. Recognizing this challenge, Transport Canada issued Staff Instruction SUR-003 entitled Regulatory Oversight Activities during the Transition to Safety Management System (SMS) that came into effect on 31 May 2007. This document describes the oversight methods its inspectors will apply to certificate holders already subject to SMS regulations and those voluntarily following SMS. The document is applicable not only to its employees, but also to individuals or organizations when they are exercising privileges granted to them under an external ministerial delegation of authority.

Section 5 of the staff instruction provides an overview of different safety oversight tools and their application. In section 5.1, "Oversight for Organizations with a Complete SMS," Transport Canada indicates that organizations with an approved SMS will be subject to routine ongoing monitoring and, if there is any indication that the company is experiencing difficulties, the appropriate oversight validation will be applied. In section 5.4, "On-Going Oversight of SMS Compliant Organizations," Transport Canada indicates that the ongoing monitoring of the risk indicators associated with a company's operation may serve to identify a problem with the company's SMS. If an organization's SMS is not in compliance, Transport Canada would consider resorting to traditional oversight activities.

1.12 Canadian Business Aviation Regulation and Safety Oversight

1.12.1 Transport Canada Regulatory Oversight of Business Aircraft

Before 1983, there were no regulations governing the operation of business aircraft in non-commercial air service. In response to a series of accidents, one of which involved a large aircraft carrying a number of company personnel, Transport Canada introduced the Private Aeroplanes Passenger Transportation Order (Air Navigation Order, Series I, No. 2). It applied to the operation of turbine-powered, pressurized and large ^{Footnote 19} passenger-carrying aircraft. In 1996, with the introduction of the Canadian Aviation Regulations (CARs), the issuance of a private operator certificate (POC) under the authority of subpart 604 of the CARs was established.

In 1999, ^{Footnote 20} there were 121 POC holders in Canada, operating 193 aircraft and employing 672 pilots. The majority of the 193 aircraft were in the corporate jet category. These operations were overseen by approximately 16 civil aviation inspectors based in Transport Canada regional offices across the country. They carried out routine regulatory audits, conducted PPCs, performed safety visits, monitored, and carried out follow-ups on incidents.

1.12.2 Canadian Business Aviation Association

The Canadian Business Aviation Association (CBAA) was incorporated in 1962. The official purpose of the CBAA is to "act as the collective voice of business aircraft operators, enhancing the understanding and value of business aviation" in Canada by assuming an advocacy role. The CBAA represents operators varying from the small one-person pilot/owner operation to some large corporate flight departments.

In late 1998, the CBAA and Transport Canada began considering the transfer of the administration and management of CARs subpart 604 to the CBAA. There were several perceived benefits of industry self-regulation for both CARs subpart 604 operators and for Transport Canada. CARs subpart 604 operators believed that CBAA rules and standards could provide additional flexibility and operating efficiencies and would give operators the opportunity to play a more direct role in managing their own safety activities, such as pilot certification.

The benefits for Transport Canada included the opportunity to shift resources from CARs subpart 604 oversight to higher risk aviation activities. Transport Canada estimated that the annual cost to carry out its traditional regulatory model of safety oversight of CARs subpart 604 operators was in the range of $1 million to $1.5 million per year.

1.12.3 Self-Regulation Studies – Phase 1 and Phase 2

Between 1999 and 2000, Transport Canada and the CBAA conducted a joint study of the feasibility of self-regulating business aviation in Canada and released a report entitled Self-Regulation of Business Aviation in Canada on 21 March 2000. The study concluded that it was feasible to amend subpart 604 of the CARs to enable the transfer of regulatory responsibilities to the CBAA. Transport Canada and the CBAA accepted the study's conclusions.

Subsequently, a second study was commissioned to develop a regulatory and management framework. The final report titled Business Aviation Operational Safety Standards System – Phase 2: Standards, Procedures and Operator Fees was released on 15 March 2001. This study looked at three alternative approaches, and recommended that the CBAA adopt a broad-based SMS approach in prescribing standards for CARs subpart 604 operators. A company risk profile would form the basis on which the operator's SMS was developed, implemented, and evaluated. The company risk profile was described as "a map that charts the contours of higher risk" in day-to-day operations. The study stated that a company's risk profile had to be sufficiently well documented to permit the regulator, corporate executive, insurance underwriters, and other interested parties to understand how the safety risks of a flight operation have been identified, assessed, and managed.

The proposed regulatory approach included designing a set of performance-based rules linked directly to the operator's SMS. These performance-based rules were to be contained in standards developed by the CBAA and called the Business Aviation Operational Safety Standards System (BA-OSS System). The Phase 2 study highlighted the need to assess, on an ongoing basis, whether the BA-OSS requirements remained adequate to meet the intended objectives.

Both studies acknowledged that there were risks associated with industry self-regulation. However, the studies noted that the safety record of business aviation operators was very good and historically they had been quite conservative in the safety risks they were prepared to assume. Recognizing that oversight of operators would still be required upon assuming regulatory responsibility for business aviation from Transport Canada, the CBAA would have to audit operators' compliance with the rules and standards. The study also noted the responsibility of the Minister of Transport to issue directives to the CBAA to institute corrective measures where deficiencies that risked compromising aviation safety were identified in the CBAA's systems and procedures.

It was concluded that any risks associated with transferring oversight and enforcement activities to the industry body could be mitigated by either developing and publishing an audit procedures manual or adopting the existing Transport Canada audit manual; monitoring the work of those who conduct operator audits on behalf of the industry body; and periodic audits by Transport Canada. A qualified certification manager employed by the CBAA would be responsible for the certification of operators and his duties would include review of audit reports. By reviewing the operator audit reports, the CBAA certification manager could assess the quality of the work of the auditors as well as the content of the audit report, thereby ensuring audit quality and standardization.

The two studies identified that a critical aspect of the feasibility of self-regulation was how much the new program would cost the CBAA members compared to the costs under the traditional Transport Canada oversight system. It was considered ideal if the new system could be delivered at the same cost as the current program. It was also noted that any new standards necessary for adequate safety management had to be cost-effective. The studies noted that a comprehensive CBAA audit system involving persons employed by the CBAA might be very effective but would be costly to establish and maintain.

Another identified concern was the potential liability of the self-regulating body and its board of directors. By producing its own standards and certifying operators to those standards, it was reasoned that the CBAA would assume a responsibility that implied a certain duty of care. This duty of care, it followed, would bring with it potential liability for negligence if a certificate holder had an accident that was reasonably foreseeable or an accredited auditor was found negligent.

1.12.4 Canadian Business Aviation Association Private Operator Certificate Program

On 01 January 2003, the CBAA began to administer the certification of CARs subpart 604 operators in Canada. This was a considerable undertaking as the volume of work to convert old subpart 604 certificates and grant new POCs to organizations wanting to join the program exceeded early predictions; however, it was completed in an effective and timely manner.

The joint Transport Canada/CBAA feasibility studies recommended that subpart 604 of the CARs be expanded to permit operators already holding POCs to include aircraft that did not meet the prevailing applicability criteria. This change was accepted by the CBAA and the criteria were expanded to include helicopters and unpressurized twin- and single-engine aircraft. The POC program no longer includes just corporate flight departments but now includes some higher risk activity areas like helicopter operations, forest-fire suppression aircraft and Royal Canadian Mounted Police (RCMP) operational flights. The CBAA also expects that the number of POC holders will continue to grow with the introduction of very light jets. The official count of POC holders provided by the CBAA in April 2008 was 321.

Although the feasibility studies described the CBAA as a delegated regulatory body, the CBAA believed its role is to provide an efficient, facilitated process for applicants to obtain certification. The CBAA currently has three staff members who are primarily responsible for the service delivery and ongoing development of the POC program.

The main condition for obtaining and maintaining a POC is that the operator must successfully undergo a third-party audit of its SMS. Audits are required to ensure that the operator complies with the CBAA's BA-OSS and that the operator's SMS is acceptable. However, the CBAA did not accept that, as a certification organization, it could insist or force an operator to comply with its standards. Rather, it believed that, with the continually maturing safety culture in the aviation industry, all of its certificate holders would eventually meet the required standards voluntarily. Other than the periodic certification audits conducted every one to three years by independent CBAA–accredited auditors, the CBAA did not provide any planned or structured oversight of private operators.

The CBAA has invested resources in developing documents and manuals to assist its members. Because it identified knowledge and skill limitations at many levels within the aviation community, the CBAA also developed a program intended to meet the training needs of its members. However, attendance at most of the training activities has been well below projections, and resulted in under funding of the program and its curtailment.

1.12.5 Canadian Business Aviation Association–Accredited Auditors

In 2002, the CBAA trained and accredited 14 auditors across Canada. These auditors were selected based on criteria identified in the feasibility studies. The auditors represent a cross-section of aviation expertise with varying levels of experience in SMS development, training or auditing. The original feasibility studies identified that the salary and associated liability insurance costs would be considerable if the CBAA directly employed the auditors and would far exceed its annual revenues. This led to the current system of accredited auditors functioning as independent contractors.

The CBAA does not recommend any particular auditor nor does it facilitate contact. It does provide a list of accredited auditors and their contact information on its website. The CBAA takes pains to remove any perception of an employee-employer relationship between it and the accredited auditors.

Notwithstanding the inherent conflict of interest or potential capture of the accredited auditors by the companies they serve, the CBAA is reluctant to direct auditors to cycle between operators based on what the CBAA perceives as interference in the auditor-client business relationship.

Regular teleconferences are used to discuss issues that have arisen during audits. Attendance, however, is not mandatory and some auditors often do not participate. It is the CBAA's position that the combination of teleconference calls, auditor training sessions, face-to-face meetings and feedback from operators is sufficient to monitor the accredited auditors' activities. Once every two years, all accredited auditors meet to review audit procedures. In the alternating years, CBAA personnel visit the auditors to review audit procedures and sometimes, but not always, review the results of their recent audits.

The CBAA firmly maintains that this oversight philosophy is adequate to ensure the consistency and standardization of its POC audit program. It believes that, given enough time, accredited auditors will become more knowledgeable and proficient in assessing operators' overall safety management capability. The CBAA does not participate in, or observe, audits because it does not think this would contribute in any meaningful way to the improvement of the audit program.

Since the beginning of the program in 2003, the CBAA estimates that the accredited auditors have conducted approximately 750 initial and recurrent audits.

1.12.6 Canadian Business Aviation Association Guidelines for Evaluating a Safety Management System

A CBAA document entitled Guidelines for Evaluating a Safety Management System was prepared in January 2003 to "guide auditors in planning, preparing, conducting and reporting the evaluation of a company's SMS." This document is also provided to prospective POC applicants to help explain the audit process. The document identifies the goal of the SMS evaluation as "to determine whether the operator is managing the safety-risks of the operation to a level as low as reasonably achievable. This is done by assessing the soundness, appropriateness and effectiveness of the operator's safety management activities."

In line with Transport Canada's phased-in approach for SMS, the CBAA has also adopted a philosophy of reasonable expectations. The guide advises that "The implementation and operation of an SMS takes time, even for mature aviation departments. Therefore, the auditor must determine a reasonable level of performance that can be expected when evaluating the SMS."

Three levels of SMS development and auditor evaluation are described in the CBAA guide.

• A level one evaluation is for initial POC applicants. To meet level one, the SMS should be "documented, approved, resourced and being implemented" and "the evaluation focuses mainly on assessing the soundness and appropriateness of the SMS." The company must demonstrate to the CBAA–accredited auditor that the necessary SMS infrastructure is in place and that safety management activity within the company's past and planned activities is appropriately targeted for its review and/or action. According to the guide, a successful level one evaluation should have a validity of one year before being re-evaluated.
• A level two evaluation is for a POC holder that has previously completed either a level one or level two evaluation. To satisfy a level two evaluation, the SMS must be shown to be functioning with results. During the evaluation, the company demonstrates that safety management activities are targeted, and safety risks are being effectively managed. Generally, a successful level two evaluation extends the validity of the POC for one to three years, depending on the nature of the findings and at the discretion of the CBAA–accredited auditor.
• In a level three evaluation, a company demonstrates that its SMS is sustained and includes an ongoing improvement process. A level three evaluation is conducted during a recurrent evaluation of a POC holder that has successfully completed at least two previous recurrent evaluations. The objectives of a level three evaluation are to confirm that safety management activities are fully integrated into the company's business and that a positive safety culture is being sustained.

Unlike Transport Canada, the CBAA did not set a fixed timetable for SMS implementation, as it believed it could not force its POC holders to achieve SMS compliance until they were ready. The CBAA indicated that very few of its POC holders have advanced beyond level one and suggested that, in some cases, it could be many years before they do.

In 2005, the CBAA hired a consultant to evaluate the POC program for the period of 01 January 2003 to 01 June 2005. The evaluation included a review of CBAA documentation and interviews with several CBAA employees, 11 of the CBAA–accredited auditors, 6 of the POC holders and the Transport Canada inspector tasked with monitoring business aviation operators. Some auditors indicated that the SMS for a number of the POC holders remained rudimentary. The CBAA's immediate response was to encourage its accredited auditors to pay particular attention to this potential deficiency. Furthermore, the CBAA planned to improve the safety management understanding of POC operators through continued exchanges between its auditors and POC program staff and to make additional training opportunities available.

1.12.7 Transport Canada Oversight of the Canadian Business Aviation Association

Early in 2006, three years after the CBAA began administering the certification of CARs subpart 604 operators, Transport Canada initiated an assessment of CBAA's management of the POC system with a view to verifying that its policies, procedures, and practices were meeting the requirements of subpart 604 of the CARs.

An assessment protocol was developed. A deficiency linked to a regulatory requirement, including deficiencies in a CBAA policy or procedure, would be identified as a "Finding"; a deficiency linked to a non-regulatory requirement would be identified as an "Observation." The CBAA was required to respond in writing to Transport Canada detailing its short- and long-term corrective action plan for each finding. After approving each corrective action plan, Transport Canada would then monitor implementation.

The assessment report was issued on 11 May 2007, and covered the period January 2003 to March 2007. The report found that the basic design of the CBAA POC program was sound, in that the responsibilities for program continuity were appropriately placed on the private operator, accredited auditors, POC program personnel, and the senior management of the CBAA. The report produced six findings and seven observations. One of the findings (FDG-05-01) indicated that the CBAA was not adequately monitoring the quality of the POC program, specifically the activities of its accredited auditors. During its review of the POC procedures manual, the assessment team noted that it lacked some of the elements identified in the Phase 2 feasibility study, including a quality assurance program.

It was also noted that there were no records of the CBAA directly monitoring auditor activities. The assessment team concluded that activities such as auditor recurrent training and standardization teleconferences were considered by the CBAA to be an adequate quality assurance program. The report noted that such activities were actually quality control measures, and did not provide the necessary assurance that audit activities were standardized, and policies and procedures were being applied uniformly. Although CBAA staff told the assessment team that they met with auditors for numerous one-on-one meetings to review documentation and discuss audit methodology, these visits had not been documented.

One observation (OBS-04-02) noted discrepancies within the risk profile concept. The CBAA–accredited auditors indicated to Transport Canada that the company-generated risk profiles tended to be superficial, and were often not supported by documentation. Smaller owner-operator companies were especially weak in developing functional risk profiles. POC staff acknowledged that this was a challenging area. The CBAA stated that it would continue to promote training programs aimed at the effective development, maintenance and use of company risk profiles.

On 04 June 2007, the CBAA submitted a corrective action plan for each finding. For FDG-05-01, the CBAA indicated that, as a short-term corrective action, it had briefed its staff on the findings content and background. The proposed long-term corrective action, to be taken before 31 December 2007, was to amend section 3 of the POC manual, by revising the current heading from "Quality Assurance" to "Quality Monitoring," and to monitor the training requirements of the accredited auditor program. Further, the CBAA proposed enhancing the effectiveness of the existing system of audit monitoring and record keeping.

Transport Canada initially rejected the corrective action plan for FDG-05-01 because it lacked sufficient detail to determine its potential effectiveness. While a revised corrective action plan was not submitted, Transport Canada sent a letter to the CBAA officially closing the assessment on 21 September 2007. Efforts were made to determine why the assessment had been closed when the corrective action plan, which had initially been unacceptable, had never been revised.

The TSB was advised that there had been considerable discussions between Transport Canada and the CBAA about this deficiency and how best to deal with it. These discussions were not documented, however, in the form of minutes or decision records.

1.13 Jetport

1.13.1 General

Jetport is a privately held charter company based in Hamilton. The company started operations in 1997 with one Cessna Caravan and one Learjet 31A. It has grown significantly since then and now offers jet-aircraft charter service from its own full service fixed-base operator (FBO) ^{Footnote 21} dedicated to servicing corporate and private aviation. It offers service 24 hours per day for transient aircraft and line maintenance for Cessna Caravan, Beechcraft King Air, Learjet, Gulfstream G100 and Bombardier Challenger series aircraft. At the time of the occurrence, the company was operating eight aircraft and one helicopter of its own, as well as managing the operation of another aircraft for a local company under a POC from the CBAA.

Jetport holds a Transport Canada–issued Air Operator Certificate and was approved to conduct operations under subparts 703 and 704 of the CARs for all aircraft except the Global 5000. Jetport had planned on operating the Global 5000 under subpart 704 of the CARs; however, the certification had been delayed pending approval of the cabin safety manual. In the meantime, it was being operated under a POC issued by the CBAA for operations in accordance with subpart 604 of the CARs. Jetport's owner relied on company aircraft for his personal transportation and for the transportation of his employees, including those employed by another of his companies, Fox Harbour Development Limited, which operated the aerodrome (CFH4) and golf resort at Fox Harbour.

At the time of the occurrence, Jetport employed 49 people: 21 pilots, including the Director of Flight Operations, the Operations Manager and the chief pilot; 9 maintenance personnel, including the Director of Maintenance; 4 flight coordinators; 10 Jetport FBO personnel for fuelling and aircraft handling; and 5 administration personnel.

1.13.2 Previous Jetport Accidents

Since Jetport began operation in 1997, aircraft operated by the company have been involved in five accidents, including this one. Two of the four previous accidents involved amphibious Cessna 208 Caravans, while the other two involved business jets.

An accident occurred on 22 March 2000 involving a Jetport Israel Aircraft Industries Astra SPX jet on a night visual approach to Runway 33 at CFH4. During the approach, the aircraft descended and struck the tops of trees. The crew initiated an overshoot and the aircraft was able to climb away successfully, eventually landing in Charlottetown (CYYG). The aircraft sustained substantial damage (TSB report A00A0051). Following this accident, the APAPI system was installed to help provide additional guidance for pilots conducting an approach to the aerodrome.

On 22 November 2005, a Jetport Gulfstream 100 jet returning from West Palm Beach, Florida, United States, was involved in an accident while landing at Hamilton (CYHM). Following an instrument approach, the aircraft touched down long on the wet runway with only about 3000 feet remaining. All available braking was used to slow the aircraft but the aircraft ran off the end and travelled 122 feet down a slope where it came to an abrupt stop and sustained substantial damage (TSB report A05O0257).

1.13.3 Jetport's Safety Management Experience

Jetport personnel were first introduced to SMS in October 2004. Jetport functioned as a third-party aircraft management company for a POC holder based at Hamilton and operated an aircraft on its behalf under subpart 604 of the CARs. In order to obtain a POC, Jetport had to submit a POC manual describing a functional SMS. A CBAA–accredited auditor assessed the SMS and found it acceptable, resulting in the issuance of the POC.

In preparation for the CARs amendments to subparts 703 and 704 in March 2009, Jetport was in the process of developing a SMS for its subparts 703 and 704 operations. A consultant was preparing a "gap analysis" and implementation plan for Jetport's aircraft maintenance operation. Jetport was planning to begin identifying its SMS requirements for CARs subparts 703 and 704 flight operations in the near future.

Although Jetport had been required to have a functioning SMS as per the BA-OSS since 2004 for its third-party aircraft management and more recently for the Global 5000 addition, it was determined that, at the time of the accident, notwithstanding several successful CBAA POC audits, Jetport was still following the traditional approach to safety management.

Jetport's Flight Safety Officer (FSO) was a senior line pilot who held the position for several years. The FSO had received Company Aviation Safety Officer (CASO) training from Transport Canada but had never attended a SMS course. Several of Jetport's managers had received some SMS training consisting of two-day courses or had attended SMS seminars.

At Jetport, safety concerns could be raised by any employee at any time and brought to the attention of the Flight Department's Manager. Incident reports would be reviewed by the FSO, the circumstances would be investigated, and the underlying conditions reviewed by the safety committee for corrective action. The safety committee played a dual role, as it does in many operations of similar size, looking at both flight safety and occupational safety and health (OSH) concerns. A total of 11 incident reports (2 maintenance, 9 operations), covering the period February 2006 to November 2007, contained an incident description and an area to suggest corrective action. There was no indication of final disposition or follow-up on the form. Most of the incident reports were reactive in nature and only one identified a potential hazard to future operations.

Safety committee meeting minutes for the previous year were requested and nine were provided for review, covering the period between January 2007 and November 2007. Most of the issues dealt with OSH issues related to maintenance activities around the Hamilton facility, but occasionally some flight safety issues were addressed. One operations issue discussed and resolved had been identified in an earlier hazard/incident report. The FSO, the Vice President, and the Director of Flight Operations were all identified as members of the safety committee. Attendance records for the nine meetings reviewed showed that the FSO and the Vice President did not attend any of the meetings. The Director of Flight Operations attended one in October 2007, after a resolution raised at the previous meeting recommended that at least one management member should attend each meeting.

Safety action resulting from incident reports was communicated to staff in the form of safety policy statements or changes to procedures manuals. Flight safety issues were discussed at the periodic pilot briefing session. None of these safety management practices were formally documented in a safety manual. Other than the very basic safety procedures outlined in the POC manual, staff awareness of safety management at Jetport was accomplished over time through verbal exchange with more experienced staff members.

1.13.4 History of Oversight and Audits of Jetport

Transport Canada inspectors have provided most of the safety oversight of Jetport because all Jetport aircraft, except the Global 5000, are operated under subparts 703 and 704 of the CARs. Over the years, there have been several Transport Canada audits of Jetport's flight and maintenance operations, which have all been closed out and completed satisfactorily.

Jetport also had its management systems assessed by two well-recognized third-party audit organizations. In total, three audits were conducted; first in 2004, then in 2005 and finally in 2007. All audits were successful with the auditors commenting favourably. The last audit indicated that Jetport had a formal SMS in place and was awaiting approval from Transport Canada. Further research established that the SMS standard used to conduct the evaluation did not contain details about the content of a satisfactory SMS but simply required that there be some SMS program documentation.

Since October 2004, Jetport had functioned as a third-party aircraft management company for another POC holder based at Hamilton and operated an aircraft on its behalf. In order to get a POC, Jetport had to develop a POC manual with a description of the SMS it was proposing to use. Once the manual was ready, Jetport contracted one of the CBAA–accredited auditors. The audit was completed over a period of two days and was assessed as successful. The audit cover sheet, the POC application form and fees were sent to the CBAA who subsequently issued a POC. In January 2007, a little over two years later, the same auditor returned to the company to complete a recurrent audit, based on an audit cycle for a company considered to be low risk. This second audit was also successful; the cover sheet indicating this was sent to the CBAA and the POC was renewed.

1.13.5 Jetport Global 5000 Private Operator Certificate Audit

When Jetport decided to operate its new Global 5000 under a POC issued by the CBAA, it contacted the same CBAA–accredited auditor it had used in the past. The audit for the Global 5000 POC application began on 29 August 2007, and was completed after a second visit to the company on 19 October 2007. The completed audit report form cover sheet was submitted to the CBAA, indicating that the company was well managed and a full system audit had been completed with successful results (see Appendix F – Canadian Business Aviation Association Audit Report Form). An operating authority for the company to conduct approaches to CFH4 was also approved. The CBAA then issued a POC for the operation of the Global 5000 to Jetport on 19 October 2007.

Jetport had been operating under a POC for a third party since October 2004 and should have gained experience with SMS. However, Jetport submitted the same POC manual for review in November 2004 and again in January 2007 (with a footer indicating the original issue date of 01 December 2004) as it had been previously reviewed and accepted by this CBAA–accredited auditor. The version of the POC manual at the time of the accident had some changes to names and a different company risk profile for the Global 5000 was completed, but otherwise there was no evidence of continued evolution or improvement of the SMS.

The TSB examined the three audits conducted at Jetport by the CBAA–accredited auditor as well as the Jetport POC manual that the auditor had reviewed. The auditor was interviewed by the TSB for clarification and to assess the auditor's knowledge of SMS concepts. The work of other CBAA–accredited auditors with other POC holders was not reviewed.

The following documents formed the basis for evaluating the accredited auditor's SMS assessment report:

• the ICAO Safety Management Manual (Document 9859, First Edition, 2006);
• Transport Canada's guidance on SMS;
• the BA-OSS for SMS standards;
• the CBAA publication Guidelines for Evaluating a Safety Management System;
• the Jetport POC manual; and
• the CBAA generic operations manual template.

Section two of the audit report checklist for SMS requirements includes 14 items to be verified during an initial audit and three additional items to be verified during a recurrent audit. Although the latest audit report indicated that an initial audit had been completed, all SMS requirements, including the three recurrent audit items, were marked as having been assessed. All 17 items were marked as compliant with the CBAA BA-OSS.

However, the POC manual contained mostly generic statements with no details as to how the SMS would be administered, continuous training provided and reporting process implemented. While some general information was provided on the reactive and proactive processes, the manual did not describe the procedures that must be followed. There was no mention of a non-punitive reporting system. No explanation was provided to explain how safety information would be disseminated. Jetport did not have a proactive process for monitoring risk factors and evaluating change, and could not provide any documentation related to risk assessments or evaluations of changes to operating practices or specifications.

The company risk profile (see Appendix G – Jetport Company Risk Profile) assessed all elements as low risk, but did not explain how a "low risk" level was determined. While hazards should be assessed for both severity and probability dimensions, Jetport had assessed one set of factors for severity only, while assessing probability for a different set of factors. For example, severity was assessed as low for factors such as fuel quantity, location of operations, weather extremes, in-flight turbulence, and emergency response services while the likelihood of other factors such as weather information and airports, maintenance, flight crew qualifications, experience, and aircraft currency was also assessed as low. This approach to risk assessment went unchallenged by the accredited auditor.

The Jetport POC includes operations specification (Ops Spec) 99, authorizing the use of restricted instrument procedures, published in the Restricted Canada Air Pilot (RCAP). Considering that an additional Ops Spec was required to operate into CFH4, it would have been reasonable to conduct a separate risk assessment specifically for this part of the operation; however, Jetport did not produce any documentation to indicate that this had been done. A discussion between the auditor and company management about the operator's comfort level regarding the safe operation of the Global 5000 into CFH4 did take place, and this resulted in the auditor approving the Ops Spec.

1.13.6 Jetport's Introduction of the Global 5000

Jetport completed a business case for the Global 5000. It covered the marketability of the aircraft, the anticipated client base, the estimated cost of operation, and the limitations and capabilities of the aircraft in terms of performance. However, Jetport only conducted an informal risk assessment for the introduction of the Global 5000; it was not documented and did not follow the CBAA's Guidelines for the Conduct of Risk Analyses by Small Private Operators. The risk assessment process consisted of meetings and discussions between the Director of Flight Operations, the Operations Manager, the chief pilot and the FSO. The purpose of this review was to examine the performance capabilities and operating procedures for the Global 5000.

Jetport considered the transition to the Global 5000 as a relatively simple type conversion rather than the introduction of a completely new aircraft. It recognized that the Global 5000 was bigger but only assessed the consequences from the perspective of ground operations. It believed that the operation of the CL604, combined with the training received from Bombardier, and some line indoctrination with an experienced Global 5000 pilot, would make up for its lack of experience with the aircraft. Because of the Global 5000 better short field capabilities, longer range, and overall better performance, Jetport considered the Global 5000 operation to be safer than the CL604. It focused on the positive aspects of the Global 5000 without fully considering the potential hazards arising from the introduction of this new equipment.

The potential hazards for aircraft operating at CFH4 are listed in the CFS (see section 1.7.2). Other hazards identified by Transport Canada inspectors assessing the aerodrome from a certification perspective were also identified to Jetport (see section 1.7.3). Some of these hazards had contributed to the 22 March 2000 accident. While Jetport was aware of these hazards and some defences, such as the APAPI installation, had been put in place, the company felt confident that the remaining hazards did not represent unacceptable risks.

A more formal risk assessment was not conducted to analyze the contribution of these hazards in potential incident scenarios that could have included:

• overrunning the end of the 4885-foot-long runway,
• touchdown before the runway threshold,
• hitting obstructions on the approach,
• runway excursions due to the narrow width of the runway,
• last minute go-around due to a vehicle on the roadway, or
• colliding with a vehicle using the roadway.

Instead of using a structured approach to hazard identification, followed by risk mitigation, Jetport conducted an informal risk assessment. Following this, the company added turning bays at both ends of the runway, reducing the risk of taxiing off the edge of the runway when making a 180-degree turn. Since pilots assigned to the Global 5000 had operated into CFH4 with other aircraft on many occasions, their experience level was considered adequate to handle any other risks.

2.1 Introduction

There were no technical deficiencies or system malfunctions before or during the flight and the aircraft responded appropriately to pilot command inputs. The aircraft sustained major structural damage. Two occupants suffered serious injuries and the other eight occupants suffered minor injuries.

The first portion of the analysis will establish an understanding of what happened, covering the operational aspects of the occurrence. The second portion of the analysis will focus on the underlying issues, including organizational and human performance issues, that led to how and why the accident happened.

2.2 Operational Aspects

2.2.1 Crew Experience

Both the captain and the first officer were experienced pilots with over 3000 hours on turbojet aircraft, but their experience on the Global 5000 was limited. In order to mitigate the risks associated with the introduction of a new aircraft type, Jetport arranged with Bombardier for an experienced pilot to fly with the captain for two weeks. Although the captain had flown approximately 64 hours on the Global 5000 before the occurrence, many of the flights had been long range, resulting in the completion of only 14 segments before the occurrence. In addition, on some of these segments, the other pilot completed the landing.

The first officer had not yet completed line indoctrination training. Following completion of his initial training in August 2007, he had not flown the Global 5000 for a period of over three months. He therefore had not had the opportunity to become comfortable with the aircraft. Such a long delay immediately following training is conducive to a loss of this newly acquired knowledge and can result in degraded skills.

An adaptation period is typically needed for pilots to transition to a new aircraft type. In this case, the transition was made more difficult because of the larger aircraft size compared with the Bombardier Challenger 604 (CL604). The increased attention and concentration required during the transition period leads to an increase in pilot workload. The pilots were still adjusting to the greater size of the Global 5000. Had the crew members operated more flights and been exposed to more landings, they would have had the opportunity to become more familiar with the aircraft size, its handling characteristics, and performance. It is likely that they did not have enough experience on the new aircraft to build an accurate sight picture for the Global 5000 to allow them to detect the unsafe landing profile.

Although Jetport flight crews were aware of the multiple hazards at Fox Harbour (CFH4), they felt confident in their ability to operate safely in and out of the aerodrome because it was one of their most frequent destinations. However, the decision of Jetport to allow operation into an aerodrome such as CFH4 so early after the introduction of this new aircraft type indicates an inadequate risk assessment. It is likely that, had the crew gained more experience while operating at airports with longer runways, it would have allowed them to adapt to the larger aircraft, as well as adapting to the Global 5000 sight picture and improving height assessment.

2.2.2 Approach Planning and Touchdown Point

The flight crew members had flown into CFH4 on many occasions over the previous years, operating different aircraft types such as the King Air 350, Astra SPX/Gulfstream G100 and the CL604. All of those aircraft were smaller than the Global 5000.

For this flight, they had properly conducted all the flight planning, and the en route portion of the flight to CFH4 was uneventful. The crew members planned to fly the same approach profile they had flown on many occasions in the past, and touchdown in the first 500 feet of Runway 33, therefore maximizing the roll-out distance available. Even though this would require them to cross the threshold at a height lower than the manufacturer recommended 50-foot threshold crossing height (TCH), they felt that the risks associated with a lower TCH were acceptable. This would maximize the roll-out distance available, and compensate for the possibility of a wet runway. The ceiling and visibility were good, the crew had good visual reference to the runway, but the gusty wind conditions would have added to the pilot flying (PF) workload on the new aircraft. Without any other contributing factors, the gusty winds and associated workload alone are considered to be within the PF's ability and experience even with his limited hours on type.

During the initial phase of the approach, the autopilot remained engaged with the aircraft following the flight management system (FMS)–generated vertical path information. Had the crew continued to follow the vertical path guidance, the aircraft would have crossed the threshold at a height of 58 feet (see Figure 7) and touched down at a point located approximately 1000 feet down the runway (see Appendix A – Touchdown Points). The analysis of the aircraft's performance, confirmed by the manufacturer, indicated that this landing profile could be safely completed within the aircraft's performance envelope at the time.

At a distance of 1.4 nm from the threshold of Runway 33, the PF disconnected the autopilot, which was following vertical path guidance. The PF continued the approach manually, initially correcting the flight path with reference to the abbreviated precision approach path indicator (APAPI) guidance. While the vertical path (VPTH) approach path of 3° meets the runway approximately 1000 feet from the threshold, the APAPI 3° path meets the runway approximately 500 feet from the threshold. Therefore, the aircraft was initially slightly above the APAPI on-slope indication (see Appendix B – Flight Data Recorder Approach Data) and the PF had to increase the descent rate to intercept the APAPI approach path.

The PF's flight path correction brought the aircraft back on the APAPI profile at approximately 350 feet above runway elevation and 0.85 nm from the threshold. However, the PF did not intercept and follow the 3° APAPI path; instead, the aircraft continued descending below the APAPI path. The PF further increased his workload by using the wing-low crosswind technique. Although the crosswind was decreasing as the aircraft neared the threshold, the use of cross-control input increased, eventually leading to spoiler deployment (see Appendix B – Flight Data Recorder Approach Data). This increase of cross-control when a reduction would be expected indicates that the aircraft was responding to pilot-induced oscillations.

Ten seconds before impact and while the aircraft was approximately 0.5 nm from the threshold, the PF, preparing for the landing, transitioned completely to the ground and runway environment for visual references used to judge height and timing of the landing flare. At this point, the aircraft dipped below the APAPI glide path, which if followed would have resulted in a main wheel TCH of approximately 8 feet, followed by a touchdown approximately 172 feet from the threshold. From this point on, the aircraft was flown below the APAPI red/white on-correct approach path and no deviation calls were made, nor were any flight path corrections initiated, indicating that the pilots were comfortable with the approach profile they were flying.

Four seconds before impact, 0.1 nm from the threshold, the auto call-out system announced "50". However, because of the low terrain before the runway, the aircraft was less than 50 feet above runway elevation. At that point, the aircraft was still below the APAPI glide path and the airspeed had decreased to 114 knots (corrected V_ref minus 4 knots). One second after the "50" auto call-out, the autothrottle speed mode changed from SPEED to RETARD mode and the thrust levers automatically moved to the IDLE position. From this point on, the airspeed continued to decrease until it reached its minimum recorded value of 102 knots, 16 knots below the corrected V_ref. Had the aircraft been over the threshold at this point instead of 830 feet back from the threshold, the decreasing speed could have been managed, resulting at worst in a hard landing. Instead, the aircraft was now in a low energy state, making corrections to the flight profile, without an associated power increase, ineffective.

With just a few seconds left before touchdown, the PF was dealing with a significant workload, attempting to control the aircraft's profile, which was affected by the gusty wind conditions, the use of the wing-down crosswind technique and the reduction of engine thrust. Although power from both engines was available, and a power increase could easily have arrested the loss of lift that occurred due to the effect of cross-controlling and roll spoiler deployment during the final stages of the approach, at no time was the power increased. The feeling of sink indicated by the pilots could have been the result of a combination of a wind speed change, engine power decrease and wing spoiler deployment, associated with a low airspeed, all of which would have resulted in a loss of lift. The increase in aircraft pitch attitude during the last seconds of flight served only to increase drag.

Because the crew members were flying the same approach profile they had used many times before at CFH4, at no point on the approach did they recognize that they were on an unsafe flight path. There were no calls for corrections because everything was considered to be within the planned approach. Furthermore, initial contact with the surface was viewed as a harder-than-normal landing until the right main gear collapsed and directional control was lost. The unusually rapid pitch change initiated by the PF seconds before impact, with a higher-than-usual final pitch attitude of 10.6° recorded on this approach, could indicate the PF's reflex to the low TCH. Due to the aircraft's low energy state at this point, the last minute rapid pitch change had little effect on the approach profile.

Although consideration had been given to the aircraft's larger size in regards to ground manoeuvring, no consideration had been given to the Global 5000 greater eye-to-wheel height (EWH) and the implications of the larger aircraft flying the accustomed flight profile at CFH4. In addition, the PF's workload at the time was significant and this increase in cognitive demand likely made decision making more difficult. The planned approach profile, combined with workload and inexperience on the aircraft type, put the PF in a situation where he was unable to detect the unsafe profile.

The pilot not flying (PNF) had less experience than the PF and it had been a considerable amount of time since he had completed his initial training on the Global 5000. It is therefore unlikely that the PNF could have helped the PF detect the unsafe profile. Like the PF, he was used to flying the same approach profile at CFH4 in the CL604 and Gulfstream G100. The profile flown on the occurrence day would have provided enough height for a CL604 to cross the threshold and land in the first 500 feet of runway (see Photo 7).

2.2.3 Eye-to-Wheel Height

Knowledge of aircraft EWH is necessary to assess whether a visual glide slope indicator (VGSI) system is appropriate for the aircraft type being flown. However, it was determined that this is an area that is not well addressed during pilot training and is therefore generally not well understood by pilots. By not being aware of the aircraft's EWH and its significance for safe TCH, pilots cannot assess the appropriateness of the visual guidance they are following on approach.

In this occurrence, the EWH information for the Global 5000 was not available. Jetport and its flight crews were aware that the Global 5000 was a larger aircraft than any other they were operating but they did not consider nor appreciate all of the implications of this difference in size. They believed that, given their significant experience on the CL604, the larger size of the Global 5000 did not introduce any additional risk. They were not aware that the Global 5000 EWH was 17.2 feet, approximately 5 feet greater than the CL604 EWH. Had they been aware of this, it might have led them to complete a more in-depth analysis, especially if they were following a formal risk assessment exercise.

The crew members were also not aware that the APAPI was only suitable for aircraft with an EWH of less than 10 feet. They did not consider that, if they had followed the APAPI guidance, the built-in safety margin normally associated with this VGSI would be eroded below acceptable levels due to the greater EWH of the Global 5000. Although the APAPI guidance did not contribute to the final flight profile flown by the PF, by establishing an acceptable TCH for the Global 5000, the appropriateness of the APAPI would have come into question during Jetport's risk assessment.

In the past, large aircraft performance characteristics precluded operations from short runways such as CFH4's 4885-foot runway. Large modern aircraft with better short field performance are now able to operate from shorter runways where they are more likely to encounter a VGSI designed for smaller aircraft. This situation increases the exposure to the risk of landing with a reduced TCH safety margin. Normally, an unsafe TCH would be corrected by the pilot relying on the runway environmental cues to assess final adjustments to the flight profile. As demonstrated by this occurrence, if the deficiency in the appropriateness of the VGSI is combined with other factors, an accident can be the result. Without readily available EWH information, and a clear understanding of its significance, aircraft operators will continue to be unable to assess the appropriateness of the VGSI system for the aircraft they operate.

2.2.4 Visual Glide Slope Indicators

Following the 22 March 2000 accident at CFH4, Fox Harbour Development Limited installed an APAPI for Runway 33. This was a mitigation strategy for dealing with some of the risks associated with operating into CFH4. While the main goal was to provide vertical guidance information to pilots flying in at night, an appropriate VGSI also provided a defence against other risks present in CFH4, such as unusual terrain features and mechanical turbulence. In addition, the APAPI assisted pilots who might have been susceptible to visual illusions on approach due to the narrow runway, as well as the surrounding environment.

At the time of the APAPI installation, Jetport was looking to purchase a Challenger CL604, which, with its EWH of 12.1 feet, required at least a precision approach path indicator (PAPI) 2 installation. Moreover, Fox Harbour Development Limited was marketing the golf resort as a fly-in destination and expecting that potential guests would be using business jets. While the installation of the APAPI would have been an appropriate defence if only small aircraft had been operating into CFH4, the lack of consideration for the expected larger aircraft actually introduced new risks. Pilots of large aircraft flying into CFH4 would now be relying on inappropriate visual guidance. This guidance would actually bring them too low over the threshold.

Flight crews in general do not have a good understanding of the different types of VGSIs and their limitations because this has not been adequately addressed during pilot training. Although the different types of VGSIs and EWH limitations are covered during commercial pilot training, the commercial pilot trainees are flying relatively small aircraft at this stage of their training, and the relevance of EWH to safe TCH for larger aircraft is usually not emphasized. As a result, in later years when pilots transition to larger aircraft, if the company employing and training them does not highlight the importance of EWH and VGSI limitations, the pilot's knowledge in this area will be deficient.

Because VGSI installations are common at aerodromes, pilots are very accustomed to using VGSI guidance. Since larger aerodromes are normally equipped with VGSI suitable for large aircraft, pilots relying on this equipment are assured a safe TCH. Pilots become accustomed to following the red/white on-slope indication without any consideration for the appropriateness of the VGSI type to the aircraft type being flown. However, when operating into smaller aerodromes with shorter runways, flight crews of large aircraft will occasionally be exposed to VGSI equipment intended for aircraft with a smaller EWH. This becomes critical when crews operating a large aircraft rely on a red/white on-slope indication from an inappropriate VGSI, since this results in an unsafe TCH. If this condition is combined with human performance issues such as inexperience, fatigue or visual illusions, it can result in an early touchdown before the runway.

Until pilots acquire a good understanding of the different VGSI systems in operation and the significance of the limitations on the safety of the operation, flight crews will continue to follow visual guidance that may not be appropriate to the aircraft type they are operating. Those flight crews will therefore not be assured safe TCH, increasing the risk of landing short of the prepared surface. Depending on terrain features at the approach end of a runway, this might result in injuries or loss of life, damage or loss of airframe, property damage, and environmental impact.

2.2.5 Cabin Safety

Although the safety features card directed the passengers to use the available shoulder straps for taxi, take-off and landing, they were not used at all during the flight. This increases the risk of injuries in the case of an accident during those phases of flight.

The passengers had removed their shoes after boarding the aircraft in Hamilton (CYHM) and, at the time of landing, they were not wearing them. In case of an emergency, this could impede the evacuation. It also increases the risk of passenger injuries either during or following evacuation, should they be exposed to fire, debris, ice, sharp objects or a hostile environment. Furthermore, in the event of an evacuation, the aircraft may no longer be accessible and the passenger may face a hostile environment without footwear, potentially for an extended period.

2.3 Safety Management System Implementation in Canada

International organizations such as the International Maritime Organization (IMO) and the International Civil Aviation Organization (ICAO) have mandated safety management systems (SMS) as a proactive strategy to reduce safety risks in the marine and aviation industries. They recognize that SMS offers greater potential to reduce accidents because it goes beyond the traditional "safety by regulatory compliance" approach to one that integrates sound risk management policies, practices, and procedures in an organization's day-to-day operations.

Transport Canada has acquired experience with SMS since it was first implemented in the federally regulated rail and marine sectors in 2001. It has also provided a significant amount of guidance material and training opportunities to commercial aviation companies to facilitate their progressive implementation of SMS. However, the success of this initiative depends heavily on each operator's safety culture and understanding of SMS concepts.

As with the transition to any new system, the introduction of SMS in the Canadian aviation industry is facing challenges. Many operators, although willing to progress to SMS, still do not possess a good understanding of how to do it. An operator's senior management must be willing to invest a considerable amount of time and sufficient resources to properly understand and implement SMS. The confusion associated with SMS implementation is not limited to the operators, as some of the people tasked with assessing SMS programs misinterpret performance indicators expected from a functioning SMS. With time and experience, operator and assessor knowledge should improve and eventually provide the level of protection expected of a mature SMS.

ICAO has outlined the requirements for complementary internal and external safety oversight within a SMS regulatory framework. Experience has shown that it takes time to develop a fully functional SMS. During this transition, it is essential that oversight not be relaxed. If adequate safety oversight of private operator certificate (POC) operators is not maintained by the regulator or the delegated organization, there is an increased risk that safety deficiencies will not be identified.

2.4 Jetport's Safety Management

2.4.1 Jetport's Safety Commitment

A key sign of an organization's commitment to safety is the proper allocation of resources to the management of safety. In the review of the Jetport management structure, there appeared to be several indicators that adequate resources were not in place. With all of the management-pilots and the Flight Safety Officer (FSO) performing line-flying duties, there was no extra time to devote to SMS development and, rather than hiring additional personnel, the emphasis appears to have been on continued production while maintaining a traditional safety management program.

Incident reports provide valuable learning opportunities for a company. They allow operators to identify hazards and risks within their operation so they can take corrective action before an accident occurs. Jetport's safety committee received 11 reports during the 20 months between February 2006 and November 2007. Employees will submit more incident reports if they are confident of management support and trained to identify and report any situations or conditions they suspect might constitute hazards. Moreover, the lack of participation on the part of certain managers at safety committee meetings is evidence of a soft commitment to safety.

This soft commitment to safety was also present at CFH4. While some improvements had been made at CFH4, several identified safety issues had not been addressed. Following installation of the APAPI equipment, Jetport had indicated to the TSB that calibration of the system would be verified on a weekly basis; however, this was never carried out. Furthermore, Jetport was reminded on multiple occasions of the importance of ensuring proper alignment of the APAPI units, along with the potential adverse consequences of having improper APAPI alignment. However, at the time of the occurrence, no personnel at CFH4 were responsible for aerodrome operation and maintenance, including regular maintenance of the APAPI, therefore preventing timely identification of APAPI equipment misalignment.

Transport Canada had advised Jetport of a concern at CFH4 regarding the roadway passing through the Runway 33 approach. It recommended that, at the very least, a sign be installed warning motorists to stop and scan for traffic before proceeding further. There was no regulatory requirement to put up a warning sign and Fox Harbour Development Limited was meeting the minimum safety standards. A sign was never installed.

2.4.2 Jetport's Safety Management System

For Jetport, obtaining a POC for the Global 5000 was a temporary measure until Transport Canada approved its cabin safety manual and issued an Air Operator Certificate for operation under subpart 704 of the Canadian Aviation Regulations (CARs). In order to obtain a POC for a third-party client, Jetport had already developed a SMS. This SMS then had to successfully undergo a complete audit by a Canadian Business Aviation Association (CBAA)–accredited auditor. Although Jetport had successfully completed three separate POC audits requiring a functional SMS, in reality, only a traditional safety program was in place. Jetport had applied minimal effort in the preparation of the SMS program and manuals, as indicated by submitting the same manual to the CBAA–accredited auditor on three different occasions. This suggests a failure to commit adequate resources, a lack of motivation or commitment or a lack of knowledge or understanding of SMS.

Jetport did not develop an accurate company risk profile. It did not assign severity and probability to each factor assessed and there was no method used to assign a risk level. Instead, the risk factors were assessed informally, resulting in a document that did not reflect the reality of the risks associated with its Global 5000 operation. This precluded identification of systemic safety deficiencies and development of appropriate mitigation strategies.

2.4.3 Introduction of the Global 5000

A comprehensive risk assessment conducted under a SMS affords some foresight of the hazards and risks in order for the company to prevent accidents. If Jetport had followed the CBAA's guidance material in the conduct of a risk assessment for the introduction of the Global 5000, it would likely have identified a number of risk scenarios, especially when considering its operations into CFH4.

Jetport's decision to operate the Global 5000 into an aerodrome such as CFH4, so early after it joined the fleet, prevented the crew from first obtaining more experience with the aircraft's landing profile. By adapting the standard operating procedures (SOPs) for the CL604 aircraft to the Global 5000, and deviating from the manufacturer's recommended procedures, Jetport introduced new risks into its operation.

One of the most significant differences between Jetport's operating practice in its SOPs and those of the manufacturer was its approval for pilots to descend below the standard 3° glide slope or below the visual guidance approach profile. The manufacturer's aircraft manuals indicate that the aircraft should cross the threshold at a height of 50 feet. A 50-foot TCH is standard for large aircraft operations. Jetport considered it "good airmanship" to "sink" below the glide slope and land as early as possible. It considered this to be safe under visual conditions and justified the practice as acceptable due to its last accident when one of its aircraft landed long at Hamilton (CYHM) and overran the runway. This practice combined with a number of other factors reduced the threshold crossing safety margin to an unacceptable level, contributing to the accident.

Had the risk profile prepared for the introduction of the Global 5000 into the company's operation been more realistic, it would have resulted in more effective risk mitigation strategies. Considering that the Global 5000 was a new aircraft to the fleet, issues such as flight crew qualifications, crew experience, aircraft currency and aircraft maintenance should have been initially assigned a higher risk rating than the low risk assigned, at least until additional experience with the aircraft was gained. The fact that operational factors such as weather information and airports were assessed as low, when CFH4 was one of the most common Jetport destinations, also points to a poor assessment of risk. All of the above may indicate a lack of understanding of hazard identification, the risk assessment process, or the overconfidence of senior management.

2.5 Canadian Business Aviation Association

2.5.1 General

The studies undertaken by Transport Canada and the CBAA identified some risks associated with the transfer of regulatory responsibilities for business aviation operators to the CBAA, as well as the operators' transition to SMS. In order to manage these risks, the Phase 2 study identified the requirement for the implementation of a quality assurance and monitoring system that would allow the CBAA to assess the work of its accredited auditors as well as assessing its operators. However, there is evidence that the CBAA has diverged from the study's recommendations in a manner that could affect the program's ability to maintain an adequate level of safety.

2.5.2 Private Operator Certificate Program

The CBAA believes that all of its POC holders (approximately 320) have successfully implemented SMS based on the completion of some 750 audits since the program began. Much of the CBAA's measurement of its program's success relates to the issuance of POCs, additional operating authorities and responses to day-to-day requests from its certificate holders. However, doubts remain about the quality of the audit program and its operators' ability to achieve full SMS compliance in a reasonable time.

The CBAA is focused on developing its program and increasing the number of POC holders. Because the CBAA does not believe it can force its operators to comply with the requirements of the POC program and it is not insisting that milestones for SMS implementation and development be followed, some POC operators may never reach full SMS compliance.

The CBAA believes that its corporate POC holders are very professional, well-resourced, safety conscious and their excellent safety records will mitigate the risk associated with less external oversight until they have fully implemented SMS. However, the CBAA program has been expanded considerably, and more operators of varying sizes, operating in environments that present greater risks than corporate aviation, are being accepted. Without adequate external oversight, operational risks may not be adequately managed.

2.5.3 Quality of Jetport Private Operator Certificate Audit

The SMS at Jetport was largely based on the traditional methods of safety management with some references to SMS. The audit of Jetport's SMS, conducted by the CBAA–accredited auditor, did not identify any deficiencies or make any suggestions for improvement. The auditor accepted the same SMS documentation three times in three years without any evidence that it had been revised or updated as experience with SMS was gained.

When the CBAA–accredited auditor accepted Jetport's Global 5000 SMS, even though it did not meet the Business Aviation Operational Safety Standards (BA-OSS), this indicated a lack of adequate understanding of SMS, the CBAA SMS assessment guide, and the audit checklist. Some of its accredited auditors were still struggling with understanding the SMS assessment guide, but the CBAA expected that this would improve as more experience was gained.

2.5.4 Canadian Business Aviation Association Quality Assurance

The need for oversight and monitoring of operators under the control of a self-regulated body like the CBAA is identified in ICAO's documentation and in the joint feasibility studies conducted by Transport Canada and the CBAA. Contrary to the recommendations made in those studies, the CBAA did not have a quality assurance program for its audit process.

Monitoring of its accredited auditors' work is a line of defence that would allow for identification of safety deficiencies, POC audit program shortfalls, operator's inadequate SMS program, or even trends in different operators' SMS programs. However, the CBAA only receives the audit cover sheet; it does not review the work of its accredited auditors or participate in actual audits of POC operators. Therefore, the CBAA cannot assess the quality of its accredited auditors' work nor can it assess the integrity of the operators' SMS or confirm that the goals of the POC program are being achieved. This means that the CBAA cannot effectively identify weaknesses in the POC audit program.

The CBAA maintains that its accredited auditors are not CBAA employees but rather independent third-party contractors. The selection and initial contact with auditors by POC applicants is left to the operator, so that the CBAA does not play any part of a managerial role in this part of the process. The arrangement between the auditor and the applicant is considered a business relationship completely separate from the CBAA and the CBAA does not interfere with the business relationship between accredited auditors and their clients. Sometimes, this arm's length relationship means that some practices go unchecked. For instance, the practice of operators using the same auditor may result in a conflict of interest or regulatory capture. Before the Fox Harbour occurrence, accredited auditor attendance at standardization teleconference calls and meetings was not mandatory because it would be perceived as an employee-employer relationship where instructions to staff are given.

One reason to avoid direct monitoring of auditor work is to avoid the costs attached to this type of oversight. The CBAA has stated that the costs of on-site direct monitoring would be prohibitive and would not result in any improvement to its current, passive oversight system.

Another reason relates to an issue identified in the first feasibility study. The study had identified liability issues the CBAA should consider in accepting regulatory responsibility for CARs subpart 604 operators. It suggested that, if duty of care is not effectively exercised, a liability claim could be made against the CBAA, its managers and Board of Directors. This could explain why the CBAA takes pains to disavow any formal relationship between it and its accredited auditors and its reticence in developing and implementing a quality assurance program.

Instead, the CBAA sees itself as a certification agency with the responsibility of serving its clients in a timely fashion. It does not believe it is responsible for regulatory oversight of CARs subpart 604 operators. This is a significant departure from the feasibility studies.

2.6 Transport Canada Safety Oversight

As shown in Figure 8 (1999 Structure), before the inception of the CBAA POC program, Transport Canada was responsible for the regulation, certification and oversight of business operators. The feasibility studies proposed a new oversight model where the CBAA would be responsible for the administration of the POC program, which involved the use of CBAA–accredited auditors.

While Transport Canada retained oversight responsibility for the CBAA activities, the new program meant that operators would be twice removed from Transport Canada's scrutiny. As identified by both the CBAA and Transport Canada in the feasibility studies, this new model introduced new risks. To mitigate those risks, both parties agreed that Transport Canada would audit the CBAA and that the CBAA would have a quality assurance program in place whereby it would audit its accredited auditors and operators.

The model as used (2008 Structure), however, contains none of these mitigation measures. Oversight is left primarily to the accredited auditors. The CBAA does not have a quality assurance program in place to verify the effectiveness of its accredited auditors or its member operators' systems. The current model consists of informal communications between the CBAA and its accredited auditors and operators during liaison visits and trade shows. Pairing an accredited auditor with insufficient SMS knowledge and an operator still following a traditional safety management scheme could allow the operator to take on unacceptable risks that will go undetected. Transport Canada has not ensured that the CBAA is fulfilling its responsibilities for oversight, therefore increasing the risk that safety deficiencies will not be identified.

Transport Canada had identified the need for effective regulatory oversight of CARs subpart 705 Air Operator Certificate holders implementing the new SMS requirements. The premise was that, if adequate compliance was not being assured by the operators in a reasonable time, a return to the more traditional regulatory oversight would be considered.

When it delegated the responsibility for CARs subpart 604 private operator certification to the CBAA, Transport Canada expected the CBAA to perform oversight functions including quality assurance monitoring of the POC audit program. If followed, this would have fulfilled Transport Canada's responsibility to ensure compliance with regulations and standards. However, since it began administering the POC program, the CBAA has been allowed to diverge from the recommendations of the feasibility studies and is not carrying out any quality assurance of its operators' SMS. Transport Canada identified this as a deficiency. However, when an unacceptable corrective action plan was presented by the CBAA, Transport Canada closed its assessment without documenting its rationale.

2.7 Summary

In this occurrence, a flight crew with low experience on a new and larger aircraft type was dispatched to an aerodrome known for its multiple hazards on a day of strong gusty winds. Because the crew members had operated to this destination frequently, they were comfortable with completing the flight. They flew the same profile they had flown on previous flights without taking into consideration the greater EWH of the Global 5000 aircraft, or following the manufacturer's recommended procedures for flight profile and handling techniques. These deviations from recommended procedures increased crew workload and reduced the TCH safety margin. The crew members were unable to clearly judge their height, and did not recognize that they were too low.

It would be expected that a company that had operated one aircraft under a POC with a functioning SMS for a period of three years would have a good understanding of a proactive risk assessment process. However, the process used by Jetport for the introduction of the Global 5000 was inadequate and did not identify some of the associated risks. Although the Jetport SMS program had been accepted by the CBAA–accredited auditor, in reality, Jetport did not have a functioning SMS. The traditional, reactive safety management process that was in place did not identify many of the risks involved.

Because the CBAA lacked a quality assurance program for its audit process, it was unable to identify either the limited appreciation of SMS on the part of the accredited auditor or the deficiencies in the operator's SMS.

Through its assessment process, Transport Canada had identified deficiencies in the CBAA's management of the POC process, including the limited oversight of the CBAA–accredited auditors and the lack of a functioning quality assurance component. While Transport Canada initially rejected the CBAA's proposed corrective action plan and no revision was produced, the assessment was closed out without any documentation of the process. Had Transport Canada required mitigating action on the part of the CBAA, there would have been an opportunity to identify deficiencies in Jetport's SMS through the audit process.

SMS is a powerful, modern concept. It is also proving to be a useful and practical tool. However, its success is reliant upon an effective transition away from the traditional and prescriptive way that safety has been managed in the past. It also requires the development of an appropriate balance between the responsibilities of the regulator, the operator, and (in this instance) the delegated agency. This balance has not been established for CARs subpart 604 operations.

3.1 Findings as to Causes and Contributing Factors

1. The crew planned a touchdown point within the first 500 feet of the runway to maximize the available roll-out. This required crossing the threshold at a height lower than the manufacturer's recommended threshold crossing height (TCH).
2. The flight crew members flew the approach profile as they had done in the past on the smaller Bombardier Challenger 604 (CL604), with no consideration for the Global 5000 greater aircraft eye-to-wheel height (EWH), resulting in a reduced TCH.
3. The abbreviated precision approach path indicator (APAPI) guidance, although not appropriate for this aircraft type, would have assured a reduced main landing gear clearance of eight feet above threshold. At 0.5 nm, the pilot flying (PF) descended below the APAPI guidance, further reducing the TCH.
4. The pilot used the wing-low crosswind technique, increasing his workload and resulting in pilot-induced oscillations.
5. Both pilots' low experience on the Global 5000, combined with the PF's high workload, affected their ability to recognize the unsafe approach path and take appropriate corrective action.
6. With the aircraft in a low energy state, the pitch up to 10.6° without an associated thrust increase could not correct the flight profile, resulting in the impact with the sloped surface before the runway threshold.
7. The impact with the sloped surface initiated a sequence resulting in the collapse of the right main gear, a loss of directional control, the eventual departure from the runway surface, substantial damage to the aircraft, and some injuries.
8. Contrary to the manufacturer's recommended practices, Jetport's standard operating procedures (SOPs) sanctioned descent under electronic or visual glide slope guidance, with a view to extending the landing distance available as acceptable and good airmanship; this contributed to the aircraft landing short of the runway.
9. The lack of an effective transition from traditional safety management to a functional safety management system (SMS) as required by Jetport's private operator certificate (POC) prevented an adequate risk assessment of the introduction of the Global 5000 into its operations and contributed to the accident.
10. An inappropriate balance of responsibilities for oversight between the regulator, its delegated agency, and the operator resulted in Jetport's inadequate risk assessment not being identified.

3.2 Findings as to Risk

1. Because aircraft EWH information is not readily available to pilots, crews may continue to conduct approaches with an aircraft mismatched to the visual glide slope indicator (VGSI) system, increasing the risk of a reduced TCH safety margin.
2. Due to limited knowledge of the various VGSI systems in operation and their limitations, flight crews will continue to follow visual guidance that might not provide for safe TCH.
3. Jetport did not develop an accurate company risk profile. This precluded identification of systemic safety deficiencies and development of appropriate mitigation strategies.
4. If adequate safety oversight of POC operators is not maintained by the regulator, or the delegated organization, especially during SMS implementation, there is an increased risk that safety deficiencies will not be identified.
5. The fact that the Canadian Business Aviation Association (CBAA) did not insist that milestones for SMS implementation and development be followed may result in some POC operators never reaching full SMS compliance.
6. If Transport Canada does not ensure that the CBAA fulfills its responsibilities for adequate oversight of the Canadian Aviation Regulations (CARs) subpart 604 community, safety deficiencies will not be identified and addressed.
7. The audit of Jetport's SMS, conducted by the CBAA–accredited auditor, did not identify the deficiencies in the program or make any suggestions for improvement. Without a comprehensive audit of an operator's SMS, deficiencies could exist resulting in the operator's inability to implement an effective mitigation strategy.
8. Contrary to the recommendations made in the Transport Canada/CBAA feasibility studies, the CBAA did not have a quality assurance program for its audit process. As a result, there is a risk that the CBAA will fail to identify weaknesses in the POC audit program.
9. At the time of the accident, no one at Fox Harbour (CFH4) had been assigned responsibility for regular maintenance of the APAPI, therefore preventing timely identification of APAPI equipment misalignment.
10. Jetport's risk analysis before the introduction of the Global 5000 did not identify the incompatibility between the EWH of the aircraft and the APAPI at CFH4.
11. Not wearing shoulder harnesses during landings and take-offs increases the potential risk of passenger injuries.
12. Passengers not wearing footwear could impede evacuation, increase the risk of injury, and reduce post-crash mobility and (potentially) survival.

3.3 Other Findings

1. A SMS integrates sound risk management policies, practices, and procedures into day-to-day operations and, properly implemented, offers great potential to reduce accidents.
2. Contrary to its own assessment protocol, Transport Canada did not document its decision to close off the CBAA assessment even though the CBAA had not submitted an acceptable corrective action plan.
3. Depiction of the different types of VGSIs differs, depending on the publication.

4.1 Action Taken

4.1.1 Action Taken by the Transportation Safety Board of Canada

On 26 November 2007, the TSB issued Aviation Safety Information Letter A07A0134-D1-L1 (APAPI Installation at Fox Harbour, Nova Scotia) to Transport Canada. This letter contained preliminary information indicating that the abbreviated precision approach path indicator (APAPI) installation might not have been appropriate for the occurrence aircraft.

On 04 April 2008, the TSB issued Aviation Safety Advisory A07A0134-D1-A1 (Flight Crew Awareness of Visual Glide Slope Indicator System Limitations) to Transport Canada. The safety advisory indicated that Transport Canada may wish to review pilot training requirements with a view to making flight crews aware of the limitations of visual glide slope indicator (VGSI) systems and their impact on the safety of flight for different aircraft types.

On 04 April 2008, the TSB issued Aviation Safety Advisory A07A0134-D2-A1 (Availability of Aircraft Eye-to-Wheel Height Information) to Transport Canada. The safety advisory indicated that Transport Canada may wish to review the requirements to have aircraft eye-to-wheel height (EWH) information available for use by flight crews in aircraft publications.

Transport Canada has acknowledged receipt of Aviation Safety Information Letter A07A0134-D1-L1 and indicated that it will wait for the TSB to complete its analysis of the issues so that any related safety deficiencies would be better understood.

Transport Canada has published excerpts of Aviation Safety Advisory A07A0134-D1-A1 and A07A0134-D2-A1 in the 1/2009 issue of the publication Aviation Safety Letter (TP 185).

4.1.2 Action Taken by Fox Harbour Management

Fox Harbour Development Limited has decommissioned the APAPI for Runway 33 and replaced it with a precision approach path indicator (PAPI) 2 system, suitable for aircraft with EWH up to 25 feet.

Fox Harbour Development Limited has displaced the threshold of Runway 33 by 88 feet. The Restricted Canada Air Pilot (RCAP) approach plates will be amended to reflect the new distances available for landing and for take-off.

4.1.3 Action Taken by Bombardier

Bombardier amended the Operations Reference Manual (ORM) to better explain the crabbed approach technique, and has stated that it is creating a presentation, to be available on the web, that explains the effects of increased wing sweep during crosswind landings.

Bombardier has informed the TSB that EWH information will be published in the BD-700 type aircraft Flight Crew Operating Manual (FCOM), for use by flight crews.

4.1.4 Action Taken by Transport Canada

In November 2007, the responsibility for providing oversight of the Canadian Business Aviation Association (CBAA) was transferred from the Standards Branch to the National Operations Branch. In February 2008, a project manager was deployed to the National Operations Branch to develop and implement an oversight program of the CBAA. In January 2009, this person was appointed as the Chief of the Airlines Division in the National Operations Branch and continued to have overall responsibility for oversight of the CBAA. To assist, two operations inspectors were assigned directly to CBAA oversight responsibilities.

Following a review of the private operator certificate (POC) program on 11 March 2009, Transport Canada considered the findings of the assessment it conducted and originally closed on 21 September 2007 to have not been fully addressed. Transport Canada has taken steps to ensure the CBAA takes action to properly address outstanding findings.

In April 2009, Transport Canada initiated meetings, to be held monthly, between its inspectors and the CBAA to review occurrences and safety reports with a view to monitoring the CBAA's management of safety information, adherence to its processes and procedures, and follow-up of cases requiring corrective action.

4.1.5 Action Taken by the Canadian Business Aviation Association

The CBAA undertook an internal review of the POC program in 2008 to identify areas beyond the scope of the 2007 Transport Canada assessment that could be subject to revision or amendment. As a result of that process, recommendations were made to improve certain areas. In keeping with those recommendations, the following changes have been implemented.

The CBAA has amended Part 2 of the Business Aviation Operational Safety Standards (BA-OSS) to eliminate ambiguities regarding audit frequency and to clarify where an updated risk profile is required and whether an audit, including a partial audit, is required. The requirement for a recurrent audit within one year from the initial certification audit has been added. These amendments also describe the process and procedure for determining POC validity based on audit requirements. In addition, the POC Program Manual (Section III, Audit Procedures) has been amended to describe how an audit for cause is convened and managed.

The CBAA reported having implemented changes to its accredited auditor program in the area of auditor oversight. It has adopted a quality assurance framework for the POC program, which has been documented in the POC Program Manual by adding a new section (Section IV, POC Program Quality Assurance (QA) Framework). This section describes CBAA's procedures for its Witness Audit program. The CBAA reports having established a procedure for monitoring the quality of the CBAA POC program to provide assurance that audit activities are standardized and audit policies and procedures are uniformly applied.

4.2 Action Required

4.2.1 Availability of Eye-to-Wheel Height Information

Knowledge of aircraft EWH is necessary to assess whether a visual glide slope indicator (VGSI) system is appropriate for the aircraft type being flown. In this occurrence, the EWH information for the Global 5000 was not available. Therefore, the crew members could not have assessed whether the VGSI was appropriate for their aircraft type.

The investigation also determined that many pilots are not aware of the EWH of the aircraft they operate. Furthermore, the topic of EWH is rarely addressed in any type of pilot training.

Without EWH information, crews will not be able to assess the appropriateness of the VGSI system they are using.

Therefore, the Board recommends that:

4.2.2 Knowledge of Visual Glide Slope Indicator System Limitations

The occurrence crew was not aware of the limitations of the VGSI system in use at the Fox Harbour aerodrome (CFH4). The investigation determined that this crew was not an exception. While most pilots are aware that different VGSI systems are in use, they are not aware of their limitations, nor are they aware of the fact that some VGSI systems may be inappropriate for a given type of aircraft.

This lack of awareness can lead pilots to rely on VGSI guidance that is unsuitable for the aircraft type they are operating. Without training to improve crew awareness of this issue, there continues to be an unacceptable level of risk to crews and the traveling public.

Therefore, the Board recommends that:

4.2.3 Oversight

In considering the transfer of regulatory responsibilities, Transport Canada and the CBAA had identified a number of risks in their initial joint studies. To address these risks, the proposed approach included designing a set of performance-based rules directly linked to an operator's safety management system (SMS). Recognizing that oversight of operators would still be required upon assuming regulatory responsibility, the CBAA would have to audit for operator compliance with the rules and standards, and develop and maintain a quality assurance program for its audit processes.

While the studies had charted a plan to mitigate the risks, it was not followed. At the time of the Fox Harbour accident, the CBAA did not participate in, or observe, audits of its POC holders and did not have a quality assurance program in place. This allowed deficiencies in Jetport's SMS to go unnoticed. Moreover, the CBAA did not believe that it could force its operators to comply with the requirements of the BA-OSS and, as such, did not insist on milestones for SMS development and implementation.

Since the inception of this new approach to regulating the Canadian Aviation Regulations (CARs) subpart 604 operators, Transport Canada did not exercise effective oversight of the CBAA, its accredited auditors, or POC holders. It did not have a program established to observe or participate in audits conducted by the CBAA's accredited auditors to verify that this new approach was meeting its safety objectives.

In its assessment in 2007, Transport Canada found that the CBAA POC program lacked the required quality assurance program. Yet, an acceptable corrective action plan to address the issue was never submitted. In spite of this, the assessment was officially closed by Transport Canada.

Since the Fox Harbour accident, the CBAA has amended its manuals to include a quality assurance framework for its POC program. Its Witness Audit program, implemented in 2009, allows CBAA staff to observe an accredited auditor during the conduct of audits. Observations are de-briefed with the individual auditors and systemic observations are used for auditor training and education and for determining program improvements. While this program seems promising, it is too early to judge its effectiveness.

Transport Canada has also taken some steps to improve its oversight of the CBAA POC program, including revisiting the findings of its 2007 assessment.

However, the Board believes that more needs to be done, specifically:

• It is imperative that the CBAA set milestones for SMS development and implementation, and insist they be met by its POC holders.
• The CBAA needs to ensure that comprehensive audits of its operators' SMS are done to ensure that deficiencies are identified and effectively mitigated.
• The CBAA needs to develop and implement an effective quality assurance program for its audit process.
• Transport Canada needs to exercise effective supervision of the CBAA to ensure adequate oversight of CARs subpart 604 operators.

If effective oversight of POC holders is not exercised by the regulator, or its delegated organization, there is an increased risk that safety deficiencies will not be identified and properly addressed.

Therefore, the Board recommends that:

In addition, the Board recommends that:

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 23 September 2009.

Appendix A – Touchdown Points

1. Aircraft on final approach
2. Impact point (-7.5 feet)
3. Touchdown point if APAPI 3° slope was followed and aircraft not flared (213 feet)
4. Planned touchdown area and main area of tire rubber deposits from other landings (129 to 500 feet)
5. APAPI units (480 feet)
6. Manufacturer recommended touchdown point (1000 feet)
7. Final aircraft position (1017 feet)

Appendix B – Flight Data Recorder Approach Data

Appendix C – Wreckage Path

1. Impact point (-7.5 feet)
2. Start of scrape marks caused by outboard and centre canoe fairing (140 feet)
3. Start of scrape marks caused by inboard canoe fairing (170 feet)
4. Left main landing gear crosses centreline (457 feet)
5. APAPI units (480 feet)
6. Ground scar caused by right wing (600 feet)
7. Right main landing gear departs runway (640 feet)
8. Air conditioning units for condominiums (893 feet)
9. Final aircraft position (1017 feet)
10. Condominium units
11. Hangar

Appendix D – Fox Harbour Aerodrome Canada Flight Supplement Information

Appendix E - Visual Glide Slope Indicators

Appendix F – Canadian Business Aviation Association Audit Report Form

Appendix G – Jetport Company Risk Profile

Appendix H – List of TSB Laboratory Reports

The following laboratory reports were completed:

• LP123/2007 – FDR/CVR Analysis
• LP131/2007 – Accelerometers Testing C-GXPR

These reports are available from the Transportation Safety Board of Canada upon request.

Appendix I – Glossary

AFM

aircraft flight manual

agl

above ground level

ALAR

Approach-and-Landing Accident Reduction

ALD

actual landing distance

AOBN

Airbus Operational Briefing Note

APAPI

abbreviated precision approach path indicator

ARCAL

aircraft radio control of aerodrome lighting

asl

above sea level

ATS

air traffic services

BA-OSS

Business Aviation Operational Safety Standards

CAP

Canada Air Pilot

CAP GEN

Canada Air Pilot general pages

CARs

Canadian Aviation Regulations

CASO

Company Aviation Safety Officer

CBAA

Canadian Business Aviation Association

CFH4

Fox Harbour aerodrome

CFS

Canada Flight Supplement

CL604

Bombardier Challenger 604

CVR

cockpit voice recorder

EGPWS

enhanced ground proximity warning system

ELT

emergency locator transmitter

EWH

eye-to-wheel height

FBO

fixed-base operator

FCOM

Flight Crew Operating Manual

FDR

flight data recorder

FMS

flight management system

FOBN

Flight Operations Briefing Note

FSO

Flight Safety Officer

ft

feet

GNSS

global navigation satellite system

GPS

global positioning system

ICAO

International Civil Aviation Organization

IMO

International Maritime Organization

in

inches

in Hg

inches of mercury

ISA

International Standard Atmosphere

Jetport

Jetport Inc.

LFL

landing field length

METAR

aviation routine weather report

MHz

megahertz

msl

mean sea level

N

north

nm

nautical miles

NPA

Notice of Proposed Amendments

N1

low pressure compressor rpm

Ops Spec

operations specification

ORM

Operations Reference Manual

OSH

occupational safety and health

PAPI

precision approach path indicator

PF

pilot flying

PNF

pilot not flying

POC

private operator certificate

PPC

pilot proficiency check

QA

quality assurance

QRH

Quick Reference Handbook

RCAP

Restricted Canada Air Pilot

RCMP

Royal Canadian Mounted Police

RNAV

area navigation

rpm

revolutions per minute

SARPs

Standards and Recommended Practices

SID

standard instrument departure

sm

statute miles

SMS

safety management system

SOPs

standard operating procedures

TCH

threshold crossing height

TP

Transport Canada publication

UNICOM

universal communications

VASIS

visual approach slope indicator system

VGSI

visual glide slope indicator

VHF

very high frequency

VPTH

vertical path

Vref

landing reference speed

W

west

°

degrees

°C

degrees Celsius

°M

degrees magnetic

′

minutes