Aviation Investigation Report A15Q0120

The float-equipped de Havilland DHC-2 Mk. 1 Beaver (registration C-FKRJ, serial number 1210), operated by Air Saguenay (1980) inc., was on a visual flight rules sightseeing flight in the region of Tadoussac, Quebec. At 1104 Eastern Daylight Time, the aircraft took off from its base on Lac Long, Quebec, for a 20-minute flight, with 1 pilot and 5 passengers on board. At 1127, on the return trip, approximately 2.5 nautical miles north northwest of its destination (7 nautical miles north of Tadoussac), the aircraft stalled in a steep turn. The aircraft descended vertically and struck a rocky outcrop. The aircraft was substantially damaged in the collision with the terrain and was destroyed by the post-impact fire. The 6 occupants received fatal injuries. No emergency locator transmitter signal was captured.

Ce rapport est également disponible en français.

1.1 History of the flight

Air Saguenay (1980) inc. (Air Saguenay), in partnership with Aviation du Fjord and in collaboration with Croisières AML, had been conducting sightseeing flights in the region of Tadoussac, Quebec, departing from Lac Long, Quebec, for 3 years.^{Footnote 1} Air Saguenay operated the aircraft, while Aviation du Fjord handled ticket sales and flight monitoring.

Flights usually lasted about 20 minutes and consisted of a loop during which the aircraft would fly over the Saguenay–St. Lawrence Marine Park, which is a whale‑watching site (Appendix A), and then over the mouth of the Fjord du Saguenay before turning inland to allow tourists to observe the region's topography, flora, and, occasionally, wildlife.

On the morning of the accident, at about 0800,^{Footnote 2} at the Lac Long water aerodrome, the pilot carried out pre-flight preparations for the first sightseeing flight, which was scheduled for 0900. The pilot did not report any discrepancies after carrying out these preparations.

The pilot completed 3 flights without incident before the occurrence flight. At about 1100, the 5 passengers boarded the floatplane. The pilot started the engine of C-FKRJ, leaving the dock at 1102 and taking off at 1104.

After takeoff, C-FKRJ climbed to 2000 feet above sea level (ASL), then headed south above the Saguenay–St. Lawrence Marine Park,^{Footnote 3} flying over this area from 1107 to 1116. It then passed above the mouth of the Fjord du Saguenay before turning north and leaving the restricted zone of the marine park (Figure 1).

C-FKRJ then descended to an altitude of approximately 1100 feet ASL, approaching hilltops with an elevation of about 1000 feet ASL. Just south of the town of Sacré-Cœur, Quebec, the aircraft turned toward the northeast and flew over the hills at about 100 feet above ground level (AGL) before turning back toward Lac Long. As the aircraft was flying over a hilltop at about 110 feet AGL, the pilot initiated a steep left turn. C-FKRJ stalled aerodynamically mid-turn, which caused the aircraft to enter an incipient spin. At 1127, the aircraft descended vertically and struck a rocky outcrop on top of a hill at 48°15.405′ N and 069°41.597′ W (Figure 2).

1.2 Injuries to persons

1.3 Damage to aircraft

The aircraft was destroyed in the collision with the rocky outcrop; the cabin was consumed by the post-impact fire.

1.4 Other damage

Approximately 106 litres (170 pounds) of fuel and approximately 24 litres of engine oil were spilled and consumed by the post-impact fire.

1.5 Personnel information

1.5.1 General

The pilot held the necessary licence and qualifications for the flight, in accordance with existing regulations. He obtained his private pilot licence in 2000 and acquired a float endorsement in June 2000. He obtained his commercial pilot licence in April 2001.

The pilot was hired as a bush pilot by Air Saguenay in 2001. He subsequently received training including familiarization training on the company's policies and procedures.

Air Saguenay considered the pilot to be dedicated, disciplined, and experienced. The company had appointed him assistant chief pilot. As such, his duties had included the role of flight instructor on the DHC-2 Mk. 1 (DHC-2) for about 10 years. He also participated in flight tests required for the external load operations specification. These tests included assessing the aircraft's stall characteristics in different conditions. As a result, the pilot would have been quite familiar with the DHC-2's stall behaviour in various conditions.

This was the pilot's second summer assigned to the Lac Long water aerodrome.

1.5.2 Training

In May 2015, the pilot completed his recurrent training, which included ground training and flight training. Following this training, the pilot successfully completed the theoretical exam and pilot proficiency check^{Footnote 4} for the DHC-2. During the proficiency check, administered by the company's chief pilot, the pilot successfully demonstrated the ability to execute manoeuvres such as slow flying, stall recovery, and 30° and 45° banked turns. Since the time of the recurrent training, the pilot had accumulated 310 flight hours, 117.6 of them in the 30 days preceding the accident.

1.5.3 Flight duty time and rest periods

After a rest period of 7 days, the pilot returned to work on 20 July 2015. With the exception of 11 August, the pilot flew every day up to and including 16 August. According to company documents, the pilot was to rest from 17 to 20 August in accordance with minimum regulatory rest periods, that is, 3 periods of at least 24 hours of rest per period of 30 consecutive days. Therefore, because no other pilot was available on 17 August, that day's sightseeing flights should have been cancelled. However, the information obtained indicates that the pilot involved in the accident completed 9 flights totalling 5.6 hours on 17 August.

The flight times for the flights completed on 17 August with C-FKRJ were not recorded in the aircraft journey logbook, as required by existing regulations,^{Footnote 5} or in the pilot's logbook. Moreover, these hours were not recorded in the flight-following log or flight duty time log.^{Footnote 6}

On 21 August, after 3 days of leave, the pilot completed a local flight from Sébastien Lake, Quebec. On the morning of 22 August, he returned to Lac Long, where he completed a number of sightseeing flights on 22 August and 23 August, the day of the accident.

The pilot had worked 27 of the preceding 30 days; his average flight duty time and flight time were 10.1 hours^{Footnote 7} and 4.4 hours^{Footnote 8} per day, respectively. A typical work day began around 0830 and ended around 1930. For the duration of his duty period, the pilot lived in a cottage at Lac Long provided by Air Saguenay. The pilot lived there alone. It was therefore not possible to obtain information on the pilot's sleep.

1.6 Aircraft information

The DHC-2 Mk. 1 Beaver (DHC-2) model was designed by de Havilland Aircraft of Canada Ltd., which began building these aircraft in the mid-1940s. The DHC-2 was specifically designed to be operated as a bush plane in Canada. The aircraft is equipped with simple systems and has a strong reputation for reliability in difficult conditions. There are currently 382 DHC-2s registered in Canada, 223 of which are used in commercial operations.

C-FKRJ had a single set of flight controls that could be pivoted to the left or right side of the cockpit. The aircraft was equipped with EDO 58-4580 floats in accordance with a type A-22 certificate (Figure 3).

On 03 June 2015, the engine was reinstalled on C-FKRJ after refurbishing, and on 03 August 2015, the aircraft underwent what is known as a "100-hour" periodic inspection. At the time of the accident, C-FKRJ had accumulated 71.7 hours since its last 100‑hour inspection and the engine had accumulated 171.4 hours of operation since being installed.

The last maintenance operation had been performed on 22 August 2015 in Baie‑Comeau, when a loose nut was tightened on the generator that had triggered the circuit breaker. This repair was recorded in the technical logbooks, and the maintenance release was completed.

There is nothing to indicate airframe failure or system malfunction during the flight.

1.6.1 Flight controls

The primary flight controls of the DHC-2 are conventional and consist of a control column and rudder pedals. C-FKRJ did not have a handwheel on the right side (that of the co‑pilot). However, it did have a control column, the upper portion of which includes the handwheel and can tilt from left to right. It is held in position by a bolt in the hinge (Figure 4). Tilting the handwheel in straight flight does not affect the aircraft's control or balance.

1.6.2 Weight and balance

The maximum authorized take-off weight was 5090 pounds. The weight and balance form for the flight could not be located; it may have been in the aircraft. To determine whether the aircraft's weight and balance could have affected C-FKRJ's flight characteristics and performance, the occupants' weight and the distribution of this weight on board the aircraft were estimated. To calculate the occupants' weight, investigators used the approved standard^{Footnote 9} summer weights.^{Footnote 10} The weight of the fuel was estimated based on typical refuelling practices before the first flight of the day. The TSB estimated the weight of the floatplane to be 4765 pounds on takeoff and 4705 pounds at the time of the accident.^{Footnote 11} Therefore, the floatplane would have been operated in compliance with the manufacturer's prescribed limits.

1.6.3 Emergency locator transmitter

The aircraft was fitted with an automatic fixed emergency locator transmitter (ELT) (Ameri‑King, model AK-451-20) transmitting on 406 MHz and 121.5 MHz. It had been installed just behind the baggage compartment on the right side of the aircraft and was completely consumed by the fire. Despite the major impact along C‑FKRJ's longitudinal axis, no ELT signal was received^{Footnote 12} by the Cospas-Sarsat system, and no signal was heard or reported during the search.

1.6.4 Ventral fin and stabilizer fins

C-FKRJ was equipped with stabilizer fins (Seafins)^{Footnote 13} from Kenmore Air Harbor Inc. (Kenmore), in place of a ventral fin, in accordance with the instructions of Supplemental Type Certificate (STC) SA456NW. Kenmore has sold several modification kits for the installation of Seafins on other DHC-2 aircraft belonging to Air Saguenay, but not for C‑FKRJ specifically.

The investigation found that the stabilizer with Seafins installed on C-FKRJ originated from another of the company's DHC-2s. However, C-FKRJ's technical logs do not contain any entries indicating that the original horizontal stabilizer was replaced by one with Seafins.

The investigation found that, despite some deficiencies that may have originated up to 20 years ago, recent records indicate that the aircraft was maintained in accordance with existing regulations and approved procedures.

1.6.4.1 History of ventral fin and stabilizer fins (Seafins)

Since the initial certification of the DHC-2 in 1948, there has been confusion about the obligation to install a ventral fin when the aircraft is equipped with floats; some wrongly believed that installation was optional (Appendix B). In some cases, the ventral fin was removed despite being required, and this reduced the directional stability of the aircraft. An in-depth study of the history of the ventral fin and Seafins was conducted (Appendix B). It can be summarized as follows:

• In Canada, the type certificate (A-22) includes a configuration on EDO 58-4580 floats with the ventral fin installed.
• The ventral fin is liable to damage during docking operations.
• Kenmore developed an STC^{Footnote 14} to replace the ventral fin with Seafins.
• Another STC^{Footnote 15} was issued to increase the maximum take-off weight from 5090 pounds to 5500 pounds. This STC includes the installation of larger floats (extended EDO 58‑4580, or EDO 679-4930) and Seafins. With this STC to increase maximum weight, the Seafins and the ventral fin must both be installed. Therefore, in this configuration, the Seafins do not replace the ventral fin.
• An accident occurred in Alaska, United States, when DHC-2 N345KA took off in conditions of strong winds caused by a passing front (winds of up to 35 to 40 knots were reported in the area). N345KA had been modified under STC SA92-63 (maximum weight increased to 5500 pounds) with the larger EDO 679-4930 floats. Seafins had been installed, and the ventral fin had been removed.
• Following this accident in the United States, the Federal Aviation Administration (FAA) questioned the directional stability and stall characteristics of the DHC-2 in certain conditions.
• In response to these questions, Transport Canada Civil Aviation (TCCA) concluded that in the approved configuration (with the Seafins as well as the ventral fin installed), the DHC-2 has sufficient vertical surface to ensure directional and lateral control during critical phases of flight.

The occurrence aircraft was equipped with EDO 58-4580 floats and had not been modified to increase its maximum take-off weight to 5500 pounds. Therefore, the replacement of the ventral fin with Seafins on C-FKRJ was in compliance with the requirements of Kenmore STC SA456NW.

1.6.5 DHC-2 stalling

The DHC-2 was designed and certified in accordance with the British Civil Airworthiness Requirements, published in 1945. The specific certification requirements regarding aircraft stall characteristics state that "as the stall is approached from straight flight, there shall be no violent wing dropping and no tendency to spin." In addition, "the aeroplane should give, by juddering or other means, clear warning of the approach to the stall from straight or turning flight." Aerodynamic indications were considered to be a clear sign of an impending stall.

The DHC-2 flight manual also indicates that in steep turns, load factors may reach the limit loads and increase the danger of an unintentional stall. The manual provides a table indicating the stall speed and corresponding load factor according to the aircraft's lateral angle of bank ( Figure 5).

According to the flight manual, "the stall is gentle at all normal conditions of load and flap and may be anticipated by a slight vibration." However, during a stall, "[i]f yaw is permitted, the aircraft has a tendency to roll." The pilot must immediately take corrective action to prevent the roll from developing.^{Footnote 16}

The flight manual also states that the DHC-2 stalls at 45 mph indicated airspeed (IAS) when flaps are in the landing position and at 60 mph IAS with raised flaps.

1.6.5.1 Flight tests

Aeronautical manufacturing companies have conducted flight tests on the DHC-2 to determine stalling characteristics following major modifications to wing structure, or in anticipation of such modifications. The results of these tests vary depending on the modifications made to the aircraft being tested. C-FKRJ had not undergone any such modifications.

Aeronautical Testing Service Inc.^{Footnote 17} conducted flight tests on an unmodified DHC-2 aircraft as part of the vortex generator design process for that aircraft type.

These tests evaluated the stall characteristics, stall warnings, and controllability of the stall in a variety of weight and balance configurations that were not specifically required by the original British Civil Airworthiness Requirements. The flight test report indicates that with a forward centre of gravity, as was the case for the occurrence aircraft, the stall characteristics of the aircraft were acceptable.

TCCA also conducted flight tests on the DHC-2 to evaluate the aircraft's stall characteristics. Flight test engineers described the stall as gentle and reported a conventional stall recovery.

1.6.6 Stall warning systems

A stall warning system that emits a visual and aural alarm is available for the DHC-2, in the form of a TCCA-approved modification set (MOD 2/973).^{Footnote 18} This system was not installed on C‑FKRJ.

1.7 Meteorological information

There is no weather station at Lac Long. According to witness statements, weather conditions in the area of the flight at the time of the accident were favourable for a visual flight, with clear skies and calm winds. The closest automatic weather station, located 10 nautical miles (nm) to the southeast (in the middle of the St. Lawrence River), reported calm winds and a temperature of 16 °C at the time of the flight. At 1100, the aviation routine weather report at Bagotville Airport (CYBG),^{Footnote 19} Quebec, reported an easterly wind of 4 knots (calm), visibility of 25 statute miles, a few clouds at 3000 feet and a cirrostratus layer covering one fourth of the sky at 26 000 feet, and a temperature of 21 °C.

1.8 Aids to navigation

One of the items used by the pilot to navigate the area of the flight was a personal global positioning system (GPS).

According to the data recorded by the GPS, C-FKRJ followed essentially the same path as that of the preceding flights. The aircraft routinely flew over the Saguenay–St. Lawrence Marine Park (Appendix A) at the prescribed altitude before beginning its descent in the direction of Sacré-Cœur and then returning to Lac Long.

1.9 Communications

The accident flight took place in uncontrolled airspace, that is, airspace with no air traffic control (ATC) services. The aircraft's radio was working normally at the time of takeoff. Communications were transmitted on 123.2 MHz. The pilot usually made 3 radio calls during a flight: before takeoff, during the initial ascent, and on approach.

During the accident flight, the pilot communicated his intention to take off from Lac Long. Then, once on the flight, he stated his intention to climb to 2000 feet in the direction of the Saguenay–St. Lawrence Marine Park, flying over the area of Gobeil Lake, Quebec. This was the aircraft's last known transmission. The pilot did not report any problems before the accident.

1.10 Aerodrome information

The Lac Long water aerodrome is located 4.6 nm north-northeast of Tadoussac and was the meeting point for customers who wanted to go on sightseeing flights in the region.

1.11 Flight recorders

The aircraft was not equipped with a flight recorder, either for flight data (flight data recorder) or for cockpit conversations (cockpit voice recorder), and existing regulations did not require one.

1.12 Wreckage and impact information

After colliding with the rocky outcrop, the aircraft caught fire and the cabin was destroyed by the post-impact fire (Figure 6). Because there were no survivors or witnesses, and given the destructive nature of the fire, it was not possible to collect evidence of the source of the fire, the fuel spill, or the propagation of the fire.

The DHC-2's main fuel tanks are located directly under the passenger cabin floor, between the main landing gear attachment points. This location makes the fuel tanks highly vulnerable in the event of an accident, such as landing gear penetration, and places the occupants within the flame front of a fuel-fed fire should ignition occur. As well, large, current-carrying direct-current cables, which are routed in the lower fuselage alongside the fuel tanks, provide an effective electrical ignition source if they are damaged by the impact.

The wreckage was positioned vertically, nose down. The belly of the aircraft was leaning against a rocky outcrop. The engine had separated from the aircraft under the force of the impact and was found about 8 m downhill. The propeller was still attached to the engine and was substantially damaged. Both blades were bent and twisted; one had broken off and was found under the wreckage.

During the aircraft's descent, the propeller had left 6 gashes in a tree at equal intervals of about 81 cm before contacting the ground. The wings were on the ground, with the right wing between 2 trees that were close together. The aircraft had not damaged the branches of these trees. The marks on the ground and the absence of damage to surrounding vegetation are consistent with a vertical descent.

1.12.1 TSB laboratory examination

C-FKRJ was examined at the accident site and again at the TSB Engineering Laboratory in Ottawa, Ontario, in the presence of a representative from Viking Air Limited (Viking), which is the holder of the type certificate, as well as a representative from Air Saguenay.

1.12.1.1 Flight control continuity

The various flight control circuits in the cabin were damaged by the force of the impact and by the post-impact fire. However, it was possible to establish the continuity of the elevator and rudder controls and of almost all the flap and aileron controls. Some components of the interior portion of the right aileron controls^{Footnote 20} and flap controls located in the cabin ceiling were destroyed in the post-impact fire. Due to the damage caused by the fire, it was not possible to determine the position of the flaps at the time of impact. The investigation did not reveal any anomalies that may have hindered the normal operation of the flight control system.

The damage observed on the hinge bolt and on the flight control column are consistent with what would have been caused by forward deformation with the control wheel in the left‑hand position (pilot side) at the moment of impact.

1.12.1.2 Extraction of global positioning system data

The GPS^{Footnote 21} belonging to the pilot was found at the accident site and sent to the TSB Engineering Laboratory to extract the flight data.^{Footnote 22} The GPS memory contained data for the 20 flights completed beginning on 17 August 2015. The GPS recorded the date, time, position, and altitude every 5 seconds.

1.12.1.3 Analysis of global positioning system data

The raw GPS data was analyzed to determine the precise trajectory of the occurrence flight's final turn and compare it with those of the preceding flights (sections 1.16.1 and 1.16.2, below).

1.12.1.4 Extraction of non-volatile memory data

A smartphone, a digital audio player, a digital camera, and a Secure Digital memory card were found at the accident site. The smartphone password was not known, so the data could not be extracted. Fire damage made it impossible to extract the data from the other devices.

1.12.1.5 Examination of instruments

Examination of the flight instruments was limited by the extent of the damage caused by the force of the impact with the ground and the post-impact fire.

The tachometer dial was charred and the needle was stuck at 3750 revolutions per minute (rpm). In the absence of witness marks, there was nothing to indicate whether the needle had been in this same position at the time of impact (Section 1.12.1.6, below).

The vertical speed indicator needle showed a rate of descent of 980 feet per minute. However, this instrument's inherent sensitivity means that needle movement is subject to rapid fluctuation when travel perpendicular to the aircraft's longitudinal axis occurs at the time of impact. Therefore, the position of the needle does not necessarily indicate the rate of descent immediately prior to impact.

The airspeed indicator needle was broken, with the part of the needle connected to the gear system found at a position equivalent to 68 mph. The precarious condition of the remaining mechanism made it impossible to definitively determine the speed of the aircraft at the time of impact. However, the position of the needle was in the possible speed range of the start of a recovery following an incipient spin.

1.12.1.6 Propeller examination

The examination of the propeller did not reveal any anomalies that could have indicated abnormal performance.

The propeller gashed a tree 6 times immediately prior to impact, which suggests that the engine was producing power at that time. TSB laboratory calculations estimated the engine speed at 1160 rpm, indicating that the engine would have been at low power immediately prior to impact. However, in the absence of a flight data recorder, it was not possible to quantify the level of power.

1.13 Medical and pathological information

An examination of the pilot's TCCA medical records did not reveal any medical factors that could have affected his performance.

An autopsy and toxicological tests were performed on the body of the pilot. The forensic pathologist determined that the cause of death was multiple blunt trauma. In other words, the pilot's death was caused by injuries received during the accident. The autopsy also revealed an atherosclerotic coronary heart disease^{Footnote 23} that could have caused a medical event.^{Footnote 24}

1.14 Fire

The post-impact fire had completely destroyed the cabin of the aircraft before rescuers arrived.

1.15 Survival aspects

The ground attendant in charge of ticketing attempted unsuccessfully to contact the aircraft when the duration of the flight had exceeded the normal flight time. The lack of communication could, however, have been explained by the line-of-sight range limits of radio waves when an aircraft flies at low altitude.

Once the aircraft was more than 30 minutes overdue, the attendant informed Air Saguenay, and the company activated emergency procedures. Air Saguenay dispatched 2 aircraft to Lac Long to begin the search and notified the Halifax Joint Rescue Coordination Centre (JRCC) that C‑FKRJ was missing.

At 1317, a CC-130 Hercules airplane was dispatched to the scene, and at 1321, a CH-146 Griffon helicopter was assigned to the rescue mission.

At about 1330, the 2 Air Saguenay aircraft located the wreckage of C-FKRJ, and its position was relayed to JRCC Halifax.

At 1430, the CC-130 flew over the accident site.

At 1510, the CH-146 arrived on site.

At 1517, the first rescuers^{Footnote 25} arrived on the scene of the accident. They found no survivors.

Inside the aircraft, the livable space was eliminated by the forces of impact, and all occupants died instantly. The accident was not survivable. The intense post-impact fire destroyed all seats, seatbelts, and their anchor points.

1.16 Tests and research

1.16.1 Analysis of final turn before accident

The raw data recorded every 5 seconds by the GPS were used to calculate C‑FKRJ's trajectory during its final turn. The calculation made it possible to determine C-FKRJ's position at every second and thus to establish the aircraft's angle of bank at the moment control was lost.

Calculations indicate that the aircraft began its last turn at 1126:49 at an altitude of 1120 feet ASL, that is, approximately 110 feet AGL (Figure 7). The increase in the aircraft's angle of bank reduced the radius of the turn from 400 feet to 275 feet. At the start of the turn, the airspeed of the aircraft increased from 73 mph to 85 mph, as the angle of bank also increased.

The aircraft's airspeed then gradually slowed to 60 mph, with an angle of bank of approximately 50° in mid-turn.^{Footnote 26} During the turn, its altitude increased by approximately 40 feet and, taking into account the variations in the terrain elevation around the top of the hill, the aircraft was approximately 175 feet above the accident site when it stalled aerodynamically. It collided with the ground at 1127:07.

1.16.2 Analysis of previous flight paths

The analysis of the GPS data^{Footnote 27} indicates that the occurrence flight path was substantially similar to that of the pilot's 20 most recent sightseeing flights (Figure 8). The data showed that the pilot regularly flew at low altitudes, sometimes making steep turns after flying over the wildlife reserve. For example, the 4 flights made on the day of the accident proceeded over Sacré-Cœur and then over a hill at low altitude (between 45 and 136 feet AGL).

Six days prior to the accident (on 17 August 2015), the pilot had flown at low altitude 12 times, with 8 of those overflights occurring above the accident site, where there had been sightings of a family of bears (Figure 9). When turning, C-FKRJ was at an altitude of between 150 and 350 feet AGL, its airspeed was between 56 and 74 mph, and its angles of bank were between 16° and 45°.

Generally, flaps are used in manoeuvres (turns) around a point of interest on the ground. However, GPS data do not allow aircraft configuration during recorded flights to be determined. Therefore, the stall margin was calculated based on C-FKRJ's angle of bank and stall speed without flaps. It is important to note that these calculations can only be used for the purposes of comparing turns, because it is impossible to determine the precise stall margin of each turn without knowing the position of the flaps. The calculations showed that the pilot regularly flew at speeds below the stall speed without flaps during low-altitude turns.

1.16.3 TSB laboratory reports

The TSB completed the following laboratory reports in support of this investigation:

• LP199/2015 – NVM [non-volatile memory] Recovery - GPS
• LP200/2015 – NVM Recovery – SD [Secure Digital] Card
• LP201/2015 – NVM Recovery – iPhone
• LP202/2015 – Flight Control Continuity
• LP203/2015 – Propeller Examination
• LP204/2015 – Instrument Examination

1.17 Organizational and management information

1.17.1 Air Saguenay (1980) inc.

Air Saguenay operates several types of floatplanes, including the DHC-2, under subparts 2 and 3 of Part VII of the Canadian Aviation Regulations (CARs). These aircraft are operated out of its main base, located on Sébastien Lake, as well as out of secondary bases, including Lac Long.

According to the company's flight operations manual (FOM), the operations manager must authorize all flights prior to departure via the flight follower. Flight authorization is granted when the pilot-in-command has determined, among other things, that the flight can be made in accordance with the CARs. The operations manager then delegates control of the flight's operation to the pilot-in-command but remains responsible for all flights.^{Footnote 28}

Aerial sightseeing flights^{Footnote 29} from Lac Long over the Tadoussac region and the Saguenay–St. Lawrence Marine Park are sightseeing operations^{Footnote 30} governed by Subpart 3 of Part VII of the CARs.

The FOM does not contain restrictions associated with sightseeing flights or prescribe a minimum flying altitude. However, the obligation to comply with the CARs includes requirements relating to the obstacle clearance margin for daytime visual flight rules (VFR) flights. This margin is 300 feet AGL (Section 1.18.1.1, below).

Air Saguenay uses a self-dispatch system: pilots are solely responsible for preparing for, planning, and executing their flights. Pilots must ensure that flights are conducted in accordance with current regulations and the procedures prescribed by the FOM. They must determine the feasibility of a flight and develop a navigation plan. The route is chosen based on the aircraft's performance, as well as on topography, obstacles, and weather conditions.

Air Saguenay uses a Type D flight following system, which involves monitoring a flight's progress and notifying search-and-rescue authorities if the flight is overdue or missing. The pilot-in-command is responsible for flight following. During sightseeing flights, the ticket agent at Lac Long follows flights by monitoring the pilot's radio communications at takeoff and landing.

When ground personnel realized that C-FKRJ was overdue, unsuccessful attempts were made to communicate with the aircraft by radio. Once the aircraft was 30 minutes overdue, the ticket agent notified Air Saguenay that the aircraft was missing, and the company activated the FOM procedures.^{Footnote 31}

1.17.1.1 Flight time, flight duty time, and rest periods

The FOM essentially re-states the flight time and flight duty time limits of the CARs. Therefore, according to the FOM,

[translation] a) All pilots must keep the company informed of their flight time and flight duty time by keeping form 8.9 up to date.

b) Form 8.9 must be completed every day and submitted to the company's person responsible for flight time and flight duty time. This log enables the company to monitor the flight time, flight duty time, and rest periods of all pilots.^{Footnote 32}

According to paragraph 3.13.1a) of the FOM,

[translation] it is prohibited for the company to assign flight time to a pilot, and for pilots to accept the assignment, if the pilot's total flight time on the flights that he or she has completed would exceed […] 120 hours in 30 consecutive days as a result […].^{Footnote 33}

However, the company had received the necessary operating instructions to increase this flight time limit to 150 hours per period of 30 consecutive days up to a maximum of 6 times in a 365-day period.^{Footnote 34}

Also according to the FOM, the company must grant 3 periods of at least 24 hours of rest per period of 30 consecutive days.^{Footnote 35} An examination of the company's records showed that, between 19 July 2015 and 16 August 2015, the pilot took only 1 day of leave, on 11 August 2015. The company had therefore granted the pilot regulatory leave from 17 to 20 August.

Regulatory requirements that limit flight time and flight duty time and prescribe minimum rest periods are the most basic line of defence against crew fatigue.^{Footnote 36}

1.17.1.2 Operations safety management

All organizations have an obligation to manage the risks associated with their air operations. At minimum, risk management consists of

• recognizing and reporting hazards;
• identifying and choosing measures to mitigate these hazards;
• assigning responsibility for managing these measures; and
• measuring and monitoring the effectiveness of measures and established control methods.^{Footnote 37}

After assessing the risks and operational requirements of the sightseeing flights at Lac Long, Air Saguenay adopted measures to minimize the risks associated with these flights:

• Aircraft were chosen based on their performance in the flight conditions.
• Only experienced pilots were assigned to these flights.
• Meteorological criteria requiring flights to be suspended were clearly stated.

Air Saguenay operated its aircraft under subparts 702 and 703 of the CARs. Operators subject to these subparts are not required to implement a safety management system (SMS). Therefore, Air Saguenay was not required to incorporate a formal SMS. However, in May 2011, the company voluntarily developed an SMS based on TCCA guidelines for activities subject to Subpart 705 of the CARs.

1.17.2 Transport Canada Civil Aviation regulatory oversight

The TCCA surveillance program "verifies that enterprises are complying with regulatory requirements and that they have effective systems in place to ensure they comply with regulatory requirements on an on-going basis."^{Footnote 38} The program includes "assessments, program validation inspections (PVIs), and process inspections."^{Footnote 39}

The TSB examined the surveillance activities conducted by TCCA and the company's responses over the 6 years preceding the occurrence.

Following an accident in July 2010, TCCA conducted a PVI from 09 to 20 August 2010 to ensure that the company had implemented effective policies, processes, and procedures to respect the regulatory requirements. According to the PVI report, "[translation] Following the analysis of all findings, it was determined that there was no systemic deficiency in the control system."^{Footnote 40}

From 17 to 27 November 2014, TCCA conducted a PVI on operational control and the maintenance quality assurance program. Because no SMS was required by regulation, the company's SMS was not subject to Transport Canada's surveillance and inspections and the PVI did not take it into account. However, the company's SMS reports were examined during the PVI and led to a finding regarding flight time limits.

The revised version of the PVI report included 4 "moderate findings"^{Footnote 41} related to operational control, one of which was on flight time limits. Air Saguenay objected to this finding because it had already implemented corrective measures through its SMS. Although TCCA did not agree to withdraw the finding, it approved the corrective measures in September 2015.

Following the accident in question, TCCA conducted a process inspection of Air Saguenay's maintenance control system; however, no flight operations surveillance activity was undertaken.

Because the CARs do not contain an operating standard for sightseeing flights specifically, the regulatory oversight conducted by TCCA could not identify deficiencies associated with flights of this type.

1.18 Additional information

1.18.1 Low-altitude manoeuvres

Poor weather conditions and the terrain surrounding some lakes can sometimes force bush pilots to fly at low altitudes and along rivers, valleys, lakes, and coasts. In such situations, pilots may be required to perform manoeuvres at the aircraft's performance limits in order to achieve the objectives of this type of flight.

Low flying

Flying at low altitude is generally considered hazardous^{Footnote 42}: the field of view is more limited and the background landscape can conceal obstructions if it does not provide sufficient contrast. There is therefore a greater risk of collision with cables and other structures. Because unmarked cables are difficult to see, such collisions can occur above flat terrain, at very low altitudes, and in favourable weather conditions. In addition, in the event of engine failure, floatplane pilots have very little time to initiate the emergency procedure, choose a lake, and perform an emergency landing on water.

According to the CARs, "no person shall operate an aircraft […] at a distance less than 500 feet from any person, vessel, vehicle, or structure."^{Footnote 43} However, the portions of C-FKRJ's flights that were conducted at low altitude were mainly over hills and forests. When there is no person, vessel, vehicle, or structure, in an operation under Subpart 3 of Part VII of the CARs, "no person shall operate an aircraft in VFR flight […] during the day, at less than 300 feet AGL or at a horizontal distance of less than 300 feet from any obstacle."^{Footnote 44}

1.18.1.1.1 Turns around an object of interest

In some circumstances, pilots may decide, for various reasons, to fly over a point of interest on the ground. If their attention is fully captured by the observation of the object on the ground, pilots may neglect airspeed control, banking control, and the increased load factor. These conditions are conducive to a stall or a spiral dive.

In order to observe an object from a low altitude, the aircraft must bank steeply at low speed, whereas at a higher altitude, the same observation would be possible with a low angle of bank at a higher speed. It should be noted that it is easy to overestimate the actual speed when an aircraft is flying at a low altitude with a tailwind, because the ground speed appears to be fast. In this situation, the pilot may tend to reduce speed until the aircraft stalls.

1.18.1.1.2 Illusions created by drift

Winds were calm at the accident site. Therefore, there were no illusions created by drift^{Footnote 45} during the final low-altitude turn.

1.18.1.3 Turning below pivotal altitude

During low-altitude turns, pilots' senses may be deceived by the illusion associated with flying below pivotal height.^{Footnote 46} Pivotal height is the height at which, from the pilot's perspective, the extension of the the aircraft's lateral axis appears as a stationary point on the ground. This altitude is calculated based on the angle of bank and the radius of turn (Figure 10).

During turns at normal altitudes, above pivotal height, the extension of the aircraft's lateral axis moves in the opposite direction over the ground. From the pilot's perspective, the lower wingtip appears to be moving backward over the ground (Figure 11).

When turns are made below pivotal height, the lower wingtip moves forward over the ground in the same direction as the aircraft. If the pilot focuses on a point on the ground near the centre of the turn, it may seem that the lower wingtip is moving faster than usual, which may prompt the pilot to apply rudder toward the inside of the turn. If the speed is close to the stall speed, this rudder input may cause the lower wing to stall, leading to an incipient spin (Figure 12).

In this accident, C-FKRJ initiated a turn at approximately 110 feet AGL, whereas the pivotal height for the turn was 328 feet AGL.^{Footnote 47}

1.18.1.1.4 Steep turn

The greater the angle of bank, the greater the aerodynamic lift required to maintain a constant altitude. As an illustration, Figure 13 compares various turn radii and the levels of risk that they pose at various speeds for a small aircraft. The figure shows the extent to which the radius of the turn is reduced simply by decreasing speed and increasing the angle of bank to 45°. It also shows that the risk of stalling increases as the turn radius decreases.

1.18.1.2 Loss of control during flight

1.18.1.2.1 Aerodynamic stall

A stall is a loss of lift and an increase in drag that occurs when an aircraft is flying at an angle of attack greater than the angle that provides maximum lift. Regardless of airspeed, an aircraft always stalls when its wings reach this critical angle of attack.^{Footnote 48}

Stall speed varies depending on factors such as weight, power, flap position, and angle of bank. If the other factors are constant, stall speed is higher when the load factor is increased, following either a sudden manoeuvre or a steep turn. Therefore, the greater the angle of bank, the higher the stall speed.

All professional pilots are aware of the dangers of stalling: an almost complete loss of control of the aircraft's trajectory and, because of the loss of lift, a high rate of descent. In addition, recovering from a stall generally requires losing altitude. To prevent the majority of problems associated with this dangerous aspect of flying, the pilot must have an immediate, clear indication that stalling is imminent: immediate because it is urgent, and clear in order to prevent any possibility of mistaking the impending stall for another type of event.

1.18.1.2.2 Incipient spin

An incipient spin occurs when an aircraft stalls and one wing produces more lift than the other. Because the descending wing is at a greater angle of attack, it stalls even further and has more drag, which triggers an autorotation. During this phase of the incipient spin, the flight path changes from horizontal to vertical.^{Footnote 49}

Generally, even if the pilot takes the necessary measures to stop the autorotation as soon as it begins, the aircraft is in a vertical position while accelerating rapidly, and a high altitude is necessary to regain a horizontal flight path (Figure 14). If the autorotation continues, the aircraft could stabilize in a spin, spiralling downward.

1.18.1.2.3 Slow flying

Slow flying can be defined as the range of speeds between the aircraft's maximum endurance airspeed and the speed immediately above stall speed. The following characteristics are associated with aircraft behaviour and operation during slow flight:

• higher nose-up attitude;
• low flight control authority;
• light control forces;
• heightened secondary effects of flight controls and engine; and
• loss of stability around axes.

On this subject, the DHC-2 flight manual indicates that it is possible to maintain full control of the aircraft at 75 mph IAS with flaps in cruising position, and at 65 mph IAS with flaps in landing position.^{Footnote 50}

1.18.1.3 Preventing loss of control during flight

1.18.1.3.1 Training on DHC-2 stall characteristics

Flight training conducted at Air Saguenay at the start of the season includes stall exercises. In straight and level flight, or in a shallow turn, the aircraft's speed is reduced gradually until the stall point is reached. The aircraft is so docile that the pilot lacks elevator control, which can lead to a full aerodynamic stall. The signs of an impending stall occur clearly and progressively so that the pilot has ample time to avoid the stall.

However, as with a number of other aircraft, a stall in a steep turn under power triggers an incipient spin with few or no signs of impending stall. Despite this, flight training does not include stalling in a steep turn under power. Stall training that does not address all flight conditions (including steep turns under power) has been cited as a risk factor in a number of TSB investigation reports.^{Footnote 51}

1.18.1.3.2 Angle-of-attack indicator systems

The General Aviation Joint Steering Committee (GAJSC) is a group that aims to improve general (recreational) aviation safety. In April 2011, the GAJSC directed its Safety Analysis Team (SAT) to conduct a review of fatal general aviation accidents from 2001 through 2010. The SAT reviewed 2472 fatal general aviation accidents and found that 1259 of these were caused by loss of control during flight.

Loss of control, primarily stalling, accounts for approximately 40% of fatal accidents.^{Footnote 52} In light of these data, the GAJSC/SAT formed a working group with the goal of finding, analyzing, and developing solutions to prevent this type of accident.

Among the working group's many recommendations was the use of an
angle of attack–based system. A visual indication of the angle of attack improves pilot awareness of the situation when the aircraft is approaching a critical angle of attack. Pilots can therefore better avoid an aerodynamic stall even with a high workload or an external distraction. Such systems provide continuous visual information on the stall margin at all times, regardless of attitude, airspeed, or power.

In response to the GAJSC report, the FAA took concrete measures to facilitate the installation of angle-of-attack indicator systems on board general aviation aircraft. The FAA then published an information letter and issued recommendations on the installation of angle‑of‑attack indicator systems and their use and related training, specifically targeting maintenance providers, pilots, aircraft owners, flight instructors, flight schools, and training centres.^{Footnote 53}

In 2016, loss of control during flight in general aviation was included on the U.S. National Transportation Safety Board (NTSB) "Most Wanted List" as a priority for improving aviation safety. According to the NTSB, 47% of fatal accidents from 2008 to 2014 were caused by loss of control in flight (1210 deaths). Some of the common causes of loss of control identified by the NTSB were pilot inattention due to workload, distractions, or reduced alertness. These losses of control are particularly deadly when aircraft are close to the ground and the time and altitude available to recover from a stall are limited. One of the proposed solutions is the use of angle-of-attack indicator systems.

In Canada, an STC is required to install angle‑of‑attack indicator systems on certified aircraft, such as the DHC-2.

1.18.1.3.3 Stall warning systems

A stall warning system is a device that provides a clear, distinctive stall warning to the pilot and that is independent of the pilot's recognition of inherent aerodynamic qualities near the stall, such as buffeting.

Following flight tests completed as part of the DHC-2 certification process in the 1940s, it was determined that aerodynamic indications constituted a clear warning of an impending stall. As a result, there was no requirement at that time for a stall warning system, and none was installed on board C-FKRJ after the aircraft was certified.

In August 2008, following an August 2007 accident in Alaska,^{Footnote 54} the FAA sent 5 recommendations regarding DHC-2 aircraft to TCCA. One of these reiterated that the DHC-2 had originally been certified without a stall warning system and that this was still not required. The FAA recommended^{Footnote 55} that stall warning systems be installed on DHC-2s.

TCCA responded that this was a good recommendation, but that stall warning systems were unlikely to be installed on existing DHC-2s without a regulatory amendment.

Since 1998, the TSB has published 12 investigation reports on accidents involving DHC-2s that are not equipped with a stall warning system and that stalled and crashed (Appendix C).

In October 2013, in the conclusion of Aviation Investigation Report A12O0071, the TSB included a safety concern indicating that the DHC-2's buffeting does not provide pilots with adequate warning of an impending stall.

The TSB also noted the high frequency of accidents caused by aerodynamic stalls and the catastrophic consequences of these accidents when stalls occur at low altitude during critical phases of flight.

Level of risk is determined by the probability and severity of adverse consequences. Given the number of accidents in conjunction with their catastrophic consequences, DHC-2 stalls at low altitude carry a high level of risk.

According to TCCA, the DHC-2's stall characteristics are acceptable and allow pilots sufficient time to recognize an impending stall and take appropriate measures to avoid it.

However, TCCA issued a Civil Aviation Safety Alert (CASA)^{Footnote 56} entitled "Installation in DHC‑2 Aeroplanes Not Originally Equipped of [sic] an Artificial Stall Warning System" in July 2014. The purpose of this CASA was to provide information on the safety benefits of stall warning systems and recommended that

all DHC-2 aeroplane owners incorporate Artificial Stall Warning System MOD 2/1605,^{Footnote 57} or other Approved Artificial Stall Warning System [and,] where possible, all owners and operators install an Artificial Stall Warning System in aeroplanes not originally equipped as such.^{Footnote 58}

Viking Air Limited, the current holder of the DHC-2 type certificate, has designed an optional modification to the de Havilland MOD 2/973 stall warning system that provides a visual and aural warning of an impending stall. This modification also improves the visual alarm by placing it in a more visible position on the dashboard.

In late June 2014, Viking Air Limited published a technical bulletin recommending that stall warning systems be installed or enhanced on all DHC-2s via MOD 2/973.

1.18.2 Flight monitoring

Air Saguenay management did not have a method of monitoring flights in real time, and there was no process for evaluating the manner in which a flight had been conducted. However, current regulations do not require this level of flight monitoring.

Pilots were evaluated based on their overall performance and during proficiency checks. Customers were invited to provide feedback after a flight. Following this occurrence, it became apparent that Air Saguenay management was not aware of the pilot's practice of making steep turns at low altitudes.

On several occasions, the TSB's accident investigations involving various organizations have found that management was not aware that an employee or instructor was deviating from existing regulations or company policies. For example, TSB Aviation Investigation Report A09Q0065 revealed that, without management's knowledge, the instructor had been flying much lower than authorized by company policy. As well, Aviation Investigation Report A12W0031 found that, on tour flights, the pilot flew exclusively over relatively gentle terrain. However, the pilot had been a passenger on a filming flight for a television show and was likely influenced by this positive experience, during which the aircraft was flown close to steep, rugged terrain.The company was not aware that the pilot had made any route changes on tour flights.

Given the combined accident statistics for operations under CARs subparts 702, 703, and 704, there is a compelling case for industry and the regulator to proactively identify hazards and manage the risks inherent in these operations. To manage risk effectively, they need to know why incidents happen and what the contributing safety deficiencies may be.

Moreover, routine monitoring of normal operations can help these operators both improve the efficiency of their operations and identify safety deficiencies before they result in an accident.

1.18.2.1 Lightweight flight data recording and flight data monitoring systems

The development of lightweight flight data recording systems presents an opportunity to extend flight monitoring to smaller operations. This technology as well as flight data monitoring (FDM) will allow these operations to monitor activities such as compliance with standard operating procedures, pilot decision making, and adherence to operational limitations. FDM will also allow operators to identify problems in their operations and take corrective actions before an accident occurs. There is no CARs requirement for lightweight flight data recording systems to be installed on aircraft.

In the event of an accident, recordings from lightweight flight data recording systems would provide useful information that would better facilitate the identification of safety deficiencies in the investigation.

The Board acknowledges that issues remain to be resolved to facilitate the effective use of recordings from lightweight flight data recording systems, including questions about the integration of this equipment in an aircraft, human resource management, and legal issues such as the restriction on the use of cockpit voice and video recordings. Nevertheless, given the potential of this technology combined with FDM to significantly improve safety, the Board believes that no effort should be spared to overcome these obstacles.

Therefore, in the investigation into an accident that occurred in March 2011,^{Footnote 59} the Board recommended that

In August 2013, Transport Canada (TC) held discussions intended to identify obstacles and barriers to FDM.

In February 2014, TC supported the recommendation and planned to draft an advisory circular to describe recommended practices regarding FDM programs.

In November 2015, TC agreed that FDM would enhance aviation safety in Canada. However, TC has not produced an advisory circular, and its revised proposed activity is to prepare an issue paper and revisit the risk assessment on FDM.

In its January 2017 response, TC indicates its renewed proposal to conduct a focus group in 2017, which it has been planning to do since 2013. However, until the focus group reaches conclusions as to the challenges and benefits associated with the installation of lightweight multi-function recording devices in small aircraft, and TC provides the TSB with its plan of action moving forward following those conclusions, it is unclear when or how the safety deficiency identified in Recommendation A13-01 will be addressed.

Therefore, the response to Recommendation A13-01 is assessed as Unable to Assess.

While TC has proposed some further study of the safety issue, no concrete actions are being taken to address the TSB recommendation. The TSB is therefore concerned that this could lead to protracted delays as observed on numerous other recommendations.

1.18.2.2 Safety management system

Transportation companies have a responsibility to manage safety risks associated with their operations. An SMS provides the necessary framework for this, and many companies implement a formal SMS, either voluntarily or to comply with CARs requirements.^{Footnote 60} Even small businesses must follow safety procedures in order to manage risks.

The TSB has repeatedly emphasized the benefits of an SMS. When implemented properly, an SMS allows companies to manage risks effectively and enhances the safety of their operations.

1.18.2.2.1 TSB Watchlist

Safety management and oversight will remain on the TSB Watchlist until

• Transport Canada implements regulations requiring all commercial operators in the air and marine industries to have formal safety management processes and effectively oversees these processes;
• transportation companies that do have SMS demonstrate that it is working—that hazards are being identified and effective risk-mitigation measures are being implemented; and
• Transport Canada not only intervenes when companies are unable to manage safety effectively, but does so in a way that succeeds in changing unsafe operating practices.

The Watchlist identifies the key safety issues that need to be addressed to make Canada's transportation system even safer.

Safety management and oversight is a Watchlist 2016 issue.

This Watchlist issue was addressed in the TSB investigation report on an accident that occurred in May 2013.^{Footnote 61} The report noted that approximately 90% of all Canadian aviation certificate holders are still not required by existing regulations to have an SMS, and that TC does not have assurance that these operators are able to manage safety effectively. The report highlighted the need for TC to adapt its approach to regulatory oversight to the competence of the operator.

Consequently, in the conclusion of Aviation Investigation Report A13H0001, this Watchlist issue was formalized in the following recommendations to the Department of Transport:

1.18.2.3 Oversight of sightseeing flights

Because of the number and concentration of sightseeing flights in the United States, the NTSB has long been concerned by the frequency of accidents involving flights of this type. Systemic factors specific to the operation of sightseeing flights noted during 2 accident investigations in 1994 prompted the NTSB to conduct a special investigation into this type of air operation.^{Footnote 62}

In June 1995, the NTSB published the special investigation report "Safety of the Air Tour Industry in the United States." The report raised the possibility of a minimum flight altitude. The NTSB concluded that "[t]he Safety Board supports the premise of operating at an altitude no lower than that which will allow sufficient time for the pilot to select a suitable landing site and prepare the aircraft and passengers for an emergency landing."^{Footnote 63}

In 1996, a group of air tour operators in the United States set up the Tour Operators Program of Safety (TOPS) with the goal of improving helicopter tour flight safety. To become members of the organization, operators must implement safety measures and operating standards above and beyond regulatory requirements and submit to an annual audit.

Among the required operating standards are limits on the attitude and angle of bank^{Footnote 64} of aircraft, as well as a minimum flight altitude of 500 feet AGL: "These standards include avoiding any perception of a thrill ride, aerobatics, nap of the earth flying or unnecessary abrupt maneuvers."^{Footnote 65}

In February 2014, a review of aviation safety concerns regarding sightseeing flights^{Footnote 66} in the United States was published, reporting significant progress on a number of concerns noted in the 1995 NTSB report and subsequent investigations. However, the review noted that the issue of minimum flying altitudes has not been fully resolved due to variations in topography, restrictions related to weather conditions, and the concentration of flights at similar altitudes.

The review found that the accident rate of some air tour industry segments was similar to the accident rate of those aviation industry segments that are recognized as being more dangerous, including helicopter emergency medical flight services. The review concluded that

[e]xposing air tour patrons and pilots to the elevated crash rates normally associated with "high hazard" flight during recreational and occupational activities that occur in visual meteorological conditions is unacceptable, and stakeholders in the air tour industry should continue to work together to reduce this unnecessary risk.^{Footnote 67}

1.19 Useful or effective investigation techniques

Not applicable.

The pilot was qualified to conduct the flight in accordance with existing regulations and had received the training required by Transport Canada Civil Aviation (TCCA). Although an examination of the pilot's medical records did not reveal any factors that may have affected his performance, an autopsy showed that he had substantial coronary atherosclerosis.

The investigation found that the aircraft was functioning normally during the flight and at the time of the accident. Examination of the wreckage and various components did not reveal any signs of airframe failure, flight control problems, abnormal flap operation, loss of engine power, or in-flight fire.

The aircraft was operating in favourable visual flight conditions, with calm winds and a clear sky. There is no indication that weather conditions contributed to this occurrence.

A vertical path with a lack of forward speed is consistent with an aerodynamic stall leading to an incipient spin. These findings, together with the examination of the data from the pilot's global positioning system (GPS), appear to indicate that the aircraft stalled in a steep left turn, initiated at approximately 110 feet above ground level (AGL). The stall would therefore have occurred at an altitude at which it was impossible to regain control of the aircraft before the collision with the terrain.

Therefore, this analysis will focus on the pilot's health as well as on low‑altitude manoeuvres, flight monitoring, loss of control during flight, and prevention of loss of control.

2.1 Pilot's health

To determine the effect of the pilot's health on the flight, investigators examined the flight data and markings left by the aircraft at the accident site. They looked for indications of abnormal behaviour by the pilot in handling the aircraft.

Analysis of the GPS data determined that the floatplane followed essentially the same flight path, both vertically and horizontally, as the preceding flights. This suggests that the pilot was in full command of his faculties until the final turn. The floatplane then stalled in a steep turn. The very nature of a stall in such circumstances would have sent the aircraft into an incipient spin. However, an examination of the site indicated that the collision with the terrain occurred when the aircraft was nose down in a vertical path without rotation. Based on these facts, it can be concluded that the pilot must have stopped the autorotation by pressing the right rudder pedal prior to impact.

For these reasons, based on the information collected, investigators determined that there was no indication of the pilot experiencing a physiological event at the time of the accident. This conclusion is supported by the GPS data and the examination of the accident site.

2.2 Low-altitude manoeuvres

The regulator is aware of the potential risks that pilots take when flying at low altitudes. For flights conducted under Subpart 3 of Part VII of the Canadian Aviation Regulations (CARs), it is prohibited to operate an aircraft under daytime visual flight rules (VFR) at less than 300 feet AGL.^{Footnote 68}

It is also recognized that low-altitude flying reduces the safety margin in the event of engine failure, loss of control, or other unforeseen circumstances, while increasing the risk of collision with the terrain. That being said, low-altitude flying may be justified in certain circumstances.

However, the terrain surrounding Lac Long, Quebec, did not require any particular low‑altitude manoeuvre for takeoffs and landings. In addition, during sightseeing flights, the pilot was obligated to fly over the Saguenay–St. Lawrence Marine Park at no less than 2000 feet above sea level (ASL). Because the terrain elevation under the path that these flights normally follow is at most 1000 feet ASL, the prescribed altitude of 2000 feet ASL ensures a terrain clearance margin of at least 1000 feet ASL, if maintained outside the park boundaries.

As well, these sightseeing flights necessarily took place in weather conditions conducive to visual flight, so that passengers could observe whales, and did not require low‑altitude manoeuvres.

It was determined that the pilot had regularly been flying at low altitudes and making steep turns close to the ground on preceding flights. Although it was not possible to determine the exact stall margin during these turns with an unknown flap position, data analysis showed that in a number of turns, C-FKRJ's airspeed was lower than the stall speed without flaps. Because these turns were made below 300 feet AGL, and the pilot would therefore have had very little altitude within which to react in the event of a loss of control of the aircraft, it can be concluded that the safety margin was reduced to near the absolute limit.

It is possible that, during his time as a bush pilot, the pilot had often been inclined to perform manoeuvres close to the ground. This suggests that, in the absence of a specific company rule on minimum flight altitude, the pilot set his own threshold for a minimum safe altitude during these flights. It is likely that the pilot either accepted the level of risk involved in these low‑altitude manoeuvres or was unaware of it. In either case, the pilot performed manoeuvres with a reduced safety margin at low altitudes. As a result, these flights involved a level of risk that was unnecessary to attain the objectives of sightseeing flights.

2.3 Flight monitoring

These sightseeing flights would appear to present few risks: by their very nature, they are conducted in good weather conditions with no operational or time constraints that would require low-altitude manoeuvres.

In principle, operations managers are to ensure the safety of operations. In practice, they may not necessarily have all the tools they need in order to do so. This is why the company's flight operations manual (FOM) reminds pilots that they are solely responsible for conducting flights and that they must ensure this is done in compliance with existing regulations and the procedures set out in the manual.

2.3.1 Flight data monitoring and lightweight flight data recording systems

Air Saguenay (1980) inc. (Air Saguenay), like most companies of its size, has no means of directly monitoring how flights are carried out. The company was therefore unaware that C‑FKRJ was not being piloted in accordance with existing regulations.^{Footnote 69} It was also unaware that the pilot's flying practices involved a level of risk that was unnecessary to attain the goals of these sightseeing flights.

Given that the occurrence aircraft was not equipped with a flight recorder, company management did not have access to flight data that would show whether operating limits were being respected.^{Footnote 70} Although the company had not established operating standards for sightseeing flights, a flight‑monitoring system or post-flight monitoring system would have enabled management to detect low-altitude manoeuvres.

The development of lightweight flight data recording systems makes it possible to broaden the level of surveillance through flight data monitoring (FDM), in particular to ensure compliance with company procedures and adherence to operational limits. In addition, the presence of a lightweight flight data recording system on board can have a positive influence on pilot behaviour. Monitoring these data allows operators to identify operational discrepancies and take corrective measures before an accident occurs. If lightweight flight data recording systems are not used to closely monitor flight operations, there is a risk that pilots will deviate from established procedures and limits, thereby reducing safety margins.

The TSB has previously recognized that monitoring systems and FDM have the potential to help operators proactively identify safety deficiencies before they cause an accident. But although affordable devices are available, installing them in an aircraft requires special certification, which can make the implementation process costlier and more complex. For this reason, the Board made a recommendation aimed at eliminating barriers to the implementation of FDM and the installation of lightweight flight data recording systems by commercial operators that are still not required to equip their aircraft with such systems.

Transport Canada (TC) supported this recommendation but has not delivered on its commitments to produce an advisory circular and establish a consultation program. Although TC has proposed a more in-depth analysis of this safety issue, it has taken no concrete action to put the TSB's recommendation into practice. If TC does not take concrete measures to facilitate the use of lightweight flight data recording systems and FDM, operators may not be able to proactively identify safety deficiencies before they cause an accident.

2.3.2 Monitoring of flight time, flight duty time, and rest periods

The pilot's work schedule met regulatory requirements, which would normally ensure a minimum amount of rest and recuperation. However, the pilot had worked on a scheduled rest day the week before the accident and had therefore not received the rest time required by regulation. Given that regulatory requirements for minimum rest time are considered the most basic line of defence against fatigue, it is vital that pilots be able to use these periods. If pilots do not obtain at least the regulatory rest periods, there is a risk that flights will be conducted when pilots are fatigued.

An examination of the pilot's work records showed that during sightseeing flight operations at Lac Long, the pilot made on average 9 flights per day, which represents 4.4 flying hours in a working day of 10.1 duty hours.

It was not possible to obtain sleep data for the occurrence pilot, so a thorough analysis of fatigue could not be completed. However, because the pilot was living at Lac Long during his work periods, it was possible for him to obtain sufficient rest between flight duty periods. In addition, the pilot had taken 3 days' leave the week before the accident. The pilot had therefore had the opportunity to obtain sufficient rest prior to the occurrence, and it is unlikely that the pilot was fatigued at the time of the occurrence.

The flight and flight-duty hours worked on 17 August were not recorded in the aircraft's journey logbook and the flight-time monitoring logbook. This contributed to the following:

• inaccurate monitoring of the pilot's flight hours; and
• inaccurate monitoring of the inspection schedules for the aircraft and its components.

As a result, company management was no longer in a position to effectively manage the pilot's flight time and rest periods. Unless all flights made are recorded in the pilot's logbook and monitored by the company, it is possible that the pilot will not receive the required rest periods, which increases the risk of flights being conducted when the pilot is fatigued.

In addition, the company's maintenance service was unable to monitor C-FKRJ's flying hours, as required by regulation. If flights made are not recorded in the aircraft's journey logbook, it is possible that inspection and maintenance schedules and component lifetimes will be exceeded, increasing the risk of failure.

2.3.3 Safety management systems

Low-altitude manoeuvres to reach lakes in mountainous regions or for flights in unfavourable weather conditions are a normal part of bush flying.

Air Saguenay worked toward implementing a safety management system (SMS), even though an SMS is not required by regulation for operators subject to Subpart 703 of the CARs. However, implementing an SMS is a challenging process, requiring a company to transform its culture of compliance into one of safety hazard management.

This transformation is all the more difficult for a bush plane company with neither the personnel nor the organizational structure of other air carriers. For this reason, TCCA, which advocates the use of an SMS for the entire aviation industry, could reasonably be expected to provide these organizations with information on the concept of safety management and facilitate the implementation of an SMS.

However, TCCA neither evaluates nor verifies a voluntarily implemented SMS. As a result, Air Saguenay's SMS was not evaluated or subject to a surveillance activity by TCCA during the most recent program validation inspection (PVI).

Investigations into this accident and other recent occurrences underscore that operators must effectively manage safety risks. Although many companies, including Air Saguenay, have recognized the benefits of having an SMS and have voluntarily begun implementing them within their organizations, current regulations still do not require approximately 90% of all Canadian aviation certificate holders to have an SMS.^{Footnote 71} Over 10 years after the introduction of the first SMS regulations for air operators and aircraft maintenance companies, SMS implementation seems to have stagnated.

As a result, TCCA has no assurance that these operators are able to detect and mitigate risks.

Accordingly, through the TSB Watchlist and recommendations,^{Footnote 72} the Board has emphasized the fact that unless an SMS is required, assessed, and monitored by TC in order to ensure continual improvement, there is an increased risk that companies will not be able to effectively identify and mitigate the hazards involved in their operations.

2.3.4 Oversight of sightseeing flights

Because of the number and concentration of sightseeing flights in the United States, the risks associated with these flights have been recognized for nearly 25 years. These risks include

• low-altitude flying;
• steep turns; and
• complex manoeuvres at low altitude, as in thrill rides.

It is conceivable that the desire to provide passengers of sightseeing flights with a memorable flying experience may prompt some pilots to fly too close to terrain and perform unnecessary, abrupt manoeuvres. To reduce these risks, U.S. operators specializing in sightseeing flights have adopted operating standards that exceed regulatory requirements.

In Canada, the frequency and geographical concentration of sightseeing flights are much lower. To date, there is no association of sightseeing flight operators in the country. As a result, it is up to each individual operator to develop and implement standards for reducing the risks involved in sightseeing flights.

Air Saguenay had not introduced any specific standard for pilots conducting sightseeing flights and was not required to do so. Air Saguenay pilots, like those of most sightseeing flight operators, were therefore free to fly according to their own limits, taking into account flying conditions and their interpretation of existing regulations.

Analysis of the flight paths of preceding flights showed that the pilot regularly flew at low speed during low-altitude turns. Therefore, it is reasonable to conclude that, over time, the pilot's personal limit had been approaching the absolute limit of the aircraft's performance.

In addition, the available data showed that the pilot always respected the prescribed altitude above the wildlife reserve. It was only outside the marine park zone, where the company had not set a minimum altitude above the CARs limit of 300 feet AGL, that the pilot flew at low altitudes. It is therefore reasonable to conclude that, with no restrictions on manoeuvres and no minimum altitude prescribed by the company prior to flight, the pilot flew according to his own limits and made a steep turn at approximately 110 feet AGL.

2.4 Loss of control during flight

After flying over the Saguenay–St. Lawrence Marine Park, the pilot initiated a descent that took the aircraft over terrain at low altitude while returning to Lac Long. Toward the end of the flight, the pilot initiated a steep turn at approximately 110 feet above a hill of partially bare rock. Previously reported observations of wildlife suggest that the purpose of the manoeuvre was to observe a family of bears.

It was during this turn that the floatplane stalled aerodynamically, causing an incipient spin. Circumstances suggest that the increased load factor generated by the turn, possibly combined with the illusion associated with flying below the pivotal height, caused the left wing to stall. It should be noted, however, that stalling does not necessarily lead to an accident if it occurs at an altitude sufficient for control to be regained before a collision with the terrain. In this case, the pilot made a steep left turn, and an aerodynamic stall ensued, causing an incipient spin at an altitude insufficient to allow control of the aircraft to be regained prior to vertical collision with the terrain (Figure 15).

2.5 Preventing loss of control during flight

In low-altitude flight, stalling followed by an incipient spin—no matter how brief—does not allow the pilot to regain control of the aircraft prior to collision with the terrain. It is therefore vital to give flight control input before the incipient spin occurs. As this accident demonstrates, even pilots with considerable experience may be unable to recover from a stall if they do not recognize the warning signs.

When the DHC-2 was certified in 1948, the aerodynamic buffeting that occurs immediately before a stall was shown to constitute a clear, distinctive stall warning. Since that time, certification standards have evolved, and a stall warning system is now required for the certification of new aircraft.

The stalling of the DHC-2 in controlled conditions has been described as gentle and its stall recovery as conventional. However, as is the case with a number of other aircraft, stalling in a steep turn under power causes an incipient spin with few or no signs that a stall is imminent.

2.5.1 Flight training on stalling in the DHC-2

The purpose of flight training is to improve safety by not placing pilots in risky situations before they are adequately prepared. Air Saguenay's flight training on stalls is provided in a controlled environment where pilots can see that

• significant and deliberate effort is required to reach the DHC-2's stall point under controlled conditions of gradual deceleration; and
• buffeting is a clear sign of an impending stall.

In a steep turn under power, however, the warning signs of an impending stall are much more subtle and allow the pilot almost no time to react before control is lost when the aircraft enters an incipient spin. It is likely that C-FKRJ showed very few signs of the impending stall as it was banking above the hilltop. Flight training does not include stalling exercises in steep turns under power.

As part of his experience as an instructor, the pilot regularly performed stall exercises in controlled conditions. Therefore, it cannot be ruled out that flight training had boosted the pilot's confidence concerning gentle stall characteristics that are not consistent with the aircraft's behaviour in a steep turn under power. Although the pilot was aware of the more abrupt stall characteristics in a steep turn, annual training did not provide representative contextual experience that could have helped him avoid the loss of control. If pilots do not receive stall training that demonstrates the aircraft's actual behaviour in a steep turn under power, there is a high risk of loss of control. In addition, if the loss of control occurs close to the ground, the pilot may not have sufficient altitude to regain control of the aircraft before colliding with the ground—as in this accident.

2.5.2 Impending-stall indicator or warning system

Oversight, flight monitoring, and pilot training are administrative measures that reduce the risks associated with loss of control. However, these measures alone are insufficient to prevent accidental losses of control.

In Canada, 13 incidents (including this accident) have resulted from DHC-2 aerodynamic stalling since 1998. In October 2013, the TSB issued a safety concern indicating that buffeting in the DHC-2 does not provide pilots with adequate warning of an impending stall.^{Footnote 73}

Risk analysis based on the likelihood and severity of adverse consequences indicates that stalling of the DHC-2 at low altitude involves a high level of risk.

Given the number of DHC-2s registered in Canada, it is possible to conclude that there is a risk of this type of accident recurring. It is therefore reasonable to examine devices that could prevent some of these accidents by increasing pilots' situational awareness so that they can act in time to prevent loss of control of the aircraft.

There are several types of on-board systems that provide a continuous indication of the stall margin. Some of these have alarms, and some simply provide a clear, unambiguous warning of an impending stall.

2.5.2.1 Angle-of-attack indicator

One of the solutions proposed by the U.S. National Transportation Safety Board (NTSB) to reduce the number of accidents involving loss of control in general aviation is the use of angle-of-attack indicator systems. Such systems provide continuous visual information on the stall margin—regardless of attitude, airspeed, or power. In addition, some of these systems generate a visual, aural, or even tactile alarm prior to a stall. This information increases pilot awareness so that loss of control can be avoided. Angle-of-attack indicator systems have been recognized as contributing to flight safety by improving pilot awareness of the stall margin at all times, thereby allowing pilots to react in order to prevent loss of control of the aircraft.

2.5.2.2 Stall warning system

Stall warning systems are one of the last lines of defence against accidental stalls, providing an aural and sometimes visual signal of an impending aerodynamic stall. TCCA and Viking Air Limited (the manufacturer) have recommended that these systems be installed on DHC‑2s. Stall warning systems have been recognized as a means of improving flight safety by providing a clear, unambiguous warning of an impending stall.

2.5.2.3 Conclusion

Angle-of-attack indicator systems provide better situational awareness of the stall margin, and stall warning systems alert pilots to an impending stall.

Despite the pilot's experience and the fact that he was a DHC-2 instructor, he did not notice the impending stall during a steep turn close to the ground, and he lost control of C‑FKRJ, which was not equipped with an indicator or warning system of any kind. It is reasonable to conclude that the absence of an angle-of-attack indicator system or impending stall warning device deprived the pilot of the last line of defence against loss of control of the aircraft.

3.1 Findings as to causes and contributing factors

1. The pilot performed manoeuvres with a reduced safety margin at low altitudes. As a result, these flights involved a level of risk that was unnecessary to attain the objectives of sightseeing flights.
2. With no restrictions on manoeuvres and no minimum altitude prescribed by the company prior to flight, the pilot flew according to his own limits and made a steep turn at approximately 110 feet above ground level.
3. When the pilot made a steep left turn, aerodynamic stalling ensued, causing an incipient spin at an altitude insufficient to allow control of the aircraft to be regained prior to vertical collision with the terrain.
4. The absence of an angle-of-attack indicator system and an impending stall warning device deprived the pilot of the last line of defence against loss of control of the aircraft.

3.2 Findings as to risk

1. If lightweight flight data recording systems are not used to closely monitor flight operations, there is a risk that pilots will deviate from established procedures and limits, thereby reducing safety margins.
2. If Transport Canada does not take concrete measures to facilitate the use of lightweight flight data recording systems and flight data monitoring, operators may not be able to proactively identify safety deficiencies before they cause an accident.
3. If pilots do not obtain at least the regulatory rest periods, there is a risk that flights will be conducted when pilots are fatigued.
4. Unless all flights made are recorded in the pilot's logbook and monitored by the company, it is possible that the pilot will not receive the required rest periods, which increases the risk of flights being conducted when the pilot is fatigued.
5. If flights made are not recorded in the aircraft's journey logbook, it is possible that inspection and maintenance schedules and component lifetimes will be exceeded, increasing the risk of failure.
6. Unless safety management systems are required, assessed, and monitored by Transport Canada in order to ensure continual improvement, there is an increased risk that companies will not be able to identify and effectively mitigate the hazards involved in their operations.
7. If pilots do not receive stall training that demonstrates the aircraft's actual behaviour in a steep turn under power, there is a high risk of loss of control.

3.3 Other findings

1. The replacement of the ventral fin with Seafins on C-FKRJ was in compliance with the requirements of Kenmore Air Harbor Inc.'s supplemental type certificate.
2. The control wheel was in the left-hand position (pilot side) at the moment of impact.
3. Angle-of-attack indicator systems have been recognized as contributing to flight safety by improving pilot awareness of the stall margin at all times, thereby allowing pilots to react in order to prevent loss of control of the aircraft.
4. Stall warning systems have been recognized as a means of improving flight safety by providing a clear, unambiguous warning of an impending stall.

4.1 Safety action taken

4.1.1 Air Saguenay (1980) inc.

Oversight of sightseeing flights:

• The pilot's tour circuit is displayed on the topographical map of the region posted at the base on Lac Long, Quebec. A copy is given to the manager of Croisières AML and is available to the operations manager at all times.
• A minimum altitude of 2000 feet above the marine park, in accordance with regulations, is prescribed.
• A minimum altitude of 500 feet above terrain is prescribed.
• When passengers are on board, turns greater than 30° are not authorized.

Annual training:

• During training sessions, the results of the TSB's investigation and of the safety management system (SMS) report are communicated to all Air Saguenay employees, as stipulated in the SMS manual.
• Test flights were conducted at a safe altitude, including stalling in a steep turn, and a description of the signs of these stalls in steep turns of the DHC-2 Beaver was added to the theoretical training given every spring.

4.2 Safety action required

4.2.1 Stall warning system

The pilot in this occurrence regularly conducted stall exercises under controlled conditions as an instructor. He was also aware of the DHC-2's more abrupt stall characteristics during steep turns. However, despite his experience, he was not able to detect the impending stall before control of the aircraft was lost.

A stall warning system was not required when the DHC-2 was certified in 1948, because the aerodynamic buffeting that occurs immediately before a stall was considered to constitute a clear, distinctive stall warning. As a result, the Canadian Aviation Regulations do not require stall warning systems to be installed on DHC-2s. Certification standards have since evolved, and a stall warning system is now required for the certification of new aircraft.

In the controlled conditions of certification, the stalling of the DHC-2 was described as gentle. However, as is the case for many other aircraft, a stall in a steep turn under power triggers an Incipient spin with few or no signs of an impending stall, and the flight path changes from horizontal to vertical. In low-altitude flight, stalling followed by incipient spin, no matter how brief, prevents the pilot from regaining control of the aircraft before impact with the ground.

In the conclusion of Aviation Investigation Report A12O0071 in October 2013, the TSB included a safety concern that the DHC-2's aerodynamic buffeting does not provide pilots with adequate warning of an impending stall. The TSB also noted the high frequency of accidents caused by an aerodynamic stall, as well as the catastrophic consequences of these accidents when they occur at low altitude and during critical phases of flight.

Since that time, 2 more accidents related to a DHC-2 stall have occurred: 1 in 2014, and this accident, in 2015. In total, 13 incidents following the aerodynamic stalling of a DHC‑2 have occurred in Canada since 1998.

To reduce the risk of losing control of the aircraft, the pilot must have an immediate, clear indication of an impending stall: immediate because it is urgent, and clear in order to prevent any possibility of mistaking the impending stall for another type of event. The aural and sometimes visual signal of an impending aerodynamic stall emitted by these warning systems means they are one of the last lines of defence against accidental stalls.

In 2014, Transport Canada and the manufacturer, Viking Air Limited, recommended that stall warning systems be installed, but only 4 have been installed on Canadian‑registered DHC-2s. There are currently 382 DHC-2s registered in Canada, 223 of which are used in commercial operations.

Level of risk is determined by the probability and severity of adverse consequences. Given the number of DHC-2s without a stall warning system in commercial operations, combined with the fact that low-altitude manoeuvres are an integral part of bush flying, it is reasonable to conclude that a stall at low altitude is likely to occur again. Because stalls at low altitude lead to catastrophic consequences, this type of accident carries a high level of risk.

Until, at a minimum, commercially operated DHC-2s registered in Canada are required to be equipped with a stall warning system, pilots and passengers who travel on these aircraft will remain exposed to an elevated risk of injury or death as a result of a stall at low altitude.

Therefore, the Board recommends that

This report concludes the Transportation Safety Board's investigation into this occurrence. the Board authorized the release of this report on 02 August 2017. It was officially released on 07 September 2017.

Appendix A— Saguenay–St. Lawrence Marine Park and flight path

Appendix B— History of ventral fin and Seafin stabilizer fins

Appendix C – TSB aviation investigation reports on accidents involving aircraft that stalled and were not equipped with stall warning systems