Aviation Investigation Report A16A0041

The Exploits Valley Air Services Beechcraft 1900D (registration C-FEVA, serial number UE 126), operating as Air Canada Express flight EV7804, was on a scheduled passenger flight from Goose Bay International Airport, Newfoundland and Labrador, to Gander International Airport, Newfoundland and Labrador. At 2130 Newfoundland Daylight Time, while landing on Runway 03, the aircraft touched down right of the centreline and almost immediately veered to the right. The nosewheel struck a compacted snow windrow on the runway, causing the nose landing gear to collapse. As the aircraft's nose began to drop, the propeller blades struck the snow and runway surface. All of the left-side propeller blades and 3 of the right-side propeller blades separated at the blade root. A portion of a blade from the right-side propeller penetrated the cabin wall. The aircraft slid to a stop on the runway. All occupants on board—14 passengers and 2 crew members—were evacuated. Three passengers sustained minor injuries. The aircraft was substantially damaged. There was no post-impact fire. There were insufficient forward impact forces to automatically activate the 121.5 MHz emergency locator transmitter. The accident occurred during the hours of darkness.

1.1 History of the flight

At about 1040^{Footnote 1} on 20 April 2016, the Exploits Valley Air Services (EVAS) crew started their duty day at the Wabush Airport (CYWK), Newfoundland and Labrador, and conducted 5 Air Canada Express flights in the Labrador and Quebec regions before landing at the Goose Bay Airport (CYYR), Newfoundland and Labrador, at 1845. The occurrence flight (EV7804) was scheduled to depart CYYR at 1920 and arrive at the Gander International Airport (CYQX), Newfoundland and Labrador, at 2054.

Before departing CYYR, the captain checked the weather at CYQX and the alternate airport, Deer Lake Airport (CYDF), Newfoundland and Labrador. The visibility at CYQX was ⅛ statute miles (sm) in heavy snow.

The weather forecast for the time of arrival at CYQX was wind 360° magnetic (M) at 35 knots, gusting to 55 knots; visibility ¼ sm in heavy snow and blowing snow; vertical visibility 100 feet above ground level (agl). Starting at 2230, the visibility was forecast to increase to ½ sm in moderate snow and blowing snow, and the vertical visibility was to improve to an overcast ceiling at 400 feet agl. A significant meteorological information (SIGMET) message was issued indicating severe turbulence below 3000 feet agl over an area of Newfoundland that included CYQX.

The crew planned to conduct the instrument landing system with distance measuring equipment precision approach for Runway 03 (ILS/DME RWY 03) at CYQX. EVAS had Operations Specification 303, which allowed the crew to attempt this approach when visibility was reported to be at or greater than ⅜ sm, or with a runway visual range (RVR) of 1600 feet.

The captain called the company's acting operations manager to discuss the potential operational impact if the flight had to divert to its alternate. At first, the intent was to delay the flight for an hour to wait for the snowfall intensity to diminish and for the visibility to improve. However, after speaking with the acting operations manager, the captain decided to depart as scheduled, anticipating that the weather conditions would improve by the time they reached CYQX. The crew was unaware that other carriers had cancelled their flights to CYQX. The captain then called the chief pilot to discuss operational issues related to passenger and fuel loads.

The aircraft departed at 1945^{Footnote 2} on an instrument flight rules flight plan. There were 14 passengers and 2 crew members on board. The first officer (F/O) was the pilot flying. While en route, the F/O indicated that he did not feel comfortable conducting the approach and landing due to his limited experience and the potential challenges associated with the anticipated weather conditions. The captain agreed to conduct the approach and landing.

During the flight, the crew received updated weather reports from both the Gander Area Control Centre and Gander Tower, which indicated an increase in visibility from ⅛ sm to ½ sm and a ½reduction in the snowfall intensity from heavy to light. The crew decided that the visibility was sufficient to conduct the approach as initially planned. The winds and blowing snow were not identified as concerns.

While the flight was en route, snow removal was in progress at CYQX. The airport plows were focused on clearing the middle 120 feet of the 200-foot-wide runway. The plows had pushed the snow into windrows along both sides of the runway, about 60 feet from the centreline.

The crew contacted the tower controller for the runway surface condition report. The latest runway condition report for Runway 03, taken at 2044, was as follows:

• 120 feet cleared width, 40% dry snow with a depth of 0.13 inches and 60% bare and dry
• Remaining width 100% dry snow with a depth of 4 inches
• Remarks—windrows along reported width with a depth of 10 inches

The snowplows continued plowing the runway until about 2110, at which point they began to plow a path for the aircraft to follow from the runway to the apron.

On the approach, about 12 minutes before touchdown, the aircraft began to encounter moderate turbulence through 5700 feet above sea level. This turbulence continued until landing and was significant enough that the passengers were experiencing discomfort.

Once the aircraft intercepted the localizer, control of the aircraft was transferred to the captain as planned. The landing gear was lowered and the flaps were set to full, as per the company's standard operating procedures.

At 2124, the tower controller cleared EV7804 to land and provided the crew with the current tower winds^{Footnote 3} of 360°M at 36 knots, gusting to 44 knots. The crew acquired the runway approach lighting at about 800 feet agl, more than 2 nautical miles (nm) from the threshold.

At approximately 2130, while on short final, the crew asked for a wind update. The tower controller informed the crew that the tower winds were currently unavailable and provided the last aerodrome special meteorological report (SPECI), which had been taken 18 minutes before. The SPECI indicated that the winds were 350°M at 29 knots, gusting to 41 knots (see section 1.7.4, "Weather on final approach and landing").

In the landing flare, the captain asked the F/O to call out the heights on the radar altimeter to help them determine how high they were above the ground. Almost immediately, the 10‑ and 0‑foot calls were made. There was no indication that the crew lost visual contact with the runway edge lighting.

At about 2130, the aircraft touched down on its main landing gear (MLG) to the right of the centreline at a normal descent rate and in a relatively flat attitude^{Footnote 4} about 2800 feet from the threshold.^{Footnote 5} The crew was unaware how far to the right of the centreline they were when they touched down. Almost immediately, the aircraft veered to the right when the right-side MLG encountered snow. The nose landing gear (NLG) struck the windrow of compacted snow, which caused the NLG to collapse. As the aircraft's nose began to drop, the propeller blades struck the snow and runway surface. All of the left-side propeller blades and 3 of the right-side propeller blades separated at the blade root. A portion of a blade tip from the right-side propeller penetrated the cabin wall at floor level.

The aircraft slid down the runway, with the nose coming within 27 feet of the runway edge, before crossing back through the windrow toward the centreline.^{Footnote 6}

The aircraft came to a stop about 14 seconds after touchdown on a heading of about 350°M. The nose was about 15 feet to the right of the centreline and 3400 feet from the threshold.

Once the aircraft came to a stop, the F/O opened the cabin door and evacuated the passengers. The captain shut down the engines. The tower controller did not have any ground radar and was unaware that the aircraft was stopped on the runway. The captain contacted the tower controller to report the situation and request assistance. The tower controller immediately activated the crash bell.

The first fire truck left the station within 1 minute of the crash bell being activated. About 2 minutes later, the plow drivers, who were cross-trained as fire rescue personnel, drove the remaining 2 fire trucks and the rescue vehicle to the aircraft.

Because the location of the aircraft was not known, the vehicles started at the north end of Runway 03. They proceeded cautiously because of the reduced visibility from blowing snow and because the passengers were out on the runway. The first fire truck arrived at the aircraft about 6 minutes after the accident. In total, 3 fire trucks,^{Footnote 7} 1 rescue vehicle, and 2 pickup trucks^{Footnote 8} responded.

Once the firefighters established that there was no fire, the rescue vehicle and pickup trucks started transporting passengers to the terminal. Within 25 minutes of the crash bell being activated, all passengers and crew had been transported to the terminal. Three passengers sustained minor injuries.^{Footnote 9} None of the injuries were attributed to the portion of the propeller blade that had penetrated the cabin.

1.2 Injuries to persons

Table 1. Injuries to persons

	Crew	Passengers	Others	Total
Fatal	0	0	–	0
Serious	0	0	–	0
Minor	0	3	–	3
None	2	11	–	13
Total	2	14	–	16

1.3 Damage to aircraft

The aircraft was substantially damaged.

1.4 Other damage

Not applicable.

1.5 Personnel information

The flight crew was certified and qualified for the flight in accordance with existing regulations.

The captain joined EVAS in February 2015 as an F/O and was upgraded to captain in December 2015.

The F/O was hired in September 2015 and completed a pilot proficiency check and line indoctrination training in March 2016.

The scheduled pairing on the day of the occurrence had the crew starting at 0730, conducting a flight from CYWK to CYYR, and flying back to CYWK in the morning. However, because the captain was getting close to the 90-day flight-time limit,^{Footnote 10} the crew-scheduling department informed the flight crew the night before the occurrence that they would not be doing those flights.

The investigation calculated how long it would have taken for the crew to divert to their alternate airport on the occurrence flight and return to CYQX the following day, in order to determine whether the captain would have exceeded the 90-day flight-time limit. According to the operator flight duty records, the captain would not have exceeded the 90-day flight-time limit.

Table 2. Personnel information

	Captain	First officer
Pilot licence	Airline transport pilot licence (ATPL)	Commercial pilot licence (CPL)
Medical expiry date	01 April 2017	01 January 2017
Total flying hours	2381	1504
Flight hours on type	1031	174
Flight hours on type as captain	375.5	0
Flight hours in the last 7 days	25.2	17.6
Flight hours in the last 30 days	109.4	99.7
Flight hours in the last 90 days	297.9	173.6
Flight hours on type in the last 90 days	297.9	173.6
Hours on duty prior to occurrence	10.8	10.8
Hours off duty prior to work period	13.4	13.4

1.6 Aircraft information

Table 3. Aircraft information

Manufacturer	Beechcraft*
Type, model, and registration	Aeroplane, B1900D, C‑FEVA
Year of manufacture	1994
Serial number	UE‑126
Certificate of airworthiness issue date	29 July 2010
Total airframe time	32 959.9 hours
Engine type (number of engines)	Pratt & Whitney Canada Inc. PT6A-67D (2)
Propeller type (number of propellers)	Hartzell HC‑E4A‑3J (2)
Maximum allowable take-off weight	7765.5 kg
Recommended fuel type(s)	Jet A, Jet A-1, Jet B
Fuel type used	Jet A

* Beechcraft is owned and operated by parent company Textron Aviation Inc.

1.6.1 General

The Beechcraft 1900D (B1900D) is a pressurized, twin-engine turboprop aircraft that is designed and primarily used as a regional airliner. The aircraft is equipped with constant speed, full‑feathering, and reversing 4‑bladed propellers with composite blades. The occurrence aircraft was configured to carry 2 crew members and up to 18 passengers.

Records indicate that the aircraft was certified, equipped, and maintained in accordance with existing regulations and approved procedures. The weight and centre of gravity were within the prescribed limits. There was no indication of a component or system failure prior to the landing.

1.6.2 Landing gear

The B1900D is equipped with a retractable tricycle landing gear system. The NLG and MLG assemblies use air‑oil oleo struts. The nose gear strut is equipped with a single wheel and tire, while each main gear strut is equipped with 2 wheels and tires. The landing gear is retracted and extended by the action of the individual actuators and drag brace assemblies connected to each strut.

The NLG drag brace assembly, which consists of an upper drag leg and 2 lower drag legs, is installed between the strut and structural components within the wheel well (Figure 1). The actuator is installed between the upper drag leg and structural components within the wheel well. When the actuator is retracted, it causes the drag brace assembly to fold upward, which causes the strut to pivot rearward into the wheel well.

When the NLG is extended, the upper drag leg and the 2 lower drag legs align. The drag brace assembly then acts as a rigid component of the landing gear assembly to take drag forces and keep the strut in position.

1.6.3 Fuselage ice shield

An ice shield is installed on each side of the fuselage within the propeller blade plane of rotation. The ice shield is designed to protect the fuselage structure from ice that is shed from the propeller blades during icing conditions. The ice shield is a composite construction, using an inner and an outer ply of fibreglass with 4 plies of aramid fibre sandwiched between them.

1.6.4 Emergency locator transmitter

The aircraft was equipped with an Artex Aircraft Supplies Inc. (Artex) model 110-4 automatic fixed emergency locator transmitter (ELT) (part number 453‑0150, serial number 62543), which is designed to transmit on both 121.5 and 243.0 MHz.^{Footnote 11} This ELT met the requirements of the CARs.^{Footnote 12} At the time of the occurrence, although not required by regulations, EVAS was in the process of replacing the 121.5 MHz ELTs in its aircraft with 406 MHz ELTs, and expected to have the entire fleet equipped by September 2017.

The ELT was installed in the aircraft such that the axis of detection of the automatic acceleration system (the g-switch) was orientated parallel to the longitudinal axis of the aircraft, in the direction of forward flight.

The ELT can be activated either manually or automatically. The ELT is automatically activated when it is armed and the forward impact forces are sufficient to trigger the g-switch. The Artex model 110-4 ELT detects forward impact forces using a single-axis, ball-and-spring-type switch, with the ball and spring contained within a tubular casing. The ELT is activated when the impact forces are sufficient for the ball to compress the spring and make contact with the front of the casing.

Based on flight data recorder (FDR) data, there were insufficient forward impact forces to automatically activate the ELT.

1.7 Meteorological information

1.7.1 General

An aerodrome routine meteorological report (METAR) is a weather report that is normally taken and disseminated on the hour. It describes the actual weather conditions at a specified location and at a specified time, as observed from the ground. The mean surface wind speed given in the METAR is a 2-minute mean measured during the 5-minute period preceding the given observation time. Wind gust information is the highest peak in wind measured in the 10-minute period preceding the observation. In the case of significant changes in weather conditions, a SPECI observation is issued.

1.7.2 Weather prior to departure

The aerodrome forecast for CYQX was, from 1730: winds 360°M at 35 knots, gusting to 55 knots; visibility ¼ sm in heavy snow and blowing snow; vertical visibility 100 feet agl. Starting at 2230, winds were forecasted to be 010°M at 30 knots, gusting to 40 knots; visibility ½ sm in moderate snow and blowing snow; ceiling overcast at 400 feet agl.

The METAR for CYQX, at 1830, when the crew was at CYYR, was: winds 350°M at 31 knots, gusting to 42 knots; visibility ⅛ sm; Runway 03 RVR 1600 feet; heavy snow and blowing snow; vertical visibility 200 feet agl; temperature −3°C and dew point −5°C. The snowfall amount in the last hour was 6 cm.

The METAR for CYQX, at 1930, just before the crew departed CYYR, was: winds 350°M at 36 knots, gusting to 48 knots; visibility ⅛ sm; Runway 03 RVR variable from 900 feet to 2000 feet; heavy snow and blowing snow; vertical visibility 200 feet agl; temperature −3°C and dew point −4°C . The snowfall amount in the last hour was 9 cm.

1.7.3 Weather during the flight

During the flight, the crew was given updated weather, which consisted of the METAR at 2030 and 3 SPECIs within the following hour. The visibility improved from ⅛ sm to ½ sm, and the snow abated from heavy, to moderate, to light snow. The winds remained consistent at 350°M with ranges of 29 knots to 33 knots, gusting to 41 knots to 47 knots.

1.7.4 Weather on final approach and landing

When EV7804 switched to the Gander Tower frequency 6 minutes before the accident, the controller reported the winds to be 360°M at 36 knots, gusting to 44 knots.

On short final, the crew asked for a wind update. The tower wind status had been intermittent and the winds were not available to the tower controller between 5 minutes prior to and 7 minutes after the accident.^{Footnote 13} The controller gave the flight crew the most recent weather available, the 2112 SPECI with winds of 350°M at 29 knots, gusting to 41 knots.

At 2130, a METAR was issued reporting winds at 350°M at 36 knots, gusting to 52 knots; visibility ½ sm; Runway 03 RVR variable from 2800 feet to 5000 feet; light snow and blowing snow; ceiling overcast at 700 feet agl; temperature −3°C and dew point −4°C. The snowfall amount in the last hour was 3 cm. The crew did not receive this weather information because it had been issued at the same time as the accident.

1.8 Aids to navigation

The occurrence aircraft was equipped with the appropriate navigation aids to conduct the approach, and these aids were serviceable at the time of the accident.

1.9 Communications

No difficulties with the quality of radio transmissions were noted during the flight.

1.10 Aerodrome information

CYQX has 2 intersecting asphalt runways. Runway 13/31 is 8900 feet long and 200 feet wide, and Runway 03/21 is 10 200 feet long and 200 feet wide. Both runways are equipped with high-intensity runway edge lights. Runway 03 and Runway 13 are equipped with high-intensity approach lights. Neither runway has centreline lighting, nor is it required.^{Footnote 14}

1.11 Flight recorders

The aircraft was equipped with a cockpit voice recorder, which was capable of storing the last 30 minutes of cockpit sounds, and an FDR, which was capable of storing about 100 hours of flight data. The cockpit voice recorder and the FDR were sent to the TSB Engineering Laboratory with the occurrence data intact.

1.12 Wreckage and impact information

1.12.1 General

When the NLG collapsed (Figure 2), the aircraft's nose struck the snow-covered portion of the runway. The force of the impact caused crush damage to the lower part of the forward fuselage. Abrasion damage due to the aircraft sliding along the runway was also noted on the lower nose area.

Both left and right inboard-flap lower-nacelle fairings, directly aft of their respective MLG assemblies, were deformed due to snow being thrown upward as the tires rolled through the snow. Both wings sustained deformation due to drag forces absorbed by the MLG. Additionally, the upper skin on the right wing was deformed beyond manufacturer allowable limits.

Both engine nacelles sustained structural damage, and the right engine mount truss failed at multiple attachment points.

1.12.2 Nose landing gear

The nosewheel assembly struck the compacted-snow windrow with sufficient force to cause the upper drag leg to fail in compressive overload (Figure 3). The hydraulic actuator rod also failed in overload. Other NLG components were damaged when the NLG assembly collapsed rearward.

1.12.3 Propeller and fuselage damage

All of the blades that separated did so at the blade root due to overload fractures. The blade fracture locations and patterns are typical for a composite propeller blade object strike. Three of the blades from the left-hand propeller and 1 of the blades from the right-hand propeller showed no chord-wise scoring or leading-edge damage, which is typical of a snow or water impact. The remaining blades showed damage consistent with striking the runway.

The right-side fuselage ice shield had large dents due to the impact from the blade segments. The upper dent caused the window interior trim and cabin interior to fracture and come loose inside the cabin. A portion of blade penetrated the cabin wall just above the floor level between seats 1B and 2B. About 19 inches of the blade tip remained embedded (Figure 4).

1.13 Medical and pathological information

The investigation conducted a thorough fatigue analysis, which included the flight crew's work–rest history. There was nothing to indicate that the captain's or F/O's performance was degraded by fatigue or physiological factors.

1.14 Fire

Not applicable.

1.15 Survival aspects

1.15.1 Passenger injuries

Most of the injuries sustained by passengers were consistent with the upper body flailing forward due to longitudinal forces while jackknifing around the lap belt and hitting either the back of the forward seat or another surface.

1.15.2 Emergency locator transmitter

1.15.2.1 G-switch

The ELT was sent to the TSB Engineering Laboratory for examination and testing. During the initial examination, no movement of the g-switch was observed. Radiographs were taken to provide images of the g-switch's internal mechanism. It was noted that the ball was stuck in the middle of the casing. The investigation could not determine when the ball became stuck.

The g-switch was tested by using a rapid forward (throwing) motion followed by a rapid reversing motion. The rapid throwing motion test is typical of many other ELT manufacturers' tests, and is sometimes referred to as the "football throw." During TSB testing, measured longitudinal accelerations were applied to assess the g-switch's activation against manufacturer data.

Multiple football throws were performed and the g-switch activated intermittently. Radiographs taken after each test indicated the ball was intermittently getting stuck in the casing.

The g-switch was cut open and found to be contaminated with a black powder-like residue, determined to be debris caused by wear between the ball and casing surfaces.^{Footnote 15}

The g-switch (part number 2014-1-000) was manufactured by Select Controls Inc. in September 1998, and is used in many other manufacturers' ELTs.

Select Controls Inc. has indicated that during normal operation, the g-switch is subject to vibrations and, over time, this causes the ball and casing surfaces to wear. As the black powder-like residue accumulates, it may eventually cause the ball to stick, rendering the ELT unserviceable.

Since 2005, 2 other ELT manufacturers have issued service bulletins for their specific ELT models that use this g-switch. These service bulletins state that

the manufacturer of the G switch […] has recommended that switches which have been in service for five years or longer be replaced, or a more frequent testing program be developed to insure [sic] proper function of the switch.^{Footnote 16}

Artex has indicated that it has no record of receiving information from Select Controls Inc. related to the recommendations for the part number 2014-1-000 g‑switch prior to the occurrence.

1.15.2.2 Automatic activation test

Under paragraph 605.86(1)(a) of the CARs, aircraft are required to be maintained in accordance with a maintenance schedule that conforms to the Aircraft Equipment and Maintenance Standards. This standard includes the annual performance testing of ELTs and a test of the automatic activation system.^{Footnote 17} Annual performance testing was carried out on the occurrence aircraft's ELT on 19 November 2015.

Artex's periodic maintenance inspection procedures for the g-switch check include the following:

Activate the ELT by using a rapid forward (throwing) motion, in the direction of the arrow, followed by a rapid reversing action.

Following activation, "RESET" the unit by toggling the "ON/OFF" switch to "ON" then back to "OFF".

Note: This is not a measured check; it only indicates that the G-switch is working.^{Footnote 18}

The g-switch must activate for the ELT to be deemed serviceable.

The inspection procedures do not specify how many times the football throw is to be carried out to activate the ELT.

1.5.2.3 Emergency locator transmitter frequency requirement

The International Satellite System for Search and Rescue (Cospas-Sarsat) Programme is a satellite-based search-and-rescue distress alert detection and information distribution system. In February 2009, Cospas-Sarsat stopped monitoring 121.5 MHz ELT signals and now monitors only 406 MHz ELT signals. Therefore, if an aircraft equipped with a 121.5 MHz–only ELT is involved in an accident, satellites will not detect that signal. The only way the signal will be detected is if an aircraft monitoring 121.5 MHz happens to fly overhead and picks up the signal, or if a ground-based radio is being used to monitor the 121.5 MHz frequency.

By comparison, 406 MHz ELT signals transmit information about a flight—such as the aircraft's registration number—that can be used to obtain emergency contact information, a description of the aircraft, and other important information from a beacon registration database. Some modern 406 MHz ELTs are also equipped with a global positioning system that sends position information along with a distress call.

On 11 June 2015, a Notice of Proposed Amendment(NPA) on 406 MHz ELTs was published on the Transport Canada (TC) Canadian Aviation Regulation Advisory Council activity website.^{Footnote 19} In it, TC proposed changes to sections 605.38 and 605.40 of the CARs, mandating the installation of 406 MHz ELTs. According to the NPA, TC is proposing that dual 121.5 MHz/406 MHz ELTs be mandated. This requirement can be met by a dual-frequency ELT unit, or by a dedicated 406 MHz ELT and a 121.5 MHz ELT. TC has indicated that virtually all new 406 MHz ELTs are dual-frequency units (that is, 406 MHz and 121.5 MHz). CARs Part VII operators and Subpart 604 operators would have a 1-year implementation period following the coming-into-force date. Private aircraft engaged in non-commercial, recreational operations would have a 5-year implementation period.

In 2016, following its investigation into the May 2013 occurrence involving a helicopter that departed controlled flight on departure at Moosonee, Ontario,^{Footnote 20} the TSB found that more than half of all Canadian-registered aircraft that require an ELT are being operated with an ELT whose signal is not detectable by Cospas-Sarsat. It further concluded that if the regulations are not amended to reflect the International Civil Aviation Organization (ICAO)'s standards, it is highly likely that non–406 MHz ELTs will continue to be used on Canadian-registered aircraft and foreign aircraft flying in Canada. As a result, flight crews and passengers will continue to be exposed to potentially life-threatening delays in search-and-rescue service following an occurrence. Therefore, the Board recommended that

TC's latest response to TSB Recommendation A16-01 agreed with the recommendation and indicated that it has begun the regulatory process to mandate the carriage of 406 MHz–capable ELTs. The response to TSB Recommendation A16-01 is assessed as Satisfactory Intent.

If aircraft are not equipped with a 406 MHz–capable ELT, flight crews and passengers are at increased risk of injury or death following an accident because search-and-rescue assistance may be delayed.

1.16 Tests and research

1.16.1 TSB laboratory reports

The TSB completed the following laboratory reports in support of this investigation:

• LP115/2016—Shimmy Damper
• LP104/2016—Examination of NLG
• LP100/2016—FDR Data Analysis
• LP098/2016—ELT Analysis

1.17 Organizational and management information

1.17.1 Exploits Valley Air Services

EVAS is based in Gander, Newfoundland and Labrador, and operates 10 B1900D aircraft under Subpart 704 of the CARs.^{Footnote 21} Since 2004, it has operated as a Tier III carrier for Air Canada under the name Air Canada Express, offering daily flights within the Atlantic provinces and Quebec.^{Footnote 22} The operator has approximately 130 employees, including approximately 40 pilots who are based in Gander and in Halifax, Nova Scotia.

EVAS uses a Type "C" operational control system (pilot self-dispatch). Even though the captain has the final authority for disposition of the aircraft during the time in command, pilots can talk with the chief pilot or other members of management, such as the acting operations manager, if they have any concerns or questions regarding the operation of the flight.

The acting operations manager was not a pilot, nor did the position require this. The acting operations manager's responsibilities focused more on pilot scheduling and operational matters associated with flight delays or diversions.

1.17.1.1 Crosswind landing

EVAS uses the B1900D Airplane Flight Manual, which states that the maximum demonstrated crosswind component is 22 knots.^{Footnote 23} This crosswind speed is not an aircraft limitation. This value is the highest crosswind component that tested satisfactorily when certifying the aircraft and does not necessarily mean that the aircraft cannot land safely in conditions with higher values.

Without a definitive maximum crosswind limitation established by the aircraft manufacturer, and in the absence of a company crosswind limit, it was at the discretion of each captain to determine their own personal limits for crosswind landings. Some captains determined their personal limits to be greater than 22 knots.

Section 2.16.4 of the standard operating procedures refers to landing variations and covers topics such as crosswind landings. The following is stated for crosswind landings:

1. The maximum demonstrated crosswind component is 22 knots. The Captain will take the following into consideration when determining takeoff [sic]^{Footnote 24} crosswind limitations:
   1. Pilot Experience and Skill level
   2. Runway and weather conditions
   3. Visibility should be ½ SM or better
   4. Where the runway is contaminated, the maximum crosswind will be determined considering the CRFI [Canadian Runway Friction Index] and the Crosswind Chart from the CFS [Canada Flight Supplement] will be referred to […]^{Footnote 25}

The crosswind chart can be found in the Canada Flight Supplement, which is carried on board the aircraft. As well, EVAS normally had a crosswind chart taped to a clipboard located in the cockpit of each aircraft. The clipboard on board the occurrence aircraft did not have this chart.

The captain did not calculate the crosswind component using the Canada Flight Supplement; however, he did determine that the winds were acceptable and did not identify any safety concerns.

The investigation determined that

• based on the steady wind reported at 2124, the calculated crosswind component would have been 18 knots,
• based on the gust wind reported at 2124, the calculated crosswind component would have been 22 knots, and
• based on the winds reported at the time of the landing, the calculated crosswind components would have been 23 knots for the steady wind and 33 knots for the gusts.

The exact winds where and when the aircraft touched down could not be determined.

1.17.1.2 Previous occurrence

On 10 December 2011, an EVAS B1900D was conducting a scheduled passenger flight from CYQX to CYYR. After the crew began the take-off roll, they noted that the control column was stuck in the full-forward position. The takeoff was rejected and the aircraft was taxied back to the terminal.

During the investigation into this occurrence,^{Footnote 26} the TSB reviewed the operator's flight safety program (FSP) and its approach to safety management, or its safety culture. The FSP did not have full-time dedicated employees. The FSP manager held several other positions in addition to conducting line pilot duties. The flight safety committee (FSC) was required to monitor all areas of operation, identify safety concerns and deficiencies, and make recommendations to senior management for corrective actions where applicable. The FSC meeting minutes reflected a priority on production and operational concerns, and on occupational safety and health-related concerns.

Operational incident reports were reviewed using an approach to safety management that relied primarily on regulatory compliance and on reacting to undesirable events by identifying the causes and prescribing specific measures to prevent them from happening again. There was no proactive identification of potential hazards, including the possible impact of increasing the fleet size and adding new employees. Although EVAS had a safety program in place, safety management was conducted using a traditional reactive approach. At the time of the occurrence, EVAS's management was focused on operational priorities^{Footnote 27} to meet Air Canada's requirement to increase the number of flights on its existing routes.

The investigation into the 2011 occurrence identified the following Finding as to risk:

When organizations do not use modern safety management practices, there is an increased risk that hazards will not be identified and mitigated.^{Footnote 28}

Following the occurrence, EVAS worked with TC, the U.S. Federal Aviation Administration, and the aircraft manufacturer regarding the design deficiency that caused the control column to be stuck in the full-forward position, and took safety action related to the use of flight control locks. However, there was no indication that safety action had been taken related to the operator's safety culture, including the proactive identification and mitigation of hazards.

1.17.1.3 Flight safety program

According to TC,

A safety management system is a businesslike approach to safety. It is a systematic, explicit and comprehensive process for managing safety risks. As with all management systems, a safety management system provides for goal setting, planning, and measuring performance. A safety management system is woven into the fabric of an organization. It becomes part of the culture, the way people do their jobs.^{Footnote 29}

EVAS does not have a safety management system (SMS), nor is it required by regulation to have one. The operator has an FSP that incorporates aspects of an SMS.

In June 2015, EVAS hired an FSP manager on a part-time basis. Although the company required the manager to successfully complete a training course,^{Footnote 30} only informal training was provided.

Chapter 7 of the Company Operations Manual (COM) describes the FSP as "a systematic, explicit and comprehensive process for the management of safety risks that integrates operations and technical systems with financial and human resource management for all activities related to the air operator's operating certificate."^{Footnote 31} All employees were required to adopt the standards and procedures set forth in the FSP.

Overall, safety was the responsibility of the operator's president. The FSP manager was responsible for managing the FSP. A list of 15 responsibilities outlined how the FSP manager was to manage the FSP; however, the list was not intended to limit the FSP manager with respect to finding other means of improving safety. Since being hired, the FSP manager had been focused primarily on participating in the review and follow-up of concerns related to flight operations that had been identified on company hazard reporting forms.

Since the 2011 occurrence, Chapter 7 of the COM had been revised once. The revisions were minor and included adding another person to the FSC, installing notice boards with blank copies of the occurrence reporting forms, and identifying these forms as a means of reporting safety concerns. The practices, procedures, and policy are consistent with those that were in place in 2011.

One aspect of the FSP was to maintain a reporting system for accidents, incidents, and hazards, and to ensure that all employees had access to the operator's occurrence report form. Hazard reports were intended to alert the FSP manager of situations that could lead to a potential incident. The operator used a reactive approach in addressing incident reports.^{Footnote 32}

Section 7.9.4 of EVAS's COM provides examples of what hazards or incidents should be reported. The examples include

1. Excessive duty times;
   

[…]

6. Incorrect or inadequate procedures, and a failure to adhere to standard procedures;
7. Poor communication between operational areas;

[…]

10. Runway incursions; or
11. Lack of adequate training and recurrent training.^{Footnote 33}

According to the COM, "[a] hazard report can be submitted anonymously or, at the request of the originator, the identity of the originator will be protected."^{Footnote 34} The reports are mostly made online and can be viewed only by select managers.

Reports are reviewed by the FSPM and either the acting operations manager or the chief pilot. Occurrence reports that are operational in nature are reviewed using an approach to safety management that relies primarily on regulatory compliance and on reacting to undesirable events and prescribing specific measures to prevent them from happening again.

None of the 125 reports from 01 January 2015 to 20 April 2016 identified a safety concern related to adverse weather conditions during operations, or crosswind limitations for the aircraft.

The FSC did not hold specific meetings to comply with the requirements of the FSP. Instead, the meetings were amalgamated into the monthly occupational health and safety meetings. The investigation reviewed the minutes from the safety meetings from December 2015 to March 2016 and observed that the topics discussed were related to conventional health and safety issues in the workplace. The number of safety issues being addressed was identified in only one of the meetings. None of these meetings specifically discussed flight safety concerns.

On 21 April 2016, the operator had a meeting to discuss its response to this occurrence. The meeting reviewed what took place and what was identified in the operator's emergency response plan, including what worked and what could be improved.

According to the COM,^{Footnote 35} any member of the FSC can call a special meeting for an urgent matter. The FSC did not call a special meeting to investigate this accident for the purpose of making recommendations for corrective action to prevent similar accidents from happening in future. This practice is consistent with what was noted during the previous TSB investigation.

However, following this occurrence, EVAS management met on several occasions to review the circumstances of the accident.

1.17.1.4 Air Canada International Air Transport Association operational safety audit

Air Canada audits all of its Tier III operators using the International Air Transport Association (IATA)^{Footnote 36} Operational Safety Audit (IOSA) and IOSA standards and recommended practices. Air Canada typically conducts these audits every 2 years. The last 2 IOSAs for EVAS were conducted in July 2013 and August 2015.

The IOSA Standards Manual provides the following information about SMS:

The Operator should have an SMS that is implemented and integrated throughout the organization to ensure management of the safety risks associated with aircraft operations.^{Footnote 37}

Specific SMS requirements for an operator will always be mandated by the State in accordance with its individual State Safety Plan (SSP).^{Footnote 38}

In the 2013 audit, Air Canada indicated that EVAS had a traditional safety policy and program in place. Even though EVAS was not operating under a formal SMS, many of the IOSA SMS-related items were shown to be either accepted or in compliance. EVAS did not have formal risk assessment programs in place for some of the sections of the company that had been audited. It was also noted that there were no reactive or proactive methods for safety data collection and analysis to identify existing and potential hazards to aircraft operations.

EVAS was not required by regulation, or by its commercial arrangement with Air Canada, to have an SMS. Consequently, some of the SMS-related findings were not addressed by EVAS in either the 2013 or the 2015 audits.^{Footnote 39}

In the 2015 audit, a number of the findings related to audit programs were the result of significant management changes at EVAS and the required training being overlooked.

Crew resource management (CRM), including threat and error management (TEM), was part of the IOSA requirements. The audit identified that one of the findings pertained to the requirement for an operator to ensure that flight crew members complete training and, when applicable, an evaluation in CRM—including TEM—be performed by facilitators who have been trained in human performance and human factors principles.

Although CRM training is not required for CARs 704 operations, EVAS submitted a corrective action plan to amend its COM to include TEM and a requirement to have facilitators who have training in human performance and human factors principles. This COM had not yet been approved by TC at the time of the occurrence.

1.17.2 Gander International Airport Authority

1.17.2.1 Snow removal policy

TC's Advisory Circular (AC) 302-013, "Airport Winter Maintenance and Planning," states that the priority areas for snow removal should include "the width of the primary runway required to support the operational requirement of the aircraft movements at the airport during a storm."^{Footnote 40}

The Gander International Airport Authority has a winter maintenance plan policy in effect that is "intended to optimize the use of personnel and equipment to effectively clear snow from aircraft manoeuvring areas, aprons […]."^{Footnote 41} The policy identifies priority levels for snow removal activity during snow events. The main priority is "the aircraft manoeuvring surfaces required for landings, take-offs, taxiing, as well as aircraft parking on the main apron."^{Footnote 42} The plan does not specify the width to which the runway needs to be plowed.

In snow conditions such as those on the night of the occurrence, it is the airport authority's practice to plow the runway to a 120-foot width. This is the typical width that is cleared when using 3 plows in tandem and is sufficient for most aircraft to land, including a B1900D.^{Footnote 43}

1.18 Additional information

1.18.1 Crosswind limitations

In 2013, the Flight Safety Foundation (FSF) published an article that discussed the results of a survey^{Footnote 44} conducted by the National Aerospace Laboratory of the Netherlands on near-ground wind gust detection and information for flight crews. The survey determined that 82.9% of respondents use the aircraft manufacturer's demonstrated crosswind values as hard limits that should not be exceeded by the crew.^{Footnote 45} Regardless of the size of the aircraft, a crosswind value that is not defined as an aircraft limitation by the manufacturer can be adopted as a limitation by an operator.

The FSF article also states that

[…] 67 percent [of operators] have procedures for how their pilots should calculate the crosswind component, with 58 percent of these specifying how the pilots should take gusts into account; and 33 percent do not include gusts in their crosswind values.^{Footnote 46}

The survey also identified that a few of the respondents left the decision about whether to include the gusts up to the captain's discretion.

The following are 2 examples of operators that limited the crosswind value as a result of an incident:

1. In 2013, the TSB investigated a nosewheel failure on landing of a DHC-6-300 Twin Otter (TSB Aviation Investigation Report A13A0033). During the landing flare, control was transferred from the F/O to the captain, and there was insufficient time to position the aircraft for a successful landing because of the substantial crosswind. As a result of the accident, the operator started restricting the crosswind limit on all landings.
2. In 2004, the TSB investigated a runway excursion of a BE-A100 King Air (TSB Aviation Investigation Report A04Q0199). Following the incident, the operator released an internal bulletin that limited the crosswind component for the aircraft.

1.18.2 Illusions caused by blowing snow

Blowing snow can create visual illusions, described as follows:

Snow blowing across the runway during landing and take off gives an illusion of the aircraft moving in the opposite direction to the blowing snow. This will make it difficult to align the aircraft with the runway. It is of utmost importance to the pilot to align the aircraft with the centreline lights or the runway lights in order to keep the correct direction.^{Footnote 47}

According to an FSF article,

Misinterpretation of ambient visual cues can result in visually induced perception of self-motion (linear or angular) and is called a vection illusion. Most people have experienced this type of illusion while sitting in a stopped car as another car moves slowly by. The illusion of motion of the subject's car moving opposite to the other occurs. […] During takeoff or landing, a snowstorm or sandstorm in a given direction can create the illusion of the subject's movement in the opposite direction and impair the normal directional control of the aircraft.^{Footnote 48}

1.18.3 Previous occurrences involving composite propeller blade separation and fuselage impact

There have been previous occurrences where composite propeller blades have separated at their root as the result of contact with terrain. Separated propeller blades can impact and may penetrate the fuselage within the plane of propeller blade rotation.

1.18.3.1 Previous occurrences in Canada

In 2003, a B1900D taxied into a 2-foot-high windrow at the St. John's International Airport, Newfoundland and Labrador (TSB Aviation Investigation Report A03A0002). When the propeller blades struck the windrow, all 4 blades from the right-side propeller and 1 blade from the left-side propeller separated at the root. The blades from the right-side propeller struck the fuselage at the forward passenger cabin window. This window shattered and the window fragments and frame were flung into the cabin. There were no injuries to the 10 passengers or 2 crew members.

More recently, in 2014, a Bombardier DHC-8-402 was landing at the Edmonton International Airport, Alberta, when the right MLG collapsed during touchdown (TSB Aviation Investigation Report A14W0177). Upon contact with the ground, all of the right-side propeller blades separated and a large section of a propeller blade penetrated the aircraft cabin wall. Three passengers were injured as a result of the partial propeller blade that punctured the fuselage; these injuries were consistent with impact from pieces of the window and cabin interior.

1.18.3.2 Previous occurrences in the United States

In the United States, between 1983 and 1986, 3^{Footnote 49} different aircraft incidents involving propeller blades penetrating the cabin led to the National Transportation Safety Board (NTSB) making the following 2 recommendations:

Both recommendations were closed in March 1988 with the status "closed – unacceptable action."

In 1997, a B1900D had just lifted off the runway when the takeoff was aborted.^{Footnote 51} After landing, the aircraft entered a snowbank on the left side of the runway. The NLG collapsed and all of the propeller blades separated at the root.

The 4 left-side propeller blades were intact; they were not damaged on the leading edges, and did not have chord-wise scratches. Three of the right-side propeller blades had impact damage along their trailing edges and chord-wise scratches on both sides of the blades.

There was a jagged opening in the fuselage, about 18 inches aft of the right engine's propeller plane of rotation. The forward edge of the opening was abeam the rear of the first-row passenger seat, 1F, and the rear edge was just forward of passenger seat 2F.

Following this accident, Beechcraft began developing a propeller impact shield as a modification kit for product improvement. The propeller impact shield was similar to the ice shield, but used 20 plies of aramid fibre between the inner and outer fibreglass plies. This modification kit was never installed because manufacture of the B1900D ceased around the time the kit was completed.

Beechcraft did not issue a service bulletin or service communication announcing that the kit was available. No modification kits were ever retrofitted on existing B1900D aircraft.

If composite propeller blades contact objects and separate, and then strike or penetrate the cabin, there is a risk of injury or death to occupants seated in the propeller's plane of rotation.

1.18.4 Transport Canada oversight

1.18.4.1 General

TC expects companies to proactively manage the safety of their operations—where risks are managed to acceptable levels—and to have programs in place to ensure their continued compliance with all regulatory requirements. TC's surveillance program is designed to assess whether an aviation operator has implemented appropriate and effective systems. Specific systems-based surveillance inspections are conducted at intervals that are based on risk indicators. The program is targeted at key systems, which are determined by certificate type, as well as by whether a given operator is required to have an SMS.

The surveillance program is based on a systemic approach to managing risk and includes the following steps:

• documentation review;
• on-site interviews and on-site sampling conducted by inspectors; and
• production of a report with findings of systemic deficiencies.

This approach allows inspectors to understand how an operator plans to meet a specific regulatory requirement. The sampling portion involves selection by inspectors of specific areas, or outputs, to test compliance with that system and with the applicable regulations.

TC normally conducts program validation inspections (PVI) on a routine schedule, based on risk indicators that are used to determine the frequency of inspection. Under TC's current approach to surveillance, planned surveillance intervals may be as frequent as every year for high-risk or high-impact companies, or as infrequent as every 5 years for those that TC determines to pose a lower risk or impact. These intervals are subject to annual review and may be adjusted at any time if TC feels that it is warranted by changes in an operator's risk indicators. During a PVI, the TC team will conduct interviews, gather evidence to support observations, and analyze those observations. It will then determine whether the operator complies with regulations and whether the operator's SMS is effective (if the organization is required to have an SMS). The team will also prepare any findings of non-compliance and document the results of the on-site review.

A process inspection (PI) is another surveillance tool TC employs to determine whether an operator's processes meet regulatory requirements and are functioning as intended. Unlike a PVI, the scope of a PI is limited to a single process and is intended to help TC determine the level of risk associated with an operator, and whether additional surveillance is required. Like a PVI, a PI may also generate findings; however, those findings are not assigned ratings. The PI report shall indicate whether the process meets applicable regulatory requirements and is being followed as published in approved operator manuals, or whether the process is not documented, not implemented, or not effective. In some cases, the results of a PI may lead to a PVI being conducted at an earlier interval than originally planned.

In principle, any process required by regulation may be the focus of a PI or a PVI. Targeted PIs across a range of areas have the potential to identify a lack of compliance with regulations requiring those processes. If a PI reveals safety-related deficiencies, then a PVI may be conducted on an urgent basis to collect sufficient material to support the issuance of a formal report and certificate action, if necessary.

Companies are required to submit corrective action plans (CAPs) to TC for any findings arising from a TC surveillance activity. CAPs are expected to provide the operator's analysis of the reasons underlying the deficiency and provide an action plan to address them. TC inspectors are responsible for assessing the CAPs for either administrative or on-site follow-up.^{Footnote 52} Rejected CAPs will be returned to the operator for revision.

1.18.4.2 Transport Canada Advisory Circular (AC) SUR-002

TC Advisory Circular (AC) SUR-002 provides information and guidance, and "explains the root cause analysis and corrective action process to address […] findings of non-compliance."^{Footnote 53} The document applies to TC personnel and to companies responding to findings.

To develop an effective CAP, the operator "must understand the nature of the system or process deficiency which led to the finding."^{Footnote 54} TC provides corrective action forms and instructions with the surveillance report to the operator. For each finding form, the operator is given the opportunity to submit a completed CAP form to TC.

Appendix A of AC SUR-002 includes a copy of the corrective action form with cross-references to guidance for completing it. Additional appendixes are included and contain information such as

• an example problem to compare effective and ineffective corrective action processes
• discussion about human and organizational factors
• a review of the techniques for analysis
• various options (5 why's, fishbone diagram, and cause map) for determining the root causes
• numerous applicable references that an organization can access
• enhanced monitoring

TC Staff Instruction (SI) No. SUR-002 defines enhanced monitoring (EM) as

a process to closely monitor an enterprise that has:

1. Major findings of systemic failures that have led to non-compliances with regulatory requirements, based on the results of a PVI or an assessment; or
2. A persistent record of non-compliance or a demonstrated inability to comply with the regulations discovered through means other than a PVI or assessment.^{Footnote 55}

According to SI SUR-002, the goals of EM are twofold:

1. That the enterprise develops and implements measures to deal with its non-compliances, ensuring compliance with regulations during and after the period of EM; and
2. That TCCA [Transport Canada Civil Aviation] takes a comprehensive look at the enterprise's systems, through increased regulatory surveillance activities, in order to confirm the enterprise's ability to maintain compliance with applicable regulations.^{Footnote 56}

TC SI SUR-004 states:

Enhanced Monitoring shall be used when an enterprise's compliance and/or safety record would indicate that an increased TCCA presence is needed to:

1. Oversee an enterprise's return to a state of compliance with regulatory requirements; and
2. Gain the confidence that the enterprise can adequately maintain compliance with those regulatory requirements.^{Footnote 57}

1.18.4.3 Exploits Valley Air Services enhanced monitoring

In April 2014, TC informed EVAS that it had been placed on EM due to the demonstrated systemic failures discovered during a PVI, which took place in January 2014.

The objective of the January 2014 PVI was to evaluate EVAS's quality assurance (QA) program to confirm its level of compliance and ability to maintain compliance with the CARs. A total of 12 findings were identified: 6 minor,^{Footnote 58} 2 moderate,^{Footnote 59} and 4 major.^{Footnote 60}

Once TC had accepted the operator's CAPs for the findings, an on-site inspection was to be carried out to verify that EVAS had implemented the provisions of the CAPs and that the implementation of the CAPs had resulted in the necessary corrections to ensure ongoing compliance.

In June 2014, TC performed its first on-site inspection. Four of the CAPs were found not acceptable; revised CAPs were then required. Also, 2 new findings were identified, which required additional CAPs.

TC performed a second on-site inspection in September 2014. During that inspection, a CAP that had previously been accepted was marked as failed, and the result was a contravention of CAR 605.94.^{Footnote 61} The original finding was reissued; an additional finding was also issued.

In January 2015, TC carried out another inspection during which an additional 5 findings were identified. The terminating PVI^{Footnote 62} was rescheduled for late April or early May 2015.

During the May 2015 inspection, TC indicated that 1 CAP was outstanding. An additional finding, which was a similar deficiency identified in a finding from the January 2014 PVI, was also issued.

In June 2015, during TC's inspection, additional non-compliances were found in the following areas:

• QA program;
• maintenance schedule;
• training program; and
• organizational culture.

In October 2015, TC carried out an inspection to verify the results of the outstanding CAPs; 2 additional findings were issued.

In November 2015, TC advised EVAS that it had complied with its CAPs in a satisfactory manner, and EM was closed.

Throughout this process, EVAS's CAPs identified root causes for the non-compliance with the regulations, including the following:

• The operator was undergoing a rapid expansion. Management's focus was primarily on the expansion and therefore did not allocate sufficient resources to ensure the existing operations had adequate oversight.
• Managers were not adequately addressing the operational requirements of the day-to-day operations.
• Senior management was not providing adequate oversight to ensure the managers were carrying out their duties effectively.
• The reporting structure was not clearly defined.
• Current audit practices were inadequate and/or not frequent enough to identify the discrepancies that were identified by TC.

1.18.4.4 EVAS additional oversight

In addition to the oversight carried out on the operator's QA program, TC carried out oversight in other operational areas.

In August 2014, TC conducted in-flight inspections on 4 of EVAS's scheduled flights. Two findings were identified, and the CAPs were accepted. In January 2015, during the follow-up inspection, TC identified 4 additional findings. All 4 of the CAPs were rejected, primarily due to either the CAP being ineffective at addressing the finding or the CAP requirements not being met as per AC SUR-002. Subsequent CAPs were accepted.

In October 2015, TC carried out a PVI of the following areas of EVAS's operation:

• chief flight instructor responsibilities and operational control; and
• company operational control.

A total of 9 findings were identified: 2 minor, 3 moderate, and 4 major.

In addition to the CAP process, TC indicated it was considering enforcement action on 3 of the major findings. Of the 9 CAPs, 7 were rejected, primarily because the CAPs did not meet the requirements of AC SUR-002. Five of these CAPs were accepted in February 2016. At the time of the occurrence, 2 CAPs, both associated with minor findings, were still outstanding.

1.18.5 Organizational culture

According to ICAO:

Organizational culture sets the boundaries for accepted executive and operational performance by establishing the norms and limits. Thus, organizational culture provides a cornerstone for managerial and employee decision making.^{Footnote 63}

A safety culture influences all parts of an organization and is characterized by proactive initiatives for identifying and managing risks, commitment from management, and clear policies and procedures that are put into practice. Management and employee decisions, actions, and behaviours are indicators of an organization's safety culture.

ICAO has described the role of management in creating a positive organizational safety culture as follows:

Those in the best position to effect accident prevention by eliminating unacceptable risks are those who can introduce changes in the organization, its structure, corporate culture, policies and procedures, etc. No one is in a better position to produce these changes than management.^{Footnote 64}

Organizations must strike a balance between safety and production by managing risks present in their operation. Within many organizations, production and operational concerns may at times seem more pressing than safety.

The traditional approach to safety management is based on compliance with regulations and a reactive response to incidents and accidents. Organizations that simply comply with regulatory requirements are not well situated to identify emerging safety problems.

According to the ICAO Safety Management Manual,

As global aviation activity and complexity continue to grow […] traditional methods of managing safety to an acceptable level [become] less effective and efficient. Different, evolved methods of understanding and managing safety are necessary.^{Footnote 65}

This is summarized in TSB Aviation Investigation Report A07A0134 as follows:

Modern safety management principles promote a proactive search for hazards, identification of risks, and the best defences to reduce risk to an acceptable level. These principles must be embedded within an organization's management system so that safety policies, planning, procedures, and performance measurement are integrated into day-to-day operations.

1.18.6 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada's transportation system even safer.

Safety management and oversight is a Watchlist 2016 issue. Some transportation companies are not effectively managing their safety risks, and many are not required to have formal safety management processes in place. TC oversight and intervention has not always proven effective at changing companies' unsafe operating practices.

All transportation companies are responsible for managing safety risks in their operations.

Some companies consider safety to be adequate as long as they are in compliance with regulatory requirements, but regulations alone cannot foresee all risks unique to a particular operation. That is why the TSB has repeatedly emphasized the advantages of SMS, an internationally recognized framework to allow companies to effectively manage risk and make operations safer.

SMS has been on the TSB Watchlist since 2010. Since then, there has been no progress on expanding the application of SMS to a broader range of companies.

1.18.7 Pilot decision making

Pilot decision making (PDM) can be described as making the right choice at the right time and avoiding circumstances that can lead to difficult choices. Many decisions are made on the ground, and a well-informed pre-flight choice avoids the need for a much more difficult in-flight decision.

An important component of PDM is good situational awareness, which requires a pilot to align the reality of a situation with his or her expectations. Inadequate or ineffective PDM can result in operating beyond an aircraft's capability or exceeding the pilot's abilities.

EVAS's pilots receive PDM training through their ground school, flight simulator, and line indoctrination training. Throughout the training process, pilots are presented with scenarios and tested on their decision-making abilities.

1.18.8 Crew resource management

At this time, CRM training is required only for CARs Subpart 705 commercial carriers in Canada; it is not required for CARs Subpart 703 or 704 operators.

Even though EVAS was not required to provide CRM training, the operator did provide a course to some of its pilots in April 2013. However, the occurrence flight crew was not working at EVAS at that time, and they did not receive this CRM training.

CRM can be defined as a management system that makes optimum use of all available resources, including equipment, procedures, and people, to promote safety and to enhance the efficiency of flight operations. ICAO states that the "fundamental purpose of CRM training is to improve flight safety through the effective use of error management strategies in individual as well as systemic areas of influence"^{Footnote 66} and proposes the integration of TEM into CRM.

Modern, well-designed CRM training now includes such things as TEM, a conceptual framework regarding aviation operations and human performance, and can be used in different contexts, including flight deck operations and occurrence investigations. Three basic components of TEM are threats, errors, and undesired aircraft states.^{Footnote 67}

In every flight, hazards will be present and will need to be handled by the crew. These hazards, referred to as threats, increase the risks during a flight and include such things as weather conditions. Provided the crew members have an opportunity to handle the threat, effective management of a hazard leads to a positive outcome with no adverse consequences. That is, the crew members take action to mitigate the threat. However, mismanaging the threat can lead to crew error, which the crew must also manage. Mismanagement of crew error may lead to an undesired aircraft state, which can lead to an accident. At any point, effective management of the situation by the crew, such as performing a go-around, can mitigate the risk, and the situation may be inconsequential.

The most common crew behaviours cited for effective error management include vigilance and crew member advocacy and inquiry. Although threats and errors are present in the majority of flight segments, they rarely carry significant consequences because they are managed effectively by the crew. The effective management of risks on the flight deck is inextricably linked to effective CRM.

In 2009, following its investigation into the January 2007 occurrence involving a Beech A100 King Air that departed controlled flight during a go-around at Sandy Bay, Saskatchewan (TSB Aviation Investigation Report A07C0001), the TSB concluded that ineffective CRM contributed to the accident. Therefore, the Board recommended that

In its responses to Recommendation A09-02, TC developed CRM training standards for CARs subparts 703 and 704 commercial air operators. These are currently in NPA format. The revised NPA was presented on 09 May 2016, with opportunity for stakeholders to offer comments until 09 June 2016.^{Footnote 68}

Following the disposition of comments received, TC intends to move ahead with implementation and a resulting mandatory requirement for operator CRM training, which will be applicable to flight crew, cabin crew, dispatchers, and maintenance personnel associated with aircraft operations.

The Board is encouraged that action on this recommendation is nearing completion. The proposed course of action should substantially reduce or eliminate the safety deficiency identified in TSB Recommendation A09-02. Until the standards are amended and fully implemented, this safety deficiency will continue to exist. The response is considered Satisfactory Intent.

The NPA recommends that CRM training be conducted annually, with a focus on TEM and additional elements, such as decision making.

If modern CRM training is not a regulatory requirement, then it is less likely to be introduced by operators and, as a result, pilots may not be fully prepared to recognize and mitigate hazards encountered during flight.

1.18.9 Plan continuation bias

Plan continuation bias is a "deep-rooted tendency of individuals to continue their original plan of action even when changing circumstances require a new plan."^{Footnote 69} Once pilots make and commit to a plan, it becomes more difficult for them to recognize stimuli or conditions in the environment that require a change to be made than if they had not made a plan beforehand. If pilots are to recognize and act upon a reason to change their plan in a timely manner, the condition or stimulus needs to be perceived as sufficiently salient to require immediate action.

1.19 Useful or effective investigation techniques

Not applicable.

There was no indication of an aircraft component or system failure during the occurrence flight, and crew fatigue was not considered a factor. The analysis will focus on pilot decision making with respect to the landing and the operator's safety management, including safety culture and practices.

2.1 Landing

Before departure, after obtaining the weather reports, the captain spoke with both the company's acting operations manager and the chief pilot. The discussions revolved around the logistics of being diverted to the alternate airport and operational issues related to aircraft loading. There were no concerns expressed regarding the potential risks associated with winds and blowing snow.

Although the reported visibility for the time of arrival was less than that required to attempt an approach, the captain believed that visibility would improve and would be sufficient to conduct the approach. Even if visibility did not improve, the crew had an acceptable alternate to which they could divert.

Due to the anticipated weather conditions, the first officer (F/O) decided, while en route, to relinquish aircraft control to the captain for the approach. During the flight, the visibility improved to the visibility required to conduct an approach, and the crew decided to continue with the landing.

The blowing snow made it difficult to identify the runway centreline markings, reducing visual cues available to the captain. This situation was exacerbated by the absence of centreline lighting and a possible visual illusion caused by blowing snow. Neither pilot had considered that the combination of landing at night in reduced visibility, with a crosswind and blowing snow, on a runway with no centreline lighting was a hazard that may create additional risks.

During the landing flare, the captain requested that the F/O call out the heights above the ground to help determine the aircraft's position. Due to the gusty crosswind conditions, the aircraft drifted to the right, which was not recognized by the crew. It is likely that the captain had difficulty determining the aircraft's position during the landing flare. The crew was unaware how far right of the centreline they were and therefore did not correct before the aircraft touched down.

Plan continuation bias indicates that without salient triggers, flight crews will continue with their original plan (in this case, to carry out the landing rather than conduct a missed approach). In this occurrence, there were no salient triggers to cause the flight crew to re‑evaluate their original plan of action. Therefore, the flight crew's decision to continue with the landing was consistent with plan continuation bias.

During landing, the nosewheel struck the compacted snow windrow on the runway, causing the NLG to collapse.

2.2 Crosswind limitations

Other than the maximum demonstrated crosswind value identified in the B1900D Airplane Flight Manual, the operator did not have an internal policy on crosswind limits, and relied on the discretion of its pilots. If operators do not have defined crosswind limits, there is a risk that pilots may land in crosswinds that exceed their abilities, which could jeopardize the safety of flight.

2.3 Operator safety management

Effective safety management relies, in part, on the safety culture of a company, which reflects the attitudes and behaviours of a company's management team.

The traditional approach to safety management has been shown to be ineffective in identifying potential hazards and associated risks. Organizations that comply with the minimum standards and manage safety using the traditional approach are not well situated to identify emerging safety problems. In today's aviation environment, modern safety management practices must be embedded within an organization's management system, so that the management of safety is integrated into day-to-day operations.

During the TSB's 2011 investigation^{Footnote 70} into an occurrence involving Exploits Valley Air Services (EVAS), it was noted that the operator did not proactively identify potential safety hazards, and that safety management was conducted using a traditional reactive approach. At the time of the 2011 occurrence, management was focused on operational priorities. At the conclusion of the investigation, there was no indication that action had been taken related to the operator's safety culture.

At the time of the 2016 occurrence, EVAS had appointed a part-time flight safety program manager who had only received limited, informal training and was focused only on a limited number of the position's responsibilities.

Following the 2016 occurrence, the flight safety committee did not call a special meeting to investigate the circumstances surrounding the occurrence and make recommendations for corrective actions.

In response to the findings from Transport Canada (TC) inspections, managers did not adequately address the requirements of the day-to-day operations, senior management did not ensure that managers were carrying out their duties, and audit practices were inadequate.

During the enhanced monitoring process, each time TC carried out an inspection, additional findings were identified and/or corrective action plans were rejected because they did not result in the necessary corrections to ensure ongoing compliance. During this period, EVAS indicated that it was focused primarily on expansion, which resulted in management overlooking the need to consider the priorities and allocation of resources to ensure that existing operations had adequate oversight.

This situation suggests that the operator's safety culture was similar to what was identified in 2011.

At the time of the accident, EVAS was not required by either Air Canada or TC to conform to safety management system requirements, and therefore did not implement some of Air Canada's International Air Transport Association Operational Safety Audit (IOSA) safety management system requirements.

If organizations do not use modern safety management practices and do not have a robust safety culture, there is an increased risk that hazards will not be identified and mitigated.

2.4 Emergency locator transmitter

The emergency locator transmitter (ELT) did not automatically activate due to insufficient forward impact forces. However, examination of the g-switch identified a known condition of residue build-up due to wear on the ball and casing surfaces, resulting in the g-switch sticking.

Both the Canadian Aviation Regulations and the ELT manufacturer require the g-switch to be checked to ensure that it is serviceable. The ELT manufacturer specifies that this check is to be carried out by using the football throw method. However, the periodic maintenance inspection procedures do not state the number of times to perform the football throw.

Without a manufacturer clearly stating the number of times the football throw is to be carried out, an operator might repeat the throw until the g-switch activates. As found in this occurrence, the g-switch operated intermittently when carrying out numerous football throws. Following activation, the ELT would be considered serviceable and therefore could remain in service.

When testing an ELT's automatic activation system, a sticking g-switch may go undetected if more than 1 football throw is necessary to activate the ELT. As a result, the ELT might not activate during an accident, and search-and-rescue assistance may be delayed, placing flight crews and passengers at an increased risk for injury or death.

3.1 Findings as to causes and contributing factors

1. Neither pilot had considered that the combination of landing at night, in reduced visibility, with a crosswind and blowing snow, on a runway with no centreline lighting, was a hazard that may create additional risks.
2. The blowing snow made it difficult to identify the runway centreline markings, thereby reducing visual cues available to the captain. This situation was exacerbated by the absence of centreline lighting and a possible visual illusion caused by blowing snow.
3. Due to the gusty crosswind conditions, the aircraft drifted to the right during the landing flare, which was not recognized by the crew.
4. It is likely that the captain had difficulty determining aircraft position during the landing flare.
5. The flight crew's decision to continue with the landing was consistent with plan continuation bias.
6. During landing, the nosewheel struck the compacted snow windrow on the runway, causing the nose landing gear to collapse.

3.2 Findings as to risk

1. If aircraft are not equipped with a 406 MHz-capable emergency locator transmitter, flight crews and passengers are at increased risk of injury or death following an accident because search-and-rescue assistance may be delayed.
2. If operators do not have defined crosswind limits, there is a risk that pilots may land in crosswinds that exceed their abilities, which could jeopardize the safety of flight.
3. If composite propeller blades contact objects and separate, and then strike or penetrate the cabin, there is a risk of injury or death to occupants seated in the propeller's plane of rotation.
4. If modern crew resource management training is not a regulatory requirement, then it is less likely to be introduced by operators and, as a result, pilots may not be fully prepared to recognize and mitigate hazards encountered during flight.
5. If organizations do not use modern safety management practices and do not have a robust safety culture, then there is an increased risk that hazards will not be identified and mitigated.
6. When testing an emergency locator transmitter's (ELT) automatic activation system, a sticking g-switch may go undetected if more than 1 football throw is necessary to activate the ELT. As a result, the ELT might not activate during an accident, and search-and-rescue assistance may be delayed, placing flight crews and passengers at an increased risk for injury or death.

4.1 Safety action taken

4.1.1 Gander International Airport Authority

The Gander International Airport Authority has stockpiled blankets in the air terminal building to supplement the existing supply of blankets in the emergency response trailer. The Gander International Airport Authority has updated its Emergency Co-ordination Center contact list to include Allied Aviation, a ground handling company.

This report concludes the Transportation Safety Board of Canada's investigation into this occurrence. The Board authorized the release of this report on 13 September 2017. It was officially released on 27 September 2017.