Aviation Investigation Report A16P0078

The Inland Air Charters Ltd. de Havilland DHC-2 Mk. I Beaver aircraft (registration C FJOM, serial number 1024) was conducting a crosswind landing at Kitkatla Water Aerodrome, British Columbia, with the pilot and 6 passengers on board. At approximately 1440 Pacific Daylight Time, the aircraft landed on its left float with sufficient force to cause the aircraft to bounce back into the air. Its right float then struck the water, causing the float support structure to collapse. The aircraft nosed over, and water entered the cabin. All 7 occupants evacuated as the aircraft's cabin became submerged. The aircraft came to rest close to shore, and local boaters were able to rescue the pilot and passengers immediately. One passenger sustained serious injuries, and the remaining passengers and the pilot sustained minor injuries. The aircraft was not equipped with an emergency locator transmitter. There was no post-impact fire.

History of the flight

At approximately 1420 ^{Footnote 1} on 24 May 2016, the float-equipped de Havilland DHC-2 Mk. I Beaver aircraft (registration C-FJOM, serial number 1024) operated by Inland Air Charters Ltd. (hereafter referred to as Inland Air) departed from Prince Rupert / Seal Cove Water Aerodrome (CZSW), British Columbia, for a scheduled visual flight rules (VFR) flight to Kitkatla Water Aerodrome (CAP7), British Columbia. The flight to CAP7, about 30 nautical miles to the south, was to take approximately 20 minutes. Seven persons, including the pilot, were on board the aircraft, and the baggage compartment contained a few small lightweight items. A second Inland Air aircraft, also a DHC-2 Mk. I Beaver (registration C-FKDC), supplemented the flight by transporting the passengers' groceries and larger baggage.

The passengers boarded C-FJOM through the left-side passenger door. The pilot then gave a safety briefing, which included information on the locations of the aircraft's personal flotation devices (PFDs), the locations of the cabin exits and, as required by Inland Air's company policy, a description of how the exits operate for passengers seated next to exits. The briefing did not include a demonstration of the exits' use, which was not required by regulation or company policy.

During the pilot's safety briefing, the 3 passengers in the middle row (a bench seat) had difficulty locating and securing their seat belts and did not focus their attention on the briefing. After the occurrence, those passengers could not recall information about the various safety features of the aircraft, including the use of the main cabin door handles or the location and use of the aircraft's PFDs.

The departure and cruise portions of the flight were uneventful. Prior to commencing their approaches, the pilots of the 2 aircraft discussed the approach plan over the radio and agreed that C-FKDC, carrying the baggage, would land first. C-FJOM would then land and disembark passengers, after which C-FKDC would bring the baggage to the dock.

C-FKDC made a west-northwestbound approach into the wind and landed without incident.

The pilot of C-FJOM determined that the wind and water-surface conditions at Kitkatla were suitable for a crosswind landing, and carried out an approach directly toward the shoreline and dock (Figure 1). The aircraft touched down approximately 200 m from shore.

During the landing approach, the pilot of C-FJOM used a side slip technique to counteract the crosswind from the right, which increased the rate of descent. ^{Footnote 2} In a crosswind landing on water, the upwind float (in this case, the right float) normally touches down first. However, in this occurrence, left lateral drift was not eliminated and the left float touched down first with sufficient force to cause the aircraft to bounce. The float support structure and the left wingtip sustained damage due to this initial impact with the water surface.

When the aircraft subsequently touched down on the right-hand float, the float support structure collapsed. C‑FJOM entered the water in a steep nose-down attitude before coming to rest inverted and partially submerged. The aircraft rapidly filled with water. The occupants, who were submerged in cold water and partially upside down, were able to escape the submerged cabin with varying degrees of difficulty. Boaters arrived on scene immediately and assisted with the egress of the aircraft occupants (Figure 2).

The aircraft was not equipped with an emergency locator transmitter (ELT) at the time of the occurrence.

Injuries to persons

Though restrained by a lap belt, the passenger who was seated directly behind the pilot sustained serious injuries.

Table 1. Injuries to persons

	Crew	Passengers	Others	Total
Fatal	0	0	−	0
Serious	0	1	−	1
Minor/none	1	5	−	6
Total	1	6	−	7

Weather and sea conditions

The weather conditions forecast for CZSW for the period of the flight included scattered clouds based at 5500 feet above sea level, visibility of 9 statute miles, and winds varying in direction from the southwest to northwest at approximately 10 knots, gusting to 18 knots. The wind recorded by marine buoy Hecate, located 26 nautical miles southwest of Kitkatla, was northwest at 14 to 16 knots, with wave heights of 1 to 3 feet.

There are no aviation weather services available at CAP7 for aircraft operating to and from this aerodrome that can record weather conditions at, or provide official weather forecasting for, Kitkatla. At the time of the occurrence, wave heights at Kitkatla were observed to be approximately 1 foot or greater, with occasional whitecaps, in a strong westerly or north-northwesterly wind.

Aircraft information

General

Records indicate that the aircraft was certified, equipped, and maintained in accordance with existing regulations and approved procedures. No issues regarding the operation of the engine were reported, and no current defects were recorded in the journey logbook, other than the removal of the aircraft's ELT. The aircraft's weight and balance for the occurrence flight were calculated during the investigation using the operator's recorded fuel volume, segmented weight figures for passengers ^{Footnote 3 Footnote 4 Footnote 5} and the most recent weight-and-balance report, dated 21 May 2014. The total take-off weight and centre of gravity were within the aircraft's limitations.

C‑FJOM was manufactured in 1956 and was equipped to carry a pilot and 6 passengers. The aircraft cabin layout consisted of 3 rows of seats. The 1st row had 2 seats, each equipped with a lap belt and a shoulder harness; the pilot's seat was on the left side. Adjacent to each 1st‑row seat was a door with a slide-down window. The second row consisted of a 3‑seat, forward-facing bench that was secured to the cabin floor and equipped with 3 lap belts. There were identical main cabin doors on each side of the 2nd‑row bench seat. The 3rd row consisted of a removable sling seat, similar to a canvas hammock, supported by 1 upper bar and 1 lower bar. The sling seat was forward-facing and equipped with 2 lap belts. Passenger access to the sling seat was through either of the main cabin doors. Behind the sling seat, and open to the cabin area, was the baggage compartment with a removable cargo restraint net.

The aircraft had been modified over its lifetime by means of supplemental type certificates (STCs) ^{Footnote 6} (Appendix A). The modifications had included an extension of the cabin to enlarge the baggage compartment and the addition of 4 rectangular windows (2 per side) in the new baggage compartment. None of the occurrence aircraft's windows were designed to serve as emergency exits. The enlarged baggage compartment was fitted with an access door beneath the windows on the left side of the aircraft. The extent of STC installations on C-FJOM required that the original DHC-2 Mk. I Beaver aircraft flight manual be replaced with aircraft flight manual B75191, a version of the manual that incorporates supplemental information pertinent to the modifications.

Other safety-related retrofit modifications issued by the original equipment manufacturer (OEM) ^{Footnote 7} issued for this aircraft model in recent years have included emergency exit windows and redesigned interior door handles that add a 2nd, more easily accessible, handle to the main cabin doors. These optional devices were assessed by the operator but not installed on C-FJOM.

The investigation determined that physical modifications to the aircraft did not play a role in this occurrence.

Damage to the aircraft

The initial impact of the aircraft on the water produced a side load from the left, which in turn applied a counter-clockwise roll moment (viewed from behind) to the left-hand float. This event fractured the left-hand support struts at the bottom-end attachments. The side load was transmitted through the spreader bars to the right-hand float. Strut geometry forced the right-hand float out and upward. The right-hand float strut fractures exhibited a clockwise rotation (opposite to the left-hand float), indicating that a second impact had occurred on the right side, which pushed the right-hand float further upward. The right‑hand float contacted and bent the right-hand wing strut, and the float transom gouged a hole in the aft fuselage. At some point in the sequence, the front left spreader bar attachment fractured and the left-hand wingtip struck the water (Figure 3).

Visual examination of the fracture surfaces on the ends of the float struts and attachments revealed overload fractures in all cases, with no evidence of pre-existing progressive failure modes. The front left spreader bar attachment was examined in greater detail and also revealed an overload fracture. Its material composition, electrical conductivity, and hardness were assessed and found to be within the specifications for the material. The float attachment fittings were appropriate for the modifications to the aircraft.

All control surfaces were in place and all windows remained intact. Damage to the fuselage during the accident sequence prevented the pilot's door from being operated. The passengers had not attempted to open any of the other 3 doors. The baggage compartment access hatch (on the left side and at that time oriented above the window) had been forced open by a passenger and provided the sole means of passenger evacuation.

Pilot information

The pilot held a Canadian airline transport pilot licence valid for single- and multi-engine land and sea aeroplanes. Records indicate that the pilot was certified and qualified for the flight in accordance with existing regulations.

The pilot had about 13 years of flight experience, including about 3000 hours on the DHC-2 Mk. I Beaver, and had worked for the operator since April 2014. Pilot training records indicate that the pilot received aeroplane-related initial training on C-FJOM in February 2016. This specific aircraft required training separate from that of the standard DHC-2 Mk. I Beaver, because of the differences in performance and handling introduced by a number of modifications.

Other training, less specific to this particular aircraft, was completed in April 2016. It covered emergency procedures, including passenger preparation for an emergency landing or ditching, emergency evacuation procedures, and the donning and inflation of PFDs. The pilot had undergone practical training in underwater egress while employed with another operator.

Company records indicate that the pilot had been on duty for about 7 hours and had flown C-FJOM for about 2 hours before the occurrence. The pilot's rest period since the previous duty day had been 16.5 hours. In the previous 7 days, the pilot had recorded 32 hours of duty time, and he was working a 2nd consecutive day following 2 days off. Although the investigation did not determine the pilot's sleep periods for the 2 days before the occurrence, fatigue was not considered to be a contributing factor.

Pilot decision making

Pilot decision making (PDM) can be described as the ability to recognize potential hazards and forecast the outcome of different scenarios in order to select the best option. Canadian Aviation Regulations (CARs) section 703.98 states, "Every air operator shall establish and maintain a ground and flight training program," and sets out the requirements for the training program. The ground training program at Inland Air did not include dedicated PDM training. However, the CARs do not require that an operator's training include PDM.

Transport Canada (TC) technical publication (TP) 13897, Pilot Decision Making, is divided into 5 modules, one of which addresses the decision-making process. The process typically follows 4 steps: gathering information, processing information, making decisions, and acting on those decisions. TP 13897 describes the risks that exist during the information‑gathering and –processing steps. If pilots use incorrect information in the decision‑making process, it is likely that they will make an ineffective decision.

Furthermore, pilots' prior training and experience influence the decisions they make, because pilots are likely to use procedures that have worked previously. As a result, it is vital that pilots be trained on how to apply PDM in a variety of different operational settings to ensure that risk remains at acceptable levels during operational duties.

To accomplish this, pilots must be provided the opportunity to practise PDM in operationally realistic scenarios that require a careful consideration of all available factors and options to help them reach an acceptable decision based on the conditions present at that time.

Air operators are required to establish and maintain a company operations manual (COM), which "shall include the instructions and information necessary to enable the personnel concerned to perform their duties safely." ^{Footnote 8} Under current regulations, CARs Subpart 703 (air taxi) and Subpart 704 (commuter) operators are not required to provide training in crew resource management (CRM), PDM, or threat-and-error management.

Survivability

The DHC-2 Mk. I Beaver main cabin door on the left side of the aircraft is normally used for embarking and disembarking passengers, and is usually operated by the pilot. The pilot usually used the left door at the front of the aircraft to enter and exit the aircraft.

The interior handle on the main cabin doors is located near the aft edge of the door, immediately below the window. The handles are most easily accessed by passengers sitting in the rear sling seat. All of the aircraft's interior door handles (Figure 4) consist of a short metal bar mounted in a shallow circular recess. Occupants open the cabin doors by rotating the bar with their thumb and fingertips. Because the aircraft is usually positioned such that the dock is to its left side, the doors on the right are rarely used. Inland Air did not require that passengers physically open and close the doors as part of the safety briefing, and the passengers on the occurrence flight did not do so.

The investigation determined that, despite having received a safety briefing from the pilot, one of the passengers was unaware that there was a main cabin door on the right side of the aircraft. None of the passengers were able to describe the door handles and none recalled being told how to operate them. They also were unable to recall whether they had been informed of the location of the on-board PFDs or provided with instructions on how to use them.

Under current regulations, occupants of seaplanes are not required to wear PFDs. The TSB has previously identified the risks associated with occupants of seaplanes not wearing devices that provide personal flotation following emergency egress. Following its investigation into a 2009 occurrence involving a DHC-2 Mk. I Beaver that crashed into the water shortly after takeoff, ^{Footnote 9} and in response to the large number of drowning fatalities that occur following emergency egress from aircraft in water, the Board recommended that

In January 2017, in its most recent response to this recommendation, TC indicated that new regulations requiring that PFDs be used by all seaplane occupants would come into effect in 2017. The requirements would exclude the use of automatically inflating devices and permit only devices that are inflated manually. As of October 2017, these regulatory changes have not come into effect.

When the aircraft nosed over, the occupants became submerged in cold water that was contaminated with fuel and oil, and some passengers were incapacitated by severe stinging pain in the eyes. Despite this hazard, all of the passengers found their way to the surface of the water or were helped there by others. One passenger was able to break open the aft baggage compartment hatch, and all 6 passengers evacuated through that opening while it remained partially above the surface of the water. The last passenger to evacuate had been seated in the right-hand seat of the first row, and was temporarily restrained by the strap of a carry-on bag looped around his neck. None of the 7 available PFDs were removed from their storage locations.

The pilot was wearing a jacket with a built-in PFD. The jacket had a feature that was designed to automatically inflate the PFD when immersed in water. When water filled the aircraft cabin, the pilot's PFD automatically inflated. After removing his seatbelt, the pilot opened the window on his door. However, the inflated PFD added to the bulk of the pilot's upper torso and prevented a head-first evacuation through the window. After attempting unsuccessfully to kick the windshield out, the pilot was able to exit the immersed aircraft cabin feet first through the window on his door.

Because the aircraft came to rest within close proximity to the seaplane dock, rescuers were able to reach the scene immediately. The first passengers out of the aircraft assisted the remaining passengers, and all occupants were pulled into boats and taken ashore.

Safety management and safety culture

General

In the air transport industry, safety management refers to an organization's ability to identify hazards in its operations (e.g., flight operations, maintenance operations) and to take measures to eliminate those hazards or put measures (i.e., defences) in place to reduce the risk of undesirable consequences to as low as reasonably practicable.

While many companies have recognized the benefits of safety management systems (SMSs) and voluntarily begun implementing them within their organizations, approximately 90% of all Canadian aviation certificate holders are still not required by regulation to have an SMS. As a result, TC does not have assurance that these operators are able to effectively manage safety.

Following its 2013 investigation into the controlled flight into terrain accident in Moosonee, Ontario, ^{Footnote 10} the TSB identified this as a safety deficiency and recommended that

TC's response to Recommendation A16-12 in September 2016 was as follows:

Transport Canada agrees in principle with the recommendation.

TC will address this recommendation in two ways. First, by continuing to promote voluntary adoption of a safety management system among the balance of commercial air operators. To support this, the department will publish updated guidance material aimed at smaller sized-operations [sic] this year. Secondly, over the next year and a half, the department will be reviewing the policy, regulations and program related to safety management systems in civil aviation. The expected outcome of the review is a determination on the scope, regulatory instrument, applicability and oversight model.

The Board was unable to assess TC's response to Recommendation A16-12 in November 2016, as there was no clear indication of what actions will be taken by TC once the review is complete. TC provided no indication as to whether or not it intends to initiate a rule‑changing process to require all commercial aviation operators to implement a formal SMS.

All transportation organizations can benefit from implementing some form of safety management. However, if the process is informal, and policies and procedures are not written for the benefit of all company personnel and customers, day-to-day practices can eventually become subject to recollection and individual interpretation of verbal rules or procedures. This informal process may not address or identify the various hazards that a seaplane operation, for example, faces on a daily basis.

An organization that is committed to managing safety effectively is governed according to a philosophy of continual improvement that is clearly communicated to employees and stakeholders, both explicitly (through values and mission statements) and implicitly (through day‑to‑day actions). This philosophy is formalized through policies that clearly communicate the operating system in place and recognize the contribution of each person within, or outside, the organization to improving that system.

Inland Air Charters Ltd.

Inland Air operates a single-engine, day VFR, air taxi transportation service under CARs Subpart 703. The company's main base is in Prince Rupert, British Columbia, and it operated 7 DHC‑2 Mk. I Beaver aircraft on floats at the time of the occurrence.

Although not required by regulation for air taxi operations, Inland Air used an informal safety management system, which was outlined in a company manual. Safety management at Inland Air relied on pilot training, customer feedback, semi‑annual staff safety meetings, informal verbal processes, and an open policy whereby employees were encouraged to report and discuss any issues or threats to safety with co-workers and company management.

A formalized approach to safety requires the proactive consideration and management of risk, where PDM, CRM, and threat‑and‑error management are vital safety-management tools. Section 10 of the Inland Air COM notes the importance of training staff "to identify and document potential hazards and incidents." ^{Footnote 11} However, there was no formal method at Inland Air for documenting and assessing identified hazards or risks such as those associated with this occurrence.

TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada's transportation system even safer.

Safety management and oversight

Safety management and oversight is a Watchlist 2016 issue.

As this occurrence demonstrates, some transportation companies are not managing their safety risks effectively, and many are not required to have formal safety management processes in place. TC oversight and intervention have not always been effective at changing companies' unsafe operating practices.

Safety oversight by Transport Canada

TC's departmental vision "is to have a transportation system […] that is recognized worldwide as safe and secure, efficient and environmentally responsible." ^{Footnote 12} For Transport Canada Civil Aviation (TCCA) in particular, that means "an integrated and progressive […] system that promotes a proactive safety culture." ^{Footnote 13}

According to TC's Advisory Circular (AC) SUR 004,

TCCA's surveillance program includes assessments, program validation inspections (PVIs) and process inspections (PIs). The program verifies that enterprises are complying with regulatory requirements and that they have effective systems in place to ensure they comply with regulatory requirements on an on-going basis. ^{Footnote 14}

CARs Subpart 703 operators are not required to implement an SMS, and Inland Air's SMS was therefore not subject to TC oversight or inspections for regulatory compliance.

Inland Air was on a 3-year PVI cycle. The last TC oversight activity for this operator had been a PVI in September 2013, which was focused on the operator's quality assurance program. As a result of oversight activities, the operator was required to submit corrective action plans (CAPs) to TC. In the operator's required analysis of its safety deficiencies, it identified issues such as insufficient staffing, inadequate training, a lack of procedures, and omission by pilots to enter defects into aircraft journey logbooks.

On 09 May 2016, about 2 weeks before this occurrence, an incident involving the same operator occurred in Masset, British Columbia. As a result of that incident, TC inspectors scheduled a visit to Inland Air's main base at CZSW, which took place the day after the occurrence at Kitkatla. Following the TC visit, in response to deficiencies identified by TC inspectors in the company's maintenance quality assurance program, Inland Air was placed on an enhanced monitoring program. This level of oversight is described in Advisory Circular (AC) SUR‑004 as follows:

Enhanced Monitoring (EM) shall be used when an enterprise's compliance and/or safety record would indicate that an increased TCCA presence is needed to:

1. Oversee an enterprise's return to a state of compliance with regulatory requirements; and
2. Gain the confidence that the enterprise can adequately maintain compliance with those regulatory requirements. ^{Footnote 15}

Safety defences at Inland Air Charters Ltd.

Flight following

Flight following at Inland Air was carried out by recording pilot reports of landings and departures and estimated times en route. This information was shared between dispatchers at CZSW and at CAP7.

Emergency locator transmitter

Following the occurrence, no distress signal was received by the Cospas-Sarsat search and rescue satellite system ^{Footnote 16} because the aircraft's ELT had been removed 4 days previously for its annual performance check. The appropriate entry had been made in the journey logbook. In accordance with CARs section 605.39, Subpart 703 operators may operate an aircraft without a serviceable ELT for up to 30 days when it has been removed for maintenance.

Although the Inland Air COM required that the location of the ELT be included in the standard safety briefing prior to takeoff, the pilot did not mention that the ELT was missing in his pre-flight safety briefing to the passengers.

SPOT tracker

The operator employed a third safety defence by means of a SPOT tracker handheld device located in each aircraft. The SPOT tracker provides position messages regarding the aircraft's location and sends a pre-programmed distress message to search and rescue, first responders, and company personnel, when activated manually by someone on board. This device was not operational at the time of the occurrence because the batteries had been depleted. There was no way to visually determine the unit's battery life, and the unit was not subject to periodic battery replacement.

Safety studies

TSB Aviation Safety Study SSA93001

In 1993, the TSB released Aviation Safety Study SSA93001, A safety study of piloting skills, abilities, and knowledge in seaplane operations, in which 1432 seaplane accidents were examined "to identify areas of seaplane operations where safety deficiencies might exist and which might require further study." ^{Footnote 17} The study report states the following:

During the initial examination of the seaplane accidents, it appeared that contributing factors which could be associated with the pilots' levels of skills, abilities, and knowledge had been cited in a significant number of cases. ^{Footnote 18}

Some of the 10 most frequently cited factors contributing to seaplane accidents were:

• selection of unsuitable area for takeoff, landing, or taxiing
• unfavourable wind
• improper compensation for wind conditions
• improper landing flare
• operation beyond pilot experience/ability level ^{Footnote 19}

The report concluded that, based on the nature of the contributing factors most frequently cited, it appeared that "the accident seaplane pilots lacked the necessary skills, knowledge, and abilities to operate safely." ^{Footnote 20} It went on to state the following:

Seaplane pilots have to rely on their own experience and on advice from others in the seaplane environment to develop their skill and knowledge. ^{Footnote 21}

[…]

Consequently, [these] pilots tend to acquire skills and knowledge through trial and error, peer example, and hearsay; this is not the most appropriate way to develop the required abilities. ^{Footnote 22}

The study culminated in several Board recommendations; most were addressed by TC in responses that were assessed as Fully Satisfactory.

Despite this, the proportion of accidents remained high in air taxi operations. In 2015, the Board initiated a safety study ^{Footnote 23} on these operations in particular. At the time of writing of this report, the study was ongoing.

TSB laboratory reports

The TSB completed the following laboratory report in support of this investigation:

• LP144/2016 − GPS [global positioning system] Analysis de Havilland DHC-2 Mk. I, C-FJOM

The investigation found no evidence of pre-existing fractures or of other defects with the aircraft. Therefore, the analysis will focus on the operational aspects of the approach and landing, as well as on safety defences.

Approach and landing

Landing a seaplane with a crosswind in rough water can challenge even the most skilled pilot. Under such conditions, the demands on the pilot and the risk of adverse consequences are high. In this occurrence, 4 of the 10 most frequently cited factors contributing to seaplane accidents, identified in TSB's Aviation Safety Study SSA93001, are applicable. All 4 of those factors are related to recognizably unsafe conditions and to piloting skills. This accident occurred during an attempt to carry out a seaplane landing in conditions that included the following:

• selection of an unsuitable area for takeoff, landing, or taxiing: the orientation of the approach and landing toward the shoreline reduced the options available to the pilot, placing the aircraft at increased risk compared to the into-wind approach and landing;
• unfavourable wind: the pilot elected to take a more challenging gusty crosswind condition instead of carrying out an into-wind approach and landing;
• improper compensation for wind conditions: there was lateral drift upon water touchdown, which compromised the float support structure; and
• improper landing flare: the pilot did not arrest the rate of descent sufficiently during the landing flare, which resulted in a hard first impact with the water and subsequent structural damage, which then led to the collapse of the float support structure.

C-FJOM and C-FKDC landed at Kitkatla within a short time of one another. The pilots were faced with the same environmental conditions, which presented them with similar challenges in relation to the approach and the landing surface. However, each pilot chose a different approach and landing area.

Given that coastal seaplane flying often presents complex challenges involving dynamic weather and sea conditions, it is not possible for operators to produce policies and guidance for all potential scenarios. Inland Air Charters Ltd. (Inland Air) did not have policies directing its pilots to land in specific directions or areas. Consequently, pilots were individually responsible for evaluating and planning their landing approaches at Kitkatla. In these circumstances, pilot decision making is influenced by the individual pilot's skills, experience, and preferences.

In this occurrence, the pilot had extensive experience flying into Kitkatla during his 2 years of employment with Inland Air, and his training had included crosswind landings in rough water conditions. This experience likely influenced the pilot's decision-making process, leading the pilot to underestimate the increased risks associated with a crosswind approach and landing in gusty wind conditions in the presence of waves with whitecaps. As a result of this, the decision to carry out a water approach and landing in gusty crosswind conditions, when lower‑risk options were available, placed the aircraft occupants at increased risk of a landing-related accident.

During the final stages of the approach, the pilot elected to continue the approach to touchdown in gusty crosswind conditions and wave conditions that included whitecaps, despite the presence of a high rate of descent and left lateral drift. This resulted in the downwind (i.e., left) float touching down hard on the water, which is contrary to the normal crosswind water landing technique. This placed significant stress on the float support structure and caused the aircraft to then impact the right float, ultimately resulting in the failure of the float support structure. The aircraft touched down on the water with a high rate of descent and lateral drift, causing the float support structure to collapse and the aircraft to flip over in the water.

Safety defences

Pilot decision making

Pilot decision making (PDM) training is designed to help pilots recognize when not to challenge unsafe conditions. That requires pilots to be able to gather information (i.e., cues) from their environment, process that information to determine what it means to them, then make and implement a decision based on the various options and risks associated with each option. However, breakdowns can occur at any of the 4 steps in the PDM process. As a result, if pilots do not accurately assess the wind and water conditions, they may not fully appreciate the risk, and they may select a sub-optimal course of action to implement.

As seen in this occurrence, 2 options were readily available: an into-wind approach and landing or a crosswind approach and landing. The occurrence pilot opted for the crosswind approach and landing, as opposed to an into-wind approach and landing. This decision, which was likely based on previous successful outcomes in similar conditions, resulted in the acceptance of an increased level of risk.

Although the operator's ground training met regulatory requirements, it did not include dedicated PDM training for company pilots. As a result, without being exposed to different operational scenarios, it would be unrealistic to expect that Inland Air pilots would consistently apply the PDM process in an effective manner when faced with multiple potential options. If pilots are not trained in an operationally realistic setting to apply PDM processes, they may make operational decisions that increase the risk of accidents.

Pre-flight safety briefing

Passenger comprehension and retention of the critical information presented in a passenger safety briefing is of utmost importance, especially during an emergency. Comprehension is a product of the delivery of information and the receipt of that information. In this occurrence, the passengers received a pre-flight safety briefing from the pilot. However, they were not adequately prepared for an emergency egress and experienced considerable difficulty egressing the aircraft. This was because some critical information was not included in the safety briefing, the pilot did not confirm that the occupants understood their role in the event of an emergency, and the passengers were preoccupied with getting ready for departure, which prevented them from paying close attention and asking questions during the pre-flight safety briefing.

Due to the routine nature of pre-flight safety briefings, and the unlikelihood of a mishap, it is easy to understand why pre-flight safety briefings are often seen as a formality, and not something that will be used. However, this occurrence highlights the importance of the pre‑flight safety briefing and the influence it can have on an emergency egress. If flight crews do not confirm that passengers understand the applicable emergency egress procedures, there is a risk that passengers will be unable to egress an aircraft in emergency situations, thereby increasing the risk of passenger injury or death.

This occurrence also highlights the importance of passengers paying attention to pre-flight safety briefings and asking questions to resolve potential areas of uncertainty. In this occurrence, that did not happen. As a result, when the aircraft flipped over in the water, the passengers had considerable difficulty egressing the aircraft and lacked critical information about available exits (i.e., the right-side cabin door) that would have been useful during the egress effort. If passengers do not take an active role in ensuring comprehension of the pre‑flight safety briefing, there is a risk that they will be unable to egress an aircraft in emergency situations, thereby increasing the risk of injury or death.

Personal flotation devices

The passengers were not wearing personal flotation devices (PFDs), nor were they required to do so by regulation. In this occurrence, the number of vessels in close proximity enabled a quick rescue of the aircraft's occupants. Although the pilot was wearing a PFD, it was designed to automatically inflate on immersion, and its inflation hindered and delayed the pilot's evacuation. Until proposed regulations requiring seaplane occupants to wear PFDs, excluding automatically inflating devices, come into effect, the drowning risks addressed by TSB Recommendation A11-06 will persist. Passengers and pilots not wearing some type of suitable flotation device prior to an impact with the water are at increased risk of drowning once they have escaped the aircraft.

Emergency locator transmitter

In this occurrence, the emergency locator transmitter (ELT) had been removed for maintenance purposes. Although this was permitted by regulation, it highlights a residual risk that exists during those periods when an aircraft is operated without an ELT. In this particular instance, a number of vessels were in close proximity and were able to render assistance immediately following the occurrence, which may not always be the case. If aircraft are permitted to operate without a serviceable ELT, there is a risk that critical search–and‑rescue services will be delayed following an accident.

At Inland Air, the company's risk assessment relied, in part, on a secondary notification system (a SPOT tracker), and did not identify the temporary removal of an ELT as an unacceptable safety risk. However, without any way to visually determine the unit's battery life, combined with the fact that the unit was not subject to periodic battery replacement, the company was unaware that the SPOT tracker's batteries were depleted. As a result, the potential safety benefits gained by having the SPOT tracker on board were not available on the occurrence flight.

While not required by regulation, the SPOT tracker is another means of flight following that has the potential to help locate an aircraft involved in an accident. If available flight-following equipment is not properly inspected and maintained, there is an increased risk that the equipment will not function as intended following an occurrence.

Findings as to causes and contributing factors

1. The aircraft touched down on the water with a high rate of descent and lateral drift, causing the float support structure to collapse and the aircraft to flip over in the water.
2. The decision to carry out a water approach and landing in gusty crosswind conditions, when lower‑risk options were available, placed the aircraft occupants at increased risk of a landing-related accident.

Findings as to risk

1. If pilots are not trained in an operationally realistic setting to apply pilot decision‑making processes, they may make operational decisions that increase the risk of accidents.
2. If flight crews do not confirm that passengers understand the applicable emergency egress procedures, there is a risk that passengers will be unable to egress an aircraft in emergency situations, thereby increasing the risk of passenger injury or death.
3. If passengers do not take an active role in ensuring comprehension of the pre-flight safety briefing, there is a risk that they will be unable to egress an aircraft in emergency situations, thereby increasing the risk of injury or death.
4. Passengers and pilots not wearing some type of suitable flotation device prior to an impact with the water are at increased risk of drowning once they have escaped the aircraft.
5. If aircraft are permitted to operate without a serviceable emergency locator transmitter, there is a risk that critical search‑and‑rescue services will be delayed following an accident.
6. If available flight-following equipment is not properly inspected and maintained, there is an increased risk that the equipment will not function as intended following an occurrence.

Other finding

1. Although the pilot was wearing a personal flotation device, it was designed to automatically inflate on immersion, and its inflation hindered and delayed the pilot's evacuation.

The Board is not aware of any safety action taken following this occurrence.

This report concludes the Transportation Safety Board of Canada's investigation into this occurrence. The Board authorized the release of this report on 17 January 2018. It was officially released on 22 January 2018.

Appendix A – C-FJOM supplemental type certificates

APPROVAL #: SA90—2
ISSUE: 1
DATE OF APPROVAL: OCTOBER 11 1990  DATE OF ISSUE: OCTOBER 11 1990
CABIN EXTENSION

APPROVAL #: SA95—44
ISSUE: 1
DATE OF APPROVAL: MAY 15 1995
DATE OF ISSUE: MAY 16 1995
SHOULDER HARNESS

APPROVAL #: SA97—88
ISSUE: 9
DATE OF APPROVAL: JUNE 25 1997
DATE OF ISSUE: MAY 9 2011
STRUT ATTACHMENT/REINFORCEMENT OF WING AT PRODUCTION JOINT

APPROVAL #: SF99—201
ISSUE: 1
DATE OF APPROVAL: JUNE 14 1999
DATE OF ISSUE: JUNE 14 1999
INCREASE BOUYANCY OF FLOATS

APPROVAL #: SA99—228
ISSUE: 3
DATE OF APPROVAL: JULY 28 1999
DATE OF ISSUE: MAY 9 2011
INSTALL FLOATS OF EDO 4930

APPROVAL #: P-LSAO3-107
ISSUE: 1
DATE OF APPROVAL JULY 10 2003
DATE OF ISSUE: JUL 10 2003
EXTENDED RADIAL ENGINE MOUNT

APPROVAL #: P—LSA13-071/D
ISSUE: 1
DATE OF APPROVAL: NOVEMBER 18 2003
BATTERY TRAY EXTENSION/INSTALLATION OF GILL G-247 BATTERY