Aviation Investigation Report A16P0186

On 13 October 2016, a privately operated Cessna Citation 500 (registration C-GTNG, serial number 500-0169), departed Kelowna Airport (CYLW), British Columbia, on an instrument flight rules night flight to Calgary/Springbank Airport (CYBW), Alberta. The pilot and 3 passengers were on board. Shortly after departure, at about 2135 Pacific Daylight Time, the aircraft made a tight right turn as it was climbing through 8600 feet above sea level, and then entered a steep descending turn to the right until it struck the ground. All of the occupants were fatally injured. Impact forces and a post-impact fire destroyed the aircraft. No emergency call was made, and no emergency locator transmitter signal was detected.

Le présent rapport est également disponible en français.

1.1 History of the flight

At 0730,^{Footnote 1} on the morning of 13 October 2016, the privately operated Cessna Citation 500 (C500) (C-GTNG) departed from Calgary/Springbank Airport (CYBW), Alberta, for Kelowna Airport (CYLW), British Columbia. The weather conditions at CYLW were light winds and broken clouds at 3900 feet above sea level (ASL), with light rain and visibility of 9 statute miles (sm). After arriving at CYLW, at about 0830, the pilot secured the aircraft and proceeded to a hotel to rest.

The pilot returned to CYLW at approximately 1830 to prepare for the flight back to CYBW. At 2039, the pilot filed an instrument flight rules (IFR) flight plan using an Internet-based flight-planning software program. The flight-planned route to CYBW was via the MENBO and IGVEP waypoints, and the flight was expected to take 46 minutes at a cruise altitude of flight level (FL) 250.^{Footnote 2}

The pilot and 3 passengers boarded the aircraft. At 2126, the pilot obtained an IFR clearance from the CYLW ground controller for the KELOWNA SEVEN DEP standard instrument departure (SID) procedure for Runway 34 (Appendix A).

The instructions for the Runway 34 KELOWNA SEVEN DEP SID were to climb to 9000 feet ASL, or to an altitude assigned by air traffic control (ATC), and to contact the Vancouver Area Control Centre (ACC) after passing through 4000 feet ASL. The aircraft was then to climb and track 330° magnetic (M) inbound to the Kelowna non-directional beacon (LW). From LW, the aircraft was to climb and track 330°M outbound for vectors to the filed or assigned route.

At 2127, C-GTNG began to taxi toward Runway 34. At 2131, the CYLW tower controller cleared the aircraft to take off from the intersection of Runway 34 and Taxiway D. The pilot acknowledged the clearance and began the take-off roll on Runway 34 about 1 minute later. Radar data showed that, at 2133:41, the aircraft was 0.5 nautical miles (nm) beyond the departure end of the runway and was climbing at more than 4000 feet per minute (fpm) through 2800 feet ASL, at a climb angle of approximately 16°. In that time, it had deviated laterally by about 3° to the right of the 330°M track associated with the SID.

At 2134:01, when the aircraft was 1.2 nm beyond the runway, it had climbed through 3800 feet ASL and deviated further to the right of the intended routing. The aircraft's rate of climb decreased to about 1600 fpm, and its ground speed was 150 knots. A short time later, the aircraft's rate of climb decreased to 600 fpm, its climb angle decreased to 2°, and its ground speed had increased to 160 knots.

At 2134:22, the aircraft was 2.1 nm beyond the departure end of the runway, and it was climbing through approximately 4800 feet ASL. The aircraft had deviated about 13° to the right of the intended track, and its rate of climb reached its maximum value of approximately 6000 fpm,^{Footnote 3} with a climb angle of about 22°. The ground speed was roughly 145 knots.

At 2134:39, the aircraft was 2.7 nm beyond the departure end of the runway, passing through 5800 feet ASL, and had deviated about 20° to the right of the intended routing. The rate of climb was approximately 2000 fpm, with a climb angle of about 7°.

According to the SID, the pilot was to make initial contact with the ACC after the aircraft had passed through 4000 feet ASL. Initial contact was made when the aircraft was passing through 6000 feet ASL, at 2134:42.

At 2134:46, the ACC acknowledged the communication and indicated that the aircraft had been identified on radar. The aircraft was then cleared for a right turn direct to the MENBO waypoint once it was at a safe altitude, or once it was climbing through 8000 feet ASL. The aircraft was also cleared to follow the flight-planned route and climb to 10 000 feet ASL.

At 2134:55, the pilot read back the clearance as the aircraft climbed through 6400 feet ASL, with a rate of climb of approximately 2400 fpm. The aircraft was tracking about 348°M at a groundspeed of about 170 knots.

At 2135:34, the aircraft began a turn to the right, which was consistent with the instruction from the ACC. Flying directly to the MENBO waypoint required the aircraft to be on a heading of 066°M, requiring a right turn of about 50°. At this point, the aircraft was still climbing and was passing through 8300 feet ASL. The rate of climb was about 3000 fpm.

The aircraft continued the right turn and was tracking through 085°M. After reaching a peak altitude of approximately 8600 feet ASL, the aircraft entered a steep descending turn to the right, consistent with the characteristics of a spiral dive (Figures 1 to 3).

At 2135:47, the ACC controller cleared C-GTNG to climb to FL 250. The lack of radar returns and radio communications from the aircraft prompted the controller to initiate search activities.

At 2151, NAV CANADA notified first responders, who located the accident site in forested terrain at about midnight. The aircraft had been destroyed, and all of the occupants had been fatally injured.

1.2 Injuries to persons

Table 1. Injuries to persons

	Crew	Passengers	Others	Total
Fatal	1	3	–	4
Serious	0	0	–	0
Minor/None	0	0	–	0
Total	1	3	–	4

1.3 Damage to aircraft

The aircraft was destroyed by impact forces and the post-impact fire.

1.4 Other damage

The aircraft had approximately 2500 pounds of fuel on board at the time of the accident. The investigation was unable to determine how much fuel contaminated the soil or burned during the post-impact fire. An environmental cleanup of the accident site was completed.

1.5 Personnel information

Table 2. Pilot information

Pilot licence	Airline transport pilot licence
Medical expiry date	01 February 2017
Total flying hours	3912.1
Flight hours on type	1.0 dual 525.1 as pilot-in-command
Flight hours in the last 7 days	3.4
Flight hours in the last 30 days	7.1
Flight hours in the last 90 days	28.7
Flight hours on type in last 90 days	26.7
Total hours in actual instrument meteorological conditions (IMC)	729.3
Total hours actual IMC in last 12 months	25.1
Total night flying hours in last 12 months	7.8
Number of night takeoffs in last 6 months	2
Number of night landings in last 6 months	3
Total night takeoffs/landings in last 12 months	19/21

The pilot held a Canadian airline transport pilot licence with a Group 1 instrument rating, renewed on 31 August 2015 and valid until 01 September 2017. He had flown a variety of single-engine aircraft, and had obtained multi-engine aircraft experience primarily on the Cessna Citation 560.

The occurrence aircraft model, the C500, was the first high-performance aeroplane^{Footnote 4} that the pilot had flown as a captain. The pilot had accumulated a total of 525.1 hours as pilot-in-command on the occurrence aircraft.

1.5.1 Pilot training on the Cessna Citation 500

1.5.1.1 Single-pilot operations for the Cessna Citation 500 model

In February 2012, the pilot was hired by Norjet Inc. and completed his initial on-aircraft training for a 2-pilot endorsement on the C500. To qualify for single-pilot operations on C-GTNG, however, the pilot required further training. In November 2013, he completed such training for various Cessna Citation models, including the C500, and was granted an endorsement by Transport Canada (TC) for single-pilot operations on the C500 on 09 December 2013.

The investigation determined that, from 19 March to 09 December 2013, the pilot had flown 61 to 68 flights^{Footnote 5} as the sole pilot on the C500 without the required TC endorsement for single-pilot operations. However, at the time of the accident, the pilot was certified and qualified for single-pilot operations in accordance with existing regulations.

The pilot completed recurrent single-pilot C500 flight simulator training every year from 2012 to 2015. This simulator training included the following modules:

• wind shear;
• low-energy awareness;
• rejected takeoff with a runway visual range of 600 feet;
• ground proximity warning system events;
• traffic alert and collision avoidance system events;
• area navigation (RNAV) / global positioning system (GPS) approaches;
• right-seat duties;
• decision making and judgment;
• resource management (member support and ATC);
• effective use of automated systems;
• situational awareness;
• computation of take-off and landing data;
• instrument takeoff;
• approach to stall recovery, climb, and in-flight manoeuvres; and
• emergency and abnormal procedures.

1.5.1.2 Night currency

The Canadian Aviation Regulations (CARs)^{Footnote 6} state that a pilot must have completed at least 5 night takeoffs and 5 night landings in the previous 6 months in order to carry passengers at night. According to the pilot's logbook and NAV CANADA records, the pilot had completed only 2 night takeoffs and 3 night landings in the 6 months before the accident. Therefore, at the time of the occurrence, the pilot did not meet the regulatory requirements for night currency to carry passengers.

1.6 Aircraft information

The C500 (Figure 4) is a pressurized turbo-fan–powered business and corporate aircraft with a maximum operating altitude of 35 000 feet ASL and retractable landing gear. The occurrence aircraft was approved for day and night visual flight rules (VFR) and IFR operations and was certified for flight into known icing conditions. The occurrence aircraft (C-GTNG) was also equipped with an autopilot (Bendix FSG-70) and an angle-of-attack indicator.

Table 3. Aircraft information

Aircraft registration	C-GTNG
Manufacturer	Cessna Aircraft Company / Textron Aviation
Model	Cessna Citation 500
Year of manufacture	1974

The aircraft was manufactured in 1974 and originally had a 7-seat configuration. In March 1999, the aircraft underwent several modifications, including a change to a 9-seat configuration and an increased baggage capacity at the rear of the aircraft.

1.6.1 Single-pilot operations for the Cessna Citation 500 model

The C500 was originally designed and configured for 2-pilot flight operations (1 pilot and 1 co-pilot). Variants of the Cessna Citation model, such as the C501, were designed by Cessna to enable single-pilot operations.

In 1997, TC issued an Airworthiness Notice^{Footnote 7} in which it recognized the similarities between the models C500 and C501, the latter having previously been authorized by TC for single-pilot operations. The Airworthiness Notice stated that airworthiness certification for single-pilot operation of the C500 can be granted through a Supplemental Type Approval process, with licensing and operational requirements being addressed in accordance with existing regulations. Thus, in addition to pilot endorsement by TC for single-pilot operations for the C500 (licensing), 2 TC approvals (technical and operational) were also required.

1.6.1.1 Technical approval for single-pilot operations

The technical approval for single-pilot operations on C-GTNG consisted of 2 steps. First, TC was required to issue a Limited Supplemental Type Certificate (LSTC) for single-pilot operations of the C500. Then, technical modifications had to be carried out on the occurrence aircraft, as stated in the LSTC.

In April 1999, TC issued LSTC C-LSA05-240/D, which authorized the technical modification of the C500 type for single-pilot operations.

On 28 June 2005, to satisfy the technical requirements of the LSTC, modifications were carried out on the occurrence aircraft, and the following equipment was installed:

• a 3-axis autopilot with approach coupling (Bendix FSG-70),
• a microphone key switch on left control wheel,
• headsets and microphone jacks at the pilot's position, and
• a transponder IDENT button on left control wheel.

On 29 June 2005, TC approved the modifications to C-GTNG, and, on 30 June 2005, TC issued a certificate of airworthiness for C-GTNG, which completed the technical approval requirements set out in the LSTC.

1.6.1.2 Operational approval for single-pilot operations

Further TC operational authorization was required before single-pilot operations could be conducted with the occurrence aircraft.

This requirement was expressly stated in the Airworthiness Notice in regard to single-pilot operations conducted on a C500 that has been modified in accordance with the technical requirements set out in the LSTC. The LSTC further stated, "This LSTC does not authorize single-pilot operations. This modification approval must be used in conjunction with an appropriate operational approval."^{Footnote 8} The airplane flight manual supplement for the single-pilot operation of the C500 reiterates that a specific operational approval from TC is required before an aircraft modified in accordance with the LSTC can be flown by a single pilot.^{Footnote 9}

Although technical modifications were carried out on the occurrence aircraft in accordance with the LSTC, no records were found indicating that the operational approval for single-pilot operations on C-GTNG was ever assessed and granted by TC. The investigation was unable to determine whether a request seeking this operational approval was ever submitted by Norjet Inc. In addition, the investigation determined that there is no formal process in place at TC to assess and grant an operational approval for single-pilot operations on a C500.

1.6.2 Aircraft airworthiness

Airworthiness standards listed in the CARs require aircraft to carry an aircraft flight manual (AFM) on board during flight operations. The AFM, which includes supplements, contains information that applies to that specific aircraft, including limitations, emergency procedures, normal procedures, performance data, and weight and balance. Minimum crew requirement for the aircraft is listed in the "Operating Limitations" section of the AFM. Regulatory compliance with the AFM is included in this section of the manual only.

The aircraft was imported into Canada from the U.S. in June 2005 and was required to be maintained in accordance with an approved maintenance schedule that conforms to CARs Standard 625, Appendices C and D. The last maintenance inspection carried out on the aircraft was completed in March 2016 at 8599 hours airframe time since new. At the time of the occurrence, the aircraft had accumulated a total of 8649 hours airframe time since new.

A review of the entries made in the aircraft journey log 2 days before the occurrence indicated that the windshield anti-ice "HI" setting had been documented as inoperative and "flight into known ice [was] prohibited."^{Footnote 10} An "inoperative windshield anti-ice – HI" placard was installed in the aircraft. The windshield anti-ice system is required to be operational when the aircraft is flown into known icing conditions.

A review of the technical records for the aircraft indicated that the last record of compliance with the Federal Aviation Administration Airworthiness Directive^{Footnote 11} (AD) 79-12-06 was dated 21 December 2007. AD 79-12-06 requires the upper and lower spar cap^{Footnote 12} stems to be inspected for cracking every 600 hours or every 600 landings, whichever comes first, unless Cessna Service Bulletin SB57-10 Rev 4 is carried out.

SB57-10 Rev 4 provides instructions for the installation of upper and lower spar cap reinforcement angles that would eliminate the 600-hour or 600-landing inspection requirement. The aircraft maintenance documents for the occurrence aircraft did not contain any record of the spar cap reinforcement angles having been installed.

The investigation found no record of compliance with AD 79-12-06 since 21 December 2007. At the time of the occurrence, the aircraft had flown 1062 hours and completed 1405 landings since the last spar cap inspection was documented in the technical records. The investigation determined that the aircraft was overdue for the inspection required in AD 79-12-06.

1.6.3 Weight and balance

Weight-and-balance calculations are used to determine whether an aircraft exceeds the allowable take-off weight and is within the specified centre of gravity (C of G) limits. These calculations must be done before every flight. Operating an aircraft outside the C of G limits may affect its stability and, in some instances, may result in a loss of control.

The aircraft was originally certified with a maximum take-off weight of 11 500 pounds. In March 1999, the maximum take-off weight was increased to 12 500 pounds under the authority of Supplemental Type Certificate (STC) SA2172NM and STC SA2646NM.

The aircraft had last been weighed in June 2007. A review of the aircraft's empty-weight-and-balance data sheet revealed no anomalies. However, a review of 2 subsequent amendments to the aircraft's weight-and-balance data sheet found errors in calculation that affected the operational empty weight and C of G location. The pilot had prepared an operational weight-and-balance report for the occurrence flight using the incorrect data from the most recently amended empty weight-and-balance data sheet, leading him to believe that the aircraft was within the required specifications.

The investigation determined that 2 sets of golf clubs were likely placed in the extended rear baggage compartment and 4 small backpacks were likely placed in the nose baggage compartment. Four passengers were listed on the flight plan; however, only 3 boarded the aircraft. The 4th passenger had decided to stay behind. The 3 passengers were seated in the centre rear-facing seats and in the aft divan seat of the cabin in 2 possible seating arrangements:

• 2 passengers seated in the centre rear-facing seats and 1 passenger in the aft divan seat; or
• 1 passenger seated in the centre rear-facing seat and 2 passengers seated in the aft divan seat.

The investigation determined that the aircraft had 2500 pounds of fuel on board and a gross weight of 10 643 pounds at the time of the occurrence. At this gross weight, the C500 weight-and-balance manual specifies that the forwardmost allowable C of G limit is 249 inches. The investigation reassessed the aircraft's operational weight and balance using the correct data, reflecting the exact gross weight and C of G location for both seating arrangements. The investigation concluded that the aircraft was under the allowable maximum take-off weight but outside the forwardmost C of G limit by either 3.4 or 2.4 inches, depending on the actual seating arrangement. This would have had a negligible effect on the aircraft's flight characteristics during takeoff.

1.6.4 Powerplant and engines

The aircraft was equipped with 2 Pratt & Whitney Canada JT15D-1A turbofan engines. The left engine had accumulated a total of 3045 hours and the right engine, a total of 2902 hours, since the last overhaul. The gas generators^{Footnote 13} on both engines had accumulated a total of 1061 hours each since the last overhaul. The engines were capable of producing 2200 pounds of thrust each and were not equipped with thrust reversers.

1.6.5 Stall warning

The pilot would have been warned of an imminent stall on C-GTNG by the aerodynamic buffeting^{Footnote 14} of the aircraft wing. The buffeting wing would have been felt as a shuddering or vibration. The aircraft was not equipped with a visual or aural stall warning system, although it was equipped with an angle-of-attack indicator that would have provided a visual cue of an impending stall.

1.6.6 Autopilot

C-GTNG was equipped with an autopilot (Bendix FSG-70), which maintains lateral, longitudinal, and directional stability of the aircraft in flight without flight control input from the pilot.

If the autopilot fails, the system can be manually disengaged and, if necessary, the drive forces required to operate the autopilot and its related components can be overridden by flight control input from the pilot. An inspection of the autopilot system for any pre-impact anomalies was inconclusive, owing to the post-impact fire. The investigation could not determine whether the autopilot was on or off at the time of the occurrence.

1.6.7 Flight instruments

The investigation determined that the aircraft was equipped with the required instrumentation to conduct the occurrence flight. The instrument flight panel, consisting of analogue instruments, was destroyed by the impact forces and the post-impact fire. The aircraft's technical records and flight plan for the occurrence flight show that the aircraft was equipped with a Bendix/King KLN 900 GPS, and an Argus 7000C/E Moving Map Display.^{Footnote 15} In addition, the following instruments were recovered at the occurrence site:

• a radio magnetic indicator,
• a horizontal situation indicator,
• an angle-of-attack indicator,
• an altimeter,
• a magnetic compass,
• a rate gyro indicator,
• an attitude indicator, and
• airspeed indicators.

The pilot had also taken a portable GPS unit and a laptop on board. The investigation determined that the GPS was likely positioned near the centre windshield. The laptop was destroyed, but the remains of a few analogue flight instruments and the portable GPS unit were secured and sent to the TSB Engineering Laboratory in Ottawa for further analysis. Analysis of the attitude indicator unit revealed that it was powered at the time of the impact. An inspection of the pitot static system for any pre-impact anomalies was inconclusive, owing to the post-impact fire. It was also impossible to extract any data from the portable GPS unit or the 2 cell phones recovered, owing to the impact forces and post-impact fire.

1.6.8 Inverters

An inverter is an electrical component that changes direct current into alternating current used to power flight instruments in the cockpit. Flight instruments, including the attitude indicator, provide information to the pilot on the aircraft's flight situation when no discernible visual reference is available. C-GTNG was equipped with 2 inverters; both were destroyed by the impact forces and post-impact fire.

1.6.9 Emergency locator transmitter

The aircraft was equipped with a 121.5/243 megahertz emergency locator transmitter; however, it was unable to transmit a signal due to damage resulting from the impact forces and post-impact fire.

1.7 Meteorological information

The pilot obtained a weather briefing and recorded the weather conditions at 1800 on the filed flight plan. The investigation determined that the pilot likely obtained additional weather updates after 1800 by using his laptop at the airport before the flight.

The weather at CYLW was forecast to deteriorate as the day progressed. At the time of departure, night marginal VFR conditions prevailed at CYLW, with known IMC expected during the initial climb. The weather report issued at 2116 showed the winds were at 330°M at 6 knots, with visibility of 9 sm in light rain, scattered cloud based at 600 feet above ground level, and broken cloud based at 2300 feet above ground level. The temperature was 7 °C, the dew point was 6 °C, and the altimeter setting was 29.47 inches of mercury. Full weather analysis of the Kelowna area conducted by Environment Canada determined that the weather conditions at CYLW at the time of the accident did not appear to be conducive to significant ice accretion.

1.8 Aids to navigation

There was no indication of problems with the available aids to navigation.

1.9 Communications

No difficulties with the quality of radio transmissions were noted. None of the radio communications between the pilot and the controllers revealed any sense of urgency or any anomalies with the aircraft.

1.10 Aerodrome information

CYLW is located approximately 6 nm from the city of Kelowna, British Columbia, in the Okanagan Valley. It has 1 asphalt runway, Runway 16/34, which is 8900 feet long and 200 feet wide. The airport is located on the east side of the valley and is surrounded by high terrain with elevations up to 7595 feet ASL.

1.11 Flight recorders

The aircraft was not equipped with a flight data recorder (FDR), a cockpit voice recorder (CVR), or any other lightweight recording device, nor were any required by regulation.

1.12 Wreckage and impact information

The accident site consisted of hard, rocky, forested terrain at an elevation of about 3400 feet ASL. The aircraft struck the ground at a high rate of descent in a 67° nose-down attitude on a 025°M heading.

The high-energy impact resulted in a crater approximately 2 feet deep. Fragmented aircraft debris was projected into trees and scattered around an area of approximately 12 000 m². The post-impact fire destroyed the majority of the aircraft structure and scorched approximately 710 m² of vegetation surrounding the wreckage (Figure 5).

Both engines were severely damaged from the impact, and the internal components of both displayed features that were indicative of an engine producing significant power at the time of impact.

The aircraft had been refuelled with Jet A-1 turbine fuel at CYBW on the morning of the occurrence. The investigation was unable to test the fuel from the aircraft wreckage; however, a fuel sample was collected from CYBW, and the analysis concluded that the fuel was clear, with no visible contamination.

Inspection of the wreckage determined that all components were accounted for at the site. An inspection of all primary and secondary control cables found that the cables exhibited numerous overload failures and heat damage, likely the result of the impact and subsequent fire. An inspection of the remainder of the aircraft for any pre-impact anomalies was inconclusive owing to the extent of the damage caused by the impact forces and post-impact fire.

1.13 Medical and pathological information

The investigation found nothing to indicate that the pilot's performance was degraded by pre-existing physiological factors.

The pilot was certified by TC as medically fit to fly and held a valid Category 1 medical certificate. The investigation determined that the pilot did not exceed his duty day, and there was no evidence to suggest that fatigue was a factor.

1.14 Fire

The post-impact fire was fed from fuel on board the aircraft and eventually self-extinguished.

1.15 Survival aspects

The accident was not survivable.

1.16 Tests and research

1.16.1 TSB laboratory reports

The TSB completed the following laboratory reports in support of this investigation:

• LP268/2016 – Radar Data Analysis
• LP274/2016 – GPS and Cell Phone Download
• LP272/2016 – Instruments Analysis
• LP273/2016 – Wreckage Analysis

1.17 Organizational and management information

1.17.1 Norjet Inc.

Norjet Inc. is a private operator,^{Footnote 16} formed in May 2008 and headquartered in Calgary, Alberta. At the time of the occurrence, the company had 4 owners.

The company owned and operated 1 privately registered aircraft (C-GTNG, the occurrence aircraft), which was based and maintained at CYBW. The aircraft was used for business and personal flights, most of which were carried out during daylight hours, and was operated using pilot self-dispatch, in accordance with CARs Subpart 604.

1.17.2 Transport Canada registration of private owners

Private operators, such as Norjet Inc., are engaged in the operation of certain types of privately registered aircraft and provide non-commercial transportation, often catering to business entities. These types of private operators fall into the business aviation sector.

New companies in the business aviation sector wishing to obtain a private operator registration document (PORD) must submit to TC information about the private operator, such as general information about the company, bases of operation, management personnel, geographical areas of operation, and the type and number of aircraft in its fleet. An application form (Appendix B) is provided by TC for this purpose.

PORD applications are assessed and approved through the Transport Canada Civil Aviation (TCCA) regional office in the geographical area of the private operator's intended base of operation. Subsection 604.04(2) of the CARs states that, upon receipt of an application containing all of the prescribed information, TC "shall" issue a PORD.

During the registration phase of a private operator, TC does not conduct on-site inspections of the operator (e.g., base of operation, aircraft flown, maintenance facilities, or personnel) before issuing a PORD. The registration of a private operator is strictly limited to a routine administrative approval of a PORD application without any follow-up verification of an applicant to ensure that its operations comply with existing regulations.

The investigation determined that, at the time of the accident, Norjet Inc. was operating under a PORD, as required by regulation.

1.17.3 Safety management system

Private operators are required, by regulation, to implement and maintain a safety management system (SMS).

Norjet Inc. had an SMS in place, and its company operations manual outlined several components of its SMS. Under the SMS, the pilot of C-GTNG simultaneously held the positions of operations manager, chief pilot, safety officer, and person responsible for maintenance.

Although several deficiencies^{Footnote 17} were identified in the SMS, the investigation could not determine to what extent its SMS was applied in practice. The investigation could not assess whether the SMS was effective at identifying and addressing safety risks because the person who administered the entirety of the SMS was the pilot, who was fatally injured in the occurrence.

1.17.4 Oversight of private operators

1.17.4.1 Inception of regulatory oversight for private operators

Before 1983, there were no federal regulations specifically governing the business aviation sector engaged in non-commercial air services. In response to a series of aviation occurrences involving private operators, TC introduced the Private Aeroplanes Passenger Transportation Order (Air Navigation Order Series I, No. 2), which regulated the transport of passengers in non-commercial air operations using turbine-powered, pressurized, and large aircraft. In 1996, with the introduction of the CARs, a regime for issuing private operator certificates (POC)^{Footnote 18} was established under CARs Subpart 604.

1.17.4.2 Canadian Business Aviation Association

In 1962, the Canadian Business Aviation Association^{Footnote 19} (CBAA) was formed to represent and advocate for private operators, ranging from 1-person pilot-owner operations to large corporate flight departments, and to promote business aviation.

In late 1998, TC conducted a study jointly with the CBAA to examine the feasibility of delegating administration and oversight of private operators from TC to the CBAA. There were several perceived benefits of the delegation for both parties. The CBAA believed that private operators could achieve greater operational efficiency through this arrangement by assuming a more direct role in managing their own safety activities. Among the benefits to TC was the opportunity to shift the resources dedicated to the oversight of private operators to the oversight of other aviation activities perceived as a higher risk. A report on the study was released on 21 March 2000, concluding that it was feasible for the CBAA to oversee this industry sector, and, on 01 January 2003, the CBAA began to administer the certification and surveillance of private operators.^{Footnote 20}

On 11 November 2007, there was an accident^{Footnote 21} involving a private operator. An aircraft touched down short of the runway at Fox Harbour Aerodrome (CFH4) in Fox Harbour, Nova Scotia, causing serious injuries to 2 of the occupants and minor injuries to the remaining 8 occupants on board the aircraft. The accident investigation identified ineffective management of the risks associated with a transition to a new, larger aircraft type.

The investigation report highlighted that an SMS "integrates sound risk management policies, practices, and procedures into day-to-day operations and, properly implemented, offers great potential to reduce accidents." The Board raised concerns with respect to the inadequate implementation of SMSs for private operators and concluded that TC had not exercised effective oversight of the CBAA, its accredited auditors, or POC holders since the inception of the new approach to regulating private operators.

The Board further commented, in Aviation Investigation Report A13H0001, on the systems-level surveillance framework required to oversee the safety of private operators:

Under a traditional approach to surveillance, TC inspectors were limited to verifying an operator's compliance with regulations. However, to provide an improved level of safety beyond regulatory compliance, TC has moved toward a systems-level approach. This type of approach involves verifying not only that operators are in compliance, but that they also have processes in place to develop corrective actions that address the underlying causes of non-conformances and to manage those actions effectively. In the long term, this approach will have a greater impact on safety than a program that relies solely on traditional inspections and local fixes. […]

The systems approach can be effective for all systems and processes, but the operators' capability to identify and rectify underlying unsafe conditions themselves must first be assured.

In the Fox Harbour investigation report, the Board concluded that "[i]f adequate safety oversight of POC operators is not maintained by the regulator, or the delegated organization, especially during SMS implementation, there is an increased risk that safety deficiencies will not be identified." Therefore, the Board recommended that

1.17.4.3 Return of oversight of private operators to Transport Canada

On 16 March 2010, TC announced that it would take back the oversight and administration of private operators from the CBAA. The transfer of responsibility took effect on 01 April 2011. TC stated that, during the period of transition, it would conduct a full review of the surveillance and regulatory structure pertaining to private operators.

In December 2012, TC advised the TSB that new CARs Subpart 604 regulations were in development and that these would bring private operators into the TC surveillance-planning framework. The new regulations were incorporated into the CARs and came into effect in 2014.

In January 2015, TC confirmed CARs Subpart 604 operators would be fully implemented within TC's surveillance program. Therefore, the response to Recommendation A09-06 was assessed by the Board as Fully Satisfactory.

1.17.4.4 Oversight of private operators at the time of the occurrence

At the time of this occurrence, TC's approach to oversight for private operators relied entirely on reactive surveillance processes. In fact, shortly before the occurrence, on 17 August 2016, TC advised its staff, through an internal process bulletin (IPB),^{Footnote 22} that it would temporarily exempt entire sectors of civil aviation,^{Footnote 23} including the business aviation sector, from its planned oversight program. During its risk assessment of the industry, TC had identified the exempted sectors as having a low risk for serious incidents or accidents.

Thus, the IPB stated that private operators would not be subject to planned surveillance. activities. TC advised that ongoing monitoring of these sectors would continue and that the suspension of its oversight over private operators would be temporary. However, no date was set for the resumption of a planned surveillance program covering private operators.

On 07 December 2016, TC issued a revised IPB^{Footnote 24} stating that, based on current risk indicators at the time, private operators would still be excluded from its surveillance planning policies and procedures until further notice, while TC reviewed its surveillance program for this industry sector. Although it would continue to monitor private operators, TC stated that these operators would only be "subject to certification/regulatory authorizations and reactive inspections" [emphasis added] unless individual risk indicators warranted additional monitoring or surveillance actions.^{Footnote 25}

The IPB also indicated that, should a serious incident or accident occur or should there be cause for concern regarding risk levels, the PORD holder involved would be subject to review by the TCCA regional director. It noted that any decline in the acceptable levels of safety may warrant increased monitoring by TC. An evaluation of the IPB's impact was scheduled to be conducted in August 2017. However, at the time of this investigation, there was no evidence demonstrating that TC had conducted this evaluation.

1.17.4.5 Oversight of Norjet Inc.

Since the inception of Norjet Inc. in 2008, the investigation determined that TC had undertaken no surveillance activities to oversee and monitor the company's flight operations.

1.18 Additional information

1.18.1 Information processing and workload in single-pilot operations

Pilots operate in a complex environment in which there are multiple sources and types of information to monitor. At the same time, human attention and the capacity to process information are limited.

Workload is a function of the number of tasks that must be completed within a given amount of time. If the number of tasks that must be completed increases, or if the time available to complete them decreases, the workload increases. High levels of workload can adversely affect a pilot's ability to perceive and evaluate cues from the environment, and may result in attentional narrowing.^{Footnote 26} Studies have shown that individuals experiencing high workload tend to limit their attention to the stimuli they perceive to be most important or most relevant to the task at hand.^{Footnote 27} This may result in pilots' paying attention only to certain cues, while excluding others.

Pilot workload peaks during and shortly after takeoff,^{Footnote 28} particularly during single-pilot night operations in IMC. The pilot must transition rapidly from using visual cues outside the cockpit to monitoring instruments in the cockpit in order to manage the aircraft systems and establish an angle and rate of climb that ensure a safe departure.

To understand the conditions that were likely to have been facing the pilot during the takeoff and initial climb, the investigation reviewed the normal sequence of required tasks. Shortly after takeoff, after having established a positive rate of climb, a pilot would select the gear and flaps up and confirm that they were in the correct positions. A pilot would normally use the autopilot to assist with vertical climb, airspeed, and tracking to the navigation aid (in this case, the non-directional beacon).

If the autopilot were not engaged, the pilot would have to hand-fly the aircraft and navigate at the same time. This would involve establishing and maintaining an accurate climb profile, while scanning and interpreting the aircraft's instruments. The pilot would also be switching radio frequencies and talking with ATC and listening and adhering to ATC clearances, as well as inserting new altitude clearances into the altitude selector.

1.18.2 Visual-spatial orientation in low-visibility conditions

The most accurate sensory input available to pilots regarding the attitude and motion of their aircraft comes from the visual cues provided by the horizon and/or the aircraft's flight instruments. When such input is not available—for example, when weather conditions or darkness mask the horizon or when the pilot's attention is diverted from the flight instruments—a pilot's sense of spatial orientation may be overpowered by the inner ear, which is an unreliable source of sensory information in flight. The result may be spatial disorientation—the pilot's inability to correctly interpret the aircraft's attitude, altitude, or airspeed in relation to the Earth or other points of reference.^{Footnote 29}

Night and IMC operations require that the pilot derive orientation information from other visual cues (i.e., flight instruments). As a result, such operations are generally associated with a higher risk of pilot spatial disorientation than operations carried out during the daytime and in visual meteorological conditions.^{Footnote 30} Pilots with limited IFR experience are most susceptible to spatial disorientation.^{Footnote 31}

A number of illusions affecting the visual and/or vestibular systems can result in spatial disorientation. Two illusions that may be relevant to this occurrence are the somatogravic illusion and the Coriolis illusion.

The somatogravic illusion is caused by an abrupt change from climbing to level flight, during which the vestibular system is excessively stimulated, creating the illusion of tumbling backwards. This illusion "causes the pilot to move the elevator control forward to lower the nose," the result of which is "to intensify the original false perception with respect to gravity."^{Footnote 32}

The Coriolis illusion is caused if the aircraft is rolling or turning and the pilot moves his or her head out of the plane of rotation. The combination of the rolling / turning and the head motion stimulates 2 (of 3) sets of semi-circular canals in the vestibular system, creating a sensation of rotation in the opposite direction" when the rotary motion stops. "In the absence of good visual cues, it is possible for the pilot to respond to this false illusion by putting the aircraft into a spin in the opposite direction."^{Footnote 33}

Flight conditions involving prolonged accelerations can lead to somatogravic illusions. If these accelerations are combined with abrupt head movements, the Coriolis illusion can be generated at the same time. The strength of these illusions can be so intense that even a conscious cross-reference to flight instruments may be insufficient to prompt the pilot to apply the appropriate corrective input to the flight controls.

In a multi-crew aircraft, it is uncommon for both pilots to be affected by spatial disorientation at the same time, and effective monitoring of flight instruments by the pilot not flying becomes critical. A single-pilot operation faces a more serious challenge with identifying and handling spatial disorientation. If the single pilot becomes disoriented, there is no one else to check information with, to monitor inputs, to hand over control to, or to consult about engaging the autopilot.

1.18.3 Cockpit design and layout in relation to risk of spatial disorientation

Cockpit design, including the layout and presentation of instruments, is important in creating a user-friendly environment that is resistant to spatial disorientation for the pilot. If key pieces of equipment are in positions that are not easily incorporated into a pilot's instrument scan, the pilot may need to make significant head movements in order to turn switches on or off during critical phases of flight. These head movements can increase the likelihood of a Coriolis illusion. Cockpit ergonomics need to take these factors into account so that the pilot is not required to make significant head movements during critical phases of flight.

The occurrence aircraft was an older-generation design, and the autopilot control was positioned low on the centre console, between the captain's seat and the co-pilot's seat.

1.18.4 Limiting the risk of spatial disorientation

Knowledge and experience are key determinants of a pilot's susceptibility to spatial disorientation.^{Footnote 34} Pilots are particularly susceptible to spatial disorientation when they have few external visual attitude references. Lack of awareness of spatial disorientation also increases the chance that it will occur^{Footnote 35} and be unrecognized and/or incapacitating.

If a pilot is unaware of the possibility of spatial disorientation, the chances of detecting an illusion and of adequately recovering from it are limited. Similarly, a pilot who does not have the skills necessary to fly safely on instruments has limited chances of successfully flying out of a disorientation event.

The Flight Safety Foundation, in its Operator's Guide to Human Factors in Aviation,^{Footnote 36} offers a number of tips for pilots to manage in-flight spatial disorientation and visual illusions:

• Be aware of the misleading information of the vestibular organ.
• Confidence, competence, and currency in instrument flying greatly reduce the risk of disorientation.
• Build up experience controlling the aircraft in an environment of conflicting orientation cues.
• In moments of stress, make decisions based on the instruments; do not fall back on instinct or perceptions.
• Recover from disorientation by making the instruments read right, regardless of your sensation.^{Footnote 37}

Effective, practical training is important for pilots to acquire the knowledge and skills necessary to fly an aircraft safely and effectively, especially under challenging conditions. Ongoing experience and regular practice improve proficiency by reinforcing lessons learned.

In unexpected situations, pilots are better prepared if they have been trained to identify similar circumstances so that they can rapidly categorize the situation, make judgments, and decide on an appropriate course of action. Presenting pilots with rarely experienced, high-risk situations in low-risk conditions, such as in a flight simulator or during line training, improves their ability to overcome spatial disorientation in the future. To mitigate the risk of pilot incapacitation from spatial disorientation, the Australian Transport Safety Bureau recommends^{Footnote 38} that pilots combine regular instrument flight exposures with in-flight disorientation demonstrations and upset/unusual attitude recovery practice.^{Footnote 39 Footnote 40}

Recency of training affects whether and how well a skill is remembered. The sooner that learning is applied after the training, the better an individual will perform. "Training transfer" refers to individuals applying knowledge, skills, and understanding acquired in a training (or classroom) setting to their operational duties.^{Footnote 41} Effective training transfer can be accomplished by applying the skills learned during training to real-world situations.^{Footnote 42}

An aircraft equipped with an autopilot system allows a pilot to maintain safe flight even when spatially disoriented. If the autopilot is engaged and working appropriately, a disoriented pilot can use it to overcome vestibular sensations without jeopardizing aircraft stability by making inappropriate control inputs. Not using the autopilot, flying an aircraft that is not equipped with an autopilot system, or having an autopilot fail can contribute to spatial disorientation in an operating pilot.^{Footnote 43}

1.18.5 On-board recorders

1.18.5.1 Flight data, cockpit voice, and image/video event recorders

Numerous TSB aviation investigation reports have referred to investigators being unable to determine the reasons for an accident because of the lack of on-board recording devices. The benefits of recorded flight data in aircraft accident investigations are well known and documented.^{Footnote 44}

For several decades now, FDRs and CVRs have been conceived, designed, and installed in order to record flight and cockpit data for accident investigation purposes. FDRs record numerous aircraft parameters—such as altitude, airspeed, and heading—many times per second. CVRs record radio transmissions and ambient cockpit sounds, including pilot voices, alarms, and engine noises. Image/video recorders provide video of the crew immediately before, during, and after an event.

Currently, FDRs and CVRs are considered the most comprehensive methods of capturing large amounts of flight data for accident investigations.

Investigations can also obtain data downloaded from GPS units, engine monitors, and other non-volatile memory sources that are not crash-protected. Investigations that can use data from these sources, as well as from other recorders, are more likely to identify safety deficiencies than investigations that do not benefit from FDR and CVR data.

1.18.5.2 Flight data and cockpit voice recorder requirements

In Canada, FDR and CVR regulations are specified in CARs section 605.33, Flight Data Recorder and Cockpit Voice Recorder. Under this provision, the requirements for FDR and CVR equipment in aircraft are based primarily on the number and type of engines, number of passenger seats, and type of operation.

In addition, flight operations involving multi-engine turbine-powered aircraft configured with 6 or more passenger seats, and for which 2 pilots are required by the aircraft type certificate or by the subpart under which the aircraft is operated, also trigger CVR and FDR requirements.

Given the characteristics and configuration of the occurrence aircraft, and the nature of its private flight operations, C-GTNG was not required by regulation to be equipped with either an FDR or a CVR.

1.18.5.3 Lightweight flight-data recording systems

Commercially operated aircraft weighing less than 12 500 pounds (5700 kg) are usually not fitted at manufacture with the system infrastructure required to support an FDR, and installing a conventional FDR would require modifications to this category of aircraft. Moreover, many other aircraft types that are operated for non-commercial purposes are not compatible with the installation of conventional FDRs.

To provide an accessible and feasible means of recording valuable flight-data information, regardless of the type of aircraft and operation flown, several lightweight flight-data recording systems that can record combined cockpit image, cockpit audio, aircraft parametric data, and/or data-link messages are currently being manufactured. These systems can vary in cost, design, and complexity, and are being designed for implementation in the near future by commercial and non-commercial flight operators that are not currently subject to FDR and CVR regulatory requirements. Thus, lightweight flight-data recording systems are a potential alternative for some sectors of the civil aviation industry.

In 2016, Annex 6 (Parts I and III) of the International Civil Aviation Organization (ICAO) Standards and Recommended Practices were amended to recommend that certain categories of aircraft flown by commercial operators carry lightweight flight recorders. These Standards and Recommended Practices apply to turbine-engine aircraft and helicopters with a maximum take-off weight of more than 2250 kg, and for which an application for type certification has been submitted on or after 01 January 2018. ICAO Annex 6 defines lightweight flight recorders as follows:

Lightweight flight recorders comprise one or more of the following systems: an aircraft data recording system (ADRS), a cockpit audio recording system (CARS), an airborne image recording system (AIRS) and/or a data link recording system (DLRS). […] Specifications applicable to lightweight flight recorders may be found in EUROCAE [European Organisation for Civil Aviation Equipment] ED-155, Minimum Operations Specifications (MOPS), or equivalent documents.^{Footnote 45}

Under ICAO Annex 6, lightweight flight recorders must also comply with EUROCAE's Minimum Operational Performance Specification for Lightweight Flight Recording Systems (ED-155), which

defines the minimum specification to be met for aircraft required to carry lightweight flight recording systems […]. It is applicable to robust on-board recording systems, ancillary equipment and their installation in aircraft.

This document can also be used to give guidance to manufacturers intending to develop or install lightweight flight recording systems which maybe [sic] used for or [sic] other purposes such as flight training or flight data monitoring.^{Footnote 46}

Furthermore, between 2005 and 2015, 12 safety recommendations to the European Aviation Safety Agency (EASA) by 7 different investigation bodies in Europe proposed that aircraft not currently covered by FDR and CVR regulations be equipped with on-board flight recorders.^{Footnote 47}

To comply with recent amendments to ICAO Annex 6 and to respond to these recommendations, EASA published a Notice of Proposed Amendment in 2017, under which new regulations would prescribe lightweight flight recorders for some categories of commercially operated aircraft and helicopters. In addition to harmonizing its regulations with recent amendments to Annex 6, EASA's proposed amendments would also include non-turbine aircraft with a maximum seating configuration of more than 9 passengers.

In Canada, there are no regulations requiring any aircraft to be equipped with a lightweight flight-data recording system, as defined by ICAO and EUROCAE (ED-155). However, the voluntary use of these devices by commercial and non-commercial operators is becoming increasingly prevalent, as more flight operators become familiar with the safety benefits of lightweight flight-data recording systems.

1.18.5.4 TSB Recommendation A13-01 (May 2013)

In 2013, following its investigation into the loss of control / in-flight breakup occurrence in March 2011 northeast of Mayo, Yukon,^{Footnote 48} the TSB found that, if cockpit or data recordings are not available to an investigation, the identification and communication of safety deficiencies to advance transportation safety may be precluded. In the preamble to its recommendation, the Board stated that,

Given the combined accident statistics for CARs Subparts 702, 703, and 704 operations, there is a compelling case for industry and the regulator to proactively identify hazards and manage the risks inherent in these operations. In order to manage risk effectively, they need to know why incidents happen and what the contributing safety deficiencies may be. Moreover, routine monitoring of normal operations can help these operators both improve the efficiency of their operations and identify safety deficiencies before they result in an accident. In the event that an accident does occur, recordings from lightweight flight recording systems will provide useful information to enhance the identification of safety deficiencies in the investigation.

The Board acknowledged that issues will need to be resolved to facilitate the effective use of recordings from lightweight flight-data recording systems, including integration of this equipment in an aircraft, human resource management, and legal issues, such as restrictions on the use of cockpit voice and video recordings.

Nevertheless, given the potential of this technology, combined with flight data monitoring (FDM), to significantly improve safety, the Board believed that no effort should be spared to overcome these obstacles. Therefore, the Board recommended that

TC has acknowledged that flight data monitoring programs would enhance safety and has taken the following actions to address the safety deficiency identified in Recommendation A13-01:

• In 2013, after conducting a risk assessment to evaluate alternative approaches to FDM, TC informed the TSB that it supported Recommendation A13-01. In 2015, TC informed the TSB that it intended to revisit this risk assessment.
• In 2013, TC informed the TSB that it would develop an Advisory Circular outlining recommended practices for FDM programs.
• In 2013, TC informed the TSB that it would incorporate its analysis and review of Recommendation A13-01 into its planned assessment for FDRs and CVRs, which was scheduled to begin in 2014–2015.
• In 2014, TC informed the TSB that it would consider adding FDM principles to future regulatory initiatives and amendments.
• In 2015, TC informed the TSB that it would prepare an issue paper on the use of FDM, providing factual information on FDM, including its benefits, costs, and challenges.

However, due to other ministerial commitments, TC did not initiate its work for any of these undertakings.

In February 2018, TC conducted a focus group with industry, to assess the challenges and benefits of installing lightweight flight recording systems on aircraft that are not currently required to carry these systems.

However, until the focus group reaches conclusions concerning these challenges and benefits in aircraft not currently required to carry them, and TC provides the TSB with its plan of action following those conclusions, it is unclear when or how the safety deficiency identified in Recommendation A13-01 will be addressed. The Board is concerned that few concrete actions have been taken to address Recommendation A13-01 and that this will result in to protracted delays, as observed on numerous other recommendations.

Therefore, the response to Recommendation A13-01 is assessed as Unable to Assess.

1.18.5.5 Demonstrated benefits of lightweight flight-data recording systems

In a recent occurrence investigated by the TSB,^{Footnote 49} a privately operated aircraft on an IFR flight plan struck terrain on its final approach to land. All 7 occupants were fatally injured.

A lightweight flight-data recording system was on board the occurrence aircraft, although it was not required by regulation. TSB investigators recovered the recorder from the wreckage, and the TSB Engineering Laboratory was able to extract and analyze its data. The resulting information was crucial to understanding the sequence of events that led to the aircraft's departure from controlled flight. Had a recording system not been on board, crucial information to understand the circumstances and events leading up to this occurrence would not have been available to the investigation.

In contrast, the information normally contained in flight-data recording systems was not available to this investigation. Therefore, if investigators do not have these data, they may not be able to fully identify and understand the underlying causal and contributory factors.

Although Recommendation A13-01 targeted commercial operators, the contrast in available evidence demonstrated by these 2 recent occurrences highlights the value of installing lightweight flight-data recording systems on privately operated aircraft.

2.1 General

The aircraft departed controlled flight, for reasons that could not be determined, and collided with terrain.

No flight, voice, or video data recordings were available to help establish a detailed sequence of actions in the cockpit. As a result, it could not be determined whether there was an abnormal event before the aircraft's rapid descent. There was no indication that environmental factors contributed to this occurrence.

Due to extensive destruction of components in the collision and post-impact fire, the investigation could not determine whether there were any pre-existing mechanical or electrical issues that could have resulted in the loss of control and collision with terrain. An examination of the wreckage revealed no pre-impact separation of aircraft components. Examination of the engines indicated that they were producing significant power at impact. The fuel sampled from Calgary/Springbank Airport (CYBW), the source of the aircraft's fuel, contained no visible contamination.

There were no indications that fatigue or other physiological factors contributed to the accident. The pilot was qualified and held the appropriate licence; however, he had not performed the number of night takeoffs and night landings required by regulation before conducting the occurrence flight with passengers.

There was no evidence to suggest that the passengers contributed to the accident.

The analysis will focus on a likely scenario involving spatial disorientation, on the aircraft's weight and balance, on technical anomalies, on Transport Canada (TC) oversight of private operators, and on the importance of on-board flight recorders.

2.2 Spatial disorientation accident scenario

Loss of control in night instrument meteorological conditions (IMC) and the aircraft entering an unusual attitude, such as a spiral dive, was considered a likely scenario. Cognitive and/or physiological factors may have contributed to the loss of control by limiting the pilot's ability to monitor and understand the flight instruments effectively. The possibility that the pilot experienced some combination of spatial disorientation, high workload, and attentional narrowing associated with single-pilot operation of the aircraft was also considered.

In this occurrence, weather conditions limited visibility shortly after takeoff, requiring the pilot to rely exclusively on flight instruments for information to help orient the aircraft. During the initial climb, and within seconds after takeoff, the aircraft experienced rapid changes in vertical rates of climb, decreasing from 4000 feet per minute (fpm) to 600 fpm within about 20 seconds, then increasing to about 6000 fpm after another 10 seconds. The aircraft eventually reached a normal rate of climb when it was at about 5800 feet above sea level (ASL).

The aircraft also deviated to the right of the intended track shortly after takeoff until shortly before the loss of control. These deviations ranged from 3° to a maximum of about 20°.

Forward, intermittent acceleration during the take-off phase and climb into night IMC conditions, followed by a reduction in vertical airspeed as the aircraft stabilized while approaching 5800 feet ASL, may have increased the risk that the pilot experienced a somatogravic illusion, or erroneous sensation of pitch. If, at the same time, the pilot had made 1 or more head movements to look for or activate a flight control (for example, the autopilot control, which was positioned low on the centre console between the seats), the risk of stimulating the inner ear's semi-circular canals and of producing a Coriolis illusion, and the accompanying sensation of tumbling, would also have increased.

The high levels of workload associated with flying the aircraft alone may have led to attentional narrowing and the pilot focusing on certain flight instruments and not others. This situation would have further challenged the pilot's ability to maintain control of the aircraft.

Knowledge and awareness of spatial disorientation are associated with an improved ability to recognize and overcome it. Recent training in how to identify spatial disorientation improves a pilot's ability to overcome it under real-world conditions. Flying at night, under conditions of limited visibility and without the aid of another crew member, would have been especially challenging for the pilot, whose night instrument flight rules (IFR) experience during the preceding months had been limited. The pilot had flown mainly in a day-operations environment and had limited recent IMC and night flying experience. In the 12 months before the occurrence, he had logged 25.1 hours of IMC flight time and 7.8 hours of night flight time. Only 2 takeoffs and 3 landings in the previous 6 months had been completed at night.

Analysis of the tasks involved in flying a similar aircraft under similar conditions (single-pilot, night flight, IMC) showed that, shortly after taking off and establishing a positive rate of climb, a pilot would normally select the gear and flaps up, and confirm that they were properly stowed. Shortly after, the pilot would normally engage the autopilot to help adhere to the profile instructions, including vertical climb, airspeed, and tracking to the non-directional beacon, and to help trim the aircraft. If the pilot relied on a portable global positioning system (GPS) unit, he would most likely check it to track to the non-directional beacon.

At the same time, the pilot would be switching radio frequencies, and listening to and acknowledging clearances from air traffic control (ATC). Using the autopilot would reduce the pilot's workload by helping to manage the flight parameters, giving the pilot more time and opportunity to scan and interpret the instruments effectively.

The pilot contacted the Vancouver Area Control Centre (ACC) after passing through 6000 feet ASL, rather than at 4000 feet per the KELOWNA SEVEN DEP standard instrument departure. The fact that the pilot made the call later than it should have been made suggests that he experienced increased workload during the climb. The delay may have been because the pilot was trying to achieve a normal rate of climb and get the aircraft on the appropriate track to the non-directional beacon, if he had noticed the track deviation. The pilot did not indicate any problems when he communicated with the ACC, nor was any sense of urgency apparent in his voice.

Another factor that may have increased the pilot's susceptibility to spatial disorientation and increased workload was the use of a portable (non-integrated) electronic device. When the aircraft was cleared by the ACC to the MENBO waypoint, the pilot might have used the portable GPS unit, because it may have been easier to interpret than the older-generation navigation instruments on the aircraft's instrument panel. The position of the portable GPS unit may not have been conducive to an adequate visual scan without making additional head movements.

The circumstances of the accident are consistent with a loss of control due to the pilot becoming spatially disoriented, which resulted in a spiral dive. If night and instrument proficiency are not adequately maintained, a pilot may not be able to recognize an aircraft upset and respond appropriately, especially during high-workload situations, increasing the risk of loss-of-control accidents.

However, without recorders, the factors that contributed to the aircraft deviating laterally and vertically during the climb, and to its eventual loss of control, could not be conclusively established.

2.3 Aircraft weight and balance

A centre of gravity (C of G) that is outside of the forwardmost allowable limit increases the aircraft's wing loading^{Footnote 50} and stall speed,^{Footnote 51} and may result in a loss of control. In this occurrence, the location of the forward C of G would have had a negligible effect on the aircraft's flight characteristics during takeoff, and likely did not contribute to the occurrence. However, if weight-and-balance documents are inaccurate, there is a risk that aircraft will be operated outside of the allowable C of G specifications, which could affect flight stability and controllability.

2.4 Technical anomalies

The investigation could not determine with certainty whether the pilot had engaged the autopilot for the climb. However, radar recordings of both the lateral and horizontal flight paths suggest that the autopilot was not being used or that it was malfunctioning. The pilot did not report any anomalies to ATC during takeoff or initial climb segments. In the event of an autopilot failure, the design allows the system to be either disengaged or overridden by the pilot. Therefore, the investigation concluded that it is unlikely that the autopilot contributed to the loss of control.

The investigation found that the attitude indicator was functioning at the time of impact. Because the attitude indicator was powered by alternating current, an inverter was likely operating at the time of impact. However, it could not be determined which of the 2 inverters on board was powering the attitude indicator.

The aircraft journey log indicated that the windshield anti-ice "HI" setting was inoperative. Reported weather for the occurrence flight did not include icing conditions; therefore, the aircraft was serviceable for the intended flight.

Federal Aviation Administration Airworthiness Directive (AD) 79-12-06 requires that the upper and lower spar caps be inspected for cracking every 600 hours or 600 landings, whichever comes first, unless Cessna Service Bulletin SB57-10 Rev 4 is carried out. A review of the technical records for the aircraft determined that the last record of compliance for AD 79-12-06 was dated 21 December 2007, and had taken place 1062 hours and 1405 landings earlier. The investigation also determined that Cessna Service Bulletin SB57-10 Rev 4 was not carried out. Failure of the spar caps would have resulted in an in-flight breakup or separation of the wing from the aircraft, and the aircraft pieces would have hit the terrain a large distance apart. Given that all components of the aircraft were accounted for at the wreckage site, the investigation concluded that there was no in-flight breakup or separation of the wing.

2.5 Transport Canada oversight of private operators

All transportation operators have a responsibility to manage the safety risks within their operations. However, operators inevitably have varying degrees of ability to manage safety effectively and comply with regulations. When operators are unable to manage safety effectively, the regulator should intervene to proactively identify safety deficiencies, and do so in a manner that succeeds in changing unsafe operating practices.

Private operators under Canadian Aviation Regulations (CARs) Subpart 604 currently fall outside the scope of TC's planned surveillance. TC's approach to oversight for private operators relies entirely on reactive surveillance processes. By excluding private operators from its planned surveillance, TC has exempted an entire industry sector from basic oversight mechanisms designed to mitigate individual and systemic safety risks.

There was no record of any surveillance of Norjet Inc. between the time of its inception in 2008 and the date of the occurrence flight, 8 years later. TC did not identify a number of safety deficiencies with respect to Norjet Inc.'s flight operations: Norjet Inc. never obtained TC's operational approval for single-pilot operations on the occurrence aircraft; the pilot had flown 61 to 68 single-pilot flights on the C500 without the required training and endorsement; and the pilot was not in compliance with currency requirements to carry passengers at night.

The TSB investigation into the Fox Harbour accident^{Footnote 52} raised several concerns about the implementation and operation of safety management systems (SMSs) in the business aviation sector as well as the oversight of private operators, which led to TSB Recommendation A09-06. In response to this recommendation, TC made a commitment to integrate SMS regulations in CARs Subpart 604 into its surveillance program. TC stated that it would conduct a full review of the surveillance and regulatory structure pertaining to private operators and that it would develop new CARs Subpart 604 regulations to bring private operators into the TC surveillance-planning framework. However, TC reversed its position in 2016, when it exempted private operators from its planned national surveillance program.

This investigation has found that TC's efforts have yet to rectify concerns about TC's surveillance of private operators. TC was unable to identify safety deficiencies with the company's SMS. Moreover, TC was unable to identify potential safety risks related to the fact that the pilot was the sole person responsible for administering the SMS in his combined roles of chief pilot, operations manager, safety officer, and person responsible for maintenance.

The current approach to oversight for private operators may be inadequate to correct unsafe practices and conditions in the business aviation sector. Without a surveillance program in place for private operators in the business aviation sector, TC's approach to surveillance will not foster a timely rectification of safety deficiencies, thus allowing unsafe practices to emerge and persist.

If TC does not effectively oversee private operators, this sector of aviation may be exposed to higher risks that could lead to an accident.

2.6 On-board flight recorders

The lack of flight data severely limited the opportunity to identify safety deficiencies that may have been significant. Safety deficiencies that are not identified during an accident investigation cannot be targeted or eliminated through safety action. In order to identify findings as to cause, contributing factors, and risk, as well as safety deficiencies, investigators need to determine the events, circumstances, and factors that led to an accident. In this investigation, critical flight and voice data—such as aircraft systems data, pilot actions, aircraft response, ambient sounds, engine noises, and other parameters—were not available to investigators.

Any type of recording system is an invaluable source of information. Not only do these systems provide objective data that can assist investigators in establishing possible causes, but they also corroborate the sequence of events. Flight data recorder (FDR) and cockpit voice recorder (CVR) data are used during accident investigations to piece together what the aircraft was doing and what pilot actions were taken in the minutes leading up to the occurrence. Recorders increase the opportunity to fully understand why an accident occurred and to identify safety deficiencies that may be significant.

For decades, operators of large passenger aircraft have benefitted in another way from on-board FDRs and CVRs to advance safety: they have used FDR information for internal flight-data monitoring and quality assurance programs for flight operations. These programs help airlines manage safety in a proactive manner.

Lightweight FDR technology is also available for installation in smaller aircraft. These systems can record aircraft performance data, cockpit audio, and image data, and are increasingly being adopted by operators around the world.

The European Organisation for Civil Aviation Equipment's Minimum Operational Performance Specification for Lightweight Flight Recording Systems defines the minimum specifications for lightweight flight-data recording systems. TC does not currently have any regulatory requirements or specifications regarding lightweight recorders.

If flight data, voice, and video recordings are not available to an investigation, the identification and communication of safety deficiencies to advance transportation safety may be precluded.

3.1 Findings as to causes and contributing factors

1. The aircraft departed controlled flight, for reasons that could not be determined, and collided with terrain.

3.2 Findings as to risk

1. If flight data, voice, and video recordings are not available to an investigation, the identification and communication of safety deficiencies to advance transportation safety may be precluded.
2. If night and instrument proficiency are not adequately maintained, a pilot may not be able to recognize an aircraft upset and respond appropriately, especially during high-workload situations, increasing the risk of loss-of-control accidents.
3. If weight-and-balance documents are inaccurate, there is a risk that aircraft will be operated outside of the allowable centre-of-gravity specifications, which could affect flight stability and controllability.
4. If Transport Canada does not effectively oversee private operators, this sector of aviation may be exposed to higher risks that could lead to an accident.

3.3 Other findings

1. Federal Aviation Administration Airworthiness Directive (AD) 79-12-06 requires that the upper and lower spar caps be inspected for cracking every 600 hours or 600 landings, whichever comes first, unless Cessna Service Bulletin SB57-10 Rev 4 is carried out. A review of the technical records for the aircraft determined that the last record of compliance for AD 79-12-06 was dated 21 December 2007, and had taken place 1062 hours and 1405 landings earlier.
2. The investigation determined that there is no formal process in place at Transport Canada to assess and grant an operational approval for single-pilot operations on a Cessna Citation 500.
3. Given that all components of the aircraft were accounted for at the wreckage site, the investigation concluded that there was no in-flight breakup or separation of the wing.

4.1 Safety action taken

The Board is not aware of any safety action taken following this occurrence.

4.2 Safety concern

4.2.1 Oversight of private operators

The TSB investigation into this occurrence demonstrates how the safety of private operators may be compromised when Transport Canada (TC) excludes the entire business aviation sector from its planned surveillance program. Because no surveillance activity ever took place at Norjet Inc. in its 8 years of existence, TC was unaware of safety deficiencies in its flight operations.

In its investigation into an occurrence involving a private operator at Fox Harbour Aerodrome, Nova Scotia,^{Footnote 53} the TSB raised several concerns regarding the inadequate implementation of safety management systems (SMSs) for private operators and concluded that TC had not exercised effective oversight over the business aviation sector.

In 2011, TC resumed the oversight and administration of business aviation, which had previously been delegated to the Canadian Business Aviation Association, and, in 2014, implemented new Canadian Aviation Regulations (CARs) Subpart 604 regulations. However, in 2016, TC introduced temporary changes to its surveillance policy^{Footnote 54} to exclude private operators and other certificate holders^{Footnote 55} from its national oversight program. Therefore, concerns still persist in this sector.

In 2016, following its investigation into a May 2013 fatal helicopter accident in Moosonee, Ontario,^{Footnote 56} the TSB determined that TC's approach to surveillance at the time of the occurrence, along with issues in the implementation of SMSs, precluded TC from ensuring that operators were effectively managing safety. Therefore, the TSB recommended that

Although Recommendation A16-13 was issued in the context of an investigation involving a commercial operator, the fatal accident involving Norjet Inc. demonstrates, in a similar fashion, that the lack of regular surveillance in the business aviation sector currently does not allow TC to assess the capability of private operators to effectively manage safety.

Under TC's current surveillance policy, and its reactive approach to oversight in the private operator sector, there is the potential for another serious incident or accident involving a private operator. Without regular surveillance audits and inspections, TC cannot validate the effectiveness of a CARs Subpart 604 operator's SMS or identify and address safety deficiencies in a timely manner, thus allowing unsafe practices to emerge and persist.

Therefore, the Board is concerned that a reactive approach to oversight, in which private operators are excluded from TC's national planned surveillance program, may expose the business aviation sector to higher risks that could lead to an accident.

The Board will continue to monitor this safety issue.

4.3 Safety action required

4.3.1 Canadian Aviation Regulations Subpart 604 private operators: Lightweight flight-data recording systems

Following a fatal accident with no survivors or witnesses, an investigation may never be able to determine the exact causes and contributing factors unless the aircraft is equipped with an on-board recording device. The benefits of recorded flight data in aircraft accident investigations are well known and documented.^{Footnote 57}

Currently, flight data recorders (FDRs) and cockpit voice recorders (CVRs) are considered the most comprehensive methods of capturing large amounts of flight data and can assist investigators in determining the reasons for an accident. FDRs record information such as altitude, airspeed, heading, and other aircraft parameters, many times per second. CVRs record radio transmissions and ambient cockpit sounds, such as pilot voices, alarms, and engine noises.

In Canada, FDR and CVR regulations are specified in section 605.33 of the CARs, Flight Data Recorder and Cockpit Voice Recorder. Under this provision, the requirements for CVR and FDR equipment in aircraft are based primarily on the number and type of engines, number of passenger seats, and type of operation. Given the design characteristics and configurations, many aircraft flown by private operators, including the occurrence aircraft, are not required by regulation to be equipped with either an FDR or a CVR.

To provide an accessible and feasible means of recording valuable flight data information, regardless of the type of aircraft and operation flown, several lightweight FDR systems currently manufactured can record combined cockpit image, cockpit audio, aircraft parametric data, and/or data-link messages.

In 2016, the International Civil Aviation Organization (ICAO) amended Annex 6 of its Standards and Recommended Practices to recommend that certain categories of aircraft and helicopters flown by commercial operators carry lightweight flight recorders.^{Footnote 58} ICAO Annex 6 also establishes the minimum specifications for such systems. To comply with recent amendments to ICAO Annex 6 and to address 12 safety recommendations issued by 7 different investigation bodies in Europe,^{Footnote 59} the European Aviation Safety Agency published a Notice of Proposed Amendment in 2017, under which new regulations would prescribe lightweight flight recorders for some categories of commercially operated aircraft and helicopters.

Although there are currently no regulations in Canada requiring any aircraft to be equipped with lightweight FDR systems, these devices provide a potential cost-effective alternative for some sectors of the civil aviation industry.

In 2013, following its investigation into a fatal in-flight breakup occurrence in March 2011 northeast of Mayo, Yukon,^{Footnote 60} the TSB concluded there was a compelling case for implementing lightweight FDR systems for all commercial operators, and recommended that

TC has acknowledged that flight data monitoring programs would enhance safety and has taken the following actions to address the safety deficiency identified in Recommendation A13-01:

• In 2013, after conducting a risk assessment to evaluate alternative approaches to flight-data monitoring (FDM), TC informed the TSB that it supported Recommendation A13-01. In 2015, TC informed the TSB that it intended to revisit this risk assessment.
• In 2013, TC informed the TSB that it would develop an Advisory Circular outlining recommended practices for FDM programs.
• In 2013, TC informed the TSB that it would incorporate its analysis and review of Recommendation A13-01 into its planned assessment for FDRs and CVRs, which was scheduled to begin in 2014–2015.
• In 2014, TC informed the TSB that it would consider adding FDM principles in future regulatory initiatives and amendments.
• In 2015, TC informed the TSB that it would prepare an issue paper on the use of FDM, providing factual information on FDM, including its benefits, costs, and challenges.

Due to other ministerial commitments, TC has not initiated its work for any of these undertakings.

In February 2018, TC conducted a focus group with industry stakeholders, including the Canadian Business Aviation Association, to evaluate the challenges and benefits of installing lightweight flight recording systems on aircraft that are not currently required to carry these systems.

However, until the focus group reaches conclusions concerning these challenges and benefits in small aircraft, and TC provides the TSB with its plan of action following those conclusions, it is unclear when or how the safety deficiency identified in Recommendation A13-01 will be addressed. The TSB is concerned that very few concrete actions are being taken to address Recommendation A13-01 and that this could lead to protracted delays, as observed on numerous other recommendations.

In a recent occurrence investigated by the TSB,^{Footnote 61} a privately operated Mitsubishi MU-2B-60 aircraft struck terrain on its final approach to Îles-de-la-Madeleine Airport, Quebec. All 7 occupants were fatally injured. A lightweight FDR system was on board the occurrence aircraft, although it was not required by regulation. By recovering the recorder and extracting its data for analysis, the investigation was able to better understand the sequence of events that led to the aircraft's departure from controlled flight. Had a recording system not been on board, crucial information to understand the circumstances and events leading up to this occurrence would not have been available to the investigation.

In contrast, the information normally contained in FDR systems was not available to this investigation. The investigation could not determine why the aircraft departed controlled flight and collided with terrain. Because the occurrence aircraft was not equipped with any type of FDR or CVR, the lack of flight data precluded investigators from fully identifying and understanding the sequence of events and the accident's underlying causes and contributing factors.

Although Recommendation A13-01 targeted commercial operators, the contrast in available evidence demonstrated between the Îles-de-la-Madeleine accident and this occurrence highlights the value of installing lightweight FDR systems on privately operated aircraft. This investigation demonstrates that investigators are at a disadvantage in determining the root causes of an occurrence when there are no flight data available, regardless of whether the investigation involves an aircraft operated commercially under CARs Part VII or a business aircraft operated privately under CARs Subpart 604.

There is compelling evidence that the lack of recording devices on board commercial aircraft and private aircraft operated under CARs Subpart 604 continues to impede the TSB's ability to advance transportation safety. Therefore, the Board recommends that

This report concludes the Transportation Safety Board of Canada's investigation into this occurrence. The Board authorized the release of this report on 28 February 2018. It was officially released on 26 April 2018.

Appendix A – KELOWNA SEVEN DEP standard instrument departure

Source: Canada Air Pilot (effective 0901Z 15 September 2016 to 0901Z 10 November 2016)

Appendix B – Private operator registration document application form

Source: Transport Canada