Aviation Investigation Report A16W0170

An Air Canada Airbus A320-200 aircraft (registration C-FDQV, serial number 068) operating as flight 221 (ACA221) was conducting a flight from Calgary International Airport, Alberta, to Vancouver International Airport, British Columbia, and had been cleared for takeoff on Runway 29. At 1649 Mountain Standard Time, as twilight was approaching darkness, the Airbus was accelerating through 100 knots indicated airspeed when the flight crew observed a Sunwest Aviation Swearingen SA226-TC aircraft (registration C-FGEW, serial number TC347) crossing Runway 29 from south to north at the intersection of Taxiway A. C-FGEW had been cleared to cross Runway 29 by the ground controller. Because C-FGEW was more than halfway across Runway 29 when the ACA221 flight crew made visual contact, they elected to continue the takeoff, which was completed without further incident.

Sequence of events

During daylight hours on Friday 02 December 2016, the active runways ^{Footnote 1} at Calgary International Airport (CYYC), Alberta, were parallel runways 17L (left) and 17R (right), and 4 controller positions were open in the control tower: west tower, east tower, east ground/apron, and west ground/clearance delivery.

At 1600, ^{Footnote 2} the control tower received updated weather information that indicated an increase in wind speed and a change in wind direction. As the change in conditions necessitated a switch in active runways, control tower personnel began procedures to change the active runway to Runway 29. Accordingly, the last of the aircraft that had been routed to land on runways 17L and 17R were permitted to proceed with approach and landing on those runways, while departing aircraft were authorized to taxi to Runway 29.

The change in active runway required that several controller positions be combined, such that

• the west tower controller became the combined (east and west) tower controller;
• the east tower controller became the combined apron/clearance delivery controller;
• the east ground/apron controller (the occurrence controller), became the combined (east and west) ground controller; and
• the west ground/clearance delivery controller stood back as the team supervisor.

At 1639:58, the extended computer display system (EXCDS) showed that the combined ground controller gave control of Runway 11/29 to the combined tower controller. The first aircraft departed Runway 29 shortly thereafter, at 1640:12. At 1640:30, the EXCDS showed the combining of east and west ground control, and the east ground/apron controller moved from that position to the west ground position in the control tower to assume combined ground duties at 1640:35.

Figure 1 and Table 1 depict the location, time, and description of events surrounding the runway incursion.

Image

Between the time at which the combined tower controller was given control of Runway 29 (1639:58) and the time at which ACA221 departed, there were 2 departures and 2 arrivals on Runway 29. ACA221's departure was the fifth movement on Runway 29 after it became the active runway.

Personnel information

All of the air traffic controllers were certified and qualified for operations in the control tower in accordance with existing regulations.

Work schedule of the combined ground controller

The combined ground controller was working his second consecutive evening shift at the time of the occurrence. A review of the combined ground controller's schedule was conducted as part of the investigation, and it was concluded that fatigue was not a factor in this occurrence.

Meteorological information

The CYYC aviation routine weather report (METAR) for 1600 was as follows:

• wind 270° true (T) at 17 knots, gusting to 26 knots
• visibility 40 statute miles
• few clouds at 6000 feet, a broken ceiling at 9000 feet, and another broken layer at 20 000 feet
• temperature 4°C with a dew point of −7°C

According to the National Research Council of Canada, on 02 December 2016, sunset was at 1632 and civil twilight ended at 1711. ^{Footnote 3} The investigation noted that the event took place during a time of increasing darkness. Runway edge, taxiway edge, and airport signage lighting were active, as well as the associated airport and city cultural lighting.

Other than the decreased visibility resulting from the twilight, weather conditions were not considered to be a factor in the occurrence.

Aerodrome information

Calgary International Airport

CYYC has 4 runways (08/26, 11/29, 17R/35L, and 17L/35R), numerous taxiways, and 10 aprons (Appendix A). Construction of the parallel north/south Runway 17L/35R was completed in June 2014.

In 2015, CYYC was ranked Canada's 3rd busiest airport by annual number of aircraft movements (248 900), ^{Footnote 4} and the country's 4th busiest airport by passenger traffic, handling approximately 15 million passengers. ^{Footnote 5}

Ground surveillance equipment

Airport surface detection equipment

CYYC is equipped with a Stage 1 advanced surface-movement guidance and control system (A-SMGCS), which provides control tower personnel with real-time display of aircraft and vehicle traffic operating on airport manoeuvring areas. The system is referred to as "airport surface detection equipment" (ASDE) in the Calgary Control Tower Unit Operations Manual.

Multilateration system

CYYC is also equipped with a multilateration (MLAT) system for surface surveillance. Using a network of ground sensors to receive signals from transponders mounted in aircraft and vehicles, the system provides an extra layer of ground surveillance with full airfield coverage. ^{Footnote 6} MLAT calculates the position of a vehicle or aircraft by interrogating its transponder from multiple antennas. The MLAT information is then integrated with surface movement radar data to depict surface traffic pictorially on the ASDE display of controllers. ^{Footnote 7}

According to the Calgary Control Tower Unit Operations Manual, all aircraft are expected to keep their transponders on when manoeuvring on aprons, taxiways, and runways. ^{Footnote 8} Aircraft that have not previously received a transponder code from air traffic services are to use transponder code 1000. If the aircraft is equipped with a mode S transponder, ^{Footnote 9} the civil registration number of their respective aircraft will be displayed on the ASDE display.

Procedures for runway crossings

The NAV CANADA Manual of Air Traffic Services (MATS) states "Do not authorize taxiing aircraft or ground traffic to operate on a runway being used for landing and takeoff unless you have coordinated with the Tower controller." ^{Footnote 10} This instruction is reflected in the Calgary Control Tower Operations Manual, which includes among the duties of a ground controller: "Coordinate access to runways that are not his/her jurisdiction with Tower Controller(s)." ^{Footnote 11}

Frequency of Runway 29 operations

Since the introduction of parallel runways at CYYC, Runway 29 operations have become considerably less frequent. Given the significantly increased capacity offered by the parallel runways, Runway 29 is used only during periods of strong west winds and for noise abatement purposes at night, but is most frequently used during night operations. The control tower is usually "single stand" at that time, meaning that one controller has possession of all runways and coordination is not required.

The investigation determined that, on the day of the occurrence, the combined ground controller was performing Runway 29 operations for the third time, other than during night operations, since parallel runway operations had begun in June 2014.

Coordination of runway jurisdiction and runway crossings

Calgary Control Tower EXCDS includes a runway jurisdiction system (RJS) that serves as a memory aid indicating when a runway is controlled by the ground or tower position. The RJS is located at the top of the EXCDS display, below the wind and altimeter information (Figure 2). Each of the airport's 4 runways is represented by a button, the colour of which indicates who has jurisdiction of that runway. If the button is green on a controller's display, that controller's position has jurisdiction of the runway; if it is red, the runway is owned by (i.e., under the control of) another controller.

Image

Transferring jurisdiction of a runway is a 2-step process. After verbal coordination has been carried out between the controllers, the controller giving away ownership of the runway is required to update the RJS in EXCDS. For safety reasons, ownership of a runway is a one-way process in EXCDS; a runway can only be given away. ^{Footnote 12}

A ground controller may authorize aircraft or vehicles to cross a runway without coordination if they have jurisdiction of the runway (i.e., if the RJS is green on their EXCDS display). However, if the ground controller does not have jurisdiction (in which case the RJS is red on the controller's EXCDS display), then coordination with the controller who does must be carried out prior to authorizing the runway crossing. ^{Footnote 13}

Virtual stop bars

The ASDE is configured with virtual stop bars that can be displayed on the ASDE display and that correspond with the approximate points at which the physical hold lines are located on taxiways and runways. When a vehicle or an aircraft travelling toward the runway crosses an activated virtual stop bar, an audible alarm sounds at the west ground and tower positions, and a red visual alert is illuminated at all ASDE positions. These signals allow the controller to provide alternate instructions to either flight crews or vehicle operators.

The flight crews and vehicle operators themselves have no indication of the virtual stop bars when they are in use. The generated alarm is provided only to the air traffic controllers.

At CYYC, the tower controller is responsible for disabling a virtual stop bar before an aircraft or a vehicle crosses it. Clicking the stop bar on the ASDE display will disable the stop bar for 45 seconds. Aircraft that have landed (or are on the runway) and then exit will not trigger an alarm.

Use of virtual stop bars is mandatory at CYYC during operations in conditions of reduced visibility, and may be used at other times to enhance safety. At the time of the occurrence, those available on Taxiway A, at the intersection of Runway 29, were not illuminated, nor required to be in use, given the level of visibility.

Organizational and management information

NAV CANADA's safety management system

The NAV CANADA Safety Management System Manual ^{Footnote 14} describes a number of proactive and reactive processes intended to improve safety by identifying and mitigating risks in the air navigation system. Relevant to this investigation among those measures are the hazard identification and risk assessment process, the operational safety investigation (OSI) process, and the confidential safety reporting program ARGUS.

Change management—hazard identification and risk assessment process

On managing change, the SMS manual states:

Safety is always considered when designing new systems and procedures as well as upgrading the existing systems and procedures. Hazards are systematically and proactively identified via the applicable safety risk assessment methods, and risk management strategies (safety requirements) are identified, developed, implemented, and subsequently evaluated. The objective is to reduce the safety risks resulting from the new development and the changes to operational facilities, systems, equipment, and procedures to a level as low as reasonably practicable (ALARP). ^{Footnote 15}

Specific procedures for conducting change management, including hazard identification and risk assessment, are outlined in the Manual for the Integration of Safety Management Activities for Operational Facilities, Systems, and Equipment Changes. ^{Footnote 16}

Operational safety investigations process

With respect to the OSI process, the SMS manual states:

An Operations Safety Investigation (OSI) or Unit Investigation (UI): The investigation of aviation occurrences is an essential requirement to ensure the integrity of the ANS system. The OSI and UI are designed to serve the following primary functions:

• ascertain and document facts related to aviation occurrences;
• ensure that circumstances surrounding the aviation occurrence are not overlooked, concealed, or ignored;
• identify the Findings as to Causes and Contributing Factors, Findings as to Risk, and Other Findings. The investigation team may also formulate recommendations to address possible safety issues identified during the investigation. ^{Footnote 17}

Confidential safety reporting program (ARGUS)

ARGUS is NAV CANADA's confidential safety reporting program. Its objective is to provide managers with timely information regarding otherwise unidentified perceived system safety and risk management deficiencies, and suggestions where safety performance might be enhanced. ^{Footnote 18}

ARGUS reports are submitted in confidence to the Safety and Quality group at head office. A letter describing the safety issues raised is forwarded to the appropriate group for response. A written response is required.

Introduction of parallel runways

In June 2014, NAV CANADA together with the Calgary Airport Authority began to operate the new 17L/35R parallel runway, which lay to the east and north of the existing 17R/35L runway.

In preparation for the introduction of parallel runway operations in Calgary, NAV CANADA carried out 10 hazard identification and risk assessment (HIRA) activities involving various stakeholders between April and June 2014.

The process identified 14 hazards related to the change. Mitigations for each, and their implementation, were tracked in a hazard log. None of the hazards identified were related specifically to the reduced frequency of use of Runway 29 or to the use of Runway 29 as a taxiway.

The identified hazards that may be regarded as relevant to this occurrence included the following:

• The increased number of runway crossings that would be required due to the configuration of the airspace (such that aircraft hangared on the west side of the airport, departing eastward, would need to cross Runway 17R/35L): Mitigations to address this hazard included establishing a minimum staffing level, controller training, and monitoring of operations during the early days of the parallel operation.
• Limited opportunity to use a crossing runway configuration: Before introducing parallel runway operations, CYYC made extensive use of crossing runways (i.e., allowing landings and departures on intersecting runways) to increase capacity. A risk was identified that controllers would lose proficiency in this type of operation after the parallel runways were introduced. Measures to mitigate this risk included avoiding the use of crossing runway configurations by limiting the hours for noise abatement configurations, using different runways for arrivals and departures, and increasing spacing during crossing runway operations.
• Non-routine operations: It was identified that controllers could encounter a configuration for which they had not been trained during preparations for the introduction of parallel runway operations. Mitigations for this hazard included tactical coordination of new configurations, an increase in coordination meetings between stakeholders, and additional staffing during the early days of the operation.

With all of the identified mitigations in place, the level of risk associated with each of the hazards identified was deemed low.

Runway 29 operating irregularities

In addition to this occurrence, there have been 4 operating irregularities resulting in runway incursions at CYYC since parallel runway operations began.

The first 3 of the OSIs carried out by NAV CANADA identified infrequent use of Runway 29 as a contributing factor, and one of the investigation reports noted that the available reminders of runway ownership were not effective in overcoming normal routines. Among the safety actions taken was routine removal of a controller from duty to review the event and ensure that no concerns were identified with respect to his or her ability to return to operational duties.

On 24 September 2015, following the third of the 4 runway incursions previous to this occurrence, NAV CANADA received and responded to an internal confidential safety report (made through ARGUS) that raised concerns with respect to controller proficiency in use of Runway 29. Its response to the ARGUS report indicated that local management and the Calgary Tower Operations Committee were discussing the inclusion of Runway 11/29 simulation in local yearly refresher training. The response also indicated that the committee was looking into technical and procedural cues that could be implemented to support Runway 11/29 operations. Although the ARGUS report was closed on 08 March 2016, the Safety and Quality group continued to monitor the issue via the internal safety investigations into runway incursions at CYYC.

The fourth operating irregularity involving Runway 29 operations took place in March 2016, approximately 6 months after the ARGUS report had been received. NAV CANADA's OSI into that occurrence again identified the infrequent use of Runway 29 as a contributing factor, together with the ineffectiveness of the RJS display as a memory aid. That OSI report recommended that steps be taken to identify and evaluate potential risk controls that would reduce the likelihood that a controller would forget who had jurisdiction of Runway 29. It concluded that EXCDS should be modified to ensure that the RJS display was not blocked by pop-up dialog boxes.

In response to the report, the Calgary Control Tower (hereafter referred to as the unit) indicated that the latter recommendation had been implemented (i.e., EXCDS had been modified to ensure that the RJS display remained visible) and that it was considering 2 other recommendations of the investigation team. First, it was investigating the potential for use of a "monitor" position when Runway 29 operations were in effect, and secondly, it was striving to identify an optimal form of refresher training that could be implemented for Runway 29 operations.

Prior to the runway incursion of 02 December 2016, the following actions had been taken by NAV CANADA to mitigate the risk that controllers would forget that Runway 29 was in use during operations on that runway:

• Given that most of these operating irregularities had happened during mornings when traffic was increasing, procedural hours were changed so that use of Runway 29 for noise abatement would end at the same time on weekends as it did on weekdays.
• EXCDS was modified to ensure that the RJS memory aid would not be blocked on the display by dialog boxes used by the controller to enter information.
• As of November 2016, all action plans resulting from safety investigations are required to have an implementation date, and any changes made to a plan or its dates are tracked by the Safety and Quality group.

Transport Canada

In March 2016, Transport Canada conducted a process inspection of the NAV CANADA SMS investigation process and reviewed investigation reports from the NAV CANADA system. A result of that oversight was a requirement for NAV CANADA to conduct an OSI even in incidents where the TSB was conducting an investigation.

Attentional errors

A strong habit intrusion is a frequently occurring form of attentional slip in which an intended sequence of actions is replaced by a stronger, well-rehearsed schema. The result of this type of error is that a typical or normal sequence of actions is carried out in place of the desired sequence.

The necessary conditions for a habit-intrusion error to occur include: ^{Footnote 19}

• the conduct of well-practised tasks in familiar surroundings;
• an intention to depart from routine; and
• the presence of a strong schema outlining the usual pattern of actions.

This type of error often occurs when an internal preoccupation, or an external distraction, results in failure to perform an attentional check at the appropriate time. While the check would have served to divert an action off the well-practised path along the desired sequence of actions, "the control of action is usurped by the strongest sequence leading onwards from that particular point in the sequence." ^{Footnote 20}

Efforts to prevent these types of errors typically focus on modification of procedures or equipment to provide better task cues. "Given the prevalence of lapses, care can be taken to remind users of steps that are known to be particularly likely to be omitted." ^{Footnote 21} Performance on tasks that require the use of prospective memory (recall related to remembering to do something such as coordinating a runway crossing) can be improved using checklists and reminders. ^{Footnote 22}

The provision of reminders prevents skill-based errors by correcting the tendency to provide familiar but inappropriate solutions, by encouraging tasks to be performed in correct sequence, and by encouraging appropriately timed checks of task status before moving on to the next step. ^{Footnote 23}

Training also has the potential to prevent these types of errors. Providing additional practice in infrequently used procedures or tasks serves to reinforce the infrequently used schema that guide them.

Skills (abilities to execute specific procedures) degrade over time, particularly if they are not actively used. The degree of retraining required to be able to retain and proficiently execute a skill rests on multiple factors, including:

• The extent of opportunities for overlearning, whereby "additional practice trials help to automate the task and reduce the forgetting rate." Skills that are used regularly are automatically reinforced in this manner, but infrequently used skills require additional and more frequent practice trials.
• The type of skill involved. Perceptual-motor skills show lesser degradation over time than procedural skills, which require more frequent reinforcement. ^{Footnote 24}

Infrequently used procedural skills, such as those involved in coordination of Runway 29 operations at CYYC, must therefore be reinforced frequently for retention and proficiency.

TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada's transportation system even safer.

Risk of collisions on runways is a 2016 Watchlist issue. At airports, aircraft and vehicles have to move between ramps, taxiways, and runways. Sometimes aircraft or vehicles mistakenly occupy an active takeoff or landing area, creating conflicts between aircraft, or between aircraft and vehicles. These conflicts are known as runway incursions. Given the millions of takeoffs and landings each year, ^{Footnote 25} incursions are rare, but their consequences can be catastrophic.

Runway incursions have been on the TSB's Watchlist since 2010, and the TSB considers that the risk is still too high. Of particular concern in Canada is the number of serious runway incursions—defined by the International Civil Aviation Organization (ICAO) as class A, those in which a collision was narrowly avoided or, class B, where there was a significant potential for collision. ^{Footnote 26} This occurrence would be described as a class B event.

From 2011 to 2015, there were 2041 ^{Footnote 27} runway incursions at Canadian airports, 27 of which were serious (Table 3).

Several recent TSB investigations ^{Footnote 28} have found a risk of collisions on runways, and the Board remains concerned that serious runway incursions will continue to occur until better defences are put in place.

TSB Aviation Investigation Report A07O0305, a runway incursion investigation at Toronto / Lester B. Pearson International Airport, contained a Board concern, which stated in part

a system to supplement ASDE / RIMCAS has not been recognized by either Transport Canada or NAV CANADA. The Board is therefore concerned that until flight crews in aircraft that are taking off or landing receive direct warnings of incursions onto the runway they are using, the risk of high-speed collisions will remain.

The United States is testing automated systems that do not require controller or pilot input to maintain runway safety. However, a recent rise in the number of the most serious incursions at U.S. airports has prompted the National Transportation Safety Board to launch a special investigation to identify some of the deeper causes and effects.

Industry and the regulator are taking helpful steps to share data and other information to improve local airport procedures, but few technological defences to alert flight crews and vehicle operators of runway conflicts have been considered or implemented in Canada. More leadership is required from Transport Canada, NAV CANADA, airport authorities, and industry to ensure they are making full use of technologies to maintain runway safety.

The runway incursion occurred after the combined ground controller cleared C-FGEW to cross Runway 29 without coordinating the clearance with the combined tower controller. The analysis will focus on the factors underlying the incursion and the adequacy of the defences in place to prevent such occurrences.

The flight crews involved in the occurrence were unable to see one another's aircraft while manoeuvring in response to the clearances and instructions given to them by the controllers for the following reasons:

• twilight lighting conditions;
• the relative position and distance between the 2 aircraft when the clearances were given to cross Runway 29 and to take off from Runway 29; and
• the masking effect of each aircraft's navigation lights due to airport runway and taxiway edge lighting blending with the backdrop of airport and city cultural lighting.

Instruction to cross Runway 29

The combined ground controller was aware that the tower controller had jurisdiction of Runway 29, and that arrivals and departures were taking place on that runway. In the 15 minutes preceding the occurrence, the combined ground controller had received a transfer-of-position-responsibility briefing, prompted by the change in runway configuration. The combined ground controller had issued taxi instructions for ACA221 to proceed to Runway 29, and had provided taxi instructions to 2 other aircraft that had already landed on Runway 29.

The combined ground controller intended to coordinate with the combined tower controller prior to clearing C-FGEW to cross Runway 29. However, at the time when C-FGEW was approaching Runway 29, the combined ground controller automatically instructed the aircraft to cross without coordinating with the combined tower controller.

Since the introduction of the parallel runway operation, Runway 29 has been used infrequently for daytime operations. It is usually under the jurisdiction of ground controllers, and aircraft frequently cross it. As a result, controllers have developed a strong schema for automatically clearing aircraft across without coordination. Further, in the moments before clearing C-FGEW to cross Runway 29, the combined ground controller's attention had been devoted to ensuring that there would be no conflict between C-FGEW and the CRJ900 at the intersection of taxiways A and J.

All of the criteria for a strong habit intrusion error were present. The controller was carrying out a well-practised task in familiar surroundings, he intended to depart from routine, and to do so, he had to overcome a strong schema for the usual pattern of actions. ^{Footnote 29} In addition, the controller's attention was devoted to another aspect of the task at the moment when an attentional check should have been expected. Due to a strong habit intrusion error, the combined ground controller reverted to the frequently practised routine of instructing the aircraft to cross Runway 29 without prior coordination with the combined tower controller.

While this type of error is common, it is also predictable and can be prevented. Potential mitigations include memory aids that ensure that attentional checks are conducted at the appropriate time, and training that reinforces the alternate schema through practice.

The need to coordinate

Controllers had few opportunities to work in a configuration wherein prior coordination was required for an aircraft to cross Runway 29. Since the introduction of parallel runways, Runway 29 operations had mainly been carried out at night (when the ground and tower positions are combined and coordination is not required) or during strong westerly winds. As a result, there was little maintenance of proficiency in Runway 29 operations during daylight hours, and no training or simulation exercises were provided to practise those operations. The infrequent use of Runway 29 during the day, together with the absence of relevant training scenarios or simulation of Runway 29 operations, meant that controllers rarely encountered situations where the need to coordinate before executing crossings of Runway 29 was reinforced.

Extended computer display system

A memory aid was provided to allow controllers to verify runway ownership prior to clearance of aircraft onto a runway. The runway jurisdiction system (RJS) consisted of 4 indicators (one for each runway) that were located at the top of the extended computer display system (EXCDS) display. The indicators were green if a controller owned the runway and red if another controller owned the runway. Investigations into previous, similar runway incursions had found that the RJS did not provide an effective reminder of the need to carry out coordination, as it was always present and did not attract sufficient attention at the appropriate time. Similarly in this occurrence, the RJS did not provide a sufficiently compelling cue to ensure that the combined ground controller did not revert to the well-practised routine of clearing aircraft across Runway 29 without coordination.

Safety management of the risks associated with Runway 29 operations

Effective safety management includes proactive and reactive processes that serve to identify hazards and maintain risk at a level that is as low as reasonably practicable. The 2 types of processes are complementary; the former helps to identify hazards prior to initiating changes to an operation, while the latter helps to identify unanticipated safety issues following change implementation.

The opening of the parallel runway in June 2014 represented a significant change in operations for the Calgary International Airport. Before this change was implemented, NAV CANADA had carried out 10 hazard identification and risk assessment (HIRA) processes, which identified 14 hazards. Mitigations were developed, and the residual risk associated with each of the hazards was assessed as low. Given that the focus of the HIRA was on the new parallel runway operations, the issue of controller proficiency with Runway 29 operations was not identified during the HIRA.

Once the parallel runways became operational, Runway 29 use became infrequent. Given the significantly improved capacity offered by the parallel runways, Runway 29 was used only at night for noise abatement purposes and when required due to strong westerly winds. In the 2½ years between the opening of the parallel runways and this occurrence, the issue of controller errors due to declining proficiency with Runway 29 operations gradually came to light through NAV CANADA's safety management system (SMS) processes.

Following 9 months of parallel runway operations, NAV CANADA experienced 3 runway incursions associated with Runway 29 operations in a 6-month period, between April and September 2015. The first 2 occurred on weekend mornings while traffic was increasing but Runway 29 operations were still in effect for noise abatement. The third incursion took place on a Tuesday morning.

NAV CANADA's investigations into these occurrences identified a decrease of proficiency in Runway 29 operations and insufficient auditory and visual cues to overcome the ground controller's well-practised habits of clearing aircraft across Runway 29 without coordination. Although the investigations into these first 3 runway incursions identified issues, the systemic nature of these was not initially understood. The safety actions identified in the resulting reports were limited to routine removal of the controller from duty to review the event and ensure that no concerns were identified with respect to his or her ability to return to operational duties.

However, around this time, the unit also took steps to reduce the period during which Runway 29 operation was used for noise abatement on weekends. Noting that most of the incursions had taken place on weekend mornings, when Runway 29 remained in use for noise abatement, but traffic was sufficient for the ground and tower positions to be split, the unit concluded that using the same hours of operation for weekdays and weekends would reduce the likelihood of Runway 29 incursions.

Shortly after the third incursion, NAV CANADA received and responded to a report through its confidential safety reporting program, ARGUS. The report raised concerns regarding declining controller proficiency in Runway 29 operations. The unit's response described the steps that had been taken to align the hours of noise abatement procedures on weekends with that of weekdays, and indicated that no additional occurrences had been reported since that alignment. The response also identified several additional mitigations under consideration involving controller training and procedural changes.

The response was considered sufficient, and the ARGUS file was closed. The actions reported by the unit as being under consideration were not implemented, and these outcomes were not tracked through the ARGUS program.

After approximately 4 months without a further incident, a fourth runway incursion occurred in March 2016. NAV CANADA's safety investigation re-identified the lack of regular practice in Runway 29 operations and ineffective memory aids as safety issues. In response, the unit initiated 1 immediate mitigation (modification of EXCDS so that the airport diagram pop-up would not block the RJS display) and indicated that it would consider additional mitigations (implementation of a monitor position and/or determining what form of refresher training would help prevent recurrence). These additional mitigations were not put in place, and the unit went an additional 9 months without a similar incident prior to the runway incursion in December 2016.

The issues of declining controller proficiency in Runway 29 operations and insufficiently compelling memory aids were identified repeatedly through NAV CANADA's SMS. However, the local corrective action taken, together with the length of time between occurrences, led to a conclusion that the risks associated with these types of occurrences were as low as reasonably practicable. As a result, further safety action that had been identified as being under consideration was not pursued.

Further, the identified safety actions that were under consideration in response to the ARGUS report and the operational safety investigations were not formally tracked or followed up in NAV CANADA's SMS. If proposed safety actions are not tracked to completion, there is an increased likelihood that identified safety risks will not be effectively mitigated.

Findings as to causes and contributing factors

1. The runway incursion occurred after the combined ground controller cleared C-FGEW to cross Runway 29 while Air Canada flight 221 was departing on Runway 29.
2. Due to a strong habit intrusion error, the combined ground controller reverted to the frequently practised routine of instructing the aircraft to cross Runway 29 without prior coordination with the combined tower controller.
3. The infrequent use of Runway 29 during the day, together with the absence of relevant training scenarios or simulation of Runway 29 operations, meant that controllers rarely encountered situations where the need to coordinate prior to executing crossings of Runway 29 was reinforced.
4. The runway jurisdiction system did not provide a sufficiently compelling cue to ensure that the combined ground controller did not revert to the well-practised routine of clearing aircraft across Runway 29 without coordination.

Findings as to risk

1. If proposed safety actions are not tracked to completion, there is an increased likelihood that identified safety risks will not be effectively mitigated.

Safety action taken

NAV CANADA

NAV CANADA has implemented a new procedure whereby Calgary Control Tower supervisors are to contact the Calgary Airport Authority to inform the authority that Runway 11/29 operations are in effect and to request that vehicle movements in the vicinity of Runway 11/29 be limited to the vehicle having an immediate requirement. This procedure is intended to reduce the number of Runway 11/29 crossings by vehicles.

Virtual stop bar procedures have been added on airport surface detection equipment (ASDE) for use during Runway 11/29 operations.

A new "monitor" control position has been implemented. The position is to be open during Runway 11/29 operations or "chinook operations" (operations in strong westerly winds). The location of the monitor position provides an efficient visual scan of the ASDE, Runway 29 and taxiways G, C, A, J, and W.

A safety briefing has been provided to all controllers at the Calgary Control Tower on Runway 11/29 operations, including technological and procedural changes (described below), reinforcement of best practices for phraseology in taxi instructions and runway jurisdiction coordination, as well as strategies to reduce distractions.

A phraseology "blitz" evaluation of Calgary Control Tower controllers has been conducted to ensure adherence to correct phraseology.

ASDE has been modified to outline Runway 29 in yellow on the west ground, west tower, and monitor control position's ASDE, when operating in Runway 29 mode. This is to serve as a memory aid to controllers to remind them that coordination is required.

The following modifications to the extended computer display system (EXCDS) have been implemented:

• Runway 29 is coloured yellow in the "hold short" pop-up on the EXCDS display at the west ground control position when operating in the Runway 29 mode (as a memory aid to controllers on required coordination).
• A yellow cautionary/informational flight data entry (FDE) appears in the taxiing bay while operating in the Runway 29 mode (as a memory aid to controllers on required coordination).
• While in the Runway 29 operations mode, when west ground controllers attempt to remove restrictions to hold short of Runway 11 or Runway 29 from an FDE, a yellow dialog box will appear, asking them to confirm this action.

A new procedure has been implemented whereby, under normal operating conditions, it is prohibited to combine the west ground position with other operational positions during Runway 29 operations when traffic levels necessitate the use of 2 or more operational positions.

The hours of night operations using Runway 29 were adjusted to avoid scenarios in which this error may occur. Runway 29 night operations are now implemented only when traffic levels allow for "single stand" operation.

This report concludes the Transportation Safety Board of Canada's investigation into this occurrence. The Board authorized the release of this report on 17 January 2018. It was officially released on 05 February 2018.

Appendix A — Calgary International Airport Taxi Chart

Image